Trojaner-Board
Seite 2 von 3 1 2 3
100 Beiträge dieses Themas auf einer Seite anzeigen

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   Sicherheitscenter deaktiviert (https://www.trojaner-board.de/95335-sicherheitscenter-deaktiviert.html)

Petersl 08.02.2011 20:42
Antivir deinstalliert, 2x neugestartet, nicht mehr in tasklleiste.
Trotzdem sagt combofix, dass noch die Real-Time-Scanner antivirus: AntiVir Desktop und antispyware: AntiVir Desktop aktiv sind!
Was tun?
Peter

cosinus 08.02.2011 21:14
Hinweis von CF ignorieren, ist ein kleiner Bug, da AntiVir noch im Sicherheitscenter drin ist, bei der Deinstallation AntiVir dies aber nicht abmeldet. ;)

Petersl 08.02.2011 23:54
so, hier der combofix-log als zip-Datei angehängt:

wie geht's weiter?
Gruß,
Peter

cosinus 09.02.2011 11:04
Combofix - Scripten

1. Starte das Notepad (Start / Ausführen / notepad[Enter])

2. Jetzt füge mit copy/paste den ganzen Inhalt der untenstehenden Codebox in das Notepad Fenster ein.

Code:
Dirlook::
c:\windows\system32\x64

Filelook::
c:\temp\remove\RectorDecryptor.exe
3. Speichere im Notepad als CFScript.txt auf dem Desktop.

4. Deaktivere den Guard Deines Antivirenprogramms und eine eventuell vorhandene Software Firewall.
(Auch Guards von Ad-, Spyware Programmen und den Tea Timer (wenn vorhanden) !)

5. Dann ziehe die CFScript.txt auf die cofi.exe, so wie es im unteren Bild zu sehen ist. Damit wird Combofix neu gestartet.

http://users.pandora.be/bluepatchy/m...s/CFScript.gif

6. Nach dem Neustart (es wird gefragt ob Du neustarten willst), poste bitte die folgenden Log Dateien:
Combofix.txt

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!

Petersl 09.02.2011 15:55
ComboFix Script ausgeführt

Anmerkungen:
Beim Start von ComboFix meldete das Programm weiterhin zwei aktive Realtimescanne (AntiVir Dektop).
Das Sicherheitscenter läßt sich - auch nach Reboot- noch immer nicht aktivieren.
Hier ist der 2. log:

Combofix Logfile:
Code:
ComboFix 11-02-08.03 - Peter3 09.02.2011  15:05:52.2.2 - x86
Microsoft Windows 7 Home Premium  6.1.7600.0.1252.49.1031.18.3005.2297 [GMT 1:00]
ausgeführt von:: c:\users\Peter3\Desktop\cofi.exe
Benutzte Befehlsschalter :: c:\users\Peter3\Desktop\CFScript.txt
AV: AntiVir Desktop *Enabled/Updated* {090F9C29-64CE-6C6F-379C-5901B49A85B7}
SP: AntiVir Desktop *Enabled/Updated* {B26E7DCD-42F4-63E1-0D2C-6273CF1DCF0A}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.

(((((((((((((((((((((((  Dateien erstellt von 2011-01-09 bis 2011-02-09  ))))))))))))))))))))))))))))))
.

2011-02-09 14:11 . 2011-02-09 14:11        --------        d-----w-        c:\users\V&M\AppData\Local\temp
2011-02-09 14:11 . 2011-02-09 14:11        --------        d-----w-        c:\users\Steffi\AppData\Local\temp
2011-02-09 14:11 . 2011-02-09 14:11        --------        d-----w-        c:\users\Default\AppData\Local\temp
2011-02-08 20:44 . 2011-02-09 14:11        --------        d-----w-        c:\users\Peter3\AppData\Local\temp
2011-02-08 17:28 . 2011-02-08 17:28        --------        d-----w-        c:\program files\CCleaner
2011-02-08 15:44 . 2011-02-08 15:44        --------        d-----w-        C:\_OTL
2011-02-04 22:43 . 2011-02-04 22:43        --------        d-----w-        c:\users\Peter3\AppData\Roaming\Malwarebytes
2011-02-04 22:43 . 2010-12-20 17:09        38224        ----a-w-        c:\windows\system32\drivers\mbamswissarmy.sys
2011-02-04 22:43 . 2011-02-04 22:43        --------        d-----w-        c:\program files\Malwarebytes' Anti-Malware
2011-02-04 22:43 . 2010-12-20 17:08        20952        ----a-w-        c:\windows\system32\drivers\mbam.sys
2011-02-02 19:56 . 2011-02-02 19:57        --------        d-----w-        c:\program files\ERUNT
2011-01-28 16:47 . 2011-01-28 16:47        --------        d-----w-        c:\windows\system32\x64
2011-01-24 09:43 . 2011-01-24 09:43        229200        ----a-w-        c:\temp\remove\RectorDecryptor.exe
2011-01-19 22:46 . 2011-01-19 22:46        --------        d-----w-        c:\users\Peter3\AppData\Roaming\GRETECH
2011-01-19 22:44 . 2011-01-19 22:44        --------        d-----w-        c:\program files\GRETECH
2011-01-16 20:22 . 2011-01-16 20:22        --------        d-----w-        c:\users\Steffi\AppData\Roaming\Malwarebytes
2011-01-16 01:31 . 2011-01-16 01:31        --------        d-----w-        c:\users\Peter3\AppData\Roaming\Malwarebytes-x
2011-01-15 22:22 . 2009-10-10 02:57        12800        ----a-w-        c:\windows\system32\drivers\sffp_sd.sys
2011-01-15 22:22 . 2009-10-10 02:31        84992        ----a-w-        c:\windows\system32\drivers\sdbus.sys
2011-01-15 21:38 . 2011-01-15 21:38        --------        d-----w-        c:\program files\Safer Networking
2011-01-15 11:40 . 2011-01-15 11:40        --------        d-----w-        c:\users\Steffi\AppData\Roaming\ImgBurn
2011-01-12 06:52 . 2010-10-16 04:34        573440        ----a-w-        c:\windows\system32\odbc32.dll
2011-01-12 06:52 . 2010-10-16 04:33        987136        ----a-w-        c:\program files\Common Files\System\ado\msado15.dll
2011-01-12 06:52 . 2010-10-16 04:33        372736        ----a-w-        c:\program files\Common Files\System\ado\msadox.dll
2011-01-12 06:52 . 2010-10-16 04:33        352256        ----a-w-        c:\program files\Common Files\System\ado\msadomd.dll
2011-01-12 06:52 . 2010-10-16 04:33        208896        ----a-w-        c:\program files\Common Files\System\msadc\msadco.dll
2011-01-12 01:05 . 2011-01-12 01:05        120832        --sha-r-        c:\windows\system32\ndishcm.dll
2011-01-11 21:31 . 2011-01-11 21:32        --------        d-----w-        c:\users\Peter3\Datenrettung
2011-01-11 21:27 . 2011-01-11 21:27        --------        d-----w-        c:\users\Steffi\AppData\Roaming\ThumbsPlus
2011-01-11 21:25 . 2011-01-11 21:25        --------        d-----w-        c:\users\Steffi\AppData\Local\Apple Computer

.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-12-22 10:59 . 2010-12-14 23:59        420920        ----a-w-        c:\windows\system32\drivers\sptd.sys
2010-12-09 22:55 . 2010-12-09 22:55        6113        ----a-w-        c:\users\Peter3\AppData\Roaming\mdbu.bin
2010-11-29 16:38 . 2010-11-29 16:38        94208        ----a-w-        c:\windows\system32\QuickTimeVR.qtx
2010-11-29 16:38 . 2010-11-29 16:38        69632        ----a-w-        c:\windows\system32\QuickTime.qts
.

((((((((((((((((((((((((((((((((((((((((((((  Look  )))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.

--- c:\temp\remove\RectorDecryptor.exe ---
Company: Kaspersky Lab ZAO
File Description: Trojan-Ransom.Win32.Rector decryptor tool
File Version: 2.3.5.0
Product Name: RectorDecryptor
Copyright: © 1997-2011 Kaspersky Lab ZAO.
Original Filename: RectorDecryptor.exe
File size: 229200
Created time: 2011-01-24 09:43
Modified time: 2011-01-24 09:43
MD5: F69AD3370F2C3C8FD823AB4667553878
SHA1: FE1C4DED61BA7CD1AF2CC52EEDA2DBC26393C825

---- Directory of c:\windows\system32\x64 ----



((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
2010-05-21 11:17        1233288        ----a-w-        c:\program files\Ask.com\GenericAskToolbar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-05-21 1233288]

[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-05-21 1233288]

[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-07-14 1173504]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HotkeyApp"="c:\program files\Launch Manager\HotkeyApp.exe" [2009-08-19 192000]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2010-08-25 136216]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2010-08-25 171032]
"Persistence"="c:\windows\system32\igfxpers.exe" [2010-08-25 170520]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Microsoft Office.lnk.disabled [2010-12-19 1972]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"mixer"=wdmaud.drv

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"DAEMON Tools Pro Agent"="c:\program files\DAEMON Tools Pro\DTAgent.exe" -autorun
"Sidebar"=c:\program files\Windows Sidebar\sidebar.exe /autoRun
"Gadwin PrintScreen"=c:\program files\1\System\PrintScreen\PrintScreen.exe /nosplash

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"Adobe Photo Downloader"="c:\program files\1\Multimedia\Bild, Foto\Photoshop Elements 6.0\apdproxy.exe"
"Wbutton"="c:\program files\Launch Manager\Wbutton.exe"
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" -atboottime
"Persistence"=c:\windows\system32\igfxpers.exe
"PDVD9LanguageShortcut"="c:\program files\CyberLink\PowerDVD9\Language\Language.exe"
"NeroFilterCheck"=c:\windows\system32\NeroCheck.exe
"MDS_Menu"="c:\program files\CyberLink\MediaShow4\MUITransfer\MUIStartMenu.exe" "c:\program files\CyberLink\MediaShow4" UpdateWithCreateOnce "Software\CyberLink\MediaShow\4.1"
"Malwarebytes' Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
"LMgrVolOSD"="c:\program files\Launch Manager\OSD.exe"
"LMgrOSD"="c:\program files\Launch Manager\OSDCtrl.exe"
"iTunesHelper"="c:\program files\1\iPod, iTunes\iTunes\iTunesHelper.exe"
"IgfxTray"=c:\windows\system32\igfxtray.exe
"IAAnotif"=c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe
"HotKeysCmds"=c:\windows\system32\hkcmd.exe
"fspuip"="c:\program files\FSP\fspuip.exe"
"CLMLServer"="c:\program files\CyberLink\Power2Go\CLMLSvc.exe"
"SysTrayApp"=%ProgramFiles%\IDT\WDM\sttray.exe
"UCam_Menu"="c:\program files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" "c:\program files\CyberLink\YouCam" UpdateWithCreateOnce "Software\CyberLink\YouCam\3.0"

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R3 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance;c:\program files\Common Files\MAGIX Services\Database\bin\fbserver.exe [2008-08-07 3276800]
R3 NxpCap;CTX capture service;c:\windows\system32\DRIVERS\NxpCap.sys [2009-07-30 1488096]
R4 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2010-12-22 420920]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-13 48128]
S2 Fabs;FABS - Helping agent for MAGIX media database;c:\program files\Common Files\MAGIX Services\Database\bin\FABS.exe [2009-02-03 1155072]
S2 NAUpdate;Nero Update;c:\program files\Nero\Update\NASvc.exe [2010-05-04 503080]
S3 fspad_wlh32;Finger Sensing Pad Driver for Windows 2000/XP/Vista/Win7_wlh32;c:\windows\system32\DRIVERS\fspad_wlh32.sys [2009-11-12 42496]
S3 IntcHdmiAddService;Intel(R) High Definition Audio HDMI;c:\windows\system32\drivers\IntcHdmi.sys [2009-07-10 122880]
S3 JMCR;JMCR;c:\windows\system32\DRIVERS\jmcr.sys [2009-07-20 116136]
S3 rtl8192se;Realtek Wireless LAN 802.11n PCI-E NIC NT Driver;c:\windows\system32\DRIVERS\rtl8192se.sys [2010-04-01 1009184]
S3 WisLMSvc;WisLMSvc;c:\program files\Launch Manager\WisLMSvc.exe [2009-03-04 113152]
S3 X10Hid;X10 Hid Device;c:\windows\System32\Drivers\x10hid.sys [2009-05-13 13720]
S3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x86.sys [2009-09-28 315392]

.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.aldi.com
uInternet Settings,ProxyOverride = *.local
IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
IE: {{0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - hxxp://rover.ebay.com/rover/1/707-37276-17534-25/4
FF - ProfilePath - c:\users\Peter3\AppData\Roaming\Mozilla\Firefox\Profiles\ed9aqaaa.default\
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla\Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: NoScript: {73a6fe31-595d-460b-a920-fcc0f8843232} - %profile%\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}
FF - Ext: Adblock Plus: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} - %profile%\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2011-02-09  15:12:39
ComboFix-quarantined-files.txt  2011-02-09 14:12
ComboFix2.txt  2011-02-08 20:50

Vor Suchlauf: 3.658.649.600 Bytes frei
Nach Suchlauf: 3.599.466.496 Bytes frei

- - End Of File - - 17C501682C7C2AA3D233A31B4C823E8E
--- --- ---
-------------------------------------------------------
Gruß,
Peter

cosinus 09.02.2011 16:12
Ok. Bitte nun Logs mit GMER und OSAM erstellen und posten.
GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus - die Online-Abfrage durch OSAM bitte überspringen.
Bei OSAM bitte darauf auch achten, dass Du das Log auch als *.log und nicht *.html oder so abspeicherst.


Downloade Dir danach bitte MBRCheck (by a_d_13) und speichere die Datei auf dem Desktop.
  • Doppelklick auf die MBRCheck.exe.
    Vista und Win7 User mit Rechtsklick "als Administrator starten"
  • Das Tool braucht nur wenige Sekunden.
  • Danach solltest du eine MBRCheck_<Datum>_<Uhrzeit>.txt auf dem Desktop finden.
Poste mir bitte den Inhalt des .txt Dokumentes

Petersl 09.02.2011 18:09
jetzt die logs
gmer:
GMER Logfile:
Code:
GMER 1.0.15.15530 - hxxp://www.gmer.net
Rootkit scan 2011-02-09 17:36:02
Windows 6.1.7600  Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 WDC_WD50 rev.01.0
Running: u7xo34y3.exe; Driver: C:\Users\Peter3\AppData\Local\Temp\fxlyykog.sys


---- Kernel code sections - GMER 1.0.15 ----

.text          ntkrnlpa.exe!ZwSaveKeyEx + 13BD                                                                                    8328E589 1 Byte  [06]
.text          ntkrnlpa.exe!KiDispatchInterrupt + 5A2                                                                              832B3092 19 Bytes  [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3}

---- User IAT/EAT - GMER 1.0.15 ----

IAT            C:\Windows\system32\rundll32.exe[1584] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!GetProcAddress]              [75595E25] C:\Windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)
IAT            C:\Windows\system32\rundll32.exe[1584] @ C:\Windows\system32\GDI32.dll [KERNEL32.dll!GetProcAddress]                [75595E25] C:\Windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)
IAT            C:\Windows\system32\rundll32.exe[1584] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!GetProcAddress]              [75595E25] C:\Windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)
IAT            C:\Windows\system32\rundll32.exe[1584] @ C:\Windows\system32\ADVAPI32.dll [KERNEL32.dll!GetProcAddress]            [75595E25] C:\Windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)
IAT            C:\Windows\system32\rundll32.exe[1584] @ C:\Windows\system32\WININET.dll [KERNEL32.dll!GetProcAddress]              [75595E25] C:\Windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)
IAT            C:\Windows\system32\rundll32.exe[1584] @ C:\Windows\system32\CRYPT32.dll [KERNEL32.dll!GetProcAddress]              [75595E25] C:\Windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)

---- Devices - GMER 1.0.15 ----

Device          \Driver\ACPI_HAL \Device\00000046                                                                                  halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation)

AttachedDevice  \Driver\volmgr \Device\HarddiskVolume1                                                                              fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice  \Driver\volmgr \Device\HarddiskVolume1                                                                              rdyboost.sys (ReadyBoost Driver/Microsoft Corporation)
AttachedDevice  \Driver\volmgr \Device\HarddiskVolume2                                                                              fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice  \Driver\volmgr \Device\HarddiskVolume2                                                                              rdyboost.sys (ReadyBoost Driver/Microsoft Corporation)
AttachedDevice  \Driver\volmgr \Device\HarddiskVolume3                                                                              fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice  \Driver\volmgr \Device\HarddiskVolume3                                                                              rdyboost.sys (ReadyBoost Driver/Microsoft Corporation)
AttachedDevice  \Driver\volmgr \Device\HarddiskVolume4                                                                              fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice  \Driver\volmgr \Device\HarddiskVolume4                                                                              rdyboost.sys (ReadyBoost Driver/Microsoft Corporation)

---- Registry - GMER 1.0.15 ----

Reg            HKLM\SYSTEM\ControlSet001\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)               
Reg            HKLM\SYSTEM\ControlSet001\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0                                    0x06 0x63 0x00 0x00 ...
Reg            HKLM\SYSTEM\ControlSet001\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0                                    0
Reg            HKLM\SYSTEM\ControlSet001\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12                                  0x31 0x0B 0x66 0x85 ...
Reg            HKLM\SYSTEM\ControlSet001\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0                                    C:\Program Files\1\Multimedia\CD_DVD\DAEMON Tools Pro\
Reg            HKLM\SYSTEM\ControlSet001\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001 (not active ControlSet)     
Reg            HKLM\SYSTEM\ControlSet001\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12                        0xAC 0x9D 0xDC 0x5D ...
Reg            HKLM\SYSTEM\ControlSet001\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0                            0xA0 0x02 0x00 0x00 ...
Reg            HKLM\SYSTEM\ControlSet001\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0 (not active ControlSet) 
Reg            HKLM\SYSTEM\ControlSet001\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12                    0x5F 0x77 0x31 0x7F ...
Reg            HKLM\SYSTEM\ControlSet001\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq1 (not active ControlSet) 
Reg            HKLM\SYSTEM\ControlSet001\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq1@hdf12                    0x2C 0x83 0xD2 0xC1 ...
Reg            HKLM\SYSTEM\CurrentControlSet@5                                                                                    9123
Reg            HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC                                   
Reg            HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0                                0x63 0x34 0x00 0x00 ...
Reg            HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0                                0
Reg            HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12                              0x49 0xBA 0x49 0x84 ...
Reg            HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0                                C:\Program Files\DAEMON Tools Pro\
Reg            HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001                         
Reg            HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12                    0xAC 0x9D 0xDC 0x5D ...
Reg            HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0                        0xA0 0x02 0x00 0x00 ...
Reg            HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0                     
Reg            HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12                0x8C 0x4C 0xCD 0x54 ...
Reg            HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq1                     
Reg            HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq1@hdf12                0x2C 0x83 0xD2 0xC1 ...
Reg            HKLM\SYSTEM\ControlSet003\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)               
Reg            HKLM\SYSTEM\ControlSet003\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0                                    0x63 0x34 0x00 0x00 ...
Reg            HKLM\SYSTEM\ControlSet003\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0                                    0
Reg            HKLM\SYSTEM\ControlSet003\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12                                  0x49 0xBA 0x49 0x84 ...
Reg            HKLM\SYSTEM\ControlSet003\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0                                    C:\Program Files\DAEMON Tools Pro\
Reg            HKLM\SYSTEM\ControlSet003\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001 (not active ControlSet)     
Reg            HKLM\SYSTEM\ControlSet003\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12                        0xAC 0x9D 0xDC 0x5D ...
Reg            HKLM\SYSTEM\ControlSet003\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0                            0xA0 0x02 0x00 0x00 ...
Reg            HKLM\SYSTEM\ControlSet003\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0 (not active ControlSet) 
Reg            HKLM\SYSTEM\ControlSet003\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12                    0x8C 0x4C 0xCD 0x54 ...
Reg            HKLM\SYSTEM\ControlSet003\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq1 (not active ControlSet) 
Reg            HKLM\SYSTEM\ControlSet003\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq1@hdf12                    0x2C 0x83 0xD2 0xC1 ...

---- EOF - GMER 1.0.15 ----
--- --- ---


und osam:

OSAM Logfile:
Code:
Report of OSAM: Autorun Manager v5.0.11926.0
hxxp://www.online-solutions.ru/en/
Saved at 17:49:02 on 09.02.2011

OS: Windows 7 Home Premium Edition (Build 7600), 32-bit
Default Browser: Mozilla Corporation Firefox 3.6.13

Scanner Settings
[x] Rootkits detection (hidden registry)
[x] Rootkits detection (hidden files)
[x] Retrieve files information
[x] Check Microsoft signatures

Filters
[ ] Trusted entries
[ ] Empty entries
[x] Hidden registry entries (rootkit activity)
[x] Exclusively opened files
[x] Not found files
[x] Files without detailed information
[x] Existing files
[ ] Non-startable services
[ ] Non-startable drivers
[x] Active entries
[x] Disabled entries


[Control Panel Objects]
-----( %SystemRoot%\system32 )-----
"ISUSPM.cpl" - "Macrovision Corporation" - C:\Windows\system32\ISUSPM.cpl
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )-----
"QuickTime" - "Apple Inc." - C:\Program Files\QuickTime\QTSystem\QuickTime.cpl

[Drivers]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"AnyDVD" (AnyDVD) - "SlySoft, Inc." - C:\Windows\System32\Drivers\AnyDVD.sys
"catchme" (catchme) - ? - C:\Users\Peter3\AppData\Local\Temp\catchme.sys  (File not found)
"ElbyCDIO Driver" (ElbyCDIO) - "Elaborate Bytes AG" - C:\Windows\System32\Drivers\ElbyCDIO.sys
"fxlyykog" (fxlyykog) - ? - C:\Users\Peter3\AppData\Local\Temp\fxlyykog.sys  (Hidden registry entry, rootkit activity | File not found)

[Explorer]
-----( HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----
{BDEADF00-C265-11d0-BCED-00A0C90AB50F} "Webordner" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\WEBFOL~1\MSONSEXT.DLL
-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----
{F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll
-----( HKLM\Software\Classes\Protocols\Handler )-----
{828030A1-22C1-4009-854F-8E305202313F} "livecall" - "Microsoft Corporation" - C:\PROGRA~1\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL
{828030A1-22C1-4009-854F-8E305202313F} "msnim" - "Microsoft Corporation" - C:\PROGRA~1\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL
{03C514A3-1EFB-4856-9F99-10D7BE1653C0} "Windows Live Mail HTML Asynchronous Pluggable Protocol Handler" - "Microsoft Corporation" - C:\Program Files\Windows Live\Mail\mailcomm.dll
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks )-----
{AEB6717E-7E19-11d0-97EE-00C04FD91972} "{AEB6717E-7E19-11d0-97EE-00C04FD91972}" - ? -  (File not found | COM-object registry key not found)
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----
{0563DB41-F538-4B37-A92D-4659049B7766} "CLSID_WLMCMimeFilter" - "Microsoft Corporation" - C:\Program Files\Windows Live\Mail\mailcomm.dll
 "CorelDRAW Shell Extension Component" - ? -  (File not found | COM-object registry key not found)
{693BE9C0-BEC3-11D2-B4C1-C33BBD3AD64B} "Fast Explorer Shell Extension" - "Alex Yakovlev" - C:\Users\Peter3\AppData\Roaming\AllDup\FEShlExt.dll
{B9E1D2CB-CCFF-4AA6-9579-D7A4754030EF} "iTunes" - ? - C:\Program Files\1\iPod, iTunes\iTunes\iTunesMiniPlayer.dll  (File not found)
{993BE281-6695-4BA5-8A2A-7AACBFAAB69E} "Microsoft Office Metadata Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll
{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97} "Microsoft Office Thumbnail Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll
{45AC2688-0253-4ED8-97DE-B5370FA7D48A} "Shell Extension for Malware scanning" - ? -  (File not found | COM-object registry key not found)
{2BE99FD4-A181-4996-BFA9-58C5FFD11F6C} "Windows Live Photo Gallery Autoplay Drop Target" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\WLXPhotoGallery.exe
{00F30F64-AC33-42F5-8FD1-5DC2D3FDE06C} "Windows Live Photo Gallery Editor Drop Target" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\WLXPhotoGallery.exe
{00F3712A-CA79-45B4-9E4D-D7891E7F8B9D} "Windows Live Photo Gallery Editor Shim" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\PhotoViewerShim.dll
{00F30F90-3E96-453B-AFCD-D71989ECC2C7} "Windows Live Photo Gallery Viewer Autoplay Shim" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\PhotoViewerShim.dll
{00F33137-EE26-412F-8D71-F84E4C2C6625} "Windows Live Photo Gallery Viewer Autoplay Shim" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\PhotoViewerShim.dll
{00F374B7-B390-4884-B372-2FC349F2172B} "Windows Live Photo Gallery Viewer Drop Target" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\WLXPhotoGallery.exe
{00F346CB-35A4-465B-8B8F-65A29DBAB1F6} "Windows Live Photo Gallery Viewer Shim" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\PhotoViewerShim.dll
{B41DB860-8EE4-11D2-9906-E49FADC173CA} "WinRAR" - ? - C:\Program Files\1\System\zip-tools\winrar\rarext.dll  (File not found)
{06A2568A-CED6-4187-BB20-400B8C02BE5A} "{06A2568A-CED6-4187-BB20-400B8C02BE5A}" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\WLXPhotoAcquireWizard.exe

[Internet Explorer]
-----( HKCU\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----
"eBay - Der weltweite Online-Marktplatz" - ? - hxxp://rover.ebay.com/rover/1/707-37276-17534-15/4  (HTTP value)
-----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )-----
<binary data> "&Windows Live Toolbar" - "Microsoft Corporation" - C:\Program Files\Windows Live\Toolbar\wltcore.dll
ITBar7Height "ITBar7Height" - ? -  (File not found | COM-object registry key not found)
<binary data> "ITBar7Layout" - ? -  (File not found | COM-object registry key not found)
<binary data> "Nero Toolbar" - "Ask.com" - C:\Program Files\Ask.com\GenericAskToolbar.dll
-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----
{8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.6.0_17" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} "Java Plug-in 1.6.0_17" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_17" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\npjpi160_17.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----
{53707962-6F74-2D53-2644-206D7942484F} "ClsidExtension" - ? - C:\PROGRA~1\1\System\SICHER~1\SPYBOT~1\SDHelper.dll  (File not found)
"eBay - Der weltweite Online-Marktplatz" - ? - hxxp://rover.ebay.com/rover/1/707-37276-17534-25/4  (HTTP value)
{5F7B1267-94A9-47F5-98DB-E99415F33AEC} "In Blog veröffentlichen" - "Microsoft Corporation" - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar )-----
<binary data> "&Windows Live Toolbar" - "Microsoft Corporation" - C:\Program Files\Windows Live\Toolbar\wltcore.dll
<binary data> "Nero Toolbar" - "Ask.com" - C:\Program Files\Ask.com\GenericAskToolbar.dll
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----
{18DF081C-E8AD-4283-A596-FA578C2EBDC3} "Adobe PDF Link Helper" - "Adobe Systems Incorporated" - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
{DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2ssv.dll
{D4027C7F-154A-4066-A1AD-4243D8127440} "Nero Toolbar" - "Ask.com" - C:\Program Files\Ask.com\GenericAskToolbar.dll
{6EBF7485-159F-4bff-A14F-B9E3AAC4465B} "Search Helper" - "Microsoft Corporation" - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
{53707962-6F74-2D53-2644-206D7942484F} "Spybot-S&D IE Protection" - ? - C:\PROGRA~1\1\System\SICHER~1\SPYBOT~1\SDHelper.dll  (File not found)
{9030D464-4C02-4ABF-8ECC-5164760863C6} "Windows Live Anmelde-Hilfsprogramm" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
{E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} "Windows Live Toolbar Helper" - "Microsoft Corporation" - C:\Program Files\Windows Live\Toolbar\wltcore.dll
{5C255C8A-E604-49b4-9D64-90988571CECB} "{5C255C8A-E604-49b4-9D64-90988571CECB}" - ? -  (File not found | COM-object registry key not found)

[Logon]
-----( %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup )-----
"desktop.ini" - ? - C:\Users\Peter3\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
-----( %AllUsersProfile%\Microsoft\Windows\Start Menu\Programs\Startup )-----
"desktop.ini" - ? - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
"Microsoft Office.lnk.disabled" - ? - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Office.lnk.disabled
-----( HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\Wds\rdpwd )-----
"StartupPrograms" - ? - rdpclip  (File not found)
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----
"HotkeyApp" - "Wistron" - "C:\Program Files\Launch Manager\HotkeyApp.exe"

[Services]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"@C:\Program Files\Nero\Update\NASvc.exe,-200" (NAUpdate) - "Nero AG" - C:\Program Files\Nero\Update\NASvc.exe
"Apple Mobile Device" (Apple Mobile Device) - "Apple Inc." - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
"Cyberlink RichVideo Service(CRVS)" (RichVideo) - ? - C:\Program Files\CyberLink\Shared files\RichVideo.exe
"Dienst "Bonjour"" (Bonjour Service) - "Apple Inc." - C:\Program Files\Bonjour\mDNSResponder.exe
"FABS - Helping agent for MAGIX media database" (Fabs) - "MAGIX AG" - C:\Program Files\Common Files\MAGIX Services\Database\bin\FABS.exe
"Firebird Server - MAGIX Instance" (FirebirdServerMAGIXInstance) - "MAGIX®" - C:\Program Files\Common Files\MAGIX Services\Database\bin\fbserver.exe
"FLEXnet Licensing Service" (FLEXnet Licensing Service) - "Macrovision Europe Ltd." - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
"Intel(R) Matrix Storage Event Monitor" (IAANTMON) - "Intel Corporation" - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
"iPod-Dienst" (iPod Service) - "Apple Inc." - C:\Program Files\iPod\bin\iPodService.exe
"Microsoft .NET Framework NGEN v4.0.30319_X86" (clr_optimization_v4.0.30319_32) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
"ProtexisLicensing" (ProtexisLicensing) - ? - C:\Windows\system32\PSIService.exe
"SeaPort" (SeaPort) - "Microsoft Corporation" - C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
"WisLMSvc" (WisLMSvc) - "Wistron Corp." - C:\Program Files\Launch Manager\WisLMSvc.exe
"X10 Device Network Service" (x10nets) - "X10" - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe

[Winsock Providers]
-----( HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries )-----
"mdnsNSP" - "Apple Inc." - C:\Program Files\Bonjour\mdnsNSP.dll

===[ Logfile end ]=========================================[ Logfile end ]===
--- --- ---

mbrcheck-log

MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:
Windows Version: Windows 7 Home Premium Edition
Windows Information: (build 7600), 32-bit
Base Board Manufacturer: MEDION
BIOS Manufacturer: Phoenix Technologies LTD
System Manufacturer: MEDION
System Product Name: E7212
Logical Drives Mask: 0x0000001c

Kernel Drivers (total 185):
0x8324B000 \SystemRoot\system32\ntkrnlpa.exe
0x83214000 \SystemRoot\system32\halmacpi.dll
0x80BC8000 \SystemRoot\system32\kdcom.dll
0x8B037000 \SystemRoot\system32\mcupdate_GenuineIntel.dll
0x8B0AF000 \SystemRoot\system32\PSHED.dll
0x8B0C0000 \SystemRoot\system32\BOOTVID.dll
0x8B0C8000 \SystemRoot\system32\CLFS.SYS
0x8B10A000 \SystemRoot\system32\CI.dll
0x8B23F000 \SystemRoot\system32\drivers\Wdf01000.sys
0x8B2B0000 \SystemRoot\system32\drivers\WDFLDR.SYS
0x8B2BE000 \SystemRoot\system32\DRIVERS\ACPI.sys
0x8B306000 \SystemRoot\system32\DRIVERS\WMILIB.SYS
0x8B30F000 \SystemRoot\system32\DRIVERS\msisadrv.sys
0x8B317000 \SystemRoot\system32\DRIVERS\vdrvroot.sys
0x8B322000 \SystemRoot\system32\DRIVERS\pci.sys
0x8B34C000 \SystemRoot\System32\drivers\partmgr.sys
0x8B35D000 \SystemRoot\system32\DRIVERS\compbatt.sys
0x8B365000 \SystemRoot\system32\DRIVERS\BATTC.SYS
0x8B370000 \SystemRoot\system32\DRIVERS\volmgr.sys
0x8B380000 \SystemRoot\System32\drivers\volmgrx.sys
0x8B3CB000 \SystemRoot\System32\drivers\mountmgr.sys
0x8B419000 \SystemRoot\system32\DRIVERS\iaStor.sys
0x8B4F3000 \SystemRoot\system32\DRIVERS\amdxata.sys
0x8B4FC000 \SystemRoot\system32\drivers\fltmgr.sys
0x8B530000 \SystemRoot\system32\drivers\fileinfo.sys
0x8B62B000 \SystemRoot\System32\Drivers\Ntfs.sys
0x8B75A000 \SystemRoot\System32\Drivers\msrpc.sys
0x8B785000 \SystemRoot\System32\Drivers\ksecdd.sys
0x8B798000 \SystemRoot\System32\Drivers\cng.sys
0x8B600000 \SystemRoot\System32\drivers\pcw.sys
0x8B60E000 \SystemRoot\System32\Drivers\Fs_Rec.sys
0x8B541000 \SystemRoot\system32\drivers\ndis.sys
0x8B200000 \SystemRoot\system32\drivers\NETIO.SYS
0x8B1B5000 \SystemRoot\System32\Drivers\ksecpkg.sys
0x8B828000 \SystemRoot\System32\drivers\tcpip.sys
0x8B971000 \SystemRoot\System32\drivers\fwpkclnt.sys
0x8B9A2000 \SystemRoot\system32\DRIVERS\volsnap.sys
0x8B9E1000 \SystemRoot\System32\Drivers\spldr.sys
0x8B000000 \SystemRoot\System32\drivers\rdyboost.sys
0x8B9E9000 \SystemRoot\System32\Drivers\mup.sys
0x8B800000 \SystemRoot\System32\drivers\hwpolicy.sys
0x8BA0C000 \SystemRoot\System32\DRIVERS\fvevol.sys
0x8BA3E000 \SystemRoot\system32\DRIVERS\disk.sys
0x8BA4F000 \SystemRoot\system32\DRIVERS\CLASSPNP.SYS
0x8BB6C000 \SystemRoot\system32\DRIVERS\cdrom.sys
0x8BB8B000 \SystemRoot\System32\Drivers\Null.SYS
0x8BB92000 \SystemRoot\System32\Drivers\Beep.SYS
0x8BB99000 \SystemRoot\System32\drivers\vga.sys
0x8BBA5000 \SystemRoot\System32\drivers\VIDEOPRT.SYS
0x8BBC6000 \SystemRoot\System32\drivers\watchdog.sys
0x8BBD3000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0x8BBDB000 \SystemRoot\system32\drivers\rdpencdd.sys
0x8BBE3000 \SystemRoot\system32\drivers\rdprefmp.sys
0x8BBEB000 \SystemRoot\System32\Drivers\Msfs.SYS
0x8B808000 \SystemRoot\System32\Drivers\Npfs.SYS
0x8B400000 \SystemRoot\system32\DRIVERS\tdx.sys
0x8BA00000 \SystemRoot\system32\DRIVERS\TDI.SYS
0x90E0E000 \SystemRoot\system32\drivers\afd.sys
0x90E68000 \SystemRoot\System32\DRIVERS\netbt.sys
0x90E9A000 \SystemRoot\system32\DRIVERS\wfplwf.sys
0x90EA1000 \SystemRoot\system32\DRIVERS\pacer.sys
0x90EC0000 \SystemRoot\system32\DRIVERS\vwififlt.sys
0x90ED1000 \SystemRoot\system32\DRIVERS\netbios.sys
0x90EDF000 \SystemRoot\system32\DRIVERS\wanarp.sys
0x90EF2000 \SystemRoot\system32\DRIVERS\termdd.sys
0x90F02000 \SystemRoot\system32\DRIVERS\rdbss.sys
0x90F43000 \SystemRoot\system32\drivers\nsiproxy.sys
0x90F4D000 \SystemRoot\system32\DRIVERS\mssmbios.sys
0x90F57000 \SystemRoot\System32\Drivers\ElbyCDIO.sys
0x90F5C000 \SystemRoot\System32\drivers\discache.sys
0x90F68000 \SystemRoot\System32\Drivers\dfsc.sys
0x90F80000 \SystemRoot\system32\DRIVERS\blbdrive.sys
0x90F8E000 \SystemRoot\system32\DRIVERS\tunnel.sys
0x90FAF000 \SystemRoot\system32\DRIVERS\wmiacpi.sys
0x92823000 \SystemRoot\system32\DRIVERS\igdkmd32.sys
0x93140000 \SystemRoot\System32\drivers\dxgkrnl.sys
0x90FB8000 \SystemRoot\System32\drivers\dxgmms1.sys
0x92800000 \SystemRoot\system32\DRIVERS\usbuhci.sys
0x91A38000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
0x91A83000 \SystemRoot\system32\DRIVERS\usbehci.sys
0x91A92000 \SystemRoot\system32\DRIVERS\HDAudBus.sys
0x91AB1000 \SystemRoot\system32\DRIVERS\rtl8192se.sys
0x91BC4000 \SystemRoot\system32\DRIVERS\vwifibus.sys
0x91C19000 \SystemRoot\system32\DRIVERS\yk62x86.sys
0x91C6A000 \SystemRoot\system32\DRIVERS\jmcr.sys
0x91C89000 \SystemRoot\system32\DRIVERS\SCSIPORT.SYS
0x91CAF000 \SystemRoot\system32\DRIVERS\CmBatt.sys
0x91CB3000 \SystemRoot\system32\DRIVERS\i8042prt.sys
0x91CCB000 \SystemRoot\system32\DRIVERS\kbdclass.sys
0x91CD8000 \SystemRoot\system32\DRIVERS\fspad_wlh32.sys
0x91CE8000 \SystemRoot\system32\DRIVERS\mouclass.sys
0x91CF5000 \SystemRoot\System32\Drivers\AnyDVD.sys
0x91D0D000 \SystemRoot\system32\DRIVERS\GEARAspiWDM.sys
0x91D13000 \SystemRoot\system32\DRIVERS\intelppm.sys
0x91D25000 \SystemRoot\system32\DRIVERS\CompositeBus.sys
0x91D32000 \SystemRoot\System32\Drivers\x10hid.sys
0x91D34000 \SystemRoot\System32\Drivers\HIDCLASS.SYS
0x91D47000 \SystemRoot\System32\Drivers\HIDPARSE.SYS
0x91D4E000 \SystemRoot\system32\DRIVERS\AgileVpn.sys
0x91D60000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
0x91D78000 \SystemRoot\system32\DRIVERS\ndistapi.sys
0x91D83000 \SystemRoot\system32\DRIVERS\ndiswan.sys
0x91DA5000 \SystemRoot\system32\DRIVERS\raspppoe.sys
0x91DBD000 \SystemRoot\system32\DRIVERS\raspptp.sys
0x91DD4000 \SystemRoot\system32\DRIVERS\rassstp.sys
0x91DEB000 \SystemRoot\system32\DRIVERS\swenum.sys
0x91A00000 \SystemRoot\system32\DRIVERS\ks.sys
0x91DED000 \SystemRoot\system32\DRIVERS\umbus.sys
0x96A28000 \SystemRoot\system32\DRIVERS\usbhub.sys
0x96A6C000 \SystemRoot\system32\DRIVERS\kbdhid.sys
0x96A78000 \SystemRoot\System32\Drivers\NDProxy.SYS
0x96A89000 \SystemRoot\system32\DRIVERS\stwrt.sys
0x96AF5000 \SystemRoot\system32\DRIVERS\portcls.sys
0x96B24000 \SystemRoot\system32\DRIVERS\drmk.sys
0x96B3D000 \SystemRoot\system32\drivers\IntcHdmi.sys
0x82700000 \SystemRoot\System32\win32k.sys
0x96B60000 \SystemRoot\System32\drivers\Dxapi.sys
0x96B6A000 \SystemRoot\System32\Drivers\crashdmp.sys
0x8BA74000 \SystemRoot\System32\Drivers\dump_iaStor.sys
0x96B77000 \SystemRoot\System32\Drivers\dump_dumpfve.sys
0x96B88000 \SystemRoot\system32\DRIVERS\hidusb.sys
0x96B93000 \SystemRoot\system32\DRIVERS\USBD.SYS
0x96B95000 \SystemRoot\system32\DRIVERS\mouhid.sys
0x96BA0000 \SystemRoot\System32\Drivers\x10ufx2.sys
0x96BAA000 \SystemRoot\system32\DRIVERS\monitor.sys
0x82960000 \SystemRoot\System32\TSDDD.dll
0x82990000 \SystemRoot\System32\cdd.dll
0x96BB5000 \SystemRoot\system32\drivers\luafv.sys
0x96BD0000 \SystemRoot\system32\drivers\WudfPf.sys
0x96BEA000 \SystemRoot\system32\DRIVERS\lltdio.sys
0x9181A000 \SystemRoot\system32\DRIVERS\nwifi.sys
0x91860000 \SystemRoot\system32\DRIVERS\ndisuio.sys
0x91870000 \SystemRoot\system32\DRIVERS\rspndr.sys
0x91883000 \SystemRoot\system32\drivers\HTTP.sys
0x91908000 \SystemRoot\system32\DRIVERS\bowser.sys
0x91921000 \SystemRoot\System32\drivers\mpsdrv.sys
0x91933000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
0x91956000 \SystemRoot\system32\DRIVERS\mrxsmb10.sys
0x91991000 \SystemRoot\system32\DRIVERS\mrxsmb20.sys
0x9A40F000 \SystemRoot\system32\drivers\peauth.sys
0x9A4A6000 \SystemRoot\System32\Drivers\secdrv.SYS
0x9A4B0000 \SystemRoot\System32\DRIVERS\srvnet.sys
0x9A4D1000 \SystemRoot\System32\drivers\tcpipreg.sys
0x9A4DE000 \SystemRoot\System32\DRIVERS\srv2.sys
0x9A52D000 \SystemRoot\System32\DRIVERS\srv.sys
0x9A57E000 \??\C:\Users\Peter3\AppData\Local\Temp\fxlyykog.sys
0x774F0000 \Windows\System32\ntdll.dll
0x482B0000 \Windows\System32\smss.exe
0x77730000 \Windows\System32\apisetschema.dll
0x00FE0000 \Windows\System32\autochk.exe
0x77650000 \Windows\System32\user32.dll
0x773F0000 \Windows\System32\wininet.dll
0x77250000 \Windows\System32\setupapi.dll
0x77220000 \Windows\System32\imagehlp.dll
0x77170000 \Windows\System32\rpcrt4.dll
0x76F70000 \Windows\System32\iertutil.dll
0x76ED0000 \Windows\System32\advapi32.dll
0x76280000 \Windows\System32\shell32.dll
0x77630000 \Windows\System32\imm32.dll
0x76140000 \Windows\System32\urlmon.dll
0x760F0000 \Windows\System32\Wldap32.dll
0x76040000 \Windows\System32\msvcrt.dll
0x75FE0000 \Windows\System32\shlwapi.dll
0x75FD0000 \Windows\System32\lpk.dll
0x75F50000 \Windows\System32\comdlg32.dll
0x75F00000 \Windows\System32\gdi32.dll
0x75EF0000 \Windows\System32\psapi.dll
0x75E50000 \Windows\System32\usp10.dll
0x75D70000 \Windows\System32\kernel32.dll
0x75D60000 \Windows\System32\nsi.dll
0x75D50000 \Windows\System32\normaliz.dll
0x75BF0000 \Windows\System32\ole32.dll
0x75B60000 \Windows\System32\clbcatq.dll
0x75AD0000 \Windows\System32\oleaut32.dll
0x75A70000 \Windows\System32\difxapi.dll
0x759A0000 \Windows\System32\msctf.dll
0x75960000 \Windows\System32\ws2_32.dll
0x75940000 \Windows\System32\sechost.dll
0x758B0000 \Windows\System32\comctl32.dll
0x75860000 \Windows\System32\KernelBase.dll
0x75830000 \Windows\System32\cfgmgr32.dll
0x75710000 \Windows\System32\crypt32.dll
0x756E0000 \Windows\System32\wintrust.dll
0x756C0000 \Windows\System32\devobj.dll
0x756B0000 \Windows\System32\msasn1.dll

Processes (total 52):
0 System Idle Process
4 System
296 C:\Windows\System32\smss.exe
412 csrss.exe
464 C:\Windows\System32\wininit.exe
472 csrss.exe
520 C:\Windows\System32\services.exe
536 C:\Windows\System32\lsass.exe
544 C:\Windows\System32\lsm.exe
668 C:\Windows\System32\svchost.exe
728 C:\Windows\System32\winlogon.exe
780 C:\Windows\System32\svchost.exe
852 C:\Windows\System32\svchost.exe
884 C:\Windows\System32\svchost.exe
912 C:\Windows\System32\svchost.exe
960 C:\Program Files\IDT\WDM\stacsv.exe
1176 C:\Windows\System32\svchost.exe
1288 C:\Windows\System32\svchost.exe
1492 C:\Windows\System32\spoolsv.exe
1500 C:\Windows\System32\taskeng.exe
1560 C:\Windows\System32\svchost.exe
1584 C:\Windows\System32\rundll32.exe
1668 C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
1700 C:\Program Files\Bonjour\mDNSResponder.exe
1736 C:\Program Files\Common Files\MAGIX Services\Database\bin\FABS.exe
1780 C:\Windows\System32\svchost.exe
1828 C:\Windows\System32\PSIService.exe
1872 C:\Program Files\CyberLink\Shared files\RichVideo.exe
1892 C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
1952 C:\Windows\System32\svchost.exe
2012 C:\PROGRA~1\COMMON~1\X10\Common\X10nets.exe
328 C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe
2184 C:\Windows\System32\svchost.exe
2444 C:\Windows\System32\dwm.exe
2472 C:\Windows\explorer.exe
2512 C:\Windows\System32\taskhost.exe
2728 C:\Program Files\Launch Manager\HotkeyApp.exe
2764 C:\Windows\System32\hkcmd.exe
2772 C:\Windows\System32\igfxpers.exe
2780 C:\Program Files\Windows Sidebar\sidebar.exe
2928 C:\Program Files\Launch Manager\WisLMSvc.exe
2980 WmiPrvSE.exe
3232 C:\Windows\System32\SearchIndexer.exe
3316 C:\Program Files\Windows Media Player\wmpnetwk.exe
3968 C:\Program Files\Nero\Update\NASvc.exe
3168 C:\Windows\System32\audiodg.exe
3180 C:\Windows\System32\SearchProtocolHost.exe
3636 C:\Windows\System32\SearchFilterHost.exe
2832 dllhost.exe
2064 dllhost.exe
3056 C:\Users\Peter3\Desktop\MBRCheck.exe
2656 C:\Windows\System32\conhost.exe

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`06500000 (NTFS)
\\.\D: --> \\.\PhysicalDrive0 at offset 0x0000006a`30900000 (NTFS)

PhysicalDrive0 Model Number: WDCWD5000BEVT-22A0RT0, Rev: 01.01A01

Size Device Name MBR Status
--------------------------------------------
465 GB \\.\PhysicalDrive0 Unknown MBR code
SHA1: A1D8436B9D28AE5947F8CFF23FE54B1DC1738268


Found non-standard or infected MBR.
Enter 'Y' and hit ENTER for more options, or 'N' to exit:

Done!

was bedeutet die non-standard oder infected mbr?
apropos: ich fühle mich etwas unsicher ohne avira - darf ich es wieder installieren? ;-)

Gruss,
Peter

cosinus 10.02.2011 10:47
Zitat:
465 GB \\.\PhysicalDrive0 Unknown MBR code
SHA1: A1D8436B9D28AE5947F8CFF23FE54B1DC1738268
Wir müssen den MBR fixen. Hast du eine Windows7 DVD zur Hand?
Hast du nur Windows oder noch andere Betriebssysteme installiert?

Petersl 10.02.2011 18:02
Aldi Laptop, Win7 war vorinstalliert, beiliegend eine
Recovery Disc, Windows 7 Home Premium "Diese Software ist nur für die Wiederherstellung des erworbenen Computersystems bestimmt".
Ist es das, was wir brauchen?
es gibt eine 32 und eine 64-Bit Version. Wir nehmen die 32, oder?
Gruß,
Peter
(und auch zwischendurch mal: Vielen, vielen Dank für Deine Hilfe!)

cosinus 10.02.2011 19:14
Ja 32-Bit-DVD ist richtig. Aber Recovery-Gedöns brauchen wir nicht.

Wenn du keine Win7-DVD hast, geht das auch mit einer Vista-Rescue-Disc, schau mal hier => Vista Notfall/Recovery-CD 32-Bit - Dr. Windows

Lad die ISO-Datei herunter, brenn sie zB mit ImgBurn per Imagebrennfunktion auf eine CD und starte damit den Rechner (von dieser CD booten).

Wie gesagt, falls Du eine normale Windows-Installations-DVD hast, brauchst Du das o.g. Image nicht sondern kannst einfach von der Windows-DVD booten.

Klick auf Computerreparaturoptionen, weiter, Eingabeaufforderung - die Konsole öffnet sich. Da bitte bootrec.exe /fixboot eintippen (mit enter bestätigen), dann bootrec.exe /fixmbr eintippen (mit enter bestätigen) - Rechner neustarten, CD vorher rausnehmen. Mach danach neue Logs mit MBRcheck und wenn's geht GMER.

Petersl 10.02.2011 19:36
das wird jetzt ne Weile dauern - abends ist oft die Internetverbindung extreeem langsam, was aber jetzt nichts mit viren, trojanern oder sonst was zu tun hat.

Erscheint beim Booten von der CD dann automatisch "Computerreparaturoptionen" oder muss ich dazu irgendwann im Bootvorgang unterbrechen, im abgesicherten Modus starten oder sonstwas?

Und mit meiner RecoveryCD geht das sicher nicht ? Ne, schon ok, war nur so ne Frage ;-)

Gruss, Peter

cosinus 10.02.2011 20:15
Warum stellst du Fragen, die im meinem vorherigen Post alle beantwortet sind?? :balla:

Petersl 11.02.2011 01:23
entschuldigung, ich werde mich zurückhalten.
Ich habe aber ein Problem beim Runterladen der vista-notfall-cd: Der Download bricht immer ab mit der Fehlermeldung:
"C:\Users\Peter3\vista_recover_x86.iso konnte nicht gespeichert werden, weil die Quelldatei nicht gelesen werden konnte.
Versuchen Sie es später nochmals oder kontaktieren Sie den Server-Administrator." Muss man sich evtl. auf dieser Seite registrieren, wenn man was runterladen will? Gibt es noch einen anderen Link?
Bei anderen Dateien dieser Größenordnung, die ich dann zu Testzwecken mal runtergeladen habe, gab es keinerlei Probleme.
Gruß, Peter

Petersl 11.02.2011 07:39
so. spät in der nacht hat es mit dem download doch noch geklappt.
logs folgen heute nachmittag / abend.
Peter

Petersl 11.02.2011 16:14
mbrcheck.log
MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:
Windows Version: Windows 7 Home Premium Edition
Windows Information: (build 7600), 32-bit
Base Board Manufacturer: MEDION
BIOS Manufacturer: Phoenix Technologies LTD
System Manufacturer: MEDION
System Product Name: E7212
Logical Drives Mask: 0x0000001c

Kernel Drivers (total 188):
0x83209000 \SystemRoot\system32\ntkrnlpa.exe
0x83619000 \SystemRoot\system32\halmacpi.dll
0x80BCE000 \SystemRoot\system32\kdcom.dll
0x8B018000 \SystemRoot\system32\mcupdate_GenuineIntel.dll
0x8B090000 \SystemRoot\system32\PSHED.dll
0x8B0A1000 \SystemRoot\system32\BOOTVID.dll
0x8B0A9000 \SystemRoot\system32\CLFS.SYS
0x8B0EB000 \SystemRoot\system32\CI.dll
0x8B228000 \SystemRoot\system32\drivers\Wdf01000.sys
0x8B299000 \SystemRoot\system32\drivers\WDFLDR.SYS
0x8B2A7000 \SystemRoot\system32\DRIVERS\ACPI.sys
0x8B2EF000 \SystemRoot\system32\DRIVERS\WMILIB.SYS
0x8B2F8000 \SystemRoot\system32\DRIVERS\msisadrv.sys
0x8B300000 \SystemRoot\system32\DRIVERS\vdrvroot.sys
0x8B30B000 \SystemRoot\system32\DRIVERS\pci.sys
0x8B335000 \SystemRoot\System32\drivers\partmgr.sys
0x8B346000 \SystemRoot\system32\DRIVERS\compbatt.sys
0x8B34E000 \SystemRoot\system32\DRIVERS\BATTC.SYS
0x8B359000 \SystemRoot\system32\DRIVERS\volmgr.sys
0x8B369000 \SystemRoot\System32\drivers\volmgrx.sys
0x8B3B4000 \SystemRoot\System32\drivers\mountmgr.sys
0x8B40D000 \SystemRoot\system32\DRIVERS\iaStor.sys
0x8B4E7000 \SystemRoot\system32\DRIVERS\amdxata.sys
0x8B4F0000 \SystemRoot\system32\drivers\fltmgr.sys
0x8B524000 \SystemRoot\system32\drivers\fileinfo.sys
0x8B632000 \SystemRoot\System32\Drivers\Ntfs.sys
0x8B761000 \SystemRoot\System32\Drivers\msrpc.sys
0x8B78C000 \SystemRoot\System32\Drivers\ksecdd.sys
0x8B79F000 \SystemRoot\System32\Drivers\cng.sys
0x8B600000 \SystemRoot\System32\drivers\pcw.sys
0x8B60E000 \SystemRoot\System32\Drivers\Fs_Rec.sys
0x8B535000 \SystemRoot\system32\drivers\ndis.sys
0x8B196000 \SystemRoot\system32\drivers\NETIO.SYS
0x8B3CA000 \SystemRoot\System32\Drivers\ksecpkg.sys
0x8B80B000 \SystemRoot\System32\drivers\tcpip.sys
0x8B954000 \SystemRoot\System32\drivers\fwpkclnt.sys
0x8B985000 \SystemRoot\system32\DRIVERS\volsnap.sys
0x8B9C4000 \SystemRoot\System32\Drivers\spldr.sys
0x8B9CC000 \SystemRoot\System32\drivers\rdyboost.sys
0x8B617000 \SystemRoot\System32\Drivers\mup.sys
0x8B800000 \SystemRoot\System32\drivers\hwpolicy.sys
0x8BA3D000 \SystemRoot\System32\DRIVERS\fvevol.sys
0x8BA6F000 \SystemRoot\system32\DRIVERS\disk.sys
0x8BA80000 \SystemRoot\system32\DRIVERS\CLASSPNP.SYS
0x8BAB2000 \SystemRoot\system32\DRIVERS\cdrom.sys
0x8BAD1000 \SystemRoot\System32\Drivers\Null.SYS
0x8BAD8000 \SystemRoot\System32\Drivers\Beep.SYS
0x8BADF000 \SystemRoot\System32\drivers\vga.sys
0x8BAEB000 \SystemRoot\System32\drivers\VIDEOPRT.SYS
0x8BB0C000 \SystemRoot\System32\drivers\watchdog.sys
0x8BB19000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0x8BB21000 \SystemRoot\system32\drivers\rdpencdd.sys
0x8BB29000 \SystemRoot\system32\drivers\rdprefmp.sys
0x8BB31000 \SystemRoot\System32\Drivers\Msfs.SYS
0x8BB3C000 \SystemRoot\System32\Drivers\Npfs.SYS
0x8BB4A000 \SystemRoot\system32\DRIVERS\tdx.sys
0x8BB61000 \SystemRoot\system32\DRIVERS\TDI.SYS
0x8BB6C000 \SystemRoot\system32\drivers\afd.sys
0x8BBC6000 \SystemRoot\System32\DRIVERS\netbt.sys
0x8BBF8000 \SystemRoot\system32\DRIVERS\wfplwf.sys
0x8BA00000 \SystemRoot\system32\DRIVERS\pacer.sys
0x8BA1F000 \SystemRoot\system32\DRIVERS\vwififlt.sys
0x8B5EC000 \SystemRoot\system32\DRIVERS\netbios.sys
0x8B200000 \SystemRoot\system32\DRIVERS\wanarp.sys
0x8B213000 \SystemRoot\system32\DRIVERS\termdd.sys
0x8BA30000 \SystemRoot\system32\DRIVERS\ssmdrv.sys
0x8FA05000 \SystemRoot\system32\DRIVERS\rdbss.sys
0x8FA46000 \SystemRoot\system32\drivers\nsiproxy.sys
0x8FA50000 \SystemRoot\system32\DRIVERS\mssmbios.sys
0x8FA5A000 \SystemRoot\System32\Drivers\ElbyCDIO.sys
0x8FA5F000 \SystemRoot\System32\drivers\discache.sys
0x8FA6B000 \SystemRoot\System32\Drivers\dfsc.sys
0x8FA83000 \SystemRoot\system32\DRIVERS\blbdrive.sys
0x8FA91000 \SystemRoot\system32\DRIVERS\avipbb.sys
0x8FAB7000 \SystemRoot\system32\DRIVERS\tunnel.sys
0x8FAD8000 \SystemRoot\system32\DRIVERS\wmiacpi.sys
0x90C10000 \SystemRoot\system32\DRIVERS\igdkmd32.sys
0x9152D000 \SystemRoot\System32\drivers\dxgkrnl.sys
0x8FAE1000 \SystemRoot\System32\drivers\dxgmms1.sys
0x915E4000 \SystemRoot\system32\DRIVERS\usbuhci.sys
0x8FB1A000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
0x915EF000 \SystemRoot\system32\DRIVERS\usbehci.sys
0x8FB65000 \SystemRoot\system32\DRIVERS\HDAudBus.sys
0x9362E000 \SystemRoot\system32\DRIVERS\rtl8192se.sys
0x93741000 \SystemRoot\system32\DRIVERS\vwifibus.sys
0x9374B000 \SystemRoot\system32\DRIVERS\yk62x86.sys
0x9379C000 \SystemRoot\system32\DRIVERS\jmcr.sys
0x937BB000 \SystemRoot\system32\DRIVERS\SCSIPORT.SYS
0x937E1000 \SystemRoot\system32\DRIVERS\CmBatt.sys
0x937E5000 \SystemRoot\system32\DRIVERS\i8042prt.sys
0x93600000 \SystemRoot\system32\DRIVERS\kbdclass.sys
0x9360D000 \SystemRoot\system32\DRIVERS\fspad_wlh32.sys
0x9361D000 \SystemRoot\system32\DRIVERS\mouclass.sys
0x8FB84000 \SystemRoot\System32\Drivers\AnyDVD.sys
0x90C00000 \SystemRoot\system32\DRIVERS\GEARAspiWDM.sys
0x8FB9C000 \SystemRoot\system32\DRIVERS\intelppm.sys
0x8FBAE000 \SystemRoot\system32\DRIVERS\CompositeBus.sys
0x9362A000 \SystemRoot\System32\Drivers\x10hid.sys
0x8FBBB000 \SystemRoot\System32\Drivers\HIDCLASS.SYS
0x90C06000 \SystemRoot\System32\Drivers\HIDPARSE.SYS
0x8FBCE000 \SystemRoot\system32\DRIVERS\AgileVpn.sys
0x8FBE0000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
0x8BAA5000 \SystemRoot\system32\DRIVERS\ndistapi.sys
0x8B1D4000 \SystemRoot\system32\DRIVERS\ndiswan.sys
0x8B000000 \SystemRoot\system32\DRIVERS\raspppoe.sys
0x93C19000 \SystemRoot\system32\DRIVERS\raspptp.sys
0x93C30000 \SystemRoot\system32\DRIVERS\rassstp.sys
0x93C47000 \SystemRoot\system32\DRIVERS\swenum.sys
0x93C49000 \SystemRoot\system32\DRIVERS\ks.sys
0x93C7D000 \SystemRoot\system32\DRIVERS\umbus.sys
0x93C8B000 \SystemRoot\system32\DRIVERS\usbhub.sys
0x93CCF000 \SystemRoot\system32\DRIVERS\kbdhid.sys
0x93CDB000 \SystemRoot\System32\Drivers\NDProxy.SYS
0x93CEC000 \SystemRoot\system32\DRIVERS\stwrt.sys
0x93D58000 \SystemRoot\system32\DRIVERS\portcls.sys
0x93D87000 \SystemRoot\system32\DRIVERS\drmk.sys
0x93DA0000 \SystemRoot\system32\drivers\IntcHdmi.sys
0x98520000 \SystemRoot\System32\win32k.sys
0x93DC3000 \SystemRoot\System32\drivers\Dxapi.sys
0x93DCD000 \SystemRoot\system32\DRIVERS\hidusb.sys
0x93DD8000 \SystemRoot\system32\DRIVERS\USBD.SYS
0x93DDA000 \SystemRoot\system32\DRIVERS\mouhid.sys
0x93DE5000 \SystemRoot\System32\Drivers\x10ufx2.sys
0x93DEF000 \SystemRoot\System32\Drivers\crashdmp.sys
0x8C819000 \SystemRoot\System32\Drivers\dump_iaStor.sys
0x8C8F3000 \SystemRoot\System32\Drivers\dump_dumpfve.sys
0x8C904000 \SystemRoot\system32\DRIVERS\monitor.sys
0x98780000 \SystemRoot\System32\TSDDD.dll
0x987B0000 \SystemRoot\System32\cdd.dll
0x8C90F000 \SystemRoot\system32\DRIVERS\avgntflt.sys
0x8C924000 \SystemRoot\system32\drivers\luafv.sys
0x8C93F000 \SystemRoot\system32\drivers\WudfPf.sys
0x8C959000 \SystemRoot\system32\DRIVERS\lltdio.sys
0x8C969000 \SystemRoot\system32\DRIVERS\nwifi.sys
0x8C9AF000 \SystemRoot\system32\DRIVERS\ndisuio.sys
0x8C9BF000 \SystemRoot\system32\DRIVERS\rspndr.sys
0x99A01000 \SystemRoot\system32\drivers\HTTP.sys
0x99A86000 \SystemRoot\system32\DRIVERS\bowser.sys
0x99A9F000 \SystemRoot\System32\drivers\mpsdrv.sys
0x99AB1000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
0x99AD4000 \SystemRoot\system32\DRIVERS\mrxsmb10.sys
0x99B0F000 \SystemRoot\system32\DRIVERS\mrxsmb20.sys
0x99B42000 \SystemRoot\system32\drivers\peauth.sys
0x99BD9000 \SystemRoot\System32\Drivers\secdrv.SYS
0x8C9D2000 \SystemRoot\System32\DRIVERS\srvnet.sys
0x99BE3000 \SystemRoot\System32\drivers\tcpipreg.sys
0xAC820000 \SystemRoot\System32\DRIVERS\srv2.sys
0xAC86F000 \SystemRoot\System32\DRIVERS\srv.sys
0xAC8C0000 \SystemRoot\system32\drivers\spsys.sys
0x777F0000 \Windows\System32\ntdll.dll
0x47680000 \Windows\System32\smss.exe
0x77A30000 \Windows\System32\apisetschema.dll
0x00BD0000 \Windows\System32\autochk.exe
0x77990000 \Windows\System32\clbcatq.dll
0x77950000 \Windows\System32\ws2_32.dll
0x77790000 \Windows\System32\shlwapi.dll
0x776C0000 \Windows\System32\msctf.dll
0x76A70000 \Windows\System32\shell32.dll
0x76A40000 \Windows\System32\imagehlp.dll
0x76970000 \Windows\System32\user32.dll
0x77940000 \Windows\System32\nsi.dll
0x76870000 \Windows\System32\wininet.dll
0x76820000 \Windows\System32\gdi32.dll
0x76800000 \Windows\System32\sechost.dll
0x767E0000 \Windows\System32\imm32.dll
0x76750000 \Windows\System32\oleaut32.dll
0x77930000 \Windows\System32\normaliz.dll
0x765F0000 \Windows\System32\ole32.dll
0x765E0000 \Windows\System32\psapi.dll
0x76530000 \Windows\System32\msvcrt.dll
0x76330000 \Windows\System32\iertutil.dll
0x762B0000 \Windows\System32\comdlg32.dll
0x76170000 \Windows\System32\urlmon.dll
0x76160000 \Windows\System32\lpk.dll
0x760C0000 \Windows\System32\advapi32.dll
0x76060000 \Windows\System32\difxapi.dll
0x75EC0000 \Windows\System32\setupapi.dll
0x75E20000 \Windows\System32\usp10.dll
0x75DD0000 \Windows\System32\Wldap32.dll
0x75D20000 \Windows\System32\rpcrt4.dll
0x75C40000 \Windows\System32\kernel32.dll
0x75B20000 \Windows\System32\crypt32.dll
0x75A90000 \Windows\System32\comctl32.dll
0x75A70000 \Windows\System32\devobj.dll
0x75A40000 \Windows\System32\cfgmgr32.dll
0x75A10000 \Windows\System32\wintrust.dll
0x759C0000 \Windows\System32\KernelBase.dll
0x759B0000 \Windows\System32\msasn1.dll

Processes (total 57):
0 System Idle Process
4 System
264 C:\Windows\System32\smss.exe
384 csrss.exe
436 C:\Windows\System32\wininit.exe
448 csrss.exe
484 C:\Windows\System32\services.exe
508 C:\Windows\System32\lsass.exe
516 C:\Windows\System32\lsm.exe
624 C:\Windows\System32\svchost.exe
692 C:\Windows\System32\winlogon.exe
724 C:\Program Files\Avira\AntiVir Desktop\avguard.exe
756 C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
764 C:\Windows\System32\conhost.exe
892 C:\Windows\System32\svchost.exe
964 C:\Windows\System32\svchost.exe
1036 C:\Windows\System32\svchost.exe
1080 C:\Windows\System32\svchost.exe
1108 C:\Program Files\IDT\WDM\stacsv.exe
1208 C:\Windows\System32\audiodg.exe
1292 C:\Windows\System32\svchost.exe
1452 C:\Windows\System32\svchost.exe
1608 C:\Windows\System32\spoolsv.exe
1620 C:\Windows\System32\taskeng.exe
1656 C:\Program Files\Avira\AntiVir Desktop\sched.exe
1680 C:\Windows\System32\rundll32.exe
1700 C:\Windows\System32\svchost.exe
1800 C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
1852 C:\Program Files\Bonjour\mDNSResponder.exe
1884 C:\Program Files\Common Files\MAGIX Services\Database\bin\FABS.exe
1928 C:\Windows\System32\svchost.exe
1972 C:\Windows\System32\PSIService.exe
2004 C:\Program Files\CyberLink\Shared files\RichVideo.exe
288 C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
296 C:\Windows\System32\svchost.exe
452 C:\PROGRA~1\COMMON~1\X10\Common\X10nets.exe
1360 C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe
2392 C:\Windows\System32\svchost.exe
2648 C:\Windows\System32\taskhost.exe
2664 C:\Windows\System32\dwm.exe
2780 C:\Windows\explorer.exe
2964 C:\Program Files\Launch Manager\HotkeyApp.exe
2992 C:\Windows\System32\hkcmd.exe
3004 C:\Windows\System32\igfxpers.exe
3068 C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
3100 C:\Program Files\Windows Sidebar\sidebar.exe
3120 C:\Program Files\Launch Manager\WisLMSvc.exe
3204 WmiPrvSE.exe
3460 C:\Windows\System32\SearchIndexer.exe
3564 C:\Program Files\Windows Media Player\wmpnetwk.exe
3956 C:\Program Files\Mozilla\Firefox\firefox.exe
2928 C:\Program Files\Nero\Update\NASvc.exe
2564 C:\Windows\System32\sppsvc.exe
3380 dllhost.exe
3308 dllhost.exe
2812 C:\Users\Peter3\Desktop\MBRCheck.exe
2640 C:\Windows\System32\conhost.exe

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`06500000 (NTFS)
\\.\D: --> \\.\PhysicalDrive0 at offset 0x0000006a`30900000 (NTFS)

PhysicalDrive0 Model Number: WDCWD5000BEVT-22A0RT0, Rev: 01.01A01

Size Device Name MBR Status
--------------------------------------------
465 GB \\.\PhysicalDrive0 Windows 2008 MBR code detected
SHA1: 8DF43F2BDE2D9451948FA14B5279969C777A7979


Done!

-----------------

gmer.log:
GMER Logfile:
Code:
GMER 1.0.15.15530 - hxxp://www.gmer.net
Rootkit scan 2011-02-11 07:37:21
Windows 6.1.7600  Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 WDC_WD50 rev.01.0
Running: u7xo34y3.exe; Driver: C:\Users\Peter3\AppData\Local\Temp\fxlyykog.sys


---- Kernel code sections - GMER 1.0.15 ----

.text          ntkrnlpa.exe!ZwSaveKeyEx + 13BD                                                                                    8324B589 1 Byte  [06]
.text          ntkrnlpa.exe!KiDispatchInterrupt + 5A2                                                                              83270092 19 Bytes  [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3}

---- User IAT/EAT - GMER 1.0.15 ----

IAT            C:\Windows\system32\rundll32.exe[1588] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!GetProcAddress]              [75D55E25] C:\Windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)
IAT            C:\Windows\system32\rundll32.exe[1588] @ C:\Windows\system32\GDI32.dll [KERNEL32.dll!GetProcAddress]                [75D55E25] C:\Windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)
IAT            C:\Windows\system32\rundll32.exe[1588] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!GetProcAddress]              [75D55E25] C:\Windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)
IAT            C:\Windows\system32\rundll32.exe[1588] @ C:\Windows\system32\ADVAPI32.dll [KERNEL32.dll!GetProcAddress]            [75D55E25] C:\Windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)
IAT            C:\Windows\system32\rundll32.exe[1588] @ C:\Windows\system32\WININET.dll [KERNEL32.dll!GetProcAddress]              [75D55E25] C:\Windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)
IAT            C:\Windows\system32\rundll32.exe[1588] @ C:\Windows\system32\CRYPT32.dll [KERNEL32.dll!GetProcAddress]              [75D55E25] C:\Windows\system32\apphelp.dll (Clientbibliothek für Anwendungskompatibilität/Microsoft Corporation)

---- Devices - GMER 1.0.15 ----

Device          \Driver\ACPI_HAL \Device\00000046                                                                                  halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation)

AttachedDevice  \Driver\volmgr \Device\HarddiskVolume1                                                                              fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice  \Driver\volmgr \Device\HarddiskVolume1                                                                              rdyboost.sys (ReadyBoost Driver/Microsoft Corporation)
AttachedDevice  \Driver\volmgr \Device\HarddiskVolume2                                                                              fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice  \Driver\volmgr \Device\HarddiskVolume2                                                                              rdyboost.sys (ReadyBoost Driver/Microsoft Corporation)
AttachedDevice  \Driver\volmgr \Device\HarddiskVolume3                                                                              fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice  \Driver\volmgr \Device\HarddiskVolume3                                                                              rdyboost.sys (ReadyBoost Driver/Microsoft Corporation)
AttachedDevice  \Driver\volmgr \Device\HarddiskVolume4                                                                              fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice  \Driver\volmgr \Device\HarddiskVolume4                                                                              rdyboost.sys (ReadyBoost Driver/Microsoft Corporation)

---- Registry - GMER 1.0.15 ----

Reg            HKLM\SYSTEM\ControlSet001\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)               
Reg            HKLM\SYSTEM\ControlSet001\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0                                    0x06 0x63 0x00 0x00 ...
Reg            HKLM\SYSTEM\ControlSet001\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0                                    0
Reg            HKLM\SYSTEM\ControlSet001\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12                                  0x31 0x0B 0x66 0x85 ...
Reg            HKLM\SYSTEM\ControlSet001\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0                                    C:\Program Files\1\Multimedia\CD_DVD\DAEMON Tools Pro\
Reg            HKLM\SYSTEM\ControlSet001\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001 (not active ControlSet)     
Reg            HKLM\SYSTEM\ControlSet001\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12                        0xAC 0x9D 0xDC 0x5D ...
Reg            HKLM\SYSTEM\ControlSet001\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0                            0xA0 0x02 0x00 0x00 ...
Reg            HKLM\SYSTEM\ControlSet001\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0 (not active ControlSet) 
Reg            HKLM\SYSTEM\ControlSet001\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12                    0x5F 0x77 0x31 0x7F ...
Reg            HKLM\SYSTEM\ControlSet001\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq1 (not active ControlSet) 
Reg            HKLM\SYSTEM\ControlSet001\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq1@hdf12                    0x2C 0x83 0xD2 0xC1 ...
Reg            HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC                                   
Reg            HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0                                0x63 0x34 0x00 0x00 ...
Reg            HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0                                0
Reg            HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12                              0x49 0xBA 0x49 0x84 ...
Reg            HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0                                C:\Program Files\DAEMON Tools Pro\
Reg            HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001                         
Reg            HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12                    0xAC 0x9D 0xDC 0x5D ...
Reg            HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0                        0xA0 0x02 0x00 0x00 ...
Reg            HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0                     
Reg            HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12                0x8C 0x4C 0xCD 0x54 ...
Reg            HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq1                     
Reg            HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq1@hdf12                0x2C 0x83 0xD2 0xC1 ...
Reg            HKLM\SYSTEM\ControlSet003\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)               
Reg            HKLM\SYSTEM\ControlSet003\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0                                    0x63 0x34 0x00 0x00 ...
Reg            HKLM\SYSTEM\ControlSet003\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0                                    0
Reg            HKLM\SYSTEM\ControlSet003\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12                                  0x49 0xBA 0x49 0x84 ...
Reg            HKLM\SYSTEM\ControlSet003\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0                                    C:\Program Files\DAEMON Tools Pro\
Reg            HKLM\SYSTEM\ControlSet003\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001 (not active ControlSet)     
Reg            HKLM\SYSTEM\ControlSet003\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12                        0xAC 0x9D 0xDC 0x5D ...
Reg            HKLM\SYSTEM\ControlSet003\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0                            0xA0 0x02 0x00 0x00 ...
Reg            HKLM\SYSTEM\ControlSet003\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0 (not active ControlSet) 
Reg            HKLM\SYSTEM\ControlSet003\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12                    0x8C 0x4C 0xCD 0x54 ...
Reg            HKLM\SYSTEM\ControlSet003\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq1 (not active ControlSet) 
Reg            HKLM\SYSTEM\ControlSet003\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq1@hdf12                    0x2C 0x83 0xD2 0xC1 ...

---- EOF - GMER 1.0.15 ----
--- --- ---

Anm: Nach Durchführen des MBR-Fixes mittels Boot-CD (Komischerweise wurde da nur ein Bereich auf D: angezeigt und nicht auf C: ) und Neustart blieb Windows nach dem Startbildschirm (Windows wird geladen) mit schwarzem Bildschirm und beweglichem Mauszeiger hängen, d.h., die Seite zurAuswahl eines Benutzerkontos kam nicht. Auschalten, Neustart, Auswahlbildschirm "Windows normal starten" - dann kam Meldung, dass Konsistenzprüfung nötig sei und dann wurden eine Menge Dateiattribute geändert. Danach Fortsetzung mit normalem Startvorgang.

ich harre weiterer Anweisungen
Peter


Alle Zeitangaben in WEZ +1. Es ist jetzt 15:42 Uhr.
Seite 2 von 3 1 2 3
100 Beiträge dieses Themas auf einer Seite anzeigen

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19