Trojaner-Board
Seite 1 von 2 1 2
100 Beiträge dieses Themas auf einer Seite anzeigen

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   Spyeye Trojaner hat laut Bank meinen PC infiziert (https://www.trojaner-board.de/95504-spyeye-trojaner-hat-laut-bank-meinen-pc-infiziert.html)

MaximilianSW 08.02.2011 15:36
Spyeye Trojaner hat laut Bank meinen PC infiziert
 
Hallo,

ich habe vor ca. 2 Wochen einen Anruf meiner Bank erhalten, dass ich den Trojaner "Spy Eye" auf dem PC habe. Laut Bank sollte ich meinen ganzen PC wieder neu aufsetzen, jedoch habe ich hier auf dem Trojaner-Board schon einige nützliche Hinweise bekommen, dass ich dies evtl. umgehen kann.

Ich habe mir nun den Thread: http://www.trojaner-board.de/95246-s...ufsetzung.html

schon durchgelesen und mir ebenfalls OTL und Malwarebytes heruntergeladen. Im Anhang findet ihr meine Log Datein. Ich musste schon bei Malware 14 Datein in die Quarantäne verschieben. Antiwir hatte und habe ich auch immer, jedoch hat es nicht gegen SPYEYE geholfen. Ich habe einen Sony Vaio FW21E, wenn dies etwas ausmacht. Ich hoffe ihr könnt mir helfen!

cosinus 09.02.2011 12:29
Wurden die Funde wirklich entfernt?

Gibt es noch weitere Logs von Malwarebytes? Wenn ja bitte alle posten, die in Malwarebytes im Reiter Logdateien sichtbar sind.

MaximilianSW 10.02.2011 20:11
Hi,

nein weitere Log Datein habe ich leider nicht, habe die Programme auch erst jetzt vor kurzem installiert.

Die Datein sollen laut Maleware nicht mehr drauf sein. Jedenfalls habe ich nun noch einen komplett Scan gemacht und dort steht nix, das er gefunden hat. Was muss ich als nächstes tun?

cosinus 10.02.2011 20:24
Beende alle Programme, starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)

Code:
:OTL
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 22:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{3e64bc0d-c848-11dd-939d-001dba811594}\Shell - "" = AutoRun
O33 - MountPoints2\{3e64bc0d-c848-11dd-939d-001dba811594}\Shell\AutoRun\command - "" = G:\start.exe
O33 - MountPoints2\{58ca1ad2-f3c5-11de-af94-001dba811594}\Shell - "" = AutoRun
O33 - MountPoints2\{58ca1ad2-f3c5-11de-af94-001dba811594}\Shell\AutoRun\command - "" = "J:\WD SmartWare.exe" autoplay=true
O33 - MountPoints2\{68cbbda3-182d-11e0-b421-001dba811594}\Shell\AutoRun\command - "" = I:\jossamludja\\\nittvoja.exe
O33 - MountPoints2\{68cbbda3-182d-11e0-b421-001dba811594}\Shell\explore\command - "" = I:\jossamludja\\\nittvoja.exe
O33 - MountPoints2\{68cbbda3-182d-11e0-b421-001dba811594}\Shell\Install\command - "" = I:\jossamludja\\\nittvoja.exe
O33 - MountPoints2\{68cbbda3-182d-11e0-b421-001dba811594}\Shell\open\command - "" = I:\jossamludja\\\nittvoja.exe
O33 - MountPoints2\{82ca40c2-ecbb-11df-9c3e-001dba811594}\Shell\AutoRun\command - "" = I:\shelexec.exe start.html
O33 - MountPoints2\{82ca40c8-ecbb-11df-9c3e-001dba811594}\Shell\AutoRun\command - "" = I:\shelexec.exe start.html
O33 - MountPoints2\{e26b45ce-3b49-11df-8f80-001dba811594}\Shell\AutoRun\command - "" = I:\shelexec.exe start.html
O33 - MountPoints2\{eae6426d-dba1-11df-9087-001dba811594}\Shell - "" = AutoRun
O33 - MountPoints2\{eae6426d-dba1-11df-9087-001dba811594}\Shell\AutoRun\command - "" = I:\LaunchU3.exe -a
@Alternate Data Stream - 206 bytes -> C:\ProgramData\TEMP:F35A93AD
:Files
I:\jossamludja
I:\shelexec.exe
:Commands
[purity]
[resethosts]
[emptytemp]
Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

MaximilianSW 10.02.2011 21:46
So habe das gemacht, wie du mir es sagtest.

cosinus 10.02.2011 21:48
Dann bitte jetzt CF ausführen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix
  • Lade dir ComboFix hier herunter auf deinen Desktop. Benenne es beim Runterladen um in cofi.exe.
http://saved.im/mtm0nzyzmzd5/cofi.jpg
  • Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.
  • Starte cofi.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
    Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.
  • Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.
Wichtiger Hinweis:
Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

MaximilianSW 10.02.2011 22:41
Combofix Logfile:
Code:
ComboFix 11-02-09.05 - Ferdi 10.02.2011  22:25:27.1.2 - x86
Microsoft® Windows Vista™ Home Premium  6.0.6002.2.1252.49.1031.18.3038.1871 [GMT 1:00]
ausgeführt von:: c:\users\Ferdi\Desktop\cofi.exe
AV: AntiVir Desktop *Disabled/Updated* {090F9C29-64CE-6C6F-379C-5901B49A85B7}
SP: AntiVir Desktop *Disabled/Updated* {B26E7DCD-42F4-63E1-0D2C-6273CF1DCF0A}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.

((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\Thumbs.db
c:\windows\system32\twunk_32.exe

.
(((((((((((((((((((((((  Dateien erstellt von 2011-01-10 bis 2011-02-10  ))))))))))))))))))))))))))))))
.

2011-02-10 21:33 . 2011-02-10 21:33        --------        d-----w-        c:\users\Ferdi\AppData\Local\temp
2011-02-10 21:33 . 2011-02-10 21:33        --------        d-----w-        c:\users\Default\AppData\Local\temp
2011-02-10 20:38 . 2011-02-10 20:38        --------        d-----w-        C:\_OTL
2011-02-08 11:38 . 2011-02-08 11:38        --------        d-----w-        c:\users\Ferdi\AppData\Roaming\Malwarebytes
2011-02-08 11:37 . 2010-12-20 17:09        38224        ----a-w-        c:\windows\system32\drivers\mbamswissarmy.sys
2011-02-08 11:37 . 2011-02-08 11:37        --------        d-----w-        c:\programdata\Malwarebytes
2011-02-08 11:37 . 2011-02-08 11:37        --------        d-----w-        c:\program files\Malwarebytes' Anti-Malware
2011-02-08 11:37 . 2010-12-20 17:08        20952        ----a-w-        c:\windows\system32\drivers\mbam.sys
2011-02-08 11:15 . 2011-01-13 09:41        5890896        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{92B5581E-729A-4DE2-B361-BFCE17660EA6}\mpengine.dll
2011-01-29 08:27 . 2011-01-29 08:27        --------        d-----w-        c:\programdata\PC Tools
2011-01-12 13:31 . 2010-12-28 15:55        413696        ----a-w-        c:\windows\system32\odbc32.dll
2011-01-12 13:31 . 2010-12-28 15:53        253952        ----a-w-        c:\program files\Common Files\System\ado\msadox.dll
2011-01-12 13:31 . 2010-12-28 15:53        241664        ----a-w-        c:\program files\Common Files\System\ado\msadomd.dll
2011-01-12 13:31 . 2010-12-28 15:53        708608        ----a-w-        c:\program files\Common Files\System\ado\msado15.dll
2011-01-12 13:31 . 2010-12-28 15:53        57344        ----a-w-        c:\program files\Common Files\System\msadc\msadcs.dll
2011-01-12 13:31 . 2010-12-28 15:53        180224        ----a-w-        c:\program files\Common Files\System\msadc\msadco.dll
2011-01-12 13:31 . 2010-12-14 14:49        1169408        ----a-w-        c:\windows\system32\sdclt.exe

.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-02-24 19:34 . 2009-02-24 19:34        1044480        ----a-w-        c:\program files\mozilla firefox\plugins\libdivx.dll
2009-02-24 19:34 . 2009-02-24 19:34        200704        ----a-w-        c:\program files\mozilla firefox\plugins\ssldivx.dll
.

((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{57BCA5FA-5DBB-45a2-B558-1755C3F6253B}"= "c:\program files\Winamp Toolbar\winamptb.dll" [2008-07-16 1266992]

[HKEY_CLASSES_ROOT\clsid\{57bca5fa-5dbb-45a2-b558-1755c3f6253b}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLTBSearch.1]
[HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLTBSearch]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NSUFloatingUI"="c:\program files\Sony\Network Utility\LANUtil.exe" [2008-07-30 262144]
"VMpTtray.exe"="c:\program files\Sony\VAIO Media plus\VMpTtray.exe" [2008-05-24 86016]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952]
"ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2005-02-16 221184]
"SpybotSD TeaTimer"="c:\program files\Spybot\TeaTimer.exe" [2009-03-05 2260480]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Apoint"="c:\program files\Apoint\Apoint.exe" [2008-02-23 122880]
"AML"="c:\program files\Sony\VAIO Launcher\AML.exe" [2008-06-13 1097728]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-05-14 61440]
"Malwarebytes' Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2010-12-20 963976]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\VESWinlogon]
2008-07-15 16:04        98304        ----a-w-        c:\windows\System32\VESWinlogon.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux9"=wdmaud.drv

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^BTTray.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\BTTray.lnk
backup=c:\windows\pss\BTTray.lnk.CommonStartup
backupExtension=.CommonStartup

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^WDDMStatus.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\WDDMStatus.lnk
backup=c:\windows\pss\WDDMStatus.lnk.CommonStartup
backupExtension=.CommonStartup

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^WDSmartWare.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\WDSmartWare.lnk
backup=c:\windows\pss\WDSmartWare.lnk.CommonStartup
backupExtension=.CommonStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BrStsWnd]
2008-09-18 07:14        880640        ------w-        c:\program files\Brownie\BrStsWnd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EPSON Stylus DX4000 Series]
2006-09-21 02:01        139264        ----a-w-        c:\windows\System32\spool\drivers\w32x86\3\E_FATIBEE.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\googletalk]
2007-01-01 21:22        3739648        ----a-w-        c:\program files\Google\Google Talk\googletalk.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
2008-10-25 10:44        31072        ----a-w-        c:\program files\Microsoft Office\Office12\GrooveMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ICQ]
2011-01-05 08:18        133432        ----a-w-        c:\program files\ICQ7.1\ICQ.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MarketingTools]
2008-08-24 09:00        24576        ----a-w-        c:\program files\Sony\Marketing Tools\MarketingTools.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
2009-07-26 14:44        3883840        ----a-w-        c:\program files\Windows Live\Messenger\msnmsgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
2009-03-05 15:07        2260480        ------w-        c:\program files\Spybot\TeaTimer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
2008-12-24 16:03        39408        ----a-w-        c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"ISUSPM Startup"=c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"ISBMgr.exe"="c:\program files\Sony\ISB Utility\ISBMgr.exe"
"SSBkgdUpdate"="c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" -start
"DNS7reminder"="c:\program files\Nuance\NaturallySpeaking10\Ereg\Ereg.exe" -r "c:\programdata\Nuance\NaturallySpeaking10\Ereg.ini
"QuickTime Task"="c:\program files\Video\QTTask.exe" -atboottime
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe"
"Acrobat Assistant 8.0"="c:\program files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"AntiVirusOverride"=dword:00000001

R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-01-10 135664]
R3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys [2008-07-23 29736]
R3 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance;c:\program files\MAGIX\Common\Database\bin\fbserver.exe [2005-11-17 1527900]
R3 nmwcdnsu;Nokia USB Flashing Phone Parent;c:\windows\system32\drivers\nmwcdnsu.sys [2009-03-19 136704]
R3 nmwcdnsuc;Nokia USB Flashing Generic;c:\windows\system32\drivers\nmwcdnsuc.sys [2009-03-19 8320]
R3 NS-FileZilla;NS-FileZilla;c:\nucserv\bin\filezilla\fzs.exe [2008-11-20 587776]
R3 VcmXmlIfHelper;VAIO Content Metadata XML Interface;c:\program files\Common Files\Sony Shared\VcmXml\VcmXmlIfHelper.exe [2008-06-11 83232]
R3 wacmoumonitor;Wacom Mode Helper;c:\windows\system32\DRIVERS\wacmoumonitor.sys [2008-10-06 15656]
R3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\DRIVERS\wdcsam.sys [2009-02-13 11520]
S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2008-12-12 717296]
S2 AntiVirSchedulerService;Avira AntiVir Planer;c:\program files\Avira\AntiVir Desktop\sched.exe [2009-05-13 108289]
S2 Apache2.2;Apache2.2;c:\xampp\apache\bin\apache.exe [2008-12-09 24636]
S2 NSUService;NSUService;c:\program files\Sony\Network Utility\NSUService.exe [2008-07-30 299008]
S2 regi;regi;c:\windows\system32\drivers\regi.sys [2007-04-17 11032]
S2 SOHCImp;VAIO Media plus Content Importer;c:\program files\Sony\VAIO Media plus\SOHCImp.exe [2008-05-20 103712]
S2 SOHDms;VAIO Media plus Digital Media Server;c:\program files\Sony\VAIO Media plus\SOHDms.exe [2008-05-20 353568]
S2 SOHDs;VAIO Media plus Device Searcher;c:\program files\Sony\VAIO Media plus\SOHDs.exe [2008-05-20 62752]
S2 TabletServicePen;TabletServicePen;c:\windows\system32\Pen_Tablet.exe [2008-12-11 2749736]
S2 VAIO Power Management;VAIO Power Management;c:\program files\Sony\VAIO Power Management\SPMService.exe [2008-08-06 411488]
S2 VCFw;VAIO Content Folder Watcher;c:\program files\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe [2008-06-20 415744]
S2 VcmIAlzMgr;VAIO Content Metadata Intelligent Analyzing Manager;c:\program files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe [2008-06-11 337184]
S2 WDDMService;WD SmartWare Drive Manager;c:\program files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe [2009-09-04 98304]
S2 WDSmartWareBackgroundService;WD SmartWare Background Service;c:\program files\Western Digital\WD SmartWare\Front Parlor\WDSmartWareBackgroundService.exe [2009-06-16 20480]
S3 NETw5v32;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;c:\windows\system32\DRIVERS\NETw5v32.sys [2009-05-28 4233728]
S3 SFEP;Sony Firmware Extension Parser;c:\windows\system32\DRIVERS\SFEP.sys [2008-03-10 9344]


[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs        REG_MULTI_SZ          BthServ

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost  - NetSvcs
UxTuneUp
.
Inhalt des "geplante Tasks" Ordners

2011-02-10 c:\windows\Tasks\1-Klick-Wartung.job
- c:\program files\TuneUp Utilities 2009\OneClickStarter.exe [2009-07-15 10:07]

2011-02-10 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-08-24 04:38]

2011-02-10 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-10 17:11]

2011-02-10 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-10 17:11]

2011-01-03 c:\windows\Tasks\NatSpeak Periodic Acoustic Optimization.job
- c:\program files\Nuance\NaturallySpeaking10\Program\schedmgr.exe [2008-08-12 16:03]

2010-10-29 c:\windows\Tasks\NatSpeak Periodic Data Collection.job
- c:\program files\Nuance\NaturallySpeaking10\Program\datacollector.exe [2008-08-12 16:02]

2011-02-09 c:\windows\Tasks\NatSpeak Periodic Language Model Optimization.job
- c:\program files\Nuance\NaturallySpeaking10\Program\schedmgr.exe [2008-08-12 16:03]

2011-02-10 c:\windows\Tasks\User_Feed_Synchronization-{103B65BD-4798-4CA0-9487-EB211B637804}.job
- c:\windows\system32\msfeedssync.exe [2011-02-09 04:47]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.google.de/
uInternet Settings,ProxyOverride = *.local
IE: &Winamp Search - c:\programdata\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html
IE: An vorhandenes PDF anfügen - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Ausgewählte Verknüpfungen in Adobe PDF konvertieren - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Ausgewählte Verknüpfungen in vorhandene PDF-Datei konvertieren - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Auswahl in Adobe PDF konvertieren - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Auswahl in vorhandene PDF-Datei konvertieren - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Bild an &Bluetooth-Gerät senden... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Free YouTube Download - c:\users\Ferdi\AppData\Roaming\DVDVideoSoftIEHelpers\youtubedownload.htm
IE: In Adobe PDF konvertieren - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Seite an &Bluetooth-Gerät senden... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
IE: Verknüpfungsziel in Adobe PDF konvertieren - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Verknüpfungsziel in vorhandene PDF-Datei konvertieren - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: {{71BFC818-0CED-42D6-9C87-5142918957EE} - c:\program files\ICQ7.1\ICQ.exe
FF - ProfilePath - c:\users\Ferdi\AppData\Roaming\Mozilla\Firefox\Profiles\xvh9g7zq.default\
FF - prefs.js: browser.search.defaulturl - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2685&invocationType=tb50ffwinampie7&query=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - www.google.de
FF - prefs.js: keyword.URL - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2685&invocationType=tb50ffwinampab&query=
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}
FF - Ext: Winamp Toolbar: {0b38152b-1b20-484d-a11f-5e04a9b0661f} - %profile%\extensions\{0b38152b-1b20-484d-a11f-5e04a9b0661f}
FF - Ext: Personas: personas@christopher.beard - %profile%\extensions\personas@christopher.beard
FF - Ext: Cooliris: piclens@cooliris.com - %profile%\extensions\piclens@cooliris.com
FF - Ext: DownThemAll!: {DDC359D1-844A-42a7-9AA1-88A850A938A8} - %profile%\extensions\{DDC359D1-844A-42a7-9AA1-88A850A938A8}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF - Ext: DVDVideoSoft Menu: {ACAA314B-EEBA-48e4-AD47-84E31C44796C} - %profile%\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF - Ext: Google Gears: {000a9d1c-beef-4f90-9363-039d445309b8} - c:\program files\Google\Google Gears\Firefox
FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: nglayout.initialpaint.delay - 600
FF - user.js: content.notify.interval - 600000
FF - user.js: content.max.tokenizing.time - 1800000
FF - user.js: content.switch.threshold - 600000
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -

MSConfigStartUp-Google Desktop Search - c:\program files\Google\Google Desktop Search\GoogleDesktop.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2011-02-10 22:33
Windows 6.0.6002 Service Pack 2 NTFS

Scanne versteckte Prozesse...

Scanne versteckte Autostarteinträge...

Scanne versteckte Dateien...

Scan erfolgreich abgeschlossen
versteckte Dateien: 0

**************************************************************************
.
--------------------- Gesperrte Registrierungsschluessel ---------------------

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Zeit der Fertigstellung: 2011-02-10  22:37:08
ComboFix-quarantined-files.txt  2011-02-10 21:37

Vor Suchlauf: 22 Verzeichnis(se), 130.312.273.920 Bytes frei
Nach Suchlauf: 26 Verzeichnis(se), 129.495.212.032 Bytes frei

- - End Of File - - 74CB110E1D2EA9BE7106A4E4294F34BA
--- --- ---

cosinus 11.02.2011 09:16
Ok. Bitte nun Logs mit GMER und OSAM erstellen und posten.
GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus - die Online-Abfrage durch OSAM bitte überspringen.
Bei OSAM bitte darauf auch achten, dass Du das Log auch als *.log und nicht *.html oder so abspeicherst.


Downloade Dir danach bitte MBRCheck (by a_d_13) und speichere die Datei auf dem Desktop.
  • Doppelklick auf die MBRCheck.exe.
    Vista und Win7 User mit Rechtsklick "als Administrator starten"
  • Das Tool braucht nur wenige Sekunden.
  • Danach solltest du eine MBRCheck_<Datum>_<Uhrzeit>.txt auf dem Desktop finden.
Poste mir bitte den Inhalt des .txt Dokumentes

MaximilianSW 11.02.2011 11:01
GMER ist leider immer abgestürzt!

OSAM Logfile:
Code:
Report of OSAM: Autorun Manager v5.0.11926.0
hxxp://www.online-solutions.ru/en/
Saved at 10:57:59 on 11.02.2011

OS: Windows Vista Home Premium Edition Service Pack 2 (Build 6002), 32-bit
Default Browser: Mozilla Corporation Firefox 3.6.13

Scanner Settings
[x] Rootkits detection (hidden registry)
[x] Rootkits detection (hidden files)
[x] Retrieve files information
[x] Check Microsoft signatures

Filters
[ ] Trusted entries
[ ] Empty entries
[x] Hidden registry entries (rootkit activity)
[x] Exclusively opened files
[x] Not found files
[x] Files without detailed information
[x] Existing files
[ ] Non-startable services
[ ] Non-startable drivers
[x] Active entries
[x] Disabled entries


[Common]
-----( %SystemRoot%\Tasks )-----
"GoogleUpdateTaskMachineCore.job" - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe
"GoogleUpdateTaskMachineUA.job" - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe
"Google Software Updater.job" - "Google" - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
"NatSpeak Periodic Acoustic Optimization.job" - "Nuance Communications, Inc." - C:\Program Files\Nuance\NaturallySpeaking10\Program\schedmgr.exe
"NatSpeak Periodic Data Collection.job" - "Nuance Communications, Inc." - C:\Program Files\Nuance\NaturallySpeaking10\Program\datacollector.exe
"NatSpeak Periodic Language Model Optimization.job" - "Nuance Communications, Inc." - C:\Program Files\Nuance\NaturallySpeaking10\Program\schedmgr.exe
"1-Klick-Wartung.job" - "TuneUp Software GmbH" - C:\Program Files\TuneUp Utilities 2009\OneClickStarter.exe

[Control Panel Objects]
-----( %SystemRoot%\system32 )-----
"ISUSPM.cpl" - "InstallShield Software Corporation" - C:\Windows\system32\ISUSPM.cpl
"PenTablet.cpl" - "Wacom Technology, Corp." - C:\Windows\system32\PenTablet.cpl
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )-----
"Adobe Gamma" - "Adobe Systems, Inc." - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma.cpl
"Adobe Version Cue CS3" - "Adobe Systems Incorporated" - C:\Program Files\Common Files\Adobe\Adobe Version Cue CS3\Server\bin\VersionCueCS3.cpl
"Catcher" - "ReGet Software" - C:\Program Files\Common Files\ReGet Shared\Catcher.cpl
"mlcfg32.cpl" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\MLCFG32.CPL
"NokiaConnectionManager" - "Nokia" - C:\PROGRA~1\Nokia\NOKIAP~1\CONNEC~1.CPL
"PROSet Tools" - "Intel(R) Corporation" - C:\Program Files\Intel\WiFi\bin\iproset.cpl
"QuickTime" - "Apple Inc." - C:\Program Files\Video\QTSystem\QuickTime.cpl
"Stifttablett" - "Wacom Technology, Corp." - C:\Windows\system32\PenTablet.cpl

[Drivers]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"apmqag1y" (apmqag1y) - "Microsoft Corporation" - C:\Windows\system32\drivers\apmqag1y.sys  (Hidden registry entry, rootkit activity | File signed by Microsoft)
"avgio" (avgio) - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\avgio.sys
"avgntflt" (avgntflt) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avgntflt.sys
"avipbb" (avipbb) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avipbb.sys
"catchme" (catchme) - ? - C:\Users\Ferdi\AppData\Local\Temp\catchme.sys  (File not found)
"cpuz132" (cpuz132) - ? - C:\Users\Ferdi\AppData\Local\Temp\cpuz132\cpuz132_x32.sys  (File not found)
"IP in IP Tunnel Driver" (IpInIp) - ? - C:\Windows\System32\DRIVERS\ipinip.sys  (File not found)
"IPX Traffic Filter Driver" (NwlnkFlt) - ? - C:\Windows\System32\DRIVERS\nwlnkflt.sys  (File not found)
"IPX Traffic Forwarder Driver" (NwlnkFwd) - ? - C:\Windows\System32\DRIVERS\nwlnkfwd.sys  (File not found)
"regi" (regi) - "InterVideo" - C:\Windows\system32\drivers\regi.sys
"Service for HDMI" (RTHDMIAzAudService) - ? - C:\Windows\System32\drivers\RtHDMIV.sys  (File not found)
"Service for Realtek HD Audio (WDM)" (IntcAzAudAddService) - ? - C:\Windows\System32\drivers\RTKVHDA.sys  (File not found)
"Sony DMI Call service" (DMICall) - "Sony Corporation" - C:\Windows\System32\DRIVERS\DMICall.sys
"sptd" (sptd) - "Duplex Secure Ltd." - C:\Windows\System32\Drivers\sptd.sys  (File is exclusively opened, access blocked)
"ssmdrv" (ssmdrv) - "Avira GmbH" - C:\Windows\System32\DRIVERS\ssmdrv.sys
"upperdev" (upperdev) - ? - C:\Windows\System32\DRIVERS\usbser_lowerflt.sys  (File not found)
"WimFltr" (WimFltr) - "Microsoft Corporation" - C:\Windows\System32\DRIVERS\wimfltr.sys

[Explorer]
-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----
{F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll
-----( HKLM\Software\Classes\Protocols\Filter )-----
{807563E5-5146-11D5-A672-00B0D022E945} "Microsoft Office InfoPath XML Mime Filter" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
-----( HKLM\Software\Classes\Protocols\Handler )-----
{314111c7-a502-11d2-bbca-00c04f8ec294} "HxProtocol Class" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
{FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} "IEProtocolHandler Class" - "Skype Technologies" - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
{828030A1-22C1-4009-854F-8E305202313F} "livecall" - "Microsoft Corporation" - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
{88FED34C-F0CA-4636-A375-3CB6248B04CD} "Local Groove Web Services Protocol" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
{0A9007C0-4076-11D3-8789-0000F8105754} "Microsoft Infotech Storage Protocol for IE 4.0" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll
{828030A1-22C1-4009-854F-8E305202313F} "msnim" - "Microsoft Corporation" - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks )-----
{B5A7F190-DDA6-4420-B3BA-52453494E6CD} "Groove GFS Stub Execution Hook" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
{AEB6717E-7E19-11d0-97EE-00C04FD91972} "{AEB6717E-7E19-11d0-97EE-00C04FD91972}" - ? -  (File not found | COM-object registry key not found)
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----
{911051fa-c21c-4246-b470-070cd8df6dc4} ".cab or .zip files" - ? -  (File not found | COM-object registry key not found)
{23170F69-40C1-278A-1000-000100020000} "7-Zip Shell Extension" - "Igor Pavlov" - C:\Program Files\7-Zip\7-zip.dll
{D25B2CAB-8A9A-4517-A9B2-CB5F68A5A802} "Acrobat Elements Context Menu" - "Adobe Systems Inc." - C:\Program Files\Adobe\Acrobat 8.0\Acrobat Elements\ContextMenu.dll
{1b24a030-9b20-49bc-97ac-1be4426f9e59} "ActiveDirectory Folder" - ? -  (File not found | COM-object registry key not found)
{34449847-FD14-4fc8-A75A-7432F5181EFB} "ActiveDirectory Folder" - ? -  (File not found | COM-object registry key not found)
{0F8604A5-4ECE-4DE1-BA7D-CF10F8AA4F48} "Contacts folder" - ? -  (File not found | COM-object registry key not found)
{2C2577C2-63A7-40e3-9B7F-586602617ECB} "Explorer Query Band" - ? -  (File not found | COM-object registry key not found)
{99FD978C-D287-4F50-827F-B2C658EDA8E7} "Groove Explorer Icon Overlay 1 (GFS Unread Stub)" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
{AB5C5600-7E6E-4B06-9197-9ECEF74D31CC} "Groove Explorer Icon Overlay 2 (GFS Stub)" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
{920E6DB1-9907-4370-B3A0-BAFC03D81399} "Groove Explorer Icon Overlay 2.5 (GFS Unread Folder)" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
{16F3DD56-1AF5-4347-846D-7C10C4192619} "Groove Explorer Icon Overlay 3 (GFS Folder)" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
{2916C86E-86A6-43FE-8112-43ABE6BF8DCC} "Groove Explorer Icon Overlay 4 (GFS Unread Mark)" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
{2A541AE1-5BF6-4665-A8A3-CFA9672E4291} "Groove Folder Synchronization" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
{72853161-30C5-4D22-B7F9-0BBC1D38A37E} "Groove GFS Browser Helper" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
{6C467336-8281-4E60-8204-430CED96822D} "Groove GFS Context Menu Handler" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
{B5A7F190-DDA6-4420-B3BA-52453494E6CD} "Groove GFS Stub Execution Hook" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
{A449600E-1DC6-4232-B948-9BD794D62056} "Groove GFS Stub Icon Handler" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
{387E725D-DC16-4D76-B310-2C93ED4752A0} "Groove XML Icon Handler" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
{FAC3CBF6-8697-43d0-BAB9-DCD1FCE19D75} "IE User Assist" - ? -  (File not found | COM-object registry key not found)
{42042206-2D85-11D3-8CFF-005004838597} "Microsoft Office HTML Icon Handler" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\msohevi.dll
{993BE281-6695-4BA5-8A2A-7AACBFAAB69E} "Microsoft Office Metadata Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll
{5858A72C-C2B4-4dd7-B2BF-B76DB1BD9F6C} "Microsoft Office OneNote Namespace Extension for Windows Desktop Search" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\ONFILTER.DLL
{00020D75-0000-0000-C000-000000000046} "Microsoft Office Outlook" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\MLSHEXT.DLL
{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97} "Microsoft Office Thumbnail Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll
{7842554E-6BED-11D2-8CDB-B05550C10000} "Monitor Class" - "Broadcom Corporation." - C:\Windows\system32\btncopy.dll
{416651E4-9C3C-11D9-8BDE-F66BAD1E3F3A} "Nokia Phone Browser" - "Nokia" - C:\Program Files\Nokia\Nokia PC Suite 7\PhoneBrowser.dll
{0006F045-0000-0000-C000-000000000046} "Outlook File Icon Extension" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\OLKFSTUB.DLL
{82AA9188-44E0-40B9-B956-43A10C315B4F} "RootShellFolder Class" - "SmartSoft Ltd." - C:\Program Files\SmartFTP Client\sfFTPShellExtension.dll
{C8494E42-ACDD-4739-B0FB-217361E4894F} "Sam Account Folder" - ? -  (File not found | COM-object registry key not found)
{E29F9716-5C08-4FCD-955A-119FDB5A522D} "Sam Account Folder" - ? -  (File not found | COM-object registry key not found)
{45AC2688-0253-4ED8-97DE-B5370FA7D48A} "Shell Extension for Malware scanning" - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\shlext.dll
{2ED7FD81-CBA6-45E5-A49A-5E84889A94E2} "ShellFolderDragDropHandler Class" - "SmartSoft Ltd." - C:\Program Files\SmartFTP Client\sfFTPShellExtension.dll
{119310E6-5FB7-4eeb-BEDB-9E229E76B9B4} "ShellFolderMultiUploadDestination Class" - "SmartSoft Ltd." - C:\Program Files\SmartFTP Client\sfFTPShellExtension.dll
{3B164627-7060-47BB-A1BE-DF5540B02821} "ShellFolderMultiUploadSource Class" - "SmartSoft Ltd." - C:\Program Files\SmartFTP Client\sfFTPShellExtension.dll
{EB5EE1F3-041A-4c03-9D51-2BEC6715FB00} "ShellFolderSearchRoot Class" - "SmartSoft Ltd." - C:\Program Files\SmartFTP Client\sfFTPShellExtension.dll
{5E2121EE-0300-11D4-8D3B-444553540000} "SimpleShlExt Class" - "Advanced Micro Devices, Inc." - C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\atiacmxx.dll
{F87DED31-303F-4ED1-9BCE-D360FBC74E0A} "SmartFTP ContextMenu Shell Extension" - "SmartSoft Ltd" - C:\Program Files\SmartFTP Client\sfShellTools.dll
{EA5A76F7-8138-4B53-B0F5-ADCC730CAFBD} "SmartFTP Drop ShellIconOverlayHandler" - "SmartSoft Ltd" - C:\Program Files\SmartFTP Client\sfShellTools.dll
{39DD67E0-73B6-4a11-AF55-49E1EBBF72BE} "SmartFTP FavoritesShellFolder Class" - "SmartSoft Ltd." - C:\Program Files\SmartFTP Client\sfFavoritesShellExtension.dll
{40FDFA48-5F4E-4627-A78E-6A49A3D4492F} "SmartFTP ShellDropHandler Class" - "SmartSoft Ltd" - C:\Program Files\SmartFTP Client\sfShellTools.dll
{4838CD50-7E5D-4811-9B17-C47A85539F28} "TuneUp Disk Space Explorer Shell Extension" - "TuneUp Software" - C:\Program Files\TuneUp Utilities 2009\DseShExt-x86.dll
{4858E7D9-8E12-45a3-B6A3-1CD128C9D403} "TuneUp Shredder Shell Extension" - "TuneUp Software" - C:\Program Files\TuneUp Utilities 2009\SDShelEx-win32.dll
{44440D00-FF19-4AFC-B765-9A0970567D97} "TuneUp Theme Extension" - "TuneUp Software" - C:\Windows\System32\uxtuneup.dll
{BDEADF00-C265-11D0-BCED-00A0C90AB50F} "Webordner" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\WEBFOL~1\MSONSEXT.DLL
{2BE99FD4-A181-4996-BFA9-58C5FFD11F6C} "Windows Live Photo Gallery Autoplay Drop Target" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\WLXPhotoGallery.exe
{00F30F64-AC33-42F5-8FD1-5DC2D3FDE06C} "Windows Live Photo Gallery Editor Drop Target" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\WLXPhotoGallery.exe
{00F3712A-CA79-45B4-9E4D-D7891E7F8B9D} "Windows Live Photo Gallery Editor Shim" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\PhotoViewerShim.dll
{00F30F90-3E96-453B-AFCD-D71989ECC2C7} "Windows Live Photo Gallery Viewer Autoplay Shim" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\PhotoViewerShim.dll
{00F33137-EE26-412F-8D71-F84E4C2C6625} "Windows Live Photo Gallery Viewer Autoplay Shim" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\PhotoViewerShim.dll
{00F374B7-B390-4884-B372-2FC349F2172B} "Windows Live Photo Gallery Viewer Drop Target" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\WLXPhotoGallery.exe
{00F346CB-35A4-465B-8B8F-65A29DBAB1F6} "Windows Live Photo Gallery Viewer Shim" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\PhotoViewerShim.dll
{da67b8ad-e81b-4c70-9b91b417b5e33527} "Windows Search Shell Service" - ? -  (File not found | COM-object registry key not found)
{B41DB860-8EE4-11D2-9906-E49FADC173CA} "WinRAR" - ? - C:\Program Files\WinRAR\rarext.dll
{06A2568A-CED6-4187-BB20-400B8C02BE5A} "{06A2568A-CED6-4187-BB20-400B8C02BE5A}" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\WLXPhotoAcquireWizard.exe

[Internet Explorer]
-----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )-----
<binary data> "Adobe PDF" - "Adobe Systems Incorporated" - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
<binary data> "DAEMON Tools Toolbar" - ? - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll
ITBar7Height "ITBar7Height" - ? -  (File not found | COM-object registry key not found)
<binary data> "ITBar7Layout" - ? -  (File not found | COM-object registry key not found)
<binary data> "Winamp Toolbar" - "AOL LLC." - C:\Program Files\Winamp Toolbar\winamptb.dll
-----( HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks )-----
{57BCA5FA-5DBB-45a2-B558-1755C3F6253B} "Winamp Search Class" - "AOL LLC." - C:\Program Files\Winamp Toolbar\winamptb.dll
-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----
{CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA} "Java Plug-in 1.6.0_06" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_06-windows-i586.cab
{8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.6.0_15" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} "Java Plug-in 1.6.0_15" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_15" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\npjpi160_15.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----
"@btrez.dll,-4015" - ? - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
{0B4350D1-055F-47A3-B112-5F2F2B0D6F08} "ClsidExtension" - "Google Inc." - C:\Program Files\Google\Google Gears\Internet Explorer\0.5.36.0\gears.dll
{53707962-6F74-2D53-2644-206D7942484F} "ClsidExtension" - "Safer Networking Limited" - C:\Program Files\Spybot\SDHelper.dll
"ICQ7.1" - "ICQ, LLC." - C:\Program Files\ICQ7.1\ICQ.exe
{FF059E31-CC5A-4E2E-BF3B-96E929D65503} "Research" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
{48E73304-E1D6-4330-914C-F5F514E3486C} "Send to OneNote" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar )-----
<binary data> "Adobe PDF" - "Adobe Systems Incorporated" - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
{517BDDE4-E3A7-4570-B21E-2B52B6139FC7} "Contribute Toolbar" - "Adobe Systems Incorporated." - C:\Program Files\Adobe\Adobe Contribute CS3\contributeieplugin.dll
<binary data> "DAEMON Tools Toolbar" - ? - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll
{0BF43445-2F28-4351-9252-17FE6E806AA0} "McAfee SiteAdvisor" - ? -  (File not found | COM-object registry key not found)
{EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} "Winamp Toolbar" - "AOL LLC." - C:\Program Files\Winamp Toolbar\winamptb.dll
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----
{AE7CD045-E861-484f-8273-0445EE161910} "Adobe PDF Conversion Toolbar Helper" - "Adobe Systems Incorporated" - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} "Adobe PDF Reader" - "Adobe Systems Incorporated" - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
{CA6319C0-31B7-401E-A518-A07C3DB8F777} "CBrowserHelperObject Object" - "Your Company Name" - C:\PROGRA~1\GOOGLE~1\BAE.dll
{16664845-0E00-11D2-8059-000000000000} "ClickCatcher MSIE handler" - "ReGet Software" - C:\Program Files\Common Files\ReGet Shared\Catcher.dll
{074C1DC5-9320-4A9A-947D-C042949C6216} "ContributeBHO Class" - "Adobe Systems Incorporated." - C:\Program Files\Adobe\Adobe Contribute CS3\contributeieplugin.dll
{E0FEFE40-FBF9-42AE-BA58-794CA7E3FB53} "Google Gears Helper" - "Google Inc." - C:\Program Files\Google\Google Gears\Internet Explorer\0.5.36.0\gears.dll
{AF69DE43-7D58-4638-B6FA-CE66B5AD205D} "Google Toolbar Notifier BHO" - "Google Inc." - C:\Program Files\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll
{72853161-30C5-4D22-B7F9-0BBC1D38A37E} "Groove GFS Browser Helper" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
{DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2ssv.dll
{53707962-6F74-2D53-2644-206D7942484F} "Spybot-S&D IE Protection" - "Safer Networking Limited" - C:\Program Files\Spybot\SDHelper.dll
{25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} "Winamp Toolbar Loader" - "AOL LLC." - C:\Program Files\Winamp Toolbar\winamptb.dll
{9030D464-4C02-4ABF-8ECC-5164760863C6} "Windows Live Anmelde-Hilfsprogramm" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

[Logon]
-----( %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup )-----
"desktop.ini" - ? - C:\Users\Ferdi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
-----( %AllUsersProfile%\Microsoft\Windows\Start Menu\Programs\Startup )-----
"desktop.ini" - ? - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
-----( HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run )-----
"ISUSPM Startup" - "InstallShield Software Corporation" - C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
"NSUFloatingUI" - "Sony Corporation" - "C:\Program Files\Sony\Network Utility\LANUtil.exe"
"SpybotSD TeaTimer" - "Safer-Networking Ltd." - C:\Program Files\Spybot\TeaTimer.exe
"VMpTtray.exe" - "Sony Corporation" - C:\Program Files\Sony\VAIO Media plus\VMpTtray.exe
-----( HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\Wds\rdpwd )-----
"StartupPrograms" - ? - rdpclip  (File not found)
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----
"Adobe_ID0EYTHM" - "Adobe Systems Incorporated" - C:\PROGRA~1\COMMON~1\Adobe\ADOBEV~1\Server\bin\VERSIO~2.EXE
"AML" - "Sony" - C:\Program Files\Sony\VAIO Launcher\AML.exe InitApp
"avgnt" - "Avira GmbH" - "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
"Malwarebytes' Anti-Malware (reboot)" - "Malwarebytes Corporation" - "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
"StartCCC" - "Advanced Micro Devices, Inc." - "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun

[Print Monitors]
-----( HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors )-----
"Adobe PDF Port" - "Adobe Systems Incorporated." - C:\Windows\system32\AdobePDF.dll
"Send To Microsoft OneNote Monitor" - "Microsoft Corporation" - C:\Windows\system32\msonpmon.dll

[Services]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762##" (Bonjour Service) - "Apple Computer, Inc." - C:\Program Files\Bonjour\mDNSResponder.exe
"@%SystemRoot%\System32\TuneUpDefragService.exe,-1" (TuneUp.Defrag) - "TuneUp Software" - C:\Windows\System32\TuneUpDefragService.exe
"@%SystemRoot%\System32\TUProgSt.exe,-1" (TuneUp.ProgramStatisticsSvc) - "TuneUp Software" - C:\Windows\System32\TUProgSt.exe
"@%SystemRoot%\System32\uxtuneup.dll,-4096" (UxTuneUp) - "TuneUp Software" - C:\Windows\System32\uxtuneup.dll
"Adobe Active File Monitor V6" (AdobeActiveFileMonitor6.0) - ? - C:\Program Files\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe  (File found, but it contains no detailed information)
"Adobe Version Cue CS3 {de_DE} " (Adobe Version Cue CS3) - "Adobe Systems Incorporated" - C:\Program Files\Common Files\Adobe\Adobe Version Cue CS3\Server\bin\VersionCueCS3.exe
"Apache2.2" (Apache2.2) - "Apache Software Foundation" - c:\xampp\apache\bin\apache.exe
"Avira AntiVir Guard" (AntiVirService) - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
"Avira AntiVir Planer" (AntiVirSchedulerService) - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\sched.exe
"VAIO Power Management" (VAIO Power Management) - "Sony Corporation" - C:\Program Files\Sony\VAIO Power Management\SPMService.exe
"Bluetooth Service" (btwdins) - "Broadcom Corporation." - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
"FileZilla Server FTP server" (FileZilla Server) - "FileZilla Project" - c:\xampp\FileZillaFTP\FileZillaServer.exe
"Firebird Server - MAGIX Instance" (FirebirdServerMAGIXInstance) - "MAGIX®" - C:\Program Files\MAGIX\Common\Database\bin\fbserver.exe
"FLEXnet Licensing Service" (FLEXnet Licensing Service) - "Macrovision Europe Ltd." - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
"Google Software Updater" (gusvc) - "Google" - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
"Google Update Service (gupdate)" (gupdate) - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe
"Intel(R) PROSet/Wireless Event Log" (EvtEng) - "Intel(R) Corporation" - C:\Program Files\Intel\WiFi\bin\EvtEng.exe
"Intel(R) PROSet/Wireless Registry Service" (RegSrvc) - "Intel(R) Corporation" - C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
"IviRegMgr" (IviRegMgr) - "InterVideo" - C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
"Microsoft Office Diagnostics Service" (odserv) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE
"Microsoft Office Groove Audit Service" (Microsoft Office Groove Audit Service) - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe
"MSCSPTISRV" (MSCSPTISRV) - "Sony Corporation" - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
"mysql" (mysql) - ? - c:\xampp\mysql\bin\mysqld.exe  (File found, but it contains no detailed information)
"NS-FileZilla" (NS-FileZilla) - "FileZilla Project" - C:\NucServ\bin\filezilla\fzs.exe
"NSUService" (NSUService) - "Sony Corporation" - C:\Program Files\Sony\Network Utility\NSUService.exe
"Office Source Engine" (ose) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"PACSPTISVR" (PACSPTISVR) - "Sony Corporation" - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
"ServiceLayer" (ServiceLayer) - "Nokia." - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
"Sony SPTI Service" (SPTISRV) - "Sony Corporation" - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
"TabletServicePen" (TabletServicePen) - "Wacom Technology, Corp." - C:\Windows\system32\Pen_Tablet.exe
"VAIO Content Folder Watcher" (VCFw) - "Sony Corporation" - C:\Program Files\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe
"VAIO Content Metadata Intelligent Analyzing Manager" (VcmIAlzMgr) - "Sony Corporation" - C:\Program Files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe
"VAIO Content Metadata XML Interface" (VcmXmlIfHelper) - "Sony Corporation" - C:\Program Files\Common Files\Sony Shared\VcmXml\VcmXmlIfHelper.exe
"VAIO Entertainment Database Service" (VzCdbSvc) - "Sony Corporation" - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
"VAIO Entertainment TV Device Arbitration Service" (VAIO Entertainment TV Device Arbitration Service) - "Sony Corporation" - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzHardwareResourceManager\VzHardwareResourceManager\VzHardwareResourceManager.exe
"VAIO Entertainment UPnP Client Adapter" (Vcsw) - "Sony Corporation" - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe
"VAIO Event Service" (VAIO Event Service) - "Sony Corporation" - C:\Program Files\Sony\VAIO Event Service\VESMgr.exe
"VAIO Media plus Content Importer" (SOHCImp) - "Sony Corporation" - C:\Program Files\Sony\VAIO Media plus\SOHCImp.exe
"VAIO Media plus Device Searcher" (SOHDs) - "Sony Corporation" - C:\Program Files\Sony\VAIO Media plus\SOHDs.exe
"VAIO Media plus Digital Media Server" (SOHDms) - "Sony Corporation" - C:\Program Files\Sony\VAIO Media plus\SOHDms.exe
"WD SmartWare Background Service" (WDSmartWareBackgroundService) - "Memeo" - C:\Program Files\Western Digital\WD SmartWare\Front Parlor\WDSmartWareBackgroundService.exe
"WD SmartWare Drive Manager" (WDDMService) - "WDC" - C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe

[Winlogon]
-----( HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify )-----
"VESWinlogon" - "Sony Corporation" - C:\Windows\system32\VESWinlogon.dll

[Winsock Providers]
-----( HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries )-----
"mdnsNSP" - "Apple Computer, Inc." - C:\Program Files\Bonjour\mdnsNSP.dll

===[ Logfile end ]=========================================[ Logfile end ]===
--- --- ---

If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru

MaximilianSW 11.02.2011 11:01
MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:
Windows Version: Windows Vista Home Premium Edition
Windows Information: Service Pack 2 (build 6002), 32-bit
Base Board Manufacturer: Sony Corporation
BIOS Manufacturer: American Megatrends Inc.
System Manufacturer: Sony Corporation
System Product Name: VGN-FW21E
Logical Drives Mask: 0x000000fc

Kernel Drivers (total 167):
0x82651000 \SystemRoot\system32\ntkrnlpa.exe
0x8261E000 \SystemRoot\system32\hal.dll
0x80400000 \SystemRoot\system32\kdcom.dll
0x80407000 \SystemRoot\system32\mcupdate_GenuineIntel.dll
0x80477000 \SystemRoot\system32\PSHED.dll
0x80488000 \SystemRoot\system32\BOOTVID.dll
0x80490000 \SystemRoot\system32\CLFS.SYS
0x804D1000 \SystemRoot\system32\CI.dll
0x8060F000 \SystemRoot\system32\drivers\Wdf01000.sys
0x8068B000 \SystemRoot\system32\drivers\WDFLDR.SYS
0x80698000 \SystemRoot\System32\Drivers\spsm.sys
0x80798000 \SystemRoot\System32\Drivers\WMILIB.SYS
0x807A1000 \SystemRoot\System32\Drivers\SCSIPORT.SYS
0x805B1000 \SystemRoot\system32\drivers\acpi.sys
0x807C7000 \SystemRoot\system32\drivers\msisadrv.sys
0x807CF000 \SystemRoot\system32\drivers\pci.sys
0x80600000 \SystemRoot\System32\drivers\partmgr.sys
0x807F6000 \SystemRoot\system32\DRIVERS\compbatt.sys
0x8A609000 \SystemRoot\system32\DRIVERS\BATTC.SYS
0x8A613000 \SystemRoot\system32\drivers\volmgr.sys
0x8A622000 \SystemRoot\System32\drivers\volmgrx.sys
0x8A66C000 \SystemRoot\System32\drivers\mountmgr.sys
0x8A67C000 \SystemRoot\system32\DRIVERS\iaStor.sys
0x8A74A000 \SystemRoot\system32\drivers\fltmgr.sys
0x8A77C000 \SystemRoot\system32\drivers\fileinfo.sys
0x8A78C000 \SystemRoot\System32\Drivers\PxHelp20.sys
0x8A803000 \SystemRoot\System32\Drivers\ksecdd.sys
0x8A874000 \SystemRoot\system32\drivers\ndis.sys
0x8A97F000 \SystemRoot\system32\drivers\msrpc.sys
0x8A9AA000 \SystemRoot\system32\drivers\NETIO.SYS
0x8AA0E000 \SystemRoot\System32\drivers\tcpip.sys
0x8AAF8000 \SystemRoot\System32\drivers\fwpkclnt.sys
0x8AC0F000 \SystemRoot\System32\Drivers\Ntfs.sys
0x8AD1F000 \SystemRoot\system32\drivers\volsnap.sys
0x8AD58000 \SystemRoot\System32\Drivers\spldr.sys
0x8AD60000 \SystemRoot\System32\Drivers\mup.sys
0x8AD6F000 \SystemRoot\System32\drivers\ecache.sys
0x8AD96000 \SystemRoot\system32\drivers\disk.sys
0x8ADA7000 \SystemRoot\system32\drivers\CLASSPNP.SYS
0x8ADC8000 \SystemRoot\system32\drivers\crcdisk.sys
0x8ADDE000 \SystemRoot\system32\DRIVERS\tunnel.sys
0x8ADE9000 \SystemRoot\system32\DRIVERS\tunmp.sys
0x8EC02000 \SystemRoot\system32\DRIVERS\atikmdag.sys
0x8F06F000 \SystemRoot\System32\drivers\dxgkrnl.sys
0x8F10E000 \SystemRoot\System32\drivers\watchdog.sys
0x8F11A000 \SystemRoot\system32\DRIVERS\HDAudBus.sys
0x8F1A7000 \SystemRoot\system32\DRIVERS\usbuhci.sys
0x8F1B2000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
0x8F1F0000 \SystemRoot\system32\DRIVERS\usbehci.sys
0x8F20D000 \SystemRoot\system32\DRIVERS\NETw5v32.sys
0x8F620000 \SystemRoot\system32\DRIVERS\yk60x86.sys
0x8F66C000 \SystemRoot\system32\DRIVERS\ohci1394.sys
0x8F67C000 \SystemRoot\system32\DRIVERS\1394BUS.SYS
0x8F68A000 \SystemRoot\system32\DRIVERS\risdptsk.sys
0x8F69B000 \SystemRoot\system32\DRIVERS\rimsptsk.sys
0x8F6B5000 \SystemRoot\system32\DRIVERS\i8042prt.sys
0x8F6C8000 \SystemRoot\system32\DRIVERS\kbdclass.sys
0x8F6D3000 \SystemRoot\system32\DRIVERS\Apfiltr.sys
0x8F6FF000 \SystemRoot\system32\DRIVERS\mouclass.sys
0x8F70A000 \SystemRoot\system32\DRIVERS\SFEP.sys
0x8F70D000 \SystemRoot\system32\DRIVERS\cdrom.sys
0x8F725000 \SystemRoot\System32\Drivers\apmqag1y.SYS
0x8F75B000 \SystemRoot\system32\DRIVERS\intelppm.sys
0x8F76A000 \SystemRoot\system32\DRIVERS\CmBatt.sys
0x8F76E000 \SystemRoot\system32\DRIVERS\wacomvhid.sys
0x8F770000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
0x8F780000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
0x8F787000 \SystemRoot\system32\DRIVERS\WacomVKHid.sys
0x8F789000 \SystemRoot\system32\DRIVERS\msiscsi.sys
0x8F7B8000 \SystemRoot\system32\DRIVERS\storport.sys
0x8F200000 \SystemRoot\system32\DRIVERS\TDI.SYS
0x8ABE1000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
0x8ADF2000 \SystemRoot\system32\DRIVERS\ndistapi.sys
0x8A796000 \SystemRoot\system32\DRIVERS\ndiswan.sys
0x8AC00000 \SystemRoot\system32\DRIVERS\raspppoe.sys
0x8A9E5000 \SystemRoot\system32\DRIVERS\raspptp.sys
0x8A7B9000 \SystemRoot\system32\DRIVERS\rassstp.sys
0x8A7CE000 \SystemRoot\system32\DRIVERS\termdd.sys
0x8F20B000 \SystemRoot\system32\DRIVERS\swenum.sys
0x8FC05000 \SystemRoot\system32\DRIVERS\ks.sys
0x8FC2F000 \SystemRoot\system32\DRIVERS\mssmbios.sys
0x8FC39000 \SystemRoot\system32\DRIVERS\umbus.sys
0x8FC46000 \SystemRoot\system32\DRIVERS\usbhub.sys
0x8FC7B000 \SystemRoot\system32\DRIVERS\mouhid.sys
0x8FC83000 \SystemRoot\system32\DRIVERS\wacommousefilter.sys
0x8FC8B000 \SystemRoot\system32\DRIVERS\kbdhid.sys
0x8FC94000 \SystemRoot\System32\Drivers\NDProxy.SYS
0x8FCA5000 \SystemRoot\system32\drivers\HdAudio.sys
0x8FCE4000 \SystemRoot\system32\drivers\portcls.sys
0x8FD11000 \SystemRoot\system32\drivers\drmk.sys
0x8FD36000 \SystemRoot\system32\DRIVERS\HSXHWAZL.sys
0x90209000 \SystemRoot\system32\DRIVERS\HSX_DPV.sys
0x9030C000 \SystemRoot\system32\DRIVERS\HSX_CNXT.sys
0x903C0000 \SystemRoot\system32\drivers\modem.sys
0x903CD000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
0x903D6000 \SystemRoot\System32\Drivers\Null.SYS
0x903DD000 \SystemRoot\System32\Drivers\Beep.SYS
0x903E4000 \SystemRoot\System32\drivers\vga.sys
0x8FD73000 \SystemRoot\System32\drivers\VIDEOPRT.SYS
0x903F0000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0x903F8000 \SystemRoot\system32\drivers\rdpencdd.sys
0x8FD94000 \SystemRoot\System32\Drivers\Msfs.SYS
0x8FD9F000 \SystemRoot\System32\Drivers\Npfs.SYS
0x90200000 \SystemRoot\System32\DRIVERS\rasacd.sys
0x8FDAD000 \SystemRoot\system32\DRIVERS\tdx.sys
0x8FDC3000 \SystemRoot\system32\DRIVERS\smb.sys
0x90605000 \SystemRoot\system32\drivers\afd.sys
0x9064D000 \SystemRoot\System32\DRIVERS\netbt.sys
0x9067F000 \SystemRoot\system32\DRIVERS\usbccgp.sys
0x90696000 \SystemRoot\system32\DRIVERS\USBD.SYS
0x90698000 \SystemRoot\system32\DRIVERS\pacer.sys
0x906AE000 \SystemRoot\System32\Drivers\usbvideo.sys
0x906CF000 \SystemRoot\system32\DRIVERS\netbios.sys
0x906DD000 \SystemRoot\system32\DRIVERS\wanarp.sys
0x906F0000 \SystemRoot\system32\DRIVERS\ssmdrv.sys
0x906F6000 \SystemRoot\system32\DRIVERS\rdbss.sys
0x90732000 \SystemRoot\system32\DRIVERS\hidusb.sys
0x9073B000 \SystemRoot\system32\drivers\nsiproxy.sys
0x90745000 \SystemRoot\system32\DRIVERS\DMICall.sys
0x90746000 \SystemRoot\System32\Drivers\dfsc.sys
0x9075D000 \SystemRoot\system32\DRIVERS\avipbb.sys
0x90783000 \??\C:\Program Files\Avira\AntiVir Desktop\avgio.sys
0x90785000 \SystemRoot\System32\Drivers\BTHUSB.sys
0x8AB13000 \SystemRoot\System32\Drivers\bthport.sys
0x90792000 \SystemRoot\system32\DRIVERS\cdfs.sys
0x907A8000 \SystemRoot\System32\Drivers\crashdmp.sys
0x9160B000 \SystemRoot\System32\Drivers\dump_iaStor.sys
0x916D9000 \SystemRoot\system32\DRIVERS\rfcomm.sys
0x91702000 \SystemRoot\system32\DRIVERS\BthEnum.sys
0x9170C000 \SystemRoot\system32\DRIVERS\bthpan.sys
0x91726000 \SystemRoot\system32\DRIVERS\bthmodem.sys
0x91735000 \SystemRoot\system32\drivers\btwavdt.sys
0x9860E000 \SystemRoot\system32\drivers\btwaudio.sys
0x98220000 \SystemRoot\System32\win32k.sys
0x9868F000 \SystemRoot\System32\drivers\Dxapi.sys
0x98699000 \SystemRoot\system32\DRIVERS\btwl2cap.sys
0x986A3000 \SystemRoot\system32\DRIVERS\btwrchid.sys
0x986A6000 \SystemRoot\system32\DRIVERS\monitor.sys
0x98440000 \SystemRoot\System32\TSDDD.dll
0x98460000 \SystemRoot\System32\cdd.dll
0x98470000 \SystemRoot\System32\ATMFD.DLL
0x986B5000 \SystemRoot\system32\drivers\luafv.sys
0x986D0000 \SystemRoot\system32\DRIVERS\avgntflt.sys
0x986E5000 \SystemRoot\system32\drivers\spsys.sys
0x98795000 \SystemRoot\system32\DRIVERS\lltdio.sys
0x987A5000 \SystemRoot\system32\DRIVERS\nwifi.sys
0x987CF000 \SystemRoot\system32\DRIVERS\ndisuio.sys
0x987D9000 \SystemRoot\system32\DRIVERS\rspndr.sys
0x9F406000 \SystemRoot\system32\drivers\HTTP.sys
0x9F473000 \SystemRoot\System32\DRIVERS\srvnet.sys
0x9F490000 \SystemRoot\system32\DRIVERS\bowser.sys
0x9F4A9000 \SystemRoot\System32\drivers\mpsdrv.sys
0x9F4BE000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
0x9F4DD000 \SystemRoot\system32\DRIVERS\mrxsmb10.sys
0x9F516000 \SystemRoot\system32\DRIVERS\mrxsmb20.sys
0x9F52E000 \SystemRoot\System32\DRIVERS\srv2.sys
0x9F556000 \SystemRoot\System32\DRIVERS\srv.sys
0x9F5BC000 \SystemRoot\system32\DRIVERS\mdmxsdk.sys
0xA0800000 \SystemRoot\system32\drivers\peauth.sys
0xA08DE000 \??\C:\Windows\system32\drivers\regi.sys
0xA08E0000 \SystemRoot\System32\Drivers\secdrv.SYS
0xA08EA000 \SystemRoot\System32\drivers\tcpipreg.sys
0xA08F6000 \SystemRoot\system32\DRIVERS\xaudio.sys
0xA08FE000 \SystemRoot\system32\DRIVERS\WUDFRd.sys
0xA0913000 \SystemRoot\system32\DRIVERS\WUDFPf.sys
0x77A30000 \Windows\System32\ntdll.dll
0x10000000 \Program Files\DAEMON\daemon.dll

Processes (total 97):
0 System Idle Process
4 System
448 C:\Windows\System32\smss.exe
584 csrss.exe
656 C:\Windows\System32\wininit.exe
664 csrss.exe
700 C:\Windows\System32\services.exe
736 C:\Windows\System32\lsass.exe
744 C:\Windows\System32\lsm.exe
804 C:\Windows\System32\winlogon.exe
924 C:\Windows\System32\svchost.exe
1004 C:\Windows\System32\svchost.exe
1048 C:\Windows\System32\svchost.exe
1136 C:\Windows\System32\Ati2evxx.exe
1160 C:\Windows\System32\svchost.exe
1184 C:\Windows\System32\svchost.exe
1200 C:\Windows\System32\svchost.exe
1320 C:\Windows\System32\audiodg.exe
1348 C:\Windows\System32\svchost.exe
1364 C:\Windows\System32\SLsvc.exe
1436 C:\Windows\System32\svchost.exe
1552 C:\Windows\System32\svchost.exe
1568 C:\Windows\System32\Ati2evxx.exe
1592 C:\Windows\System32\wisptis.exe
1600 C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe
1804 C:\Windows\System32\wlanext.exe
1896 C:\Windows\System32\spoolsv.exe
1924 C:\Program Files\Avira\AntiVir Desktop\sched.exe
1964 C:\Windows\System32\svchost.exe
908 C:\Program Files\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe
1544 C:\Program Files\Avira\AntiVir Desktop\avguard.exe
1624 C:\xampp\apache\bin\apache.exe
548 C:\Program Files\Bonjour\mDNSResponder.exe
848 C:\Windows\System32\svchost.exe
2076 C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
2112 C:\Program Files\Intel\WiFi\bin\EvtEng.exe
2204 C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
2260 C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
2300 C:\xampp\mysql\bin\mysqld.exe
2384 C:\Program Files\Sony\Network Utility\NSUService.exe
2468 C:\Windows\System32\svchost.exe
2488 C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
2512 C:\Program Files\Sony\VAIO Media plus\SOHCImp.exe
2536 C:\Program Files\Sony\VAIO Media plus\SOHDms.exe
3156 C:\Program Files\Sony\VAIO Media plus\SOHDs.exe
3164 C:\Windows\System32\dwm.exe
3220 C:\Windows\System32\svchost.exe
3240 C:\Windows\System32\wisptis.exe
3248 C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe
3308 C:\Windows\System32\Pen_Tablet.exe
3392 C:\Windows\System32\TUProgSt.exe
3460 C:\Program Files\Sony\VAIO Event Service\VESMgr.exe
3504 C:\Program Files\Sony\VAIO Power Management\SPMService.exe
3536 dllhost.exe
3568 C:\Windows\System32\WTablet\Pen_TabletUser.exe
3620 C:\xampp\apache\bin\apache.exe
3628 C:\Windows\System32\Pen_Tablet.exe
4488 C:\Program Files\Sony\VAIO Event Service\VESMgrSub.exe
4732 dllhost.exe
4780 C:\Program Files\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe
4820 C:\Windows\System32\taskeng.exe
4868 C:\Program Files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe
4884 C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
4924 C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe
4952 C:\Program Files\Western Digital\WD SmartWare\Front Parlor\WDSmartWareBackgroundService.exe
5184 C:\Windows\System32\svchost.exe
5216 C:\Windows\System32\drivers\XAudio.exe
5328 C:\Windows\explorer.exe
5432 WUDFHost.exe
5604 WmiPrvSE.exe
5652 C:\Windows\System32\taskeng.exe
5888 C:\Program Files\Sony\VAIO Power Management\SPMgr.exe
5928 C:\Windows\System32\taskeng.exe
6104 C:\Program Files\Sony\VAIO Update 4\VAIOUpdt.exe
3040 C:\Program Files\Google\Update\1.2.183.39\GoogleCrashHandler.exe
5280 C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe
1632 C:\Program Files\Apoint\Apoint.exe
1244 C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
1764 C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
5540 C:\Program Files\Sony\Network Utility\LANUtil.exe
1772 C:\Program Files\Apoint\ApMsgFwd.exe
5588 C:\Program Files\Sony\VAIO Media plus\VMpTtray.exe
5836 C:\Windows\ehome\ehtray.exe
6152 C:\Windows\ehome\ehmsas.exe
6180 C:\Program Files\Spybot\TeaTimer.exe
6344 C:\Program Files\Apoint\ApntEx.exe
6508 C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
7108 C:\Windows\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
7712 C:\Program Files\Mozilla Firefox\firefox.exe
7876 C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe
8180 C:\Program Files\Windows Media Player\wmpnetwk.exe
7564 C:\Users\Ferdi\Desktop\osam.exe
5384 C:\Windows\System32\dllhost.exe
2848 dllhost.exe
6892 dllhost.exe
7852 C:\Users\Ferdi\Desktop\MBRCheck.exe
2580 C:\Windows\System32\conime.exe

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000002`cde00000 (NTFS)

PhysicalDrive0 Model Number: TOSHIBAMK3252GSX, Rev: LV010A

Size Device Name MBR Status
--------------------------------------------
298 GB \\.\PhysicalDrive0 Windows 2008 MBR code detected
SHA1: 8DF43F2BDE2D9451948FA14B5279969C777A7979


Done!

cosinus 11.02.2011 12:09
Sieht ok aus. Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SASW und poste die Logs.
Denk dran beide Tools zu updaten vor dem Scan!!

MaximilianSW 13.02.2011 10:07
So hier sind nun beide Logs. Einer im Anhang den andern muss ich leider posten.

SUPERAntiSpyware Scan Log
hxxp://www.superantispyware.com

Generated 02/11/2011 at 04:58 PM

Application Version : 4.48.1000

Core Rules Database Version : 6379
Trace Rules Database Version: 4191

Scan type : Complete Scan
Total Scan Time : 01:17:35

Memory items scanned : 1202
Memory threats detected : 0
Registry items scanned : 11939
Registry threats detected : 0
File items scanned : 45993
File threats detected : 8

Adware.Tracking Cookie
C:\Users\Ferdi\AppData\Roaming\Microsoft\Windows\Cookies\ferdi@content.yieldmanager[1].txt
C:\Users\Ferdi\AppData\Roaming\Microsoft\Windows\Cookies\ferdi@content.yieldmanager[3].txt
C:\Users\Ferdi\AppData\Roaming\Microsoft\Windows\Cookies\ferdi@mediaplex[1].txt
C:\Users\Ferdi\AppData\Roaming\Microsoft\Windows\Cookies\ferdi@apmebf[1].txt
C:\Users\Ferdi\AppData\Roaming\Microsoft\Windows\Cookies\ferdi@advertising[1].txt
C:\Users\Ferdi\AppData\Roaming\Microsoft\Windows\Cookies\ferdi@ad.yieldmanager[2].txt
C:\Users\Ferdi\AppData\Roaming\Microsoft\Windows\Cookies\ferdi@de.at.atwola[1].txt
C:\Users\Ferdi\AppData\Roaming\Microsoft\Windows\Cookies\ferdi@doubleclick[1].txt

cosinus 13.02.2011 20:35
Ich wollte Malwarebytes nicht MBRCheck.

MaximilianSW 14.02.2011 12:39
Oh Mist. Hier der Log!

cosinus 14.02.2011 13:54
Zitat:
Datenbank Version: 5740
Du hast Malwarebytes vorher nicht aktualisiert. Bitte updaten und einen Vollscan machen.


Alle Zeitangaben in WEZ +1. Es ist jetzt 21:03 Uhr.
Seite 1 von 2 1 2
100 Beiträge dieses Themas auf einer Seite anzeigen

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19