Trojaner-Board - Mehrere Trojaner innerhalb einer Woche mit Avira gefunden

Trojaner-Board (https://www.trojaner-board.de/)

- Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)

- - Mehrere Trojaner innerhalb einer Woche mit Avira gefunden (https://www.trojaner-board.de/93454-mehrere-trojaner-innerhalb-woche-avira-gefunden.html)

Mehrere Trojaner innerhalb einer Woche mit Avira gefunden

Hallo zusammen und guten Abend,

ich bin das erste Mal hier und freue mich auf eure Hilfe. Mein Vater bat mich um Hilfe, da er in der letzten Woche insgesamt drei Trojaner mit Avira Premium gefunden hat. Ich habe ihm gesagt, dass er alle in die Quarantäne verschieben soll, wollte mich aber nochmal versichern, wie es nun weitergehen soll.

Die Trojaner sind laut Avira:

Beginne mit der Suche in 'C:\Program Files\Microsoft Works\wksss.exe'
C:\Program Files\Microsoft Works\wksss.exe
[FUND] Ist das Trojanische Pferd TR/Spy.ZBot.avca

Beginne mit der Suche in 'C:\Users\Arbeitsplatz\AppData\Roaming\Twainbus\freetor.exe'
C:\Users\Arbeitsplatz\AppData\Roaming\Twainbus\freetor.exe
[FUND] Ist das Trojanische Pferd TR/Drop.Riner.IK

Beginne mit der Suche in 'C:\Users\Arbeitsplatz\AppData\Roaming\Helper\bin\liveu.exe'
C:\Users\Arbeitsplatz\AppData\Roaming\Helper\bin\liveu.exe
[FUND] Ist das Trojanische Pferd TR/Unruy.1.9

Anbei poste ich den Malware-log und den OTL-Auszug:

Malwarebytes' Anti-Malware 1.50
www.malwarebytes.org

Datenbank Version: 5240

Windows 6.0.6002 Service Pack 2
Internet Explorer 7.0.6002.18005

03.12.2010 21:09:42
mbam-log-2010-12-03 (21-09-42).txt

Art des Suchlaufs: Quick-Scan
Durchsuchte Objekte: 136492
Laufzeit: 5 Minute(n), 5 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)
OTL Logfile:

Code:

OTL logfile created on: 03.12.2010 21:14:03 - Run 1

OTL by OldTimer - Version 3.2.17.3 Folder = C:\Users\Arbeitsplatz\Downloads

Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation

Internet Explorer (Version = 7.0.6002.18005)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

2,00 Gb Total Physical Memory | 1,00 Gb Available Physical Memory | 51,00% Memory free

4,00 Gb Paging File | 3,00 Gb Available in Paging File | 75,00% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files

Drive C: | 141,50 Gb Total Space | 107,75 Gb Free Space | 76,15% Space Free | Partition Type: NTFS

Drive D: | 7,55 Gb Total Space | 2,29 Gb Free Space | 30,34% Space Free | Partition Type: NTFS

 

Computer Name: ARBEITSPLATZ-PC | User Name: Arbeitsplatz | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user

Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Processes (SafeList) ==========

 

PRC - C:\Users\Arbeitsplatz\Downloads\OTL.exe (OldTimer Tools)

PRC - C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira GmbH)

PRC - C:\Programme\Avira\AntiVir Desktop\avwebgrd.exe (Avira GmbH)

PRC - C:\Programme\Avira\AntiVir Desktop\avmailc.exe (Avira GmbH)

PRC - C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)

PRC - C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)

PRC - C:\Programme\Avira\AntiVir Desktop\avshadow.exe (Avira GmbH)

PRC - C:\Windows\explorer.exe (Microsoft Corporation)

PRC - C:\Programme\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe (Logitech Inc.)

PRC - C:\Programme\Common Files\LogiShrd\LVCOMSER\LVComSer.exe (Logitech Inc.)

PRC - C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)

PRC - C:\Programme\HP\QuickPlay\Kernel\TV\CLCapSvc.exe ()

 

 
 ========== Modules (SafeList) ==========

 

MOD - C:\Users\Arbeitsplatz\Downloads\OTL.exe (OldTimer Tools)

MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_5cb72f2a088b0ed3\comctl32.dll (Microsoft Corporation)

MOD - C:\Windows\Temp\logishrd\LVPrcInj01.dll (Logitech Inc.)

 

 
 ========== Win32 Services (SafeList) ==========

 

SRV - (AntiVirSchedulerService) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH)

SRV - (AntiVirWebService) -- C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE (Avira GmbH)

SRV - (AntiVirMailService) -- C:\Program Files\Avira\AntiVir Desktop\avmailc.exe (Avira GmbH)

SRV - (AntiVirService) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)

SRV - (WPFFontCache_v0400) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe (Microsoft Corporation)

SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)

SRV - (FontCache) -- C:\Windows\System32\FntCache.dll (Microsoft Corporation)

SRV - (LVPrcSrv) -- C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe (Logitech Inc.)

SRV - (LVCOMSer) -- C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe (Logitech Inc.)

SRV - (WinDefend) -- C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)

SRV - (CLSched) CyberLink Task Scheduler (CTS) -- C:\Program Files\HP\QuickPlay\Kernel\TV\CLSched.exe ()

SRV - (CLCapSvc) CyberLink Background Capture Service (CBCS) -- C:\Program Files\HP\QuickPlay\Kernel\TV\CLCapSvc.exe ()

 

 
 ========== Driver Services (SafeList) ==========

 

DRV - (NwlnkFwd) -- C:\Windows\System32\DRIVERS\nwlnkfwd.sys File not found

DRV - (NwlnkFlt) -- C:\Windows\System32\DRIVERS\nwlnkflt.sys File not found

DRV - (IpInIp) -- C:\Windows\System32\DRIVERS\ipinip.sys File not found

DRV - (blbdrive) -- C:\Windows\System32\drivers\blbdrive.sys File not found

DRV - (avgntflt) -- C:\Windows\System32\drivers\avgntflt.sys (Avira GmbH)

DRV - (avipbb) -- C:\Windows\System32\drivers\avipbb.sys (Avira GmbH)

DRV - (ssmdrv) -- C:\Windows\System32\drivers\ssmdrv.sys (Avira GmbH)

DRV - (usbaudio) USB-Audiotreiber (WDM) -- C:\Windows\System32\drivers\USBAUDIO.sys (Microsoft Corporation)

DRV - (avgio) -- C:\Programme\Avira\AntiVir Desktop\avgio.sys (Avira GmbH)

DRV - (nvlddmkm) -- C:\Windows\System32\drivers\nvlddmkm.sys (NVIDIA Corporation)

DRV - (LVUSBSta) -- C:\Windows\System32\drivers\LVUSBSta.sys (Logitech Inc.)

DRV - (LVRS) -- C:\Windows\System32\drivers\lvrs.sys (Logitech Inc.)

DRV - (PID_PEPI) Logitech QuickCam IM(PID_PEPI) -- C:\Windows\System32\drivers\LV302V32.SYS (Logitech Inc.)

DRV - (pepifilter) -- C:\Windows\System32\drivers\lv302af.sys (Logitech Inc.)

DRV - (LVPr2Mon) -- C:\Windows\System32\drivers\LVPr2Mon.sys ()

DRV - (HdAudAddService) -- C:\Windows\System32\drivers\CHDART.sys (Conexant Systems Inc.)

DRV - (NVENETFD) -- C:\Windows\System32\drivers\nvmfdx32.sys (NVIDIA Corporation)

DRV - (rimmptsk) -- C:\Windows\System32\drivers\rimmptsk.sys (REDC)

DRV - (nvsmu) -- C:\Windows\System32\drivers\nvsmu.sys (NVIDIA Corporation)

DRV - (rismxdp) -- C:\Windows\System32\drivers\rixdptsk.sys (REDC)

DRV - (rimsptsk) -- C:\Windows\System32\drivers\rimsptsk.sys (REDC)

DRV - (SynTP) -- C:\Windows\System32\drivers\SynTP.sys (Synaptics, Inc.)

DRV - (BCM43XX) -- C:\Windows\System32\drivers\BCMWL6.SYS (Broadcom Corporation)

DRV - (BCM43XV) -- C:\Windows\System32\drivers\BCMWL6.SYS (Broadcom Corporation)

DRV - (HSF_DPV) -- C:\Windows\System32\drivers\HSX_DPV.sys (Conexant Systems, Inc.)

DRV - (HSXHWAZL) -- C:\Windows\System32\drivers\HSXHWAZL.sys (Conexant Systems, Inc.)

DRV - (winachsf) -- C:\Windows\System32\drivers\HSX_CNXT.sys (Conexant Systems, Inc.)

DRV - (eabfiltr) -- C:\Windows\System32\drivers\eabfiltr.sys (Hewlett-Packard Development Company, L.P.)

DRV - (XAudio) -- C:\Windows\System32\drivers\XAudio.sys (Conexant Systems, Inc.)

DRV - (AF15BDA) Cinergy T USB XE (MKII) -- C:\Windows\System32\drivers\AF15BDA.sys (AfaTech )

DRV - (ql2300) -- C:\Windows\system32\drivers\ql2300.sys (QLogic Corporation)

DRV - (adp94xx) -- C:\Windows\system32\drivers\adp94xx.sys (Adaptec, Inc.)

DRV - (elxstor) -- C:\Windows\system32\drivers\elxstor.sys (Emulex)

DRV - (adpahci) -- C:\Windows\system32\drivers\adpahci.sys (Adaptec, Inc.)

DRV - (uliahci) -- C:\Windows\system32\drivers\uliahci.sys (ULi Electronics Inc.)

DRV - (iaStorV) -- C:\Windows\system32\drivers\iastorv.sys (Intel Corporation)

DRV - (adpu320) -- C:\Windows\system32\drivers\adpu320.sys (Adaptec, Inc.)

DRV - (ulsata2) -- C:\Windows\system32\drivers\ulsata2.sys (Promise Technology, Inc.)

DRV - (vsmraid) -- C:\Windows\system32\drivers\vsmraid.sys (VIA Technologies Inc.,Ltd)

DRV - (ql40xx) -- C:\Windows\system32\drivers\ql40xx.sys (QLogic Corporation)

DRV - (UlSata) -- C:\Windows\system32\drivers\ulsata.sys (Promise Technology, Inc.)

DRV - (adpu160m) -- C:\Windows\system32\drivers\adpu160m.sys (Adaptec, Inc.)

DRV - (nvraid) -- C:\Windows\system32\drivers\nvraid.sys (NVIDIA Corporation)

DRV - (nfrd960) -- C:\Windows\system32\drivers\nfrd960.sys (IBM Corporation)

DRV - (iirsp) -- C:\Windows\system32\drivers\iirsp.sys (Intel Corp./ICP vortex GmbH)

DRV - (SiSRaid4) -- C:\Windows\system32\drivers\sisraid4.sys (Silicon Integrated Systems)

DRV - (nvstor) -- C:\Windows\system32\drivers\nvstor.sys (NVIDIA Corporation)

DRV - (aic78xx) -- C:\Windows\system32\drivers\djsvs.sys (Adaptec, Inc.)

DRV - (arcsas) -- C:\Windows\system32\drivers\arcsas.sys (Adaptec, Inc.)

DRV - (LSI_SCSI) -- C:\Windows\system32\drivers\lsi_scsi.sys (LSI Logic)

DRV - (SiSRaid2) -- C:\Windows\system32\drivers\sisraid2.sys (Silicon Integrated Systems Corp.)

DRV - (HpCISSs) -- C:\Windows\system32\drivers\hpcisss.sys (Hewlett-Packard Company)

DRV - (arc) -- C:\Windows\system32\drivers\arc.sys (Adaptec, Inc.)

DRV - (iteraid) -- C:\Windows\system32\drivers\iteraid.sys (Integrated Technology Express, Inc.)

DRV - (iteatapi) -- C:\Windows\system32\drivers\iteatapi.sys (Integrated Technology Express, Inc.)

DRV - (LSI_SAS) -- C:\Windows\system32\drivers\lsi_sas.sys (LSI Logic)

DRV - (Symc8xx) -- C:\Windows\system32\drivers\symc8xx.sys (LSI Logic)

DRV - (LSI_FC) -- C:\Windows\system32\drivers\lsi_fc.sys (LSI Logic)

DRV - (Sym_u3) -- C:\Windows\system32\drivers\sym_u3.sys (LSI Logic)

DRV - (Mraid35x) -- C:\Windows\system32\drivers\mraid35x.sys (LSI Logic Corporation)

DRV - (Sym_hi) -- C:\Windows\system32\drivers\sym_hi.sys (LSI Logic)

DRV - (megasas) -- C:\Windows\system32\drivers\megasas.sys (LSI Logic Corporation)

DRV - (viaide) -- C:\Windows\system32\drivers\viaide.sys (VIA Technologies, Inc.)

DRV - (cmdide) -- C:\Windows\system32\drivers\cmdide.sys (CMD Technology, Inc.)

DRV - (aliide) -- C:\Windows\system32\drivers\aliide.sys (Acer Laboratories Inc.)

DRV - (Brserid) Brother MFC Serial Port Interface Driver (WDM) -- C:\Windows\system32\drivers\brserid.sys (Brother Industries Ltd.)

DRV - (BrUsbSer) -- C:\Windows\system32\drivers\brusbser.sys (Brother Industries Ltd.)

DRV - (BrFiltUp) -- C:\Windows\system32\drivers\brfiltup.sys (Brother Industries, Ltd.)

DRV - (BrFiltLo) -- C:\Windows\system32\drivers\brfiltlo.sys (Brother Industries, Ltd.)

DRV - (BrSerWdm) -- C:\Windows\system32\drivers\brserwdm.sys (Brother Industries Ltd.)

DRV - (BrUsbMdm) -- C:\Windows\system32\drivers\brusbmdm.sys (Brother Industries Ltd.)

DRV - (HSFHWAZL) -- C:\Windows\System32\drivers\VSTAZL3.SYS (Conexant Systems, Inc.)

DRV - (ntrigdigi) -- C:\Windows\system32\drivers\ntrigdigi.sys (N-trig Innovative Technologies)

DRV - (E1G60) Intel(R) -- C:\Windows\System32\drivers\E1G60I32.sys (Intel Corporation)

DRV - (ialm) -- C:\Windows\System32\drivers\igdkmd32.sys (Intel Corporation)

DRV - (HBtnKey) -- C:\Windows\System32\drivers\CPQBttn.sys (Hewlett-Packard Development Company, L.P.)

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=DE_DE&c=73&bd=Pavilion&pf=laptop

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=DE_DE&c=73&bd=Pavilion&pf=laptop

 

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=DE_DE&c=73&bd=Pavilion&pf=laptop

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 
 ========== FireFox ==========

 

FF - prefs.js..browser.search.defaultenginename: "Google"

FF - prefs.js..browser.search.defaulturl: "hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q="

FF - prefs.js..browser.search.update: false

FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de/"

FF - prefs.js..extensions.enabledItems: {e001c731-5e37-4538-a5cb-8168736a2360}:0.9.9.52

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22

FF - prefs.js..extensions.enabledItems: {635abd67-4fe9-1b23-4f01-e679fa7484c1}:1.6.6.20090220

 

 

FF - HKLM\software\mozilla\Firefox\Extensions\\{3112ca9c-de6d-4884-a869-9855de68056c}: C:\ProgramData\Google\Toolbar for Firefox\{3112ca9c-de6d-4884-a869-9855de68056c} [2009.01.28 12:46:20 | 000,000,000 | ---D | M]

FF - HKLM\software\mozilla\Mozilla Firefox 3.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2009.01.28 12:46:12 | 000,000,000 | ---D | M]

FF - HKLM\software\mozilla\Mozilla Firefox 3.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010.04.28 14:33:44 | 000,000,000 | ---D | M]

FF - HKLM\software\mozilla\Mozilla Thunderbird 3.1.6\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2010.11.28 18:15:45 | 000,000,000 | ---D | M]

FF - HKLM\software\mozilla\Mozilla Thunderbird 3.1.6\extensions\\Plugins: C:\Program Files\Mozilla Thunderbird\plugins

 

[2010.09.11 19:26:02 | 000,000,000 | ---D | M] -- C:\Users\Arbeitsplatz\AppData\Roaming\mozilla\Extensions

[2010.09.11 19:26:02 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Arbeitsplatz\AppData\Roaming\mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}

[2010.12.03 19:57:04 | 000,000,000 | ---D | M] -- C:\Users\Arbeitsplatz\AppData\Roaming\mozilla\Firefox\Profiles\cl1fdnze.default\extensions

[2009.08.12 11:58:12 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\Arbeitsplatz\AppData\Roaming\mozilla\Firefox\Profiles\cl1fdnze.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}

[2010.09.06 19:51:42 | 000,000,000 | ---D | M] (Google Toolbar for Firefox) -- C:\Users\Arbeitsplatz\AppData\Roaming\mozilla\Firefox\Profiles\cl1fdnze.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}

[2010.01.17 18:29:38 | 000,000,000 | ---D | M] (Yahoo! Toolbar) -- C:\Users\Arbeitsplatz\AppData\Roaming\mozilla\Firefox\Profiles\cl1fdnze.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}

[2010.12.03 19:56:57 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Arbeitsplatz\AppData\Roaming\mozilla\Firefox\Profiles\cl1fdnze.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}

[2010.11.01 09:50:24 | 000,000,000 | ---D | M] -- C:\Programme\Mozilla Firefox\extensions

[2010.04.28 14:33:46 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}

[2010.09.08 11:52:13 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}

[2010.11.01 09:50:24 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}

[2010.09.15 04:50:38 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\Mozilla Firefox\plugins\npdeployJava1.dll

[2008.03.15 14:56:14 | 000,001,392 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\amazondotcom-de.xml

[2008.03.15 14:56:14 | 000,002,642 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml

[2008.02.19 15:40:48 | 000,006,805 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\leo_ende_de.xml

[2006.12.03 16:59:22 | 000,000,986 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\wikipedia-de.xml

[2006.11.17 12:19:24 | 000,000,801 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml

 

O1 HOSTS File: ([2009.03.23 15:41:34 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts

O1 - Hosts: 127.0.0.1 localhost

O1 - Hosts: ::1 localhost

O2 - BHO: (Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)

O2 - BHO: (Skype add-on (mastermind)) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Programme\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.)

O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Programme\Google\Google Toolbar\GoogleToolbar.dll ()

O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programme\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll (Google Inc.)

O2 - BHO: (Google Dictionary Compression sdch) - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Programme\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll (Google Inc.)

O3 - HKLM\..\Toolbar: (&Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Programme\Google\Google Toolbar\GoogleToolbar.dll ()

O3 - HKCU\..\Toolbar\WebBrowser: (&Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Programme\Google\Google Toolbar\GoogleToolbar.dll ()

O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)

O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)

O4 - HKCU..\Run: [Getdo] File not found

O4 - HKLM..\RunOnce: [Launcher] C:\Windows\SMINST\Launcher.exe (soft thinks)

O4 - HKLM..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)

O8 - Extra context menu item: Nach Microsoft E&xel exportieren - C:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)

O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)

O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)

O9 - Extra Button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Programme\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.)

O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira GmbH)

O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira GmbH)

O10 - Protocol_Catalog9\Catalog_Entries\000000000013 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira GmbH)

O13 - gopher Prefix: missing

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)

O16 - DPF: {CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0-windows-i586.cab (Java Plug-in 1.6.0)

O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab (Java Plug-in 1.6.0_03)

O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab (Java Plug-in 1.6.0_05)

O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Java Plug-in 1.6.0_07)

O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1

O18 - Protocol\Handler\bwfile-8876480 {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll (Logitech Inc.)

O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)

O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Programme\Common Files\microsoft shared\Information Retrieval\msitss.dll (Microsoft Corporation)

O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Common Files\Skype\Skype4COM.dll (Skype Technologies)

O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)

O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)

O24 - Desktop WallPaper: C:\Users\Arbeitsplatz\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg

O24 - Desktop BackupWallPaper: C:\Users\Arbeitsplatz\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2006.09.18 22:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]

O32 - AutoRun File - [2005.09.11 16:18:54 | 000,000,340 | -HS- | M] () - D:\AUTOMODE -- [ NTFS ]

O34 - HKLM BootExecute: (autocheck autochk *) - File not found

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2010.12.03 20:05:38 | 000,000,000 | ---D | C] -- C:\Users\Arbeitsplatz\AppData\Roaming\Malwarebytes

[2010.12.03 20:05:32 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys

[2010.12.03 20:05:30 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes

[2010.12.03 20:05:27 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys

[2010.12.03 20:05:26 | 000,000,000 | ---D | C] -- C:\Programme\Malwarebytes' Anti-Malware

[2010.12.03 19:57:12 | 000,000,000 | ---D | C] -- C:\Users\Arbeitsplatz\AppData\Roaming\QuickScan

[2010.11.26 20:05:56 | 000,000,000 | ---D | C] -- C:\ProgramData\LightScribe

[2010.11.26 19:18:21 | 000,000,000 | ---D | C] -- C:\Programme\CCleaner

[2010.11.26 18:46:05 | 000,000,000 | ---D | C] -- C:\Users\Arbeitsplatz\Diagnoseprogramme

[2010.11.25 20:31:32 | 000,000,000 | ---D | C] -- C:\Users\Arbeitsplatz\AppData\Roaming\Helper

[2010.11.24 12:10:26 | 000,000,000 | ---D | C] -- C:\Users\Arbeitsplatz\AppData\Roaming\Twainbus

 
 ========== Files - Modified Within 30 Days ==========

 

[2010.12.03 20:05:32 | 000,000,906 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk

[2010.12.03 19:54:03 | 000,000,432 | -H-- | M] () -- C:\Windows\tasks\User_Feed_Synchronization-{CBCE1F23-ACDC-4133-8BB6-979CE9ED1486}.job

[2010.12.03 19:52:34 | 000,003,168 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0

[2010.12.03 19:52:33 | 000,043,096 | ---- | M] () -- C:\ProgramData\nvModes.001

[2010.12.03 19:52:33 | 000,003,168 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0

[2010.12.03 19:52:24 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat

[2010.12.02 19:39:42 | 000,043,096 | ---- | M] () -- C:\ProgramData\nvModes.dat

[2010.11.29 17:42:18 | 000,038,224 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys

[2010.11.29 17:42:06 | 000,020,952 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys

[2010.11.28 18:07:34 | 000,001,887 | ---- | M] () -- C:\Users\Public\Desktop\Adobe Reader 8.lnk

[2010.11.28 13:50:54 | 000,628,742 | ---- | M] () -- C:\Windows\System32\perfh007.dat

[2010.11.28 13:50:54 | 000,595,996 | ---- | M] () -- C:\Windows\System32\perfh009.dat

[2010.11.28 13:50:54 | 000,126,260 | ---- | M] () -- C:\Windows\System32\perfc007.dat

[2010.11.28 13:50:54 | 000,104,070 | ---- | M] () -- C:\Windows\System32\perfc009.dat

[2010.11.27 13:48:51 | 000,000,148 | ---- | M] () -- C:\Users\Public\Documents\hpqp.ini

[2010.11.26 19:18:30 | 000,000,804 | ---- | M] () -- C:\Users\Public\Desktop\CCleaner.lnk

[2010.11.23 07:34:03 | 000,061,960 | ---- | M] (Avira GmbH) -- C:\Windows\System32\drivers\avgntflt.sys

[2010.11.19 21:34:25 | 000,002,633 | ---- | M] () -- C:\Users\Arbeitsplatz\Desktop\Microsoft Office Excel 2007.lnk

 
 ========== Files Created - No Company Name ==========

 

[2010.12.03 20:05:32 | 000,000,906 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk

[2010.11.28 18:07:34 | 000,001,887 | ---- | C] () -- C:\Users\Public\Desktop\Adobe Reader 8.lnk

[2010.11.26 19:18:30 | 000,000,804 | ---- | C] () -- C:\Users\Public\Desktop\CCleaner.lnk

[2009.10.08 15:08:56 | 000,000,680 | ---- | C] () -- C:\Users\Arbeitsplatz\AppData\Local\d3d9caps.dat

[2009.09.11 07:10:35 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll

[2009.02.18 13:54:46 | 000,043,096 | ---- | C] () -- C:\ProgramData\nvModes.001

[2009.02.18 13:54:44 | 000,043,096 | ---- | C] () -- C:\ProgramData\nvModes.dat

[2008.12.25 11:54:39 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat

[2008.12.25 11:08:00 | 000,066,482 | ---- | C] () -- C:\Windows\System32\lvcoinst.ini

[2008.07.26 08:25:02 | 000,025,624 | ---- | C] () -- C:\Windows\System32\drivers\LVPr2Mon.sys

[2007.10.30 14:03:10 | 000,000,305 | ---- | C] () -- C:\ProgramData\addr_file.html

[2007.10.27 18:47:26 | 000,006,656 | ---- | C] () -- C:\Users\Arbeitsplatz\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2007.10.25 20:55:20 | 000,042,336 | ---- | C] () -- C:\Users\Arbeitsplatz\AppData\Roaming\nvModes.001

[2007.10.25 20:55:15 | 000,042,336 | ---- | C] () -- C:\Users\Arbeitsplatz\AppData\Roaming\nvModes.dat

[2007.10.22 12:17:25 | 000,000,000 | ---- | C] () -- C:\Users\Arbeitsplatz\AppData\Local\QSwitch.txt

[2007.10.22 12:17:25 | 000,000,000 | ---- | C] () -- C:\Users\Arbeitsplatz\AppData\Local\DSwitch.txt

[2007.10.22 12:17:25 | 000,000,000 | ---- | C] () -- C:\Users\Arbeitsplatz\AppData\Local\AtStart.txt

[2007.08.18 21:13:07 | 000,000,320 | ---- | C] () -- C:\ProgramData\hpzinstall.log

[2007.02.27 21:43:02 | 000,000,000 | ---- | C] () -- C:\Windows\System32\px.ini

[2006.12.14 07:01:36 | 000,520,192 | ---- | C] () -- C:\Windows\System32\CddbPlaylist2Roxio.dll

[2006.12.14 07:01:36 | 000,204,800 | ---- | C] () -- C:\Windows\System32\CddbFileTaggerRoxio.dll

[2006.11.02 13:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll

[2006.11.02 11:25:21 | 000,061,440 | ---- | C] () -- C:\Windows\System32\igfxTMM.dll

[2006.11.02 08:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini

[2006.03.10 01:58:00 | 001,060,424 | ---- | C] () -- C:\Windows\System32\WdfCoInstaller01000.dll

[2005.05.07 13:06:00 | 000,016,480 | ---- | C] () -- C:\Windows\System32\rixdicon.dll

 
 ========== Alternate Data Streams ==========

 

@Alternate Data Stream - 104 bytes -> C:\ProgramData\TEMP:DFC5A2B2

 

< End of report >

--- --- ---
OTL Logfile:

Code:

OTL Extras logfile created on: 03.12.2010 21:14:03 - Run 1

OTL by OldTimer - Version 3.2.17.3 Folder = C:\Users\Arbeitsplatz\Downloads

Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation

Internet Explorer (Version = 7.0.6002.18005)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

2,00 Gb Total Physical Memory | 1,00 Gb Available Physical Memory | 51,00% Memory free

4,00 Gb Paging File | 3,00 Gb Available in Paging File | 75,00% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files

Drive C: | 141,50 Gb Total Space | 107,75 Gb Free Space | 76,15% Space Free | Partition Type: NTFS

Drive D: | 7,55 Gb Total Space | 2,29 Gb Free Space | 30,34% Space Free | Partition Type: NTFS

 

Computer Name: ARBEITSPLATZ-PC | User Name: Arbeitsplatz | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user

Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Extra Registry (SafeList) ==========

 

 
 ========== File Associations ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)

.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)

 

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]

.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

 
 ========== Shell Spawning ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]

batfile [open] -- "%1" %*

cmdfile [open] -- "%1" %*

comfile [open] -- "%1" %*

cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)

exefile [open] -- "%1" %*

helpfile [open] -- Reg Error: Key error.

hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)

inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)

piffile [open] -- "%1" %*

regfile [merge] -- Reg Error: Key error.

scrfile [config] -- "%1"

scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)

scrfile [open] -- "%1" /S

txtfile [edit] -- Reg Error: Key error.

Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1

Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)

Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Directory [OneNote.Open] -- C:\PROGRA~1\MICROS~3\Office12\ONENOTE.EXE "%L" (Microsoft Corporation)

Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)

Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)

Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

 
 ========== Security Center Settings ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

"cval" = 1

"UacDisableNotify" = 1

"InternetSettingsDisableNotify" = 1

"AutoUpdateDisableNotify" = 1

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

"DisableMonitoring" = 1

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

"DisableMonitoring" = 1

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

"DisableMonitoring" = 1

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

"AntiVirusOverride" = 0

"AntiSpywareOverride" = 0

"FirewallOverride" = 0

"VistaSp1" = Reg Error: Unknown registry data type -- File not found

"VistaSp2" = Reg Error: Unknown registry data type -- File not found

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

 
 ========== Firewall Settings ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

"DisableNotifications" = 0

"EnableFirewall" = 1

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

"DisableNotifications" = 0

"EnableFirewall" = 1

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]

"DisableNotifications" = 0

"EnableFirewall" = 1

 
 ========== Authorized Applications List ==========

 

 
 ========== Vista Active Open Ports Exception List ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

"{0D08C5AA-94FF-4F91-AB63-22FD08ABD3FC}" = lport=2869 | protocol=6 | dir=in | app=system | 

"{5C1DA321-53CA-4A81-8C82-FD53BB418D74}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe | 

 
 ========== Vista Active Application Exception List ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

"{3E6965C3-E75F-462F-8A59-FB1E63BA8D9E}" = dir=in | app=c:\program files\hp\quickplay\qpservice.exe | 

"{4200018A-B5D3-4143-ACDB-51BE4D9460ED}" = protocol=6 | dir=in | app=c:\program files\logitech\desktop messenger\8876480\program\logitechdesktopmessenger.exe | 

"{455EB745-EB3D-4125-8033-874346FD60FD}" = dir=in | app=c:\program files\msn messenger\livecall.exe | 

"{557EA078-56B2-4AAD-ACCC-4996C2A236B9}" = protocol=17 | dir=in | app=c:\program files\logitech\desktop messenger\8876480\program\logitechdesktopmessenger.exe | 

"{64165BB1-28A6-4984-AA23-751AE54E17C2}" = protocol=6 | dir=in | app=c:\program files\logitech\desktop messenger\8876480\program\logitechdesktopmessenger.exe | 

"{6D25413B-9F82-4E35-A566-3F426CDF00BB}" = dir=in | app=c:\program files\hp\quickplay\qp.exe | 

"{7CBFC84A-BBAF-40D0-AE03-5DC46525EE8E}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{ADFB78E5-B0C4-4D9A-BACB-AD9EA59B6629}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe | 

"{C318199D-0C6D-425E-B4F4-40F2BCCD8911}" = protocol=6 | dir=in | app=c:\program files\logitech\desktop messenger\8876480\program\logitechdesktopmessenger.exe | 

"{C4854F05-327E-4E4B-A834-79455AD1AE78}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe | 

"{D3CEEAD7-2825-4CDA-B36C-F11F5A27731F}" = protocol=17 | dir=in | app=c:\program files\logitech\desktop messenger\8876480\program\logitechdesktopmessenger.exe | 

"{E28877CC-FCED-4188-80A7-69C6B7BA2123}" = protocol=17 | dir=in | app=c:\program files\logitech\desktop messenger\8876480\program\logitechdesktopmessenger.exe | 

"{F2EFAD50-5466-472B-8A9D-650883AA58BF}" = dir=in | app=c:\program files\msn messenger\msnmsgr.exe | 

"TCP Query User{7FD6BD7F-B7BC-4B3F-874D-C03D06752FC6}C:\program files\real\realplayer\realplay.exe" = protocol=6 | dir=in | app=c:\program files\real\realplayer\realplay.exe | 

"TCP Query User{C832EC44-430D-4FFD-A3B3-B8BAC27FA827}C:\program files\mozilla firefox\firefox.exe" = protocol=6 | dir=in | app=c:\program files\mozilla firefox\firefox.exe | 

"UDP Query User{3A9B81E7-0D46-423E-AB7E-E0409FEDCF20}C:\program files\real\realplayer\realplay.exe" = protocol=17 | dir=in | app=c:\program files\real\realplayer\realplay.exe | 

"UDP Query User{D16CB58C-9E63-4AF7-9C86-1D7D89EA2729}C:\program files\mozilla firefox\firefox.exe" = protocol=17 | dir=in | app=c:\program files\mozilla firefox\firefox.exe | 

 
 ========== HKEY_LOCAL_MACHINE Uninstall List ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"{0394CDC8-FABD-4ed8-B104-03393876DFDF}" = Roxio Creator Tools

"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu

"{082702D5-5DD8-4600-BCE5-48B15174687F}" = HP Doc Viewer

"{0CFD3BAF-9F4D-4D70-BD0B-638EA2504C25}" = PSSWCORE

"{0D397393-9B50-4c52-84D5-77E344289F87}" = Roxio Creator Data

"{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_iP3500_series" = Canon iP3500 series

"{11F93B4B-48F0-4A4E-AE77-DFA96A99664B}" = Roxio Creator EasyArchive

"{1D14373E-7970-4F2F-A467-ACA4F0EA21E3}" = Google Earth

"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer

"{254C37AA-6B72-4300-84F6-98A82419187E}" = Hewlett-Packard Active Check

"{26A24AE4-039D-4CA4-87B4-2F83216013FF}" = Java(TM) 6 Update 22

"{290B83AA-093A-45BF-A917-D1C4A1E8D917}" = HP Active Support Library

"{3248F0A8-6813-11D6-A77B-00B0D0160000}" = Java(TM) SE Runtime Environment 6

"{3248F0A8-6813-11D6-A77B-00B0D0160030}" = Java(TM) 6 Update 3

"{3248F0A8-6813-11D6-A77B-00B0D0160050}" = Java(TM) 6 Update 5

"{3248F0A8-6813-11D6-A77B-00B0D0160070}" = Java(TM) 6 Update 7

"{33C65B6A-5D73-4E3E-A1F9-127C27BD3F72}" = Roxio MyDVD Basic v9

"{34D2AB40-150D-475D-AE32-BD23FB5EE355}" = HP Quick Launch Buttons 6.20 B1

"{35E1EC43-D4FC-4E4A-AAB3-20DDA27E8BB0}" = Roxio Activation Module

"{3AF8FCCD-F51A-4014-9002-F195E1CBC876}" = Logitech QuickCam

"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile

"{40F7AED3-0C7D-4582-99F6-484A515C73F2}" = HP Easy Setup - Frontend

"{45D707E9-F3C4-11D9-A373-0050BAE317E1}" = HP QuickPlay 3.2

"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater

"{4EA2F95F-A537-4d17-9E7F-6B3FF8D9BBE3}" = Microsoft Works

"{53735ECE-E461-4FD0-B742-23A352436D3A}" = Logitech Updater

"{5C82DAE5-6EB0-4374-9254-BE3319BA4E82}" = Skype™ 3.8

"{619CDD8A-14B6-43a1-AB6C-0F4EE48CE048}" = Roxio Creator Copy

"{63B9BAB5-F36A-4A3B-9E5C-68A7F212BFB9}" = TerraTec Home Cinema

"{65DA2EC9-0642-47E9-AAE2-B5267AA14D75}" = Activation Assistant for the 2007 Microsoft Office suites

"{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA}" = Roxio Express Labeler 3

"{669D4A35-146B-4314-89F1-1AC3D7B88367}" = Hewlett-Packard Asset Agent

"{83FFCFC7-88C6-41c6-8752-958A45325C82}" = Roxio Creator Audio

"{8CC5F040-44F2-4FB7-9720-47F53F96D180}" = MSCU for Microsoft Vista

"{8CEA85DE-955B-4BF4-87F2-0BAA62821633}" = HP Photosmart Essential2.5

"{900B1197-53F5-4F46-A882-2CFFFE2EEDCB}" = Logitech Desktop Messenger

"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007

"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007

"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007

"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007

"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007

"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007

"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007

"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007

"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007

"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007

"{9061CEF2-51F5-42C9-8A70-9ED351C6597A}" = HP Help and Support

"{90850407-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Word Viewer 2003

"{91120000-002F-0000-0000-0000000FF1CE}" = Microsoft Office Home and Student 2007

"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

"{A49F249F-0C91-497F-86DF-B2585E8E76B7}" = Microsoft Visual C++ 2005 Redistributable

"{AB5E289E-76BF-4251-9F3F-9B763F681AE0}" = HP Customer Experience Enhancements

"{AC76BA86-7AD7-1031-7B44-A81300000003}" = Adobe Reader 8.1.4 - Deutsch

"{B76A76EB-BCCA-4625-9C4C-1FFAE19E4772}" = ESU for Microsoft Vista

"{BA820A24-704B-428D-9904-71A10DAC1372}" = OLYMPUS Master

"{C8B0680B-CDAE-4809-9F91-387B6DE00F7C}" = Roxio Creator Basic v9

"{CD95F661-A5C4-44F5-A6AA-ECDD91C240B7}" = WinZip 12.0

"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1

"{D32067CD-7409-4792-BFA0-1469BCD8F0C8}" = HP Wireless Assistant

"{D9B4D7EE-481C-4C36-86AB-A8F7417725FF}" = LightScribe 1.6.43.1

"{DDFD9BA2-8E26-4E49-92AE-882424DAB1BC}" = HP User Guides 0057

"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack

"{FAB0C302-CB18-4A7A-BA03-C3DC23101A68}" = HP Active Support Library 32 bit components

"{FE57DE70-95DE-4B64-9266-84DA811053DB}" = HP Update

"7-Zip" = 7-Zip 9.15 beta

"Activation Assistant for the 2007 Microsoft Office suites" = Activation Assistant for the 2007 Microsoft Office suites

"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin

"Avira AntiVir Desktop" = Avira AntiVir Premium

"Canon iP3500 series Benutzerregistrierung" = Canon iP3500 series Benutzerregistrierung

"CanonMyPrinter" = Canon My Printer

"CanonSolutionMenu" = Canon Utilities Solution Menu

"CCleaner" = CCleaner

"CNXT_HDAUDIO" = Conexant HD Audio

"CNXT_MODEM_HDAUDIO_VEN_14F1&DEV_5045&SUBSYS_103C30B7" = HDAUDIO Soft Data Fax Modem with SmartCP

"Easy-PhotoPrint EX" = Canon Utilities Easy-PhotoPrint EX

"Google Updater" = Google Updater

"HijackThis" = HijackThis 2.0.2

"HOMESTUDENTR" = Microsoft Office Home and Student 2007

"HP Photosmart Essential" = HP Photosmart Essential 2.0

"InstallShield_{BA820A24-704B-428D-9904-71A10DAC1372}" = OLYMPUS Master

"lvdrivers_11.80" = Logitech QuickCam-Treiberpaket

"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware

"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU

"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1

"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile

"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack

"Mozilla Firefox (3.0.1)" = Mozilla Firefox (3.0.1)

"Mozilla Thunderbird (3.1.6)" = Mozilla Thunderbird (3.1.6)

"NVIDIA Drivers" = NVIDIA Drivers

"QuickTime" = QuickTime

"RealPlayer 6.0" = RealPlayer

"ShockwaveFlash" = Adobe Flash Player 9 ActiveX

"SmartAudio" = SmartAudio

"SynTPDeinstKey" = Synaptics Pointing Device Driver

 
 ========== Last 10 Event Log Errors ==========

 

[ Application Events ]

Error - 22.05.2009 12:30:41 | Computer Name = Arbeitsplatz-PC | Source = Windows Search Service | ID = 3006

Description = 

 

Error - 22.05.2009 12:30:41 | Computer Name = Arbeitsplatz-PC | Source = Windows Search Service | ID = 3007

Description = 

 

Error - 01.11.2009 06:11:30 | Computer Name = Arbeitsplatz-PC | Source = ESENT | ID = 215

Description = WinMail (1240) WindowsMail0: Die Sicherung wurde abgebrochen, weil

sie vom Client angehalten wurde, oder weil die Verbindung mit dem Client unterbrochen

wurde.

 

Error - 15.11.2009 13:54:53 | Computer Name = Arbeitsplatz-PC | Source = Application Hang | ID = 1002

Description = Programm firefox.exe, Version 1.9.0.3105 arbeitet nicht mehr mit Windows

zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet "Lösungen

für Probleme" in der Systemsteuerung, um nach weiteren Informationen über das Problem

zu suchen. Prozess-ID: 158c Anfangszeit: 01ca66186d5bcd31 Zeitpunkt der Beendigung:

899

 

Error - 23.11.2009 17:26:17 | Computer Name = Arbeitsplatz-PC | Source = Application Error | ID = 1000

Description = Fehlerhafte Anwendung LogitechDesktopMessenger.exe, Version 2.54.11.0,

Zeitstempel 0x45590e0d, fehlerhaftes Modul kernel32.dll, Version 6.0.6002.18005,

Zeitstempel 0x49e037dd, Ausnahmecode 0xe06d7363, Fehleroffset 0x0003fbae, Prozess-ID

0x558, Anwendungsstartzeit 01ca6c8377bb3cdf.

 

Error - 26.12.2009 07:54:44 | Computer Name = Arbeitsplatz-PC | Source = Application Error | ID = 1000

Description = Fehlerhafte Anwendung firefox.exe, Version 1.9.0.3105, Zeitstempel

0x486bac70, fehlerhaftes Modul unknown, Version 0.0.0.0, Zeitstempel 0x00000000,

Ausnahmecode 0xc0000005, Fehleroffset 0xe2b8003f, Prozess-ID 0x1400, Anwendungsstartzeit

01ca8620a0fb1e62.

 

Error - 10.01.2010 12:55:42 | Computer Name = Arbeitsplatz-PC | Source = Windows Search Service | ID = 3013

Description = 

 

Error - 14.01.2010 14:45:12 | Computer Name = Arbeitsplatz-PC | Source = Application Hang | ID = 1002

Description = Programm firefox.exe, Version 1.9.0.3105 arbeitet nicht mehr mit Windows

zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet "Lösungen

für Probleme" in der Systemsteuerung, um nach weiteren Informationen über das Problem

zu suchen. Prozess-ID: 12e0 Anfangszeit: 01ca95495f35dea0 Zeitpunkt der Beendigung:

225

 

Error - 22.01.2010 10:09:09 | Computer Name = Arbeitsplatz-PC | Source = Application Hang | ID = 1002

Description = Programm firefox.exe, Version 1.9.0.3105 arbeitet nicht mehr mit Windows

zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet "Lösungen

für Probleme" in der Systemsteuerung, um nach weiteren Informationen über das Problem

zu suchen. Prozess-ID: ff8 Anfangszeit: 01ca9b6822e6db63 Zeitpunkt der Beendigung:

75

 

Error - 28.02.2010 05:13:08 | Computer Name = Arbeitsplatz-PC | Source = Windows Search Service | ID = 3013

Description = 

 

[ System Events ]

Error - 02.12.2010 03:01:30 | Computer Name = Arbeitsplatz-PC | Source = Service Control Manager | ID = 7000

Description = 

 

Error - 02.12.2010 03:01:30 | Computer Name = Arbeitsplatz-PC | Source = Service Control Manager | ID = 7009

Description = 

 

Error - 02.12.2010 03:01:43 | Computer Name = Arbeitsplatz-PC | Source = Service Control Manager | ID = 7022

Description = 

 

Error - 02.12.2010 03:01:43 | Computer Name = Arbeitsplatz-PC | Source = Service Control Manager | ID = 7001

Description = 

 

Error - 02.12.2010 13:47:54 | Computer Name = Arbeitsplatz-PC | Source = Service Control Manager | ID = 7000

Description = 

 

Error - 02.12.2010 13:47:54 | Computer Name = Arbeitsplatz-PC | Source = Service Control Manager | ID = 7009

Description = 

 

Error - 03.12.2010 14:54:03 | Computer Name = Arbeitsplatz-PC | Source = Service Control Manager | ID = 7000

Description = 

 

Error - 03.12.2010 14:54:03 | Computer Name = Arbeitsplatz-PC | Source = Service Control Manager | ID = 7009

Description = 

 

Error - 03.12.2010 14:54:16 | Computer Name = Arbeitsplatz-PC | Source = Service Control Manager | ID = 7022

Description = 

 

Error - 03.12.2010 14:54:16 | Computer Name = Arbeitsplatz-PC | Source = Service Control Manager | ID = 7001

Description = 

 

 

< End of report >

--- --- ---

Zwar hat Anti-Malware nix mehr gefunden, aber ich bin mir nicht sicher, wie ich weiterverfahren soll. Ich habe meinem Vater erstmal gesagt, dass er kein Internetbanking mehr machen soll. Ich hoffe auf eure Hilfe

Zitat:

Art des Suchlaufs: Quick-Scan

Hallo und :hallo:

Bitte routinemäßig einen Vollscan mit malwarebytes machen und Log posten.
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss!

Falls Logs aus älteren Scans mit Malwarebytes vorhanden sind, bitte auch davon alle posten!

Hallo,

anbei der Report vom Vollscan.

Malwarebytes' Anti-Malware 1.50
www.malwarebytes.org

Datenbank Version: 5242

Windows 6.0.6002 Service Pack 2
Internet Explorer 7.0.6002.18005

04.12.2010 12:53:38
mbam-log-2010-12-04 (12-53-38).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|)
Durchsuchte Objekte: 280996
Laufzeit: 1 Stunde(n), 17 Minute(n), 18 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)

Beste Grüße, Jens

Beende alle Programme, starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)

Code:

:OTL

O4 - HKCU..\Run: [Getdo] File not found

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2006.09.18 22:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]

O32 - AutoRun File - [2005.09.11 16:18:54 | 000,000,340 | -HS- | M] () - D:\AUTOMODE -- [ NTFS ]

@Alternate Data Stream - 104 bytes -> C:\ProgramData\TEMP:DFC5A2B2

:Commands

[purity]

[resethosts]

[emptytemp]

Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Hallo Arne,

hier der logfile.

All processes killed
========== OTL ==========
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\Getdo deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!
C:\autoexec.bat moved successfully.
D:\AUTOMODE moved successfully.
ADS C:\ProgramData\TEMP:DFC5A2B2 deleted successfully.
========== COMMANDS ==========
C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully

[EMPTYTEMP]

User: All Users

User: Arbeitsplatz
->Temp folder emptied: 95052509 bytes
->Temporary Internet Files folder emptied: 541074 bytes
->Java cache emptied: 114605915 bytes
->FireFox cache emptied: 61216384 bytes
->Flash cache emptied: 7191 bytes

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Flash cache emptied: 83 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Public

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 124523 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 259,00 mb

OTL by OldTimer - Version 3.2.17.3 log created on 12052010_200334

Files\Folders moved on Reboot...
File move failed. C:\Windows\temp\logishrd\LVPrcInj01.dll scheduled to be moved on reboot.

Registry entries deleted on Reboot...

Beste Grüße, Jens

Dann bitte jetzt CF ausführen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix

Lade dir ComboFix hier herunter auf deinen Desktop. Benenne es beim Runterladen um in cofi.exe.

http://saved.im/mtm0nzyzmzd5/cofi.jpg

Dann folgende Anleitung durchlesen und abarbeiten -> CCleaner Systembereinigung

Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.

Starte cofi.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.

Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.

Wichtiger Hinweis:

Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

Hallo,

ich habe nun alles ausgeführt, komme aber nicht mehr ins Netz über den Computer meines Vaters, da immer eine Fehlermeldung kommt:

"Es wurde versucht, einem Registrierungsschlüssel einen unzulässigen Vorgang zu unterziehen, der zum Löschen markiert wurde."

Ich hoffe, ich habe nichts falsch gemacht...

Gruß, Jens

Hallo,

ich kann den log nun doch posten. Ich musste einen Neustart machen, da sich der Computer aufgehangen hat und nun geht es wieder. Sorry für die Aufregung... :pfeiff:

Combofix Logfile:

Code:

ComboFix 10-12-04.06 - Arbeitsplatz 06.12.2010  15:48:32.1.2 - x86

Microsoft® Windows Vista™ Home Premium   6.0.6002.2.1252.49.1031.18.1982.1160 [GMT 1:00]

ausgeführt von:: c:\users\Arbeitsplatz\Desktop\cofi.exe.exe

SP: Windows-Defender *disabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}

 * Neuer Wiederherstellungspunkt wurde erstellt

.
 

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.
 

c:\users\Arbeitsplatz\AppData\Roaming\Adobe\Update\flacor.dat

c:\windows\TEMP\logishrd\LVPrcInj01.dll
 

.

(((((((((((((((((((((((   Dateien erstellt von 2010-11-06 bis 2010-12-06  ))))))))))))))))))))))))))))))

.
 

2010-12-06 14:57 . 2010-12-06 15:01        --------        d-----w-        c:\users\Arbeitsplatz\AppData\Local\temp

2010-12-05 19:03 . 2010-12-05 19:03        --------        d-----w-        C:\_OTL

2010-12-03 19:19 . 2010-11-10 04:33        6273872        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{FF2E21AB-5E4B-4112-B2D0-9DB20C02CF8D}\mpengine.dll

2010-12-03 19:05 . 2010-12-03 19:05        --------        d-----w-        c:\users\Arbeitsplatz\AppData\Roaming\Malwarebytes

2010-12-03 19:05 . 2010-11-29 16:42        38224        ----a-w-        c:\windows\system32\drivers\mbamswissarmy.sys

2010-12-03 19:05 . 2010-12-03 19:05        --------        d-----w-        c:\programdata\Malwarebytes

2010-12-03 19:05 . 2010-11-29 16:42        20952        ----a-w-        c:\windows\system32\drivers\mbam.sys

2010-12-03 19:05 . 2010-12-03 19:05        --------        d-----w-        c:\program files\Malwarebytes' Anti-Malware

2010-12-03 18:57 . 2010-12-03 19:00        --------        d-----w-        c:\users\Arbeitsplatz\AppData\Roaming\QuickScan

2010-11-26 19:05 . 2010-11-26 19:05        --------        d-----w-        c:\programdata\LightScribe

2010-11-26 18:18 . 2010-11-26 18:18        --------        d-----w-        c:\program files\CCleaner

2010-11-26 17:46 . 2010-11-26 17:46        --------        d-----w-        c:\users\Arbeitsplatz\Diagnoseprogramme

2010-11-25 19:31 . 2010-11-25 19:31        --------        d-----w-        c:\users\Arbeitsplatz\AppData\Roaming\Helper

2010-11-24 11:10 . 2010-11-29 21:35        --------        d-----w-        c:\users\Arbeitsplatz\AppData\Roaming\Twainbus

2010-11-10 14:39 . 2010-10-07 11:37        2409784        ----a-w-        c:\program files\Windows Mail\OESpamFilter.dat
 

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2010-11-23 06:34 . 2009-05-18 13:53        61960        ----a-w-        c:\windows\system32\drivers\avgntflt.sys

2010-11-03 08:54 . 2009-05-18 13:53        126856        ----a-w-        c:\windows\system32\drivers\avipbb.sys

2010-10-19 09:41 . 2009-10-03 07:44        222080        ------w-        c:\windows\system32\MpSigStub.exe

2010-09-15 03:50 . 2010-04-28 13:33        472808        ----a-w-        c:\windows\system32\deployJava1.dll

2010-09-13 13:56 . 2010-10-14 17:31        8147456        ----a-w-        c:\windows\system32\wmploc.DLL

2010-09-08 17:23 . 2010-10-14 17:28        78336        ----a-w-        c:\windows\system32\ieencode.dll

2010-09-08 17:07 . 2010-10-14 17:28        834048        ----a-w-        c:\windows\system32\wininet.dll

2010-09-08 15:23 . 2010-10-14 17:28        389632        ----a-w-        c:\windows\system32\html.iec

.
 

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2010-11-03 281768]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]

"Launcher"="c:\windows\SMINST\launcher.exe" [2006-11-08 44128]
 

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"EnableUIADesktopToggle"= 0 (0x0)
 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Defender]

%ProgramFiles%\Windows Defender\MSASCui.exe -hide [X]
 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]

2008-10-15 00:04        39792        ----a-w-        c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe
 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CanonMyPrinter]

2007-04-04 01:50        1603152        ----a-w-        c:\program files\Canon\MyPrinter\BJMYPRT.EXE
 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CanonSolutionMenu]

2007-05-15 01:01        644696        ----a-w-        c:\program files\Canon\SolutionMenu\CNSLMAIN.EXE
 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ehTray.exe]

2008-01-19 07:33        125952        ----a-w-        c:\windows\ehome\ehtray.exe
 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Health Check Scheduler]

2007-03-12 18:54        50696        ----a-w-        c:\program files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]

2007-05-08 15:24        54840        ----a-w-        c:\program files\HP\HP Software Update\hpwuSchd2.exe
 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LightScribe Control Panel]

2007-04-19 20:26        484904        ----a-w-        c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe
 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]

2008-12-04 01:42        13556256        ----a-w-        c:\windows\System32\nvcpl.dll
 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]

2008-12-04 01:42        92704        ----a-w-        c:\windows\System32\nvmctray.dll
 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OM_Monitor]

2006-05-16 16:50        40960        ----a-w-        c:\program files\OLYMPUS\OLYMPUS Master\FirstStart.exe
 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Parimg]

2010-08-04 18:16        0        ----a-w-        c:\users\Arbeitsplatz\AppData\Roaming\Adobe\Update\dxnat.exe
 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QPService]

2007-04-24 01:11        176128        ----a-w-        c:\program files\HP\QuickPlay\QPService.exe
 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]

2007-11-01 17:26        77824        ----a-w-        c:\program files\QuickTime\qttask.exe
 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sidebar]

2009-04-11 06:28        1233920        ----a-w-        c:\program files\Windows Sidebar\sidebar.exe
 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]

2010-05-14 09:44        248552        ----a-w-        c:\program files\Common Files\Java\Java Update\jusched.exe
 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPEnh]

2007-01-13 03:36        827392        ----a-w-        c:\program files\Synaptics\SynTP\SynTPEnh.exe
 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]

2007-10-31 14:13        185632        ----a-w-        c:\program files\Common Files\Real\Update_OB\realsched.exe
 

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]

"DisableMonitoring"=dword:00000001
 

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]

"DisableMonitoring"=dword:00000001
 

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]

"DisableMonitoring"=dword:00000001
 

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]

R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]

S2 AntiVirMailService;Avira AntiVir MailGuard;c:\program files\Avira\AntiVir Desktop\avmailc.exe [2010-11-03 339624]

S2 AntiVirSchedulerService;Avira AntiVir Planer;c:\program files\Avira\AntiVir Desktop\sched.exe [2010-11-03 135336]

S2 AntiVirWebService;Avira AntiVir WebGuard;c:\program files\Avira\AntiVir Desktop\AVWEBGRD.EXE [2010-11-03 403624]
 
 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

LocalServiceAndNoImpersonation        REG_MULTI_SZ           FontCache
 

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]

2007-04-19 20:23        452136        ----a-w-        c:\program files\Common Files\LightScribe\LSRunOnce.exe

.

Inhalt des "geplante Tasks" Ordners
 

2010-12-05 c:\windows\Tasks\User_Feed_Synchronization-{CBCE1F23-ACDC-4133-8BB6-979CE9ED1486}.job

- c:\windows\system32\msfeedssync.exe [2008-09-22 07:33]

.

.

------- Zusätzlicher Suchlauf -------

.

uStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=DE_DE&c=73&bd=Pavilion&pf=laptop

mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=DE_DE&c=73&bd=Pavilion&pf=laptop

IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000

LSP: c:\program files\Avira\AntiVir Desktop\avsda.dll

Handler: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - c:\program files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll

FF - ProfilePath - c:\users\Arbeitsplatz\AppData\Roaming\Mozilla\Firefox\Profiles\cl1fdnze.default\

FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=

FF - prefs.js: browser.startup.homepage - hxxp://www.google.de/

FF - component: c:\users\Arbeitsplatz\AppData\Roaming\Mozilla\Firefox\Profiles\cl1fdnze.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\frozen.dll

FF - component: c:\users\Arbeitsplatz\AppData\Roaming\Mozilla\Firefox\Profiles\cl1fdnze.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\components\qscanff.dll

FF - plugin: c:\program files\Google\Google Updater\2.4.1368.5602\npCIDetect13.dll

FF - plugin: c:\program files\Java\jre6\bin\new_plugin\npdeployJava1.dll

FF - plugin: c:\program files\Mozilla Firefox\plugins\npdeployJava1.dll

FF - plugin: c:\users\Arbeitsplatz\AppData\Roaming\Mozilla\Firefox\Profiles\cl1fdnze.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\plugins\npqscan.dll

FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

FF - Extension: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

FF - Extension: Java Console: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}

FF - Extension: Java Console: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}

FF - Extension: Java Console: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}

FF - Extension: Java Console: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}

FF - Extension: Java Console: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}

FF - Extension: Google Toolbar for Firefox: {3112ca9c-de6d-4884-a869-9855de68056c} - c:\programdata\Google\Toolbar for Firefox\{3112ca9c-de6d-4884-a869-9855de68056c}

FF - Extension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension

FF - Extension: Google Toolbar for Firefox: {3112ca9c-de6d-4884-a869-9855de68056c} - c:\users\Arbeitsplatz\AppData\Roaming\Mozilla\Firefox\Profiles\cl1fdnze.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}

FF - Extension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\users\Arbeitsplatz\AppData\Roaming\Mozilla\Firefox\Profiles\cl1fdnze.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}

FF - Extension: Yahoo! Toolbar: {635abd67-4fe9-1b23-4f01-e679fa7484c1} - c:\users\Arbeitsplatz\AppData\Roaming\Mozilla\Firefox\Profiles\cl1fdnze.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}

FF - Extension: BitDefender QuickScan: {e001c731-5e37-4538-a5cb-8168736a2360} - c:\users\Arbeitsplatz\AppData\Roaming\Mozilla\Firefox\Profiles\cl1fdnze.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}
 

---- FIREFOX Richtlinien ----

FF - user.js: yahoo.homepage.dontask - true

.

- - - - Entfernte verwaiste Registrierungseinträge - - - -
 

MSConfigStartUp-Helper - c:\users\Arbeitsplatz\AppData\Roaming\Helper\bin\liveu.exe

MSConfigStartUp-hpWirelessAssistant - %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe

MSConfigStartUp-NapsterShell - c:\program files\Napster\napster.exe

MSConfigStartUp-QlbCtrl - %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe

MSConfigStartUp-Regnew - c:\users\Arbeitsplatz\AppData\Roaming\Twainbus\freetor.exe

MSConfigStartUp-WAWifiMessage - %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
 
 
 

**************************************************************************
 

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net

Rootkit scan 2010-12-06 16:00

Windows 6.0.6002 Service Pack 2 NTFS
 

Scanne versteckte Prozesse... 
 

Scanne versteckte Autostarteinträge... 
 

Scanne versteckte Dateien... 
 

Scan erfolgreich abgeschlossen

versteckte Dateien: 0
 

**************************************************************************

.

--------------------- Gesperrte Registrierungsschluessel ---------------------
 

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="FirefoxHTML"
 

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="FirefoxHTML"
 

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="FirefoxHTML"
 

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="FirefoxHTML"
 

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="FirefoxHTML"
 

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

--------------------- Durch laufende Prozesse gestartete DLLs ---------------------
 

- - - - - - - > 'Explorer.exe'(9384)

c:\windows\TEMP\logishrd\LVPrcInj01.dll

.

------------------------ Weitere laufende Prozesse ------------------------

.

c:\windows\system32\nvvsvc.exe

c:\windows\system32\rundll32.exe

c:\program files\Avira\AntiVir Desktop\avguard.exe

c:\program files\HP\QuickPlay\Kernel\TV\CLCapSvc.exe

c:\program files\Avira\AntiVir Desktop\avshadow.exe

c:\program files\Common Files\LightScribe\LSSrvc.exe

c:\program files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe

c:\program files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe

c:\program files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe

c:\windows\system32\DRIVERS\xaudio.exe

c:\program files\Hewlett-Packard\Shared\hpqwmiex.exe

c:\program files\HP\QuickPlay\Kernel\TV\CLSched.exe

c:\windows\system32\conime.exe

c:\program files\Hewlett-Packard\HP Health Check\hphc_service.exe

c:\windows\servicing\TrustedInstaller.exe

.

**************************************************************************

.

Zeit der Fertigstellung: 2010-12-06  16:07:53 - PC wurde neu gestartet

ComboFix-quarantined-files.txt  2010-12-06 15:07
 

Vor Suchlauf: 11 Verzeichnis(se), 115.829.313.536 Bytes frei

Nach Suchlauf: 18 Verzeichnis(se), 115.765.985.280 Bytes frei
 

- - End Of File - - AA397C81AF223C12EEEDDE35BAD30B93

--- --- ---

Beste Grüße, Jens

Ok. Bitte nun Logs mit GMER und OSAM erstellen und posten.
GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus - die Online-Abfrage durch OSAM bitte überspringen.
Bei OSAM bitte darauf auch achten, dass Du das Log auch als *.log und nicht *.html oder so abspeicherst.

Downloade Dir danach bitte MBRCheck (by a_d_13) und speichere die Datei auf dem Desktop.

Doppelklick auf die MBRCheck.exe.
Vista und Win7 User mit Rechtsklick "als Administrator starten"
Das Tool braucht nur eine Sekunde.
Danach solltest du eine MBRCheck_<Datum>_<Uhrzeit>.txt auf dem Desktop finden.

Poste mir bitte den Inhalt des .txt Dokumentes

Hallo Arne,

hier die logfiles.

GMER Logfile:

Code:

GMER 1.0.15.15530 - hxxp://www.gmer.net

Rootkit scan 2010-12-06 22:58:04

Windows 6.0.6002 Service Pack 2 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP2T0L0-3 FUJITSU_MHW2160BH_PL rev.891F

Running: 1cwxh93y.exe; Driver: C:\Users\ARBEIT~1\AppData\Local\Temp\fxryikob.sys
 
 

---- Kernel code sections - GMER 1.0.15 ----
 

.text           C:\Windows\system32\DRIVERS\nvlddmkm.sys                                                                                     section is writeable [0x8B60C340, 0x3FA057, 0xE8000020]
 

---- User IAT/EAT - GMER 1.0.15 ----
 

IAT             C:\Program Files\Avira\AntiVir Desktop\avgnt.exe[1760] @ C:\Windows\system32\kernel32.dll [ntdll.dll!NtCreateFile]           [003D2F30] C:\Windows\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)

IAT             C:\Program Files\Avira\AntiVir Desktop\avgnt.exe[1760] @ C:\Windows\system32\kernel32.dll [ntdll.dll!NtClose]                [003D2D00] C:\Windows\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)

IAT             C:\Program Files\Avira\AntiVir Desktop\avgnt.exe[1760] @ C:\Windows\system32\kernel32.dll [ntdll.dll!NtDeviceIoControlFile]  [003D2CA0] C:\Windows\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)

IAT             C:\Program Files\Avira\AntiVir Desktop\avgnt.exe[1760] @ C:\Windows\system32\kernel32.dll [ntdll.dll!NtDuplicateObject]      [003D2CD0] C:\Windows\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)

IAT             C:\Windows\Explorer.EXE[1784] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdiplusShutdown]                                        [74D77817] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

IAT             C:\Windows\Explorer.EXE[1784] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCloneImage]                                         [74DCA86D] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

IAT             C:\Windows\Explorer.EXE[1784] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDrawImageRectI]                                     [74D7BB22] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

IAT             C:\Windows\Explorer.EXE[1784] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipSetInterpolationMode]                               [74D6F695] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

IAT             C:\Windows\Explorer.EXE[1784] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdiplusStartup]                                         [74D775E9] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

IAT             C:\Windows\Explorer.EXE[1784] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateFromHDC]                                      [74D6E7CA] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

IAT             C:\Windows\Explorer.EXE[1784] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateBitmapFromStreamICM]                          [74DA8395] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

IAT             C:\Windows\Explorer.EXE[1784] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateBitmapFromStream]                             [74D7DA60] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

IAT             C:\Windows\Explorer.EXE[1784] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipGetImageHeight]                                     [74D6FFFA] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

IAT             C:\Windows\Explorer.EXE[1784] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipGetImageWidth]                                      [74D6FF61] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

IAT             C:\Windows\Explorer.EXE[1784] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDisposeImage]                                       [74D671CF] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

IAT             C:\Windows\Explorer.EXE[1784] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipLoadImageFromFileICM]                               [74DFCAE2] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

IAT             C:\Windows\Explorer.EXE[1784] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipLoadImageFromFile]                                  [74D9C8D8] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

IAT             C:\Windows\Explorer.EXE[1784] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDeleteGraphics]                                     [74D6D968] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

IAT             C:\Windows\Explorer.EXE[1784] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipFree]                                               [74D66853] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

IAT             C:\Windows\Explorer.EXE[1784] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipAlloc]                                              [74D6687E] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

IAT             C:\Windows\Explorer.EXE[1784] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipSetCompositingMode]                                 [74D72AD1] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18005_none_9e50b396ca17ae07\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

IAT             C:\Windows\Explorer.EXE[1784] @ C:\Windows\system32\kernel32.dll [ntdll.dll!NtCreateFile]                                    [017D2F30] C:\Windows\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)

IAT             C:\Windows\Explorer.EXE[1784] @ C:\Windows\system32\kernel32.dll [ntdll.dll!NtClose]                                         [017D2D00] C:\Windows\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)

IAT             C:\Windows\Explorer.EXE[1784] @ C:\Windows\system32\kernel32.dll [ntdll.dll!NtDeviceIoControlFile]                           [017D2CA0] C:\Windows\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)

IAT             C:\Windows\Explorer.EXE[1784] @ C:\Windows\system32\kernel32.dll [ntdll.dll!NtDuplicateObject]                               [017D2CD0] C:\Windows\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)

IAT             C:\Program Files\Mozilla Firefox\firefox.exe[2108] @ C:\Windows\system32\kernel32.dll [ntdll.dll!NtCreateFile]               [00762F30] C:\Windows\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)

IAT             C:\Program Files\Mozilla Firefox\firefox.exe[2108] @ C:\Windows\system32\kernel32.dll [ntdll.dll!NtClose]                    [00762D00] C:\Windows\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)

IAT             C:\Program Files\Mozilla Firefox\firefox.exe[2108] @ C:\Windows\system32\kernel32.dll [ntdll.dll!NtDeviceIoControlFile]      [00762CA0] C:\Windows\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)

IAT             C:\Program Files\Mozilla Firefox\firefox.exe[2108] @ C:\Windows\system32\kernel32.dll [ntdll.dll!NtDuplicateObject]          [00762CD0] C:\Windows\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)

IAT             C:\Users\Arbeitsplatz\Desktop\1cwxh93y.exe[3788] @ C:\Windows\system32\kernel32.dll [ntdll.dll!NtCreateFile]                 [00242F30] C:\Windows\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)

IAT             C:\Users\Arbeitsplatz\Desktop\1cwxh93y.exe[3788] @ C:\Windows\system32\kernel32.dll [ntdll.dll!NtClose]                      [00242D00] C:\Windows\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)

IAT             C:\Users\Arbeitsplatz\Desktop\1cwxh93y.exe[3788] @ C:\Windows\system32\kernel32.dll [ntdll.dll!NtDeviceIoControlFile]        [00242CA0] C:\Windows\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)

IAT             C:\Users\Arbeitsplatz\Desktop\1cwxh93y.exe[3788] @ C:\Windows\system32\kernel32.dll [ntdll.dll!NtDuplicateObject]            [00242CD0] C:\Windows\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
 

---- Devices - GMER 1.0.15 ----
 

AttachedDevice  \Driver\kbdclass \Device\KeyboardClass0                                                                                      Wdf01000.sys (WDF Dynamic/Microsoft Corporation)
 

---- EOF - GMER 1.0.15 ----

--- --- ---

OSAM Logfile:

Code:

Report of OSAM: Autorun Manager v5.0.11926.0

hxxp://www.online-solutions.ru/en/

Saved at 23:21:10 on 06.12.2010
 

OS: Windows Vista Home Premium Edition Service Pack 2 (Build 6002), 32-bit

Default Browser: Mozilla Corporation Firefox 3.0.1
 

Scanner Settings

[x] Rootkits detection (hidden registry)

[x] Rootkits detection (hidden files)

[x] Retrieve files information

[x] Check Microsoft signatures
 

Filters

[ ] Trusted entries

[ ] Empty entries

[x] Hidden registry entries (rootkit activity)

[x] Exclusively opened files

[x] Not found files

[x] Files without detailed information

[x] Existing files

[ ] Non-startable services

[ ] Non-startable drivers

[x] Active entries

[x] Disabled entries
 
 

[Control Panel Objects]

-----( %SystemRoot%\system32 )-----

"QuickTime.cpl" - "Apple Computer, Inc." - C:\Windows\system32\QuickTime.cpl
 

[Drivers]

-----( HKLM\SYSTEM\CurrentControlSet\Services )-----

"avgio" (avgio) - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\avgio.sys

"avgntflt" (avgntflt) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avgntflt.sys

"avipbb" (avipbb) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avipbb.sys

"catchme" (catchme) - ? - C:\Users\ARBEIT~1\AppData\Local\Temp\catchme.sys  (File not found)

"fxryikob" (fxryikob) - ? - C:\Users\ARBEIT~1\AppData\Local\Temp\fxryikob.sys  (Hidden registry entry, rootkit activity | File not found)

"IP in IP Tunnel Driver" (IpInIp) - ? - C:\Windows\System32\DRIVERS\ipinip.sys  (File not found)

"IPX Traffic Filter Driver" (NwlnkFlt) - ? - C:\Windows\System32\DRIVERS\nwlnkflt.sys  (File not found)

"IPX Traffic Forwarder Driver" (NwlnkFwd) - ? - C:\Windows\System32\DRIVERS\nwlnkfwd.sys  (File not found)

"PxHelp20" (PxHelp20) - "Sonic Solutions" - C:\Windows\System32\Drivers\PxHelp20.sys

"ssmdrv" (ssmdrv) - "Avira GmbH" - C:\Windows\System32\DRIVERS\ssmdrv.sys
 

[Explorer]

-----( HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components )-----

{10880D85-AAD9-4558-ABDC-2AB1552D831F} "LightScribe Control Panel" - "Hewlett-Packard Company" - "C:\Program Files\Common Files\LightScribe\LSRunOnce.exe"

-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----

{F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll

-----( HKLM\Software\Classes\Protocols\Filter )-----

{807563E5-5146-11D5-A672-00B0D022E945} "Microsoft Office InfoPath XML Mime Filter" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL

-----( HKLM\Software\Classes\Protocols\Handler )-----

{9462A756-7B47-47BC-8C80-C34B9B80B32B} "BackWeb GA Pluggable Protocol" - "Logitech Inc." - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll

{314111c7-a502-11d2-bbca-00c04f8ec294} "HxProtocol Class" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll

{FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} "IEProtocolHandler Class" - "Skype Technologies" - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL

{0A9007C0-4076-11D3-8789-0000F8105754} "Microsoft Infotech Storage Protocol for IE 4.0" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks )-----

{AEB6717E-7E19-11d0-97EE-00C04FD91972} "{AEB6717E-7E19-11d0-97EE-00C04FD91972}" - ? -   (File not found | COM-object registry key not found)

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----

{911051fa-c21c-4246-b470-070cd8df6dc4} ".cab or .zip files" - ? -   (File not found | COM-object registry key not found)

{23170F69-40C1-278A-1000-000100020000} "7-Zip Shell Extension" - "Igor Pavlov" - C:\Program Files\7-Zip\7-zip.dll

{1b24a030-9b20-49bc-97ac-1be4426f9e59} "ActiveDirectory Folder" - ? -   (File not found | COM-object registry key not found)

{34449847-FD14-4fc8-A75A-7432F5181EFB} "ActiveDirectory Folder" - ? -   (File not found | COM-object registry key not found)

{0F8604A5-4ECE-4DE1-BA7D-CF10F8AA4F48} "Contacts folder" - ? -   (File not found | COM-object registry key not found)

{2C2577C2-63A7-40e3-9B7F-586602617ECB} "Explorer Query Band" - ? -   (File not found | COM-object registry key not found)

{00020d75-0000-0000-c000-000000000046} "lnkfile" - ? -   (File not found | COM-object registry key not found)

{42042206-2D85-11D3-8CFF-005004838597} "Microsoft Office HTML Icon Handler" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\OFFICE11\msohev.dll

{993BE281-6695-4BA5-8A2A-7AACBFAAB69E} "Microsoft Office Metadata Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll

{5858A72C-C2B4-4dd7-B2BF-B76DB1BD9F6C} "Microsoft Office OneNote Namespace Extension for Windows Desktop Search" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\Office12\ONFILTER.DLL

{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97} "Microsoft Office Thumbnail Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll

{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4} "RealOne Player Context Menu Class" - "RealNetworks, Inc." - C:\Program Files\Real\RealPlayer\rpshell.dll

{C8494E42-ACDD-4739-B0FB-217361E4894F} "Sam Account Folder" - ? -   (File not found | COM-object registry key not found)

{E29F9716-5C08-4FCD-955A-119FDB5A522D} "Sam Account Folder" - ? -   (File not found | COM-object registry key not found)

{45AC2688-0253-4ED8-97DE-B5370FA7D48A} "Shell Extension for Malware scanning" - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\shlext.dll

{7F67036B-66F1-411A-AD85-759FB9C5B0DB} "ShellViewRTF" - "XSS" - C:\Windows\System32\ShellvRTF.dll

{da67b8ad-e81b-4c70-9b91b417b5e33527} "Windows Search Shell Service" - ? -   (File not found | COM-object registry key not found)

{E0D79304-84BE-11CE-9641-444553540000} "WinZip" - "WinZip Computing, S.L." - C:\Program Files\WinZip\wzshlstb.dll

{E0D79305-84BE-11CE-9641-444553540000} "WinZip" - "WinZip Computing, S.L." - C:\Program Files\WinZip\wzshlstb.dll

{E0D79306-84BE-11CE-9641-444553540000} "WinZip" - "WinZip Computing, S.L." - C:\Program Files\WinZip\wzshlstb.dll

{E0D79307-84BE-11CE-9641-444553540000} "WinZip" - "WinZip Computing, S.L." - C:\Program Files\WinZip\wzshlstb.dll
 

[Internet Explorer]

-----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )-----

<binary data> "&Google Toolbar" - ? - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll  (File found, but it contains no detailed information)

<binary data> "ITBar7Layout" - ? -   (File not found | COM-object registry key not found)

-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----

{CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA} "Java Plug-in 1.6.0" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0-windows-i586.cab

{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} "Java Plug-in 1.6.0_03" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab

{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} "Java Plug-in 1.6.0_05" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab

{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} "Java Plug-in 1.6.0_07" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab

{8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.6.0_22" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab

{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} "Java Plug-in 1.6.0_22" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab

{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_22" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\npjpi160_22.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab

-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----

{48E73304-E1D6-4330-914C-F5F514E3486C} "An OneNote senden" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll

{FF059E31-CC5A-4E2E-BF3B-96E929D65503} "Research" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL

{77BF5300-1474-4EC7-9980-D32B190E9B07} "Skype" - "Skype Technologies S.A." - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll

-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar )-----

<binary data> "&Google Toolbar" - ? - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll  (File found, but it contains no detailed information)

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----

{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} "Adobe PDF Reader" - "Adobe Systems Incorporated" - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

{C84D72FE-E17D-4195-BB24-76C02E2E7C4E} "Google Dictionary Compression sdch" - "Google Inc." - C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll

{AA58ED58-01DD-4d91-8333-CF10577473F7} "Google Toolbar Helper" - ? - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll  (File found, but it contains no detailed information)

{AF69DE43-7D58-4638-B6FA-CE66B5AD205D} "Google Toolbar Notifier BHO" - "Google Inc." - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll

{DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2ssv.dll

{22BF413B-C6D2-4d91-82A9-A0F997BA588C} "Skype add-on (mastermind)" - "Skype Technologies S.A." - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
 

[Logon]

-----( %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup )-----

"desktop.ini" - ? - C:\Users\Arbeitsplatz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini

-----( %AllUsersProfile%\Microsoft\Windows\Start Menu\Programs\Startup )-----

"desktop.ini" - ? - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini

-----( HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\Wds\rdpwd )-----

"StartupPrograms" - ? - rdpclip  (File not found)

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----

"Adobe Reader Speed Launcher" - "Adobe Systems Incorporated" - "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"

"avgnt" - "Avira GmbH" - "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce )-----

"Launcher" - "soft thinks" - %WINDIR%\SMINST\launcher.exe
 

[Print Monitors]

-----( HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors )-----

"Send To Microsoft OneNote Monitor" - "Microsoft Corporation" - C:\Windows\system32\msonpmon.dll
 

[Services]

-----( HKLM\SYSTEM\CurrentControlSet\Services )-----

"@C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe,-100" (WPFFontCache_v0400) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe

"Avira AntiVir Guard" (AntiVirService) - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\avguard.exe

"Avira AntiVir MailGuard" (AntiVirMailService) - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\avmailc.exe

"Avira AntiVir Planer" (AntiVirSchedulerService) - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\sched.exe

"Avira AntiVir WebGuard" (AntiVirWebService) - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE

"CyberLink Background Capture Service (CBCS)" (CLCapSvc) - ? - C:\Program Files\HP\QuickPlay\Kernel\TV\CLCapSvc.exe

"CyberLink Task Scheduler (CTS)" (CLSched) - ? - C:\Program Files\HP\QuickPlay\Kernel\TV\CLSched.exe

"Google Updater Service" (gusvc) - "Google" - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

"HP Health Check Service" (HP Health Check Service) - "Hewlett-Packard" - C:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe

"hpqwmiex" (hpqwmiex) - "Hewlett-Packard Development Company, L.P." - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe

"InstallDriver Table Manager" (IDriverT) - "Macrovision Corporation" - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe

"LightScribeService Direct Disc Labeling Service" (LightScribeService) - "Hewlett-Packard Company" - C:\Program Files\Common Files\LightScribe\LSSrvc.exe

"LVCOMSer" (LVCOMSer) - "Logitech Inc." - C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe

"Microsoft .NET Framework NGEN v4.0.30319_X86" (clr_optimization_v4.0.30319_32) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

"Microsoft Office Diagnostics Service" (odserv) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE

"Office Source Engine" (ose) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE

"Process Monitor" (LVPrcSrv) - "Logitech Inc." - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe

"RoxMediaDB9" (RoxMediaDB9) - "Sonic Solutions" - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe

"stllssvr" (stllssvr) - "MicroVision Development, Inc." - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
 

[Winsock Providers]

-----( HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries )-----

"AVSDA" - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\avsda.dll
 

===[ Logfile end ]=========================================[ Logfile end ]===

--- --- ---

If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru

MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:
Windows Version: Windows Vista Home Premium Edition
Windows Information: Service Pack 2 (build 6002), 32-bit
Base Board Manufacturer: Quanta
BIOS Manufacturer: Hewlett-Packard
System Manufacturer: Hewlett-Packard
System Product Name: HP Pavilion dv6500 Notebook PC
Logical Drives Mask: 0x0000001c

Kernel Drivers (total 157):
0x81C3D000 \SystemRoot\system32\ntkrnlpa.exe
0x81C0A000 \SystemRoot\system32\hal.dll
0x80409000 \SystemRoot\system32\kdcom.dll
0x80410000 \SystemRoot\system32\PSHED.dll
0x80421000 \SystemRoot\system32\BOOTVID.dll
0x80429000 \SystemRoot\system32\CLFS.SYS
0x8046A000 \SystemRoot\system32\CI.dll
0x8054A000 \SystemRoot\system32\drivers\Wdf01000.sys
0x805C6000 \SystemRoot\system32\drivers\WDFLDR.SYS
0x8060B000 \SystemRoot\system32\drivers\acpi.sys
0x80651000 \SystemRoot\system32\drivers\WMILIB.SYS
0x8065A000 \SystemRoot\system32\drivers\msisadrv.sys
0x80662000 \SystemRoot\system32\drivers\pci.sys
0x80689000 \SystemRoot\System32\drivers\partmgr.sys
0x80698000 \SystemRoot\system32\DRIVERS\compbatt.sys
0x8069B000 \SystemRoot\system32\DRIVERS\BATTC.SYS
0x806A5000 \SystemRoot\system32\drivers\volmgr.sys
0x806B4000 \SystemRoot\System32\drivers\volmgrx.sys
0x806FE000 \SystemRoot\system32\drivers\pciide.sys
0x80705000 \SystemRoot\system32\drivers\PCIIDEX.SYS
0x80713000 \SystemRoot\System32\drivers\mountmgr.sys
0x80723000 \SystemRoot\system32\drivers\atapi.sys
0x8072B000 \SystemRoot\system32\drivers\ataport.SYS
0x80749000 \SystemRoot\system32\drivers\fltmgr.sys
0x8077B000 \SystemRoot\system32\drivers\fileinfo.sys
0x8078B000 \SystemRoot\System32\Drivers\PxHelp20.sys
0x8220C000 \SystemRoot\System32\Drivers\ksecdd.sys
0x8227D000 \SystemRoot\system32\drivers\ndis.sys
0x82388000 \SystemRoot\system32\drivers\msrpc.sys
0x823B3000 \SystemRoot\system32\drivers\NETIO.SYS
0x87602000 \SystemRoot\System32\drivers\tcpip.sys
0x876EC000 \SystemRoot\System32\drivers\fwpkclnt.sys
0x8780E000 \SystemRoot\System32\Drivers\Ntfs.sys
0x8791E000 \SystemRoot\system32\drivers\volsnap.sys
0x87957000 \SystemRoot\System32\Drivers\spldr.sys
0x8795F000 \SystemRoot\System32\Drivers\mup.sys
0x8796E000 \SystemRoot\System32\drivers\ecache.sys
0x87995000 \SystemRoot\system32\drivers\disk.sys
0x879A6000 \SystemRoot\system32\drivers\CLASSPNP.SYS
0x879C7000 \SystemRoot\system32\drivers\crcdisk.sys
0x879F0000 \SystemRoot\system32\DRIVERS\tunnel.sys
0x87800000 \SystemRoot\system32\DRIVERS\tunmp.sys
0x87707000 \SystemRoot\system32\DRIVERS\amdk8.sys
0x87809000 \SystemRoot\system32\DRIVERS\CmBatt.sys
0x879FB000 \SystemRoot\system32\DRIVERS\cpqbttn.sys
0x87717000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
0x87727000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
0x8772E000 \SystemRoot\system32\DRIVERS\wmiacpi.sys
0x87737000 \SystemRoot\system32\DRIVERS\nvsmu.sys
0x8773A000 \SystemRoot\system32\DRIVERS\usbohci.sys
0x87744000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
0x87782000 \SystemRoot\system32\DRIVERS\usbehci.sys
0x87791000 \SystemRoot\system32\DRIVERS\cdrom.sys
0x8B20F000 \SystemRoot\system32\DRIVERS\HDAudBus.sys
0x8B29C000 \SystemRoot\system32\DRIVERS\ohci1394.sys
0x8B2AC000 \SystemRoot\system32\DRIVERS\1394BUS.SYS
0x8B2BA000 \SystemRoot\system32\DRIVERS\sdbus.sys
0x8B2D4000 \SystemRoot\system32\DRIVERS\rimmptsk.sys
0x8B2E3000 \SystemRoot\system32\DRIVERS\rimsptsk.sys
0x8B2F7000 \SystemRoot\system32\DRIVERS\rixdptsk.sys
0x8B402000 \SystemRoot\system32\DRIVERS\nvmfdx32.sys
0x8B503000 \SystemRoot\system32\DRIVERS\bcmwl6.sys
0x8B60C000 \SystemRoot\system32\DRIVERS\nvlddmkm.sys
0x8BD4E000 \SystemRoot\System32\drivers\dxgkrnl.sys
0x8BDEF000 \SystemRoot\System32\drivers\watchdog.sys
0x8B589000 \SystemRoot\system32\DRIVERS\i8042prt.sys
0x8B600000 \SystemRoot\system32\DRIVERS\kbdclass.sys
0x8B59C000 \SystemRoot\system32\DRIVERS\SynTP.sys
0x8BDFB000 \SystemRoot\system32\DRIVERS\USBD.SYS
0x8B5C7000 \SystemRoot\system32\DRIVERS\mouclass.sys
0x8B348000 \SystemRoot\system32\DRIVERS\msiscsi.sys
0x8B377000 \SystemRoot\system32\DRIVERS\storport.sys
0x8B5D2000 \SystemRoot\system32\DRIVERS\TDI.SYS
0x8B5DD000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
0x8B5F4000 \SystemRoot\system32\DRIVERS\ndistapi.sys
0x8B3B8000 \SystemRoot\system32\DRIVERS\ndiswan.sys
0x8B3DB000 \SystemRoot\system32\DRIVERS\raspppoe.sys
0x8B3EA000 \SystemRoot\system32\DRIVERS\raspptp.sys
0x877A9000 \SystemRoot\system32\DRIVERS\rassstp.sys
0x877BE000 \SystemRoot\system32\DRIVERS\termdd.sys
0x8BDFD000 \SystemRoot\system32\DRIVERS\swenum.sys
0x877CE000 \SystemRoot\system32\DRIVERS\ks.sys
0x8B200000 \SystemRoot\system32\DRIVERS\mssmbios.sys
0x823EE000 \SystemRoot\system32\DRIVERS\umbus.sys
0x82200000 \SystemRoot\system32\DRIVERS\kbdhid.sys
0x80794000 \SystemRoot\system32\DRIVERS\usbhub.sys
0x807C9000 \SystemRoot\System32\Drivers\NDProxy.SYS
0x805D3000 \SystemRoot\system32\drivers\CHDART.sys
0x8C007000 \SystemRoot\system32\drivers\portcls.sys
0x8C034000 \SystemRoot\system32\drivers\drmk.sys
0x8C059000 \SystemRoot\system32\DRIVERS\HSXHWAZL.sys
0x8C096000 \SystemRoot\system32\DRIVERS\HSX_DPV.sys
0x8C203000 \SystemRoot\system32\DRIVERS\HSX_CNXT.sys
0x8C2B7000 \SystemRoot\system32\drivers\modem.sys
0x8C2D5000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
0x8C2DE000 \SystemRoot\System32\Drivers\Null.SYS
0x8C2E5000 \SystemRoot\System32\Drivers\Beep.SYS
0x8C2EC000 \SystemRoot\System32\drivers\vga.sys
0x8C2F8000 \SystemRoot\System32\drivers\VIDEOPRT.SYS
0x8C319000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0x8C321000 \SystemRoot\system32\drivers\rdpencdd.sys
0x8C329000 \SystemRoot\System32\Drivers\Msfs.SYS
0x8C334000 \SystemRoot\System32\Drivers\Npfs.SYS
0x8C342000 \SystemRoot\System32\DRIVERS\rasacd.sys
0x8C34B000 \SystemRoot\system32\DRIVERS\tdx.sys
0x8C361000 \SystemRoot\system32\DRIVERS\smb.sys
0x8C375000 \SystemRoot\system32\drivers\afd.sys
0x8C3BD000 \SystemRoot\System32\DRIVERS\netbt.sys
0x8C3EF000 \SystemRoot\system32\drivers\ws2ifsl.sys
0x8C199000 \SystemRoot\system32\DRIVERS\pacer.sys
0x8C1AF000 \SystemRoot\system32\DRIVERS\netbios.sys
0x8C3F8000 \SystemRoot\system32\DRIVERS\eabfiltr.sys
0x8C1BD000 \SystemRoot\system32\DRIVERS\wanarp.sys
0x8C3FA000 \SystemRoot\system32\DRIVERS\ssmdrv.sys
0x8C405000 \SystemRoot\system32\DRIVERS\rdbss.sys
0x8C441000 \SystemRoot\system32\drivers\nsiproxy.sys
0x8C44B000 \SystemRoot\System32\Drivers\dfsc.sys
0x8C462000 \SystemRoot\system32\DRIVERS\avipbb.sys
0x8C485000 \??\C:\Program Files\Avira\AntiVir Desktop\avgio.sys
0x8C487000 \SystemRoot\System32\Drivers\crashdmp.sys
0x8C494000 \SystemRoot\System32\Drivers\dump_dumpata.sys
0x8C49F000 \SystemRoot\System32\Drivers\dump_atapi.sys
0x94080000 \SystemRoot\System32\win32k.sys
0x8C4A7000 \SystemRoot\System32\drivers\Dxapi.sys
0x8C4B1000 \SystemRoot\system32\DRIVERS\monitor.sys
0x942A0000 \SystemRoot\System32\TSDDD.dll
0x942C0000 \SystemRoot\System32\cdd.dll
0x8C4C0000 \SystemRoot\system32\drivers\luafv.sys
0x8C4DB000 \SystemRoot\system32\DRIVERS\avgntflt.sys
0x8C501000 \SystemRoot\system32\drivers\spsys.sys
0x8C5B1000 \SystemRoot\system32\DRIVERS\lltdio.sys
0x8C5C1000 \SystemRoot\system32\DRIVERS\nwifi.sys
0x8C5EB000 \SystemRoot\system32\DRIVERS\ndisuio.sys
0x8C1D0000 \SystemRoot\system32\DRIVERS\rspndr.sys
0x9AE06000 \SystemRoot\system32\drivers\HTTP.sys
0x9AE73000 \SystemRoot\System32\DRIVERS\srvnet.sys
0x9AE90000 \SystemRoot\system32\DRIVERS\bowser.sys
0x9AEA9000 \SystemRoot\System32\drivers\mpsdrv.sys
0x9AEBE000 \SystemRoot\system32\drivers\mrxdav.sys
0x9AEDF000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
0x9AEFE000 \SystemRoot\system32\DRIVERS\mrxsmb10.sys
0x9AF37000 \SystemRoot\system32\DRIVERS\mrxsmb20.sys
0x9AF4F000 \SystemRoot\System32\DRIVERS\srv2.sys
0x9AF77000 \SystemRoot\System32\DRIVERS\srv.sys
0x9AFDD000 \SystemRoot\system32\DRIVERS\mdmxsdk.sys
0x9D003000 \SystemRoot\system32\drivers\peauth.sys
0x9D0E1000 \SystemRoot\System32\Drivers\secdrv.SYS
0x9D0EB000 \SystemRoot\System32\drivers\tcpipreg.sys
0x9D0F7000 \SystemRoot\system32\DRIVERS\xaudio.sys
0x9D0FF000 \SystemRoot\system32\DRIVERS\LVPr2Mon.sys
0x9D104000 \SystemRoot\system32\drivers\tdtcp.sys
0x9D10F000 \SystemRoot\System32\DRIVERS\tssecsrv.sys
0x9D11B000 \SystemRoot\System32\Drivers\RDPWD.SYS
0x9D14E000 \SystemRoot\system32\DRIVERS\cdfs.sys
0x9D164000 \SystemRoot\system32\DRIVERS\asyncmac.sys
0x9D177000 \??\C:\Users\ARBEIT~1\AppData\Local\Temp\fxryikob.sys
0x77B80000 \Windows\System32\ntdll.dll

Processes (total 51):
0 System Idle Process
4 System
400 C:\Windows\System32\smss.exe
468 csrss.exe
520 csrss.exe
528 C:\Windows\System32\wininit.exe
564 C:\Windows\System32\services.exe
580 C:\Windows\System32\lsass.exe
588 C:\Windows\System32\lsm.exe
640 C:\Windows\System32\winlogon.exe
792 C:\Windows\System32\svchost.exe
856 C:\Windows\System32\nvvsvc.exe
884 C:\Windows\System32\svchost.exe
936 C:\Windows\System32\svchost.exe
1024 C:\Windows\System32\svchost.exe
1052 C:\Windows\System32\svchost.exe
1068 C:\Windows\System32\svchost.exe
1188 C:\Windows\System32\audiodg.exe
1224 C:\Windows\System32\SLsvc.exe
1252 C:\Windows\System32\svchost.exe
1304 C:\Windows\System32\rundll32.exe
1500 C:\Windows\System32\svchost.exe
1736 C:\Windows\System32\dwm.exe
1784 C:\Windows\explorer.exe
1860 C:\Windows\System32\spoolsv.exe
1884 C:\Program Files\Avira\AntiVir Desktop\sched.exe
1892 C:\Windows\System32\taskeng.exe
1920 C:\Windows\System32\svchost.exe
780 C:\Program Files\Avira\AntiVir Desktop\avguard.exe
952 C:\Windows\System32\taskeng.exe
1180 C:\Program Files\HP\QuickPlay\Kernel\TV\CLCapSvc.exe
1476 C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
2156 C:\Program Files\Common Files\LightScribe\LSSrvc.exe
2192 C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
2208 C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
2244 C:\Windows\System32\svchost.exe
2316 C:\Windows\System32\svchost.exe
2340 C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
2424 C:\Windows\System32\svchost.exe
2548 C:\Windows\System32\SearchIndexer.exe
2596 C:\Windows\System32\drivers\XAudio.exe
2616 C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
3096 C:\Program Files\Avira\AntiVir Desktop\avmailc.exe
3108 C:\Program Files\Avira\AntiVir Desktop\avwebgrd.exe
1760 C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
1076 C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Service.exe
6140 C:\Program Files\Mozilla Firefox\firefox.exe
5332 C:\Program Files\Avira\AntiVir Desktop\avcenter.exe
5468 C:\Program Files\Windows Defender\MSASCui.exe
4104 C:\Users\Arbeitsplatz\Desktop\MBRCheck.exe
1400 C:\Windows\System32\conime.exe

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`00007e00 (NTFS)
\\.\D: --> \\.\PhysicalDrive0 at offset 0x00000023`602c5000 (NTFS)

PhysicalDrive0 Model Number: FUJITSUMHW2160BHPL, Rev: 891F

Size Device Name MBR Status
--------------------------------------------
149 GB \\.\PhysicalDrive0 Unknown MBR code
SHA1: D94F393960D1CD66C2071F2D7260A5196DF105AC

Found non-standard or infected MBR.
Enter 'Y' and hit ENTER for more options, or 'N' to exit:

Done!

Beste Grüße, Jens

:dankeschoen:

Zitat:

149 GB \\.\PhysicalDrive0 Unknown MBR code
SHA1: D94F393960D1CD66C2071F2D7260A5196DF105AC

Hast Du noch andere Betriebssysteme außer Vista installiert?

Wenn nicht: Schau mal hier => Vista Notfall/Recovery-CD 32-Bit - Dr. Windows

Lad das iso runter, brenn es zB mit ImgBurn per Imagebrennfunktion auf eine CD und starte damit den Rechner (von dieser CD booten).

Falls Du eine normale Vista-Installations-DVD hast, brauchst Du das o.g. Image nicht sondern kannst einfach von der Vista-DVD booten.

Klick auf Computerreparaturoptionen, weiter, Eingabeaufforderung - die Konsole öffnet sich. Da bitte bootrec.exe /fixboot eintippen (mit enter bestätigen), dann bootrec.exe /fixmbr eintippen (mit enter bestätigen) - Rechner neustarten, CD vorher rausnehmen.

Hallo Arne,

ich habe alles genauso gemacht. Irgendwie ist der Laptop nun schneller. Kann das sein? Wäre ja super:applaus:!

Erstmal möchte ich dir ein kleines Zwischen-"Danke" aussprechen. Ich habe noch nie so leicht extrem komplexe - für mich - Programme ausgeführt. Ganz großes Lob an dich!

Wie geht es nun weiter?

Beste Grüße, Jens

Wenn der MBR gefixt ist bitte zur Kontrolle ein neues Log mit mbrcheck machen :)

Hallo Arne,

hier der log. Ich glaube, dass ich da eventuell etwas mit dem Fix falsch gemacht habe.

MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:
Windows Version: Windows Vista Home Premium Edition
Windows Information: Service Pack 2 (build 6002), 32-bit
Base Board Manufacturer: Quanta
BIOS Manufacturer: Hewlett-Packard
System Manufacturer: Hewlett-Packard
System Product Name: HP Pavilion dv6500 Notebook PC
Logical Drives Mask: 0x0000001c

Kernel Drivers (total 155):
0x81C18000 \SystemRoot\system32\ntkrnlpa.exe
0x81FD1000 \SystemRoot\system32\hal.dll
0x80401000 \SystemRoot\system32\kdcom.dll
0x80408000 \SystemRoot\system32\PSHED.dll
0x80419000 \SystemRoot\system32\BOOTVID.dll
0x80421000 \SystemRoot\system32\CLFS.SYS
0x80462000 \SystemRoot\system32\CI.dll
0x80542000 \SystemRoot\system32\drivers\Wdf01000.sys
0x805BE000 \SystemRoot\system32\drivers\WDFLDR.SYS
0x80601000 \SystemRoot\system32\drivers\acpi.sys
0x80647000 \SystemRoot\system32\drivers\WMILIB.SYS
0x80650000 \SystemRoot\system32\drivers\msisadrv.sys
0x80658000 \SystemRoot\system32\drivers\pci.sys
0x8067F000 \SystemRoot\System32\drivers\partmgr.sys
0x8068E000 \SystemRoot\system32\DRIVERS\compbatt.sys
0x80691000 \SystemRoot\system32\DRIVERS\BATTC.SYS
0x8069B000 \SystemRoot\system32\drivers\volmgr.sys
0x806AA000 \SystemRoot\System32\drivers\volmgrx.sys
0x806F4000 \SystemRoot\system32\drivers\pciide.sys
0x806FB000 \SystemRoot\system32\drivers\PCIIDEX.SYS
0x80709000 \SystemRoot\System32\drivers\mountmgr.sys
0x80719000 \SystemRoot\system32\drivers\atapi.sys
0x80721000 \SystemRoot\system32\drivers\ataport.SYS
0x8073F000 \SystemRoot\system32\drivers\fltmgr.sys
0x80771000 \SystemRoot\system32\drivers\fileinfo.sys
0x80781000 \SystemRoot\System32\Drivers\PxHelp20.sys
0x8078A000 \SystemRoot\System32\Drivers\ksecdd.sys
0x82203000 \SystemRoot\system32\drivers\ndis.sys
0x8230E000 \SystemRoot\system32\drivers\msrpc.sys
0x82339000 \SystemRoot\system32\drivers\NETIO.SYS
0x8760A000 \SystemRoot\System32\drivers\tcpip.sys
0x876F4000 \SystemRoot\System32\drivers\fwpkclnt.sys
0x87804000 \SystemRoot\System32\Drivers\Ntfs.sys
0x87914000 \SystemRoot\system32\drivers\volsnap.sys
0x8794D000 \SystemRoot\System32\Drivers\spldr.sys
0x87955000 \SystemRoot\System32\Drivers\mup.sys
0x87964000 \SystemRoot\System32\drivers\ecache.sys
0x8798B000 \SystemRoot\system32\drivers\disk.sys
0x8799C000 \SystemRoot\system32\drivers\CLASSPNP.SYS
0x879BD000 \SystemRoot\system32\drivers\crcdisk.sys
0x879E6000 \SystemRoot\system32\DRIVERS\tunnel.sys
0x879F1000 \SystemRoot\system32\DRIVERS\tunmp.sys
0x8770F000 \SystemRoot\system32\DRIVERS\amdk8.sys
0x879FA000 \SystemRoot\system32\DRIVERS\CmBatt.sys
0x87800000 \SystemRoot\system32\DRIVERS\cpqbttn.sys
0x8771F000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
0x8772F000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
0x87736000 \SystemRoot\system32\DRIVERS\wmiacpi.sys
0x8773F000 \SystemRoot\system32\DRIVERS\nvsmu.sys
0x87742000 \SystemRoot\system32\DRIVERS\usbohci.sys
0x8774C000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
0x8778A000 \SystemRoot\system32\DRIVERS\usbehci.sys
0x87799000 \SystemRoot\system32\DRIVERS\cdrom.sys
0x8AE04000 \SystemRoot\system32\DRIVERS\HDAudBus.sys
0x8AE91000 \SystemRoot\system32\DRIVERS\ohci1394.sys
0x8AEA1000 \SystemRoot\system32\DRIVERS\1394BUS.SYS
0x8AEAF000 \SystemRoot\system32\DRIVERS\sdbus.sys
0x8AEC9000 \SystemRoot\system32\DRIVERS\rimmptsk.sys
0x8AED8000 \SystemRoot\system32\DRIVERS\rimsptsk.sys
0x8AEEC000 \SystemRoot\system32\DRIVERS\rixdptsk.sys
0x8B40F000 \SystemRoot\system32\DRIVERS\nvmfdx32.sys
0x8B510000 \SystemRoot\system32\DRIVERS\bcmwl6.sys
0x8B607000 \SystemRoot\system32\DRIVERS\nvlddmkm.sys
0x8BD49000 \SystemRoot\System32\drivers\dxgkrnl.sys
0x8BDEA000 \SystemRoot\System32\drivers\watchdog.sys
0x8B596000 \SystemRoot\system32\DRIVERS\i8042prt.sys
0x8B5A9000 \SystemRoot\system32\DRIVERS\kbdclass.sys
0x8B5B4000 \SystemRoot\system32\DRIVERS\SynTP.sys
0x8BDF6000 \SystemRoot\system32\DRIVERS\USBD.SYS
0x8B5DF000 \SystemRoot\system32\DRIVERS\mouclass.sys
0x8AF3D000 \SystemRoot\system32\DRIVERS\msiscsi.sys
0x8AF6C000 \SystemRoot\system32\DRIVERS\storport.sys
0x8B5EA000 \SystemRoot\system32\DRIVERS\TDI.SYS
0x8AFAD000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
0x8B5F5000 \SystemRoot\system32\DRIVERS\ndistapi.sys
0x8AFC4000 \SystemRoot\system32\DRIVERS\ndiswan.sys
0x8B400000 \SystemRoot\system32\DRIVERS\raspppoe.sys
0x8AFE7000 \SystemRoot\system32\DRIVERS\raspptp.sys
0x877B1000 \SystemRoot\system32\DRIVERS\rassstp.sys
0x877C6000 \SystemRoot\system32\DRIVERS\termdd.sys
0x8BDF8000 \SystemRoot\system32\DRIVERS\swenum.sys
0x877D6000 \SystemRoot\system32\DRIVERS\ks.sys
0x87600000 \SystemRoot\system32\DRIVERS\mssmbios.sys
0x82374000 \SystemRoot\system32\DRIVERS\umbus.sys
0x82381000 \SystemRoot\system32\DRIVERS\kbdhid.sys
0x8238A000 \SystemRoot\system32\DRIVERS\usbhub.sys
0x823BF000 \SystemRoot\System32\Drivers\NDProxy.SYS
0x805CB000 \SystemRoot\system32\drivers\CHDART.sys
0x8BE00000 \SystemRoot\system32\drivers\portcls.sys
0x8BE2D000 \SystemRoot\system32\drivers\drmk.sys
0x8BE52000 \SystemRoot\system32\DRIVERS\HSXHWAZL.sys
0x8BE8F000 \SystemRoot\system32\DRIVERS\HSX_DPV.sys
0x8C206000 \SystemRoot\system32\DRIVERS\HSX_CNXT.sys
0x8C2BA000 \SystemRoot\system32\drivers\modem.sys
0x8C2C7000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
0x8C2D0000 \SystemRoot\System32\Drivers\Null.SYS
0x8C2D7000 \SystemRoot\System32\Drivers\Beep.SYS
0x8C2DE000 \SystemRoot\System32\drivers\vga.sys
0x8C2EA000 \SystemRoot\System32\drivers\VIDEOPRT.SYS
0x8C30B000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0x8C313000 \SystemRoot\system32\drivers\rdpencdd.sys
0x8C31B000 \SystemRoot\System32\Drivers\Msfs.SYS
0x8C326000 \SystemRoot\System32\Drivers\Npfs.SYS
0x8C334000 \SystemRoot\System32\DRIVERS\rasacd.sys
0x8C33D000 \SystemRoot\system32\DRIVERS\tdx.sys
0x8C353000 \SystemRoot\system32\DRIVERS\smb.sys
0x8C367000 \SystemRoot\system32\drivers\afd.sys
0x8C3AF000 \SystemRoot\System32\DRIVERS\netbt.sys
0x8C3E1000 \SystemRoot\system32\drivers\ws2ifsl.sys
0x8C3EA000 \SystemRoot\system32\DRIVERS\pacer.sys
0x8BF92000 \SystemRoot\system32\DRIVERS\netbios.sys
0x8C200000 \SystemRoot\system32\DRIVERS\eabfiltr.sys
0x8BFA0000 \SystemRoot\system32\DRIVERS\wanarp.sys
0x8BFB3000 \SystemRoot\system32\DRIVERS\ssmdrv.sys
0x8BFB9000 \SystemRoot\system32\DRIVERS\rdbss.sys
0x8BFF5000 \SystemRoot\system32\drivers\nsiproxy.sys
0x823D9000 \SystemRoot\System32\Drivers\dfsc.sys
0x8C403000 \SystemRoot\system32\DRIVERS\avipbb.sys
0x8C426000 \??\C:\Program Files\Avira\AntiVir Desktop\avgio.sys
0x8C428000 \SystemRoot\System32\Drivers\crashdmp.sys
0x8C435000 \SystemRoot\System32\Drivers\dump_dumpata.sys
0x8C440000 \SystemRoot\System32\Drivers\dump_atapi.sys
0x93CB0000 \SystemRoot\System32\win32k.sys
0x8C448000 \SystemRoot\System32\drivers\Dxapi.sys
0x8C452000 \SystemRoot\system32\DRIVERS\monitor.sys
0x93ED0000 \SystemRoot\System32\TSDDD.dll
0x93EF0000 \SystemRoot\System32\cdd.dll
0x8C461000 \SystemRoot\system32\drivers\luafv.sys
0x8C47C000 \SystemRoot\system32\DRIVERS\avgntflt.sys
0x8C4A2000 \SystemRoot\system32\drivers\spsys.sys
0x8C552000 \SystemRoot\system32\DRIVERS\lltdio.sys
0x8C562000 \SystemRoot\system32\DRIVERS\nwifi.sys
0x8C58C000 \SystemRoot\system32\DRIVERS\ndisuio.sys
0x8C596000 \SystemRoot\system32\DRIVERS\rspndr.sys
0x9A80F000 \SystemRoot\system32\drivers\HTTP.sys
0x9A87C000 \SystemRoot\System32\DRIVERS\srvnet.sys
0x9A899000 \SystemRoot\system32\DRIVERS\bowser.sys
0x9A8B2000 \SystemRoot\System32\drivers\mpsdrv.sys
0x9A8C7000 \SystemRoot\system32\drivers\mrxdav.sys
0x9A8E8000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
0x9A907000 \SystemRoot\system32\DRIVERS\mrxsmb10.sys
0x9A940000 \SystemRoot\system32\DRIVERS\mrxsmb20.sys
0x9A958000 \SystemRoot\System32\DRIVERS\srv2.sys
0x9A980000 \SystemRoot\System32\DRIVERS\srv.sys
0x9A9E6000 \SystemRoot\system32\DRIVERS\mdmxsdk.sys
0x9CE09000 \SystemRoot\system32\drivers\peauth.sys
0x9CEE7000 \SystemRoot\System32\Drivers\secdrv.SYS
0x9CEF1000 \SystemRoot\System32\drivers\tcpipreg.sys
0x9CEFD000 \SystemRoot\system32\DRIVERS\xaudio.sys
0x9CF05000 \SystemRoot\system32\DRIVERS\LVPr2Mon.sys
0x9CF0A000 \SystemRoot\system32\drivers\tdtcp.sys
0x9CF15000 \SystemRoot\System32\DRIVERS\tssecsrv.sys
0x9CF21000 \SystemRoot\System32\Drivers\RDPWD.SYS
0x9CF54000 \SystemRoot\system32\DRIVERS\cdfs.sys
0x77AA0000 \Windows\System32\ntdll.dll

Processes (total 49):
0 System Idle Process
4 System
400 C:\Windows\System32\smss.exe
468 csrss.exe
520 C:\Windows\System32\wininit.exe
532 csrss.exe
564 C:\Windows\System32\services.exe
584 C:\Windows\System32\lsass.exe
592 C:\Windows\System32\lsm.exe
668 C:\Windows\System32\winlogon.exe
776 C:\Windows\System32\svchost.exe
844 C:\Windows\System32\nvvsvc.exe
872 C:\Windows\System32\svchost.exe
908 C:\Windows\System32\svchost.exe
1008 C:\Windows\System32\svchost.exe
1076 C:\Windows\System32\svchost.exe
1124 C:\Windows\System32\svchost.exe
1176 C:\Windows\System32\audiodg.exe
1212 C:\Windows\System32\SLsvc.exe
1236 C:\Windows\System32\svchost.exe
1360 C:\Windows\System32\rundll32.exe
1388 C:\Windows\System32\svchost.exe
1732 C:\Windows\System32\spoolsv.exe
1788 C:\Windows\System32\dwm.exe
1828 C:\Windows\explorer.exe
1876 C:\Program Files\Avira\AntiVir Desktop\sched.exe
1884 C:\Windows\System32\taskeng.exe
1896 C:\Windows\System32\svchost.exe
512 C:\Program Files\Avira\AntiVir Desktop\avguard.exe
1144 C:\Program Files\HP\QuickPlay\Kernel\TV\CLCapSvc.exe
1472 C:\Windows\System32\taskeng.exe
1552 C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
656 C:\Program Files\Common Files\LightScribe\LSSrvc.exe
964 C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
2076 C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
2120 C:\Windows\System32\svchost.exe
2144 C:\Windows\System32\svchost.exe
2204 C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
2336 C:\Windows\System32\svchost.exe
2408 C:\Windows\System32\SearchIndexer.exe
2468 C:\Windows\System32\drivers\XAudio.exe
2492 C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
2900 C:\Program Files\Avira\AntiVir Desktop\avmailc.exe
2912 C:\Program Files\Avira\AntiVir Desktop\avwebgrd.exe
3952 C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
2528 C:\Program Files\Mozilla Firefox\firefox.exe
3800 C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Service.exe
1980 C:\Users\Arbeitsplatz\Desktop\MBRCheck.exe
2324 C:\Windows\System32\conime.exe

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`00007e00 (NTFS)
\\.\D: --> \\.\PhysicalDrive0 at offset 0x00000023`602c5000 (NTFS)

PhysicalDrive0 Model Number: FUJITSUMHW2160BHPL, Rev: 891F

Size Device Name MBR Status
--------------------------------------------
149 GB \\.\PhysicalDrive0 Windows 2008 MBR code detected
SHA1: 8DF43F2BDE2D9451948FA14B5279969C777A7979

Done!

Grüße, Jens

Sieht ok aus. Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SASW und poste die Logs.
Denk dran beide Tools zu updaten vor dem Scan!!