Trojaner-Board - Downloads langsam (brechen ab) und .exe dateien teilweise nicht ausführbar

Trojaner-Board (https://www.trojaner-board.de/)

- Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)

- - Downloads langsam (brechen ab) und .exe dateien teilweise nicht ausführbar (https://www.trojaner-board.de/96129-downloads-langsam-brechen-ab-exe-dateien-teilweise-ausfuehrbar.html)

Downloads langsam (brechen ab) und .exe dateien teilweise nicht ausführbar

Hallo zusammen,

ich habe seit einigen Tagen das Problem, dass meine Downloads sehr langsam sind oder sogar abbrechen, einige Programme sich nicht updaten lassen (Pokerstars, Malewarebytes) und .exe dateien sich nicht ausführen lassen (Pokerstars).

Hier meine Logs:

OTLOTL Logfile:

Code:

OTL logfile created on: 27.02.2011 22:43:26 - Run 2

OTL by OldTimer - Version 3.2.9.0     Folder = C:\Users\HerrBert\Desktop\Robert Virus

64bit- Ultimate Edition  (Version = 6.1.7600) - Type = NTWorkstation

Internet Explorer (Version = 8.0.7600.16385)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

2,00 Gb Total Physical Memory | 1,00 Gb Available Physical Memory | 58,00% Memory free

4,00 Gb Paging File | 3,00 Gb Available in Paging File | 74,00% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)

Drive C: | 97,56 Gb Total Space | 70,35 Gb Free Space | 72,12% Space Free | Partition Type: NTFS

Drive D: | 146,48 Gb Total Space | 108,86 Gb Free Space | 74,32% Space Free | Partition Type: NTFS

Drive E: | 146,48 Gb Total Space | 116,72 Gb Free Space | 79,68% Space Free | Partition Type: NTFS

Drive F: | 205,54 Gb Total Space | 181,94 Gb Free Space | 88,52% Space Free | Partition Type: NTFS

G: Drive not present or media not loaded

H: Drive not present or media not loaded

I: Drive not present or media not loaded

 

Computer Name: HERRBERT-PC

Current User Name: HerrBert

Logged in as Administrator.

 

Current Boot Mode: Normal

Scan Mode: Current user

Include 64bit Scans

Company Name Whitelist: Off

Skip Microsoft Files: Off

File Age = 30 Days

Output = Minimal

 
 ========== Processes (SafeList) ==========

 

PRC - C:\Programme\Alwil Software\Avast5\AvastUI.exe (AVAST Software)

PRC - C:\Programme\Alwil Software\Avast5\AvastSvc.exe (AVAST Software)

PRC - C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)

PRC - C:\Users\HerrBert\Desktop\Robert Virus\OTL.exe (OldTimer Tools)

PRC - C:\Windows\SysWOW64\PnkBstrA.exe ()

PRC - C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe (Nero AG)

PRC - C:\Program Files (x86)\Gigabyte\EasySaver\ESSVR.EXE ()

 

 
 ========== Modules (SafeList) ==========

 

MOD - C:\Programme\Alwil Software\Avast5\snxhk.dll (AVAST Software)

MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_420fe3fa2b8113bd\comctl32.dll (Microsoft Corporation)

MOD - C:\Users\HerrBert\Desktop\Robert Virus\OTL.exe (OldTimer Tools)

MOD - C:\Windows\SysWOW64\msscript.ocx (Microsoft Corporation)

 

 
 ========== Win32 Services (SafeList) ==========

 

SRV:64bit: - (PnkBstrA) -- C:\Windows\SysNative\PnkBstrA.exe File not found

SRV:64bit: - (avast! Antivirus) -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (AVAST Software)

SRV:64bit: - (AMD External Events Utility) -- C:\Windows\SysNative\atiesrxx.exe (AMD)

SRV:64bit: - (UmRdpService) -- C:\Windows\SysNative\umrdp.dll (Microsoft Corporation)

SRV:64bit: - (PeerDistSvc) -- C:\Windows\SysNative\PeerDistSvc.dll (Microsoft Corporation)

SRV:64bit: - (CscService) -- C:\Windows\SysNative\cscsvc.dll (Microsoft Corporation)

SRV:64bit: - (AppMgmt) -- C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)

SRV - (clr_optimization_v4.0.30319_64) -- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe (Microsoft Corporation)

SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)

SRV - (PnkBstrA) -- C:\Windows\SysWOW64\PnkBstrA.exe ()

SRV - (DAUpdaterSvc) -- E:\Games\Dragon Age\bin_ship\daupdatersvc.service.exe (BioWare)

SRV - (Steam Client Service) -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe (Valve Corporation)

SRV - (Nero BackItUp Scheduler 4.0) -- C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe (Nero AG)

SRV - (ES lite Service) -- C:\Program Files (x86)\Gigabyte\EasySaver\ESSVR.EXE ()

SRV - (pgsql-8.3) -- C:\Program Files (x86)\PostgreSQL\8.3\bin\pg_ctl.exe (PostgreSQL Global Development Group)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV:64bit: - (aswMonFlt) -- C:\Windows\SysNative\drivers\aswMonFlt.sys (AVAST Software)

DRV:64bit: - (atksgt) -- C:\Windows\SysNative\drivers\atksgt.sys ()

DRV:64bit: - (lirsgt) -- C:\Windows\SysNative\drivers\lirsgt.sys ()

DRV:64bit: - (sptd) -- C:\Windows\SysNative\drivers\sptd.sys ()

DRV:64bit: - (atikmdag) -- C:\Windows\SysNative\drivers\atikmdag.sys (ATI Technologies Inc.)

DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)

DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)

DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)

DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)

DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)

DRV:64bit: - (vmbus) -- C:\Windows\SysNative\drivers\vmbus.sys (Microsoft Corporation)

DRV:64bit: - (storflt) -- C:\Windows\SysNative\drivers\vmstorfl.sys (Microsoft Corporation)

DRV:64bit: - (storvsc) -- C:\Windows\SysNative\drivers\storvsc.sys (Microsoft Corporation)

DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)

DRV:64bit: - (s3cap) -- C:\Windows\SysNative\drivers\vms3cap.sys (Microsoft Corporation)

DRV:64bit: - (VMBusHID) -- C:\Windows\SysNative\drivers\VMBusHID.sys (Microsoft Corporation)

DRV:64bit: - (CSC) -- C:\Windows\SysNative\drivers\csc.sys (Microsoft Corporation)

DRV:64bit: - (Ntfs) -- C:\Windows\SysNative\wbem\ntfs.mof ()

DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)

DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)

DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)

DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)

DRV:64bit: - (RTL8167) -- C:\Windows\SysNative\drivers\Rt64win7.sys (Realtek Corporation                                            )

DRV:64bit: - (RTHDMIAzAudService) -- C:\Windows\SysNative\drivers\RtHDMIVX.sys (Realtek Semiconductor Corp.)

DRV - (gdrv) -- C:\Windows\gdrv.sys (Windows (R) Server 2003 DDK provider)

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm

 

IE - HKCU\..\URLSearchHook: {0063BF63-BFFF-4B8F-9D26-4267DF7F17DD} - Reg Error: Key error. File not found

IE - HKCU\..\URLSearchHook: {ba14329e-9550-4989-b3f2-9732e92d17cc} - Reg Error: Key error. File not found

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 
 ========== FireFox ==========

 

FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de"

 

FF - HKLM\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2010.12.13 14:24:17 | 000,000,000 | ---D | M]

FF - HKLM\software\mozilla\Mozilla Firefox 3.6.13\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2010.12.13 14:24:17 | 000,000,000 | ---D | M]

 

[2010.02.04 14:50:37 | 000,000,000 | ---D | M] -- C:\Users\HerrBert\AppData\Roaming\mozilla\Extensions

[2011.02.11 13:38:29 | 000,000,000 | ---D | M] -- C:\Users\HerrBert\AppData\Roaming\mozilla\Firefox\Profiles\lalgv0rp.default\extensions

[2011.02.27 21:42:43 | 000,000,000 | ---D | M] -- C:\Program Files (x86)\mozilla firefox\extensions

[2010.11.02 11:53:45 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml

[2010.11.02 11:53:45 | 000,002,344 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml

[2010.11.02 11:53:45 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml

[2010.11.02 11:53:45 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml

[2010.11.02 11:53:45 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml

 

O1 HOSTS File: ([2010.07.19 15:05:24 | 000,000,098 | ---- | M]) - C:\Windows\SysNative\drivers\etc\Hosts

O1 - Hosts: 127.0.0.1       localhost

O1 - Hosts: ::1       localhost

O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {BA14329E-9550-4989-B3F2-9732E92D17CC} - No CLSID value found.

O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Programme\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)

O4:64bit: - HKLM..\Run: [Skytel] C:\Programme\Realtek\Audio\HDA\SkyTel.exe (Realtek Semiconductor Corp.)

O4 - HKLM..\Run: [avast5] C:\Program Files\Alwil Software\Avast5\avastUI.exe (AVAST Software)

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O9 - Extra Button: ICQ7 - {88EB38EF-4D2C-436D-ABD3-56B232674062} - C:\Program Files (x86)\ICQ7.0\ICQ.exe (ICQ, Inc.)

O9 - Extra 'Tools' menuitem : ICQ7 - {88EB38EF-4D2C-436D-ABD3-56B232674062} - C:\Program Files (x86)\ICQ7.0\ICQ.exe (ICQ, Inc.)

O13 - gopher Prefix: missing

O13 - gopher Prefix: missing

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab (Java Plug-in 1.6.0_15)

O16 - DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab (Java Plug-in 1.6.0_15)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab (Java Plug-in 1.6.0_15)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1

O18:64bit: - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - Reg Error: Key error. File not found

O18:64bit: - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - Reg Error: Key error. File not found

O18:64bit: - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - Reg Error: Key error. File not found

O18:64bit: - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - Reg Error: Key error. File not found

O18:64bit: - Protocol\Handler\msdaipp - No CLSID value found

O18:64bit: - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - Reg Error: Key error. File not found

O18:64bit: - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - Reg Error: Key error. File not found

O18:64bit: - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - Reg Error: Key error. File not found

O18:64bit: - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - Reg Error: Key error. File not found

O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)

O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)

O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)

O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)

O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)

O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)

O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)

O18:64bit: - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)

O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found

O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysWow64\SystemPropertiesPerformance.exe (Microsoft Corporation)

O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found

O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.

O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.

O32 - HKLM CDRom: AutoRun - 1

O33 - MountPoints2\{30b2293d-94ce-11df-84f0-00241d2e133e}\Shell - "" = AutoRun

O33 - MountPoints2\{30b2293d-94ce-11df-84f0-00241d2e133e}\Shell\AutoRun\command - "" = H:\Setup.exe -- File not found

O34 - HKLM BootExecute: (autocheck autochk *) -  File not found

O35:64bit: - HKLM\..comfile [open] -- "%1" %*

O35:64bit: - HKLM\..exefile [open] -- "%1" %*

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*

O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2011.02.11 12:37:25 | 000,000,000 | ---D | C] -- C:\Users\HerrBert\AppData\Roaming\skypePM

[2011.02.11 12:34:50 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Skype

[2011.02.11 12:34:49 | 000,000,000 | R--D | C] -- C:\Program Files (x86)\Skype

[2011.02.11 12:34:48 | 000,000,000 | ---D | C] -- C:\Users\HerrBert\AppData\Roaming\Skype

[2011.02.11 12:34:43 | 000,000,000 | ---D | C] -- C:\ProgramData\Skype

[2011.02.09 07:04:07 | 000,599,040 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msfeeds.dll

[2011.02.09 07:04:06 | 002,447,872 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iertutil.dll

[2011.02.09 07:04:06 | 000,703,488 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msfeeds.dll

[2011.02.09 07:04:06 | 000,256,000 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iepeers.dll

[2011.02.09 07:04:06 | 000,247,808 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll

[2011.02.09 07:04:06 | 000,185,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iepeers.dll

[2011.02.09 07:04:06 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll

[2011.02.09 07:04:06 | 000,097,280 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmled.dll

[2011.02.09 07:04:06 | 000,067,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmled.dll

[2011.02.09 07:04:06 | 000,057,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\licmgr10.dll

[2011.02.09 07:04:06 | 000,044,544 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\licmgr10.dll

[2011.02.09 07:04:06 | 000,012,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msfeedssync.exe

[2011.02.09 07:04:06 | 000,012,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msfeedssync.exe

[2011.02.09 07:04:05 | 000,482,816 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\html.iec

[2011.02.09 07:04:05 | 000,386,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\html.iec

[2011.02.09 07:03:38 | 000,852,480 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript.dll

[2011.02.09 07:03:38 | 000,716,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript.dll

[2011.02.09 07:03:38 | 000,612,352 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\vbscript.dll

[2011.02.09 07:03:38 | 000,428,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\vbscript.dll

[2011.02.09 07:03:37 | 005,510,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ntoskrnl.exe

[2011.02.09 07:03:37 | 001,739,176 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ntdll.dll

[2011.02.09 07:03:36 | 003,957,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntkrnlpa.exe

[2011.02.09 07:03:36 | 003,901,824 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntoskrnl.exe

[2011.02.09 07:03:35 | 000,366,080 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\SysNative\atmfd.dll

[2011.02.09 07:03:35 | 000,294,400 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\atmfd.dll

[2011.02.09 07:03:35 | 000,046,080 | ---- | C] (Adobe Systems) -- C:\Windows\SysNative\atmlib.dll

[2011.02.09 07:03:35 | 000,034,304 | ---- | C] (Adobe Systems) -- C:\Windows\SysWow64\atmlib.dll

[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

 
 ========== Files - Modified Within 30 Days ==========

 

[2011.02.27 22:45:01 | 001,572,864 | -HS- | M] () -- C:\Users\HerrBert\ntuser.dat

[2011.02.27 22:44:20 | 004,689,994 | ---- | M] () -- C:\Users\HerrBert\Desktop\mbam-setup.exe.part

[2011.02.27 22:37:05 | 000,000,000 | ---- | M] () -- C:\Users\HerrBert\Desktop\mbam-setup.exe

[2011.02.27 22:04:39 | 000,014,016 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

[2011.02.27 22:04:39 | 000,014,016 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

[2011.02.27 22:04:20 | 001,507,104 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI

[2011.02.27 22:04:20 | 000,657,428 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat

[2011.02.27 22:04:20 | 000,618,714 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat

[2011.02.27 22:04:20 | 000,130,818 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat

[2011.02.27 22:04:20 | 000,107,034 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat

[2011.02.27 21:59:36 | 000,023,080 | ---- | M] (Windows (R) Server 2003 DDK provider) -- C:\Windows\gdrv.sys

[2011.02.27 21:59:36 | 000,000,006 | -H-- | M] () -- C:\Windows\tasks\SA.DAT

[2011.02.27 21:59:30 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat

[2011.02.27 21:59:25 | 1609,424,896 | -HS- | M] () -- C:\hiberfil.sys

[2011.02.27 21:58:40 | 001,991,138 | -H-- | M] () -- C:\Users\HerrBert\AppData\Local\IconCache.db

[2011.02.11 12:37:28 | 000,000,056 | -H-- | M] () -- C:\Windows\SysWow64\ezsidmv.dat

[2011.02.11 10:46:41 | 000,296,824 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT

[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

 
 ========== Files Created - No Company Name ==========

 

[2011.02.27 22:37:05 | 000,000,000 | ---- | C] () -- C:\Users\HerrBert\Desktop\mbam-setup.exe

[2011.02.27 22:36:55 | 004,198,474 | ---- | C] () -- C:\Users\HerrBert\Desktop\mbam-setup.exe.part

[2011.02.11 12:37:28 | 000,000,056 | -H-- | C] () -- C:\Windows\SysWow64\ezsidmv.dat

[2010.02.04 15:13:09 | 001,499,556 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI

[2010.01.27 16:53:26 | 000,000,400 | ---- | C] () -- C:\Windows\ODBC.INI

[2009.12.27 08:42:17 | 000,000,116 | ---- | C] () -- C:\Windows\NeroDigital.ini

[2009.12.03 14:26:18 | 000,000,010 | ---- | C] () -- C:\Windows\GSetup.ini

[2009.07.14 00:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\SysWow64\BWContextHandler.dll

[2009.07.13 22:03:59 | 000,364,544 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll

[2009.06.19 20:06:22 | 000,197,912 | ---- | C] () -- C:\Windows\SysWow64\physxcudart_20.dll

[2009.06.19 20:06:22 | 000,058,648 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelTraditionalChinese.dll

[2009.06.19 20:06:22 | 000,058,648 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelSwedish.dll

[2009.06.19 20:06:22 | 000,058,648 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelSpanish.dll

[2009.06.19 20:06:22 | 000,058,648 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelSimplifiedChinese.dll

[2009.06.19 20:06:22 | 000,058,648 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelPortugese.dll

[2009.06.19 20:06:22 | 000,058,648 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelKorean.dll

[2009.06.19 20:06:22 | 000,058,648 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelJapanese.dll

[2009.06.19 20:06:22 | 000,058,648 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelGerman.dll

[2009.06.19 20:06:22 | 000,058,648 | ---- | C] () -- C:\Windows\SysWow64\AgCPanelFrench.dll

[2005.04.28 05:22:38 | 003,596,288 | ---- | C] () -- C:\Windows\SysWow64\qt-dx331.dll

[2005.04.28 05:22:34 | 000,831,488 | ---- | C] () -- C:\Windows\SysWow64\libeay32.dll

[2005.04.28 05:22:34 | 000,159,744 | ---- | C] () -- C:\Windows\SysWow64\ssleay32.dll

 
 ========== LOP Check ==========

 

[2010.12.04 16:53:02 | 000,000,000 | ---D | M] -- C:\Users\HerrBert\AppData\Roaming\Azureus

[2010.04.08 21:44:19 | 000,000,000 | ---D | M] -- C:\Users\HerrBert\AppData\Roaming\DAEMON Tools Lite

[2010.12.28 15:45:25 | 000,000,000 | ---D | M] -- C:\Users\HerrBert\AppData\Roaming\DC++

[2010.03.04 18:38:14 | 000,000,000 | ---D | M] -- C:\Users\HerrBert\AppData\Roaming\ICQ

[2010.07.21 22:22:27 | 000,000,000 | ---D | M] -- C:\Users\HerrBert\AppData\Roaming\Ubisoft

[2011.01.13 14:10:44 | 000,032,632 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

 
 ========== Purity Check ==========

 

 

< End of report >

--- --- ---

OTL Logfile:

Code:

OTL Extras logfile created on: 27.02.2011 22:43:26 - Run 2

OTL by OldTimer - Version 3.2.9.0     Folder = C:\Users\HerrBert\Desktop\Robert Virus

64bit- Ultimate Edition  (Version = 6.1.7600) - Type = NTWorkstation

Internet Explorer (Version = 8.0.7600.16385)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

2,00 Gb Total Physical Memory | 1,00 Gb Available Physical Memory | 58,00% Memory free

4,00 Gb Paging File | 3,00 Gb Available in Paging File | 74,00% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)

Drive C: | 97,56 Gb Total Space | 70,35 Gb Free Space | 72,12% Space Free | Partition Type: NTFS

Drive D: | 146,48 Gb Total Space | 108,86 Gb Free Space | 74,32% Space Free | Partition Type: NTFS

Drive E: | 146,48 Gb Total Space | 116,72 Gb Free Space | 79,68% Space Free | Partition Type: NTFS

Drive F: | 205,54 Gb Total Space | 181,94 Gb Free Space | 88,52% Space Free | Partition Type: NTFS

G: Drive not present or media not loaded

H: Drive not present or media not loaded

I: Drive not present or media not loaded

 

Computer Name: HERRBERT-PC

Current User Name: HerrBert

Logged in as Administrator.

 

Current Boot Mode: Normal

Scan Mode: Current user

Include 64bit Scans

Company Name Whitelist: Off

Skip Microsoft Files: Off

File Age = 30 Days

Output = Minimal

 
 ========== Extra Registry (SafeList) ==========

 

 
 ========== File Associations ==========

 
 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)

 

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]

.html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)

 
 ========== Shell Spawning ==========

 
 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]

batfile [open] -- "%1" %* File not found

cmdfile [open] -- "%1" %* File not found

comfile [open] -- "%1" %* File not found

exefile [open] -- "%1" %* File not found

helpfile [open] -- Reg Error: Key error.

htmlfile [edit] -- "C:\Program Files (x86)\Microsoft Office\Office12\msohtmed.exe" %1 (Microsoft Corporation)

htmlfile [print] -- "C:\Program Files (x86)\Microsoft Office\Office12\msohtmed.exe" /p %1 (Microsoft Corporation)

inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)

InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)

piffile [open] -- "%1" %* File not found

regfile [merge] -- Reg Error: Key error.

scrfile [config] -- "%1" File not found

scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)

scrfile [open] -- "%1" /S File not found

txtfile [edit] -- Reg Error: Key error.

Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 File not found

Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)

Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Directory [Winamp.Bookmark] -- "C:\Program Files (x86)\Winamp\Winamp.exe" /BOOKMARK "%1" (Nullsoft)

Directory [Winamp.Enqueue] -- "C:\Program Files (x86)\Winamp\Winamp.exe" /ADD "%1" (Nullsoft)

Directory [Winamp.Play] -- "C:\Program Files (x86)\Winamp\Winamp.exe" "%1" (Nullsoft)

Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Folder [explore] -- Reg Error: Value error.

Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]

batfile [open] -- "%1" %*

cmdfile [open] -- "%1" %*

comfile [open] -- "%1" %*

cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)

exefile [open] -- "%1" %*

helpfile [open] -- Reg Error: Key error.

htmlfile [edit] -- "C:\Program Files (x86)\Microsoft Office\Office12\msohtmed.exe" %1 (Microsoft Corporation)

htmlfile [print] -- "C:\Program Files (x86)\Microsoft Office\Office12\msohtmed.exe" /p %1 (Microsoft Corporation)

inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)

InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)

piffile [open] -- "%1" %*

regfile [merge] -- Reg Error: Key error.

scrfile [config] -- "%1"

scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)

scrfile [open] -- "%1" /S

txtfile [edit] -- Reg Error: Key error.

Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1

Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)

Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Directory [Winamp.Bookmark] -- "C:\Program Files (x86)\Winamp\Winamp.exe" /BOOKMARK "%1" (Nullsoft)

Directory [Winamp.Enqueue] -- "C:\Program Files (x86)\Winamp\Winamp.exe" /ADD "%1" (Nullsoft)

Directory [Winamp.Play] -- "C:\Program Files (x86)\Winamp\Winamp.exe" "%1" (Nullsoft)

Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Folder [explore] -- Reg Error: Value error.

Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

 
 ========== Security Center Settings ==========

 
 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

"cval" = 1

 
 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

 
 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

"VistaSp1" = 28 4D B2 76 41 04 CA 01  [binary data]

"AntiVirusOverride" = 0

"AntiSpywareOverride" = 0

"FirewallOverride" = 0

 
 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

"DisableNotifications" = 0

"EnableFirewall" = 1

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

"DisableNotifications" = 0

"EnableFirewall" = 1

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]

"DisableNotifications" = 0

"EnableFirewall" = 1

 
 ========== Authorized Applications List ==========

 

 
 ========== HKEY_LOCAL_MACHINE Uninstall List ==========

 

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"{0E3DAF3D-FF69-345A-A99E-1FED304CA083}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack

"{90120000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2007

"{90120000-002A-0407-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (German) 2007

"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile

"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile

"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam

"{07300F01-89CA-4CF8-92BD-2A605EB83C95}" = EasySaver B9.0205.1 

"{18D10072035C4515918F7E37EAFAACFC}" = AutoUpdate

"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148

"{26A24AE4-039D-4CA4-87B4-2F83216015FF}" = Java(TM) 6 Update 15

"{33cf58f5-48d8-4575-83d6-96f574e4d83a}" = Nero DriveSpeed

"{359cfc0a-beb1-440d-95ba-cf63a86da34f}" = Nero Recode

"{368ba326-73ad-4351-84ed-3c0a7a52cc53}" = Nero Rescue Agent

"{3FC7CBBC4C1E11DCA1A752EA55D89593}" = DivX Version Checker

"{43e39830-1826-415d-8bae-86845787b54b}" = Nero Vision

"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml

"{595a3116-40bb-4e0f-a2e8-d7951da56270}" = NeroExpress

"{5DB65884-C963-4454-AABA-4CA3089281FA}" = NVIDIA PhysX

"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053

"{62ac81f6-bdd3-4110-9d36-3e9eaab40999}" = Nero CoverDesigner

"{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD

"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update

"{6AFCA4E1-9B78-3640-8F72-A7BF33448200}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729

"{6C64AB8C-F78B-45C0-98E3-6DE9702E0225}" = Microsoft Office Live Meeting 2007

"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable

"{7748ac8c-18e3-43bb-959b-088faea16fb2}" = Nero StartSmart

"{7829db6f-a066-4e40-8912-cb07887c20bb}" = Nero BurnRights

"{7B63B2922B174135AFC0E1377DD81EC2}" = DivX Codec

"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable

"{88EB38EF-4D2C-436D-ABD3-56B232674062}" = ICQ7

"{90120000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2007

"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007

"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007

"{90120000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2007

"{90120000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2007

"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007

"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007

"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007

"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007

"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007

"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007

"{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007

"{90120000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2007

"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007

"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007

"{90120000-00BA-0407-0000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2007

"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

"{9e82b934-9a25-445b-b8df-8012808074ac}" = Nero PhotoSnap

"{a209525b-3377-43f4-b886-32f6b6e7356f}" = Nero WaveEditor

"{A8F2089B-1F79-4BF6-B385-A2C2B0B9A74D}" = ImagXpress

"{A93944F2-D2D4-4750-BFE7-9A288FEAF2CF}" = Apple Application Support

"{AC76BA86-7AD7-1031-7B44-A93000000001}" = Adobe Reader 9.3 - Deutsch

"{AEC81925-9C76-4707-84A9-40696C613ED3}" = Dragon Age: Origins

"{B194272D-1F92-46DF-99EB-8D5CE91CB4EC}" = Adobe AIR

"{b1adf008-e898-4fe2-8a1f-690d9a06acaf}" = DolbyFiles

"{b2ec4a38-b545-4a00-8214-13fe0e915e6d}" = Advertising Center

"{b78120a0-cf84-4366-a393-4d0a59bc546c}" = Menu Templates - Starter Kit

"{B823632F-3B72-4514-8861-B961CE263224}" = PostgreSQL 8.3

"{BBF0A67B-5DBA-452F-9D2E-6F168BC226E4}" = Need for Speed™ SHIFT

"{bd5ca0da-71ad-43da-b19e-6eee0c9adc9a}" = Nero ControlCenter

"{c5a7cb6c-e76d-408f-ba0e-85605420fe9d}" = SoundTrax

"{d025a639-b9c9-417d-8531-208859000af8}" = NeroBurningROM

"{d9dcf92e-72eb-412d-ac71-3b01276e5f8b}" = Nero ShowTime

"{E633D396-5188-4E9D-8F6B-BFB8BF3467E8}" = Skype™ 5.1

"{e8a80433-302b-4ff1-815d-fcc8eac482ff}" = Nero Installer

"{EB900AF8-CC61-4E15-871B-98D1EA3E8025}" = QuickTime

"{EF7E931D-DC84-471B-8DB6-A83358095474}" = EA Download Manager

"{f127d02d-a8ae-4539-a6a8-e1b8375efae9}" = Nero 9 Trial

"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver

"{fbcdfd61-7dcf-4e71-9226-873ba0053139}" = Nero InfoTool

"8461-7759-5462-8226" = Vuze

"Adobe AIR" = Adobe AIR

"Adobe Flash Player ActiveX" = Adobe Flash Player ActiveX

"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin

"avast5" = avast! Free Antivirus

"CCleaner" = CCleaner

"DC++" = DC++ 0.750

"DivX Setup.divx.com" = DivX-Setup

"ENTERPRISE" = Microsoft Office Enterprise 2007

"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware

"Mozilla Firefox (3.6.13)" = Mozilla Firefox (3.6.13)

"PunkBusterSvc" = PunkBuster Services

"Steam App 13140" = America's Army 3

"VL Sound 5.1" = VL Sound 5.1

"VLC media player" = VideoLAN VLC media player 0.8.2

"Winamp" = Winamp (remove only)

"WinRAR archiver" = WinRAR Archivierer

 
 ========== Last 10 Event Log Errors ==========

 

[ Antivirus Events ]

Error - 30.08.2010 12:09:20 | Computer Name = HerrBert-PC | Source = avast! | ID = 33554522

Description = 

 

Error - 30.08.2010 12:15:39 | Computer Name = HerrBert-PC | Source = avast! | ID = 33554522

Description = 

 

Error - 31.08.2010 02:54:46 | Computer Name = HerrBert-PC | Source = avast! | ID = 33554522

Description = 

 

Error - 28.09.2010 11:36:22 | Computer Name = HerrBert-PC | Source = avast! | ID = 33554522

Description = 

 

[ Application Events ]

Error - 11.02.2011 05:46:52 | Computer Name = HerrBert-PC | Source = PostgreSQL | ID = 0

Description = 2011-02-11 09:46:52 GMT FATAL:  bogus data in lock file "postmaster.pid":

 "" 

 

Error - 15.02.2011 06:15:18 | Computer Name = HerrBert-PC | Source = PostgreSQL | ID = 0

Description = 2011-02-15 10:15:18 GMT FATAL:  bogus data in lock file "postmaster.pid":

 "" 

 

Error - 15.02.2011 14:38:18 | Computer Name = HerrBert-PC | Source = PostgreSQL | ID = 0

Description = 2011-02-15 18:38:18 GMT FATAL:  bogus data in lock file "postmaster.pid":

 "" 

 

Error - 16.02.2011 07:29:14 | Computer Name = HerrBert-PC | Source = PostgreSQL | ID = 0

Description = 2011-02-16 11:29:14 GMT FATAL:  bogus data in lock file "postmaster.pid":

 "" 

 

Error - 22.02.2011 12:48:22 | Computer Name = HerrBert-PC | Source = PostgreSQL | ID = 0

Description = 2011-02-22 16:48:22 GMT FATAL:  bogus data in lock file "postmaster.pid":

 "" 

 

Error - 22.02.2011 16:19:28 | Computer Name = HerrBert-PC | Source = SideBySide | ID = 16842832

Description = Fehler beim Generieren des Aktivierungskontexts für "C:\Program Files

 (x86)\Nero\Nero 9\Nero PhotoSnap\PhotoSnapViewer.exe.Manifest". Fehler in  Manifest-

 oder Richtliniendatei "" in Zeile .  Eine für die Anwendung erforderliche Komponentenversion

 steht in Konflikt mit  einer anderen, bereits aktiven Komponentenversion.  In Konflikt

 stehende Komponenten:.  Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_fa62ad231704eab7.manifest.

Komponente

 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_420fe3fa2b8113bd.manifest.

 

Error - 22.02.2011 17:06:19 | Computer Name = HerrBert-PC | Source = PostgreSQL | ID = 0

Description = 2011-02-22 21:06:19 GMT FATAL:  bogus data in lock file "postmaster.pid":

 "" 

 

Error - 25.02.2011 07:53:29 | Computer Name = HerrBert-PC | Source = PostgreSQL | ID = 0

Description = 2011-02-25 11:53:29 GMT FATAL:  bogus data in lock file "postmaster.pid":

 "" 

 

Error - 27.02.2011 16:24:12 | Computer Name = HerrBert-PC | Source = PostgreSQL | ID = 0

Description = 2011-02-27 20:24:12 GMT FATAL:  bogus data in lock file "postmaster.pid":

 "" 

 

Error - 27.02.2011 16:59:38 | Computer Name = HerrBert-PC | Source = PostgreSQL | ID = 0

Description = 2011-02-27 20:59:38 GMT FATAL:  bogus data in lock file "postmaster.pid":

 "" 

 

[ System Events ]

Error - 30.12.2010 08:59:31 | Computer Name = HerrBert-PC | Source = atikmdag | ID = 52236

Description = CPLIB :: General - Invalid Parameter

 

Error - 30.12.2010 08:59:31 | Computer Name = HerrBert-PC | Source = atikmdag | ID = 43029

Description = Display is not active

 

Error - 31.12.2010 09:04:30 | Computer Name = HerrBert-PC | Source = atikmdag | ID = 52236

Description = CPLIB :: General - Invalid Parameter

 

Error - 31.12.2010 09:04:30 | Computer Name = HerrBert-PC | Source = atikmdag | ID = 43029

Description = Display is not active

 

Error - 31.12.2010 11:51:53 | Computer Name = HerrBert-PC | Source = atikmdag | ID = 52236

Description = CPLIB :: General - Invalid Parameter

 

Error - 31.12.2010 11:51:53 | Computer Name = HerrBert-PC | Source = atikmdag | ID = 43029

Description = Display is not active

 

Error - 31.12.2010 16:47:02 | Computer Name = HerrBert-PC | Source = atikmdag | ID = 52236

Description = CPLIB :: General - Invalid Parameter

 

Error - 31.12.2010 16:47:02 | Computer Name = HerrBert-PC | Source = atikmdag | ID = 43029

Description = Display is not active

 

Error - 01.01.2011 06:11:55 | Computer Name = HerrBert-PC | Source = atikmdag | ID = 52236

Description = CPLIB :: General - Invalid Parameter

 

Error - 01.01.2011 06:11:55 | Computer Name = HerrBert-PC | Source = atikmdag | ID = 43029

Description = Display is not active

 

 

< End of report >

--- --- ---

Malwarebytes:

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Datenbank Version: 5363

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

27.02.2011 23:49:53
mbam-log-2011-02-27 (23-49-53).txt

Art des Suchlaufs: Quick-Scan
Durchsuchte Objekte: 166658
Laufzeit: 1 Minute(n), 19 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)

Man kann die Updates manuell installieren für MBAM => http://data.mbamupdates.com/tools/mbam-rules.exe
Einspielen und bitte einen Vollscan machen

Schon mal danke für die schnelle Antwort. Bin jetzt gerade bei meiner Freundin und werde mal das Update laden, bei mir funktionierte gestern Abend kein Download mehr... :confused:
Spiel es dann morgen auf, mache den Vollscan und poste diesen.

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Datenbank Version: 5914

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

01.03.2011 15:00:22
mbam-log-2011-03-01 (15-00-22).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|F:\|)
Durchsuchte Objekte: 286467
Laufzeit: 20 Minute(n), 51 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)

Dieser ist schon einige Tage alt, es wurde auch einiges gefunden aber das Problem bestand danach weiterhin:

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Datenbank Version: 4318

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

27.02.2011 21:58:13
mbam-log-2011-02-27 (21-58-13).txt

Art des Suchlaufs: Quick-Scan
Durchsuchte Objekte: 139071
Laufzeit: 2 Minute(n), 44 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 2
Infizierte Dateiobjekte der Registrierung: 3
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\nofolderoptions (Hijack.FolderOptions) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\nofolderoptions (Hijack.FolderOptions) -> Delete on reboot.

Infizierte Dateiobjekte der Registrierung:
HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\Windows\System\DisableCMD (Hijack.CMDPrompt) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions (Hijack.FolderOptions) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions (Hijack.FolderOptions) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)

Dann bitte jetzt CF ausführen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix

Lade dir ComboFix hier herunter auf deinen Desktop. Benenne es beim Runterladen um in cofi.exe.

http://saved.im/mtm0nzyzmzd5/cofi.jpg

Dann folgende Anleitung durchlesen und abarbeiten -> CCleaner Systembereinigung

Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.

Starte cofi.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.

Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.

Wichtiger Hinweis:

Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

Habe CCleaner und Combofix laufen lassen.

Combofix Logfile:

Code:

ComboFix 11-02-28.07 - HerrBert 01.03.2011  16:02:22.1.4 - x64

Microsoft Windows 7 Ultimate   6.1.7600.0.1252.49.1031.18.2046.1091 [GMT 1:00]

ausgeführt von:: c:\users\HerrBert\Desktop\cofi.exe

AV: avast! Antivirus *Disabled/Updated* {C37D8F93-0602-E43C-40AA-47DAD597F308}

SP: avast! Antivirus *Disabled/Updated* {781C6E77-2038-EBB2-7A1A-7CA8AE10B9B5}

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.
 

(((((((((((((((((((((((   Dateien erstellt von 2011-02-01 bis 2011-03-01  ))))))))))))))))))))))))))))))

.
 

2011-03-01 15:05 . 2011-03-01 15:05        --------        d-----w-        c:\users\postgres\AppData\Local\temp

2011-03-01 15:05 . 2011-03-01 15:05        --------        d-----w-        c:\users\Default\AppData\Local\temp

2011-03-01 13:46 . 2011-02-11 07:30        7947600        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{BB963205-C707-4B2E-8894-46FEB1A780A2}\mpengine.dll

2011-02-27 22:41 . 2010-12-20 17:09        38224        ----a-w-        c:\windows\SysWow64\drivers\mbamswissarmy.sys

2011-02-11 11:37 . 2011-02-23 01:15        --------        d-----w-        c:\users\HerrBert\AppData\Roaming\skypePM

2011-02-11 11:34 . 2011-02-11 11:34        --------        d-----w-        c:\program files (x86)\Common Files\Skype

2011-02-11 11:34 . 2011-02-27 21:21        --------        d-----r-        c:\program files (x86)\Skype

2011-02-11 11:34 . 2011-02-23 02:56        --------        d-----w-        c:\users\HerrBert\AppData\Roaming\Skype

2011-02-11 11:34 . 2011-02-11 11:34        --------        d-----w-        c:\programdata\Skype

2011-02-09 06:03 . 2010-12-18 06:11        714752        ----a-w-        c:\windows\system32\kerberos.dll
 

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2011-03-01 15:06 . 2009-12-03 13:26        23080        ----a-w-        c:\windows\gdrv.sys

2011-02-02 16:11 . 2010-02-04 13:57        270720        ------w-        c:\windows\system32\MpSigStub.exe

2011-01-13 08:47 . 2011-01-13 12:52        38848        ----a-w-        c:\windows\avastSS.scr

2011-01-13 08:47 . 2010-02-04 14:03        188216        ----a-w-        c:\windows\SysWow64\aswBoot.exe

2011-01-13 08:47 . 2011-01-13 12:53        237168        ----a-w-        c:\windows\system32\aswBoot.exe

2011-01-13 08:41 . 2010-02-04 14:03        273488        ----a-w-        c:\windows\system32\drivers\aswSP.sys

2011-01-13 08:40 . 2010-02-04 14:03        51792        ----a-w-        c:\windows\system32\drivers\aswTdi.sys

2011-01-13 08:37 . 2010-02-04 14:03        29264        ----a-w-        c:\windows\system32\drivers\aswRdr.sys

2011-01-13 08:37 . 2010-02-04 14:03        62032        ----a-w-        c:\windows\system32\drivers\aswMonFlt.sys

2011-01-13 08:37 . 2010-02-04 14:03        20560        ----a-w-        c:\windows\system32\drivers\aswFsBlk.sys

2010-12-20 17:08 . 2010-07-16 10:12        24152        ----a-w-        c:\windows\system32\drivers\mbam.sys

.
 

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4
 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-07-14 1475072]
 

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 0 (0x0)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableLUA"= 0 (0x0)

"EnableUIADesktopToggle"= 0 (0x0)

"PromptOnSecureDesktop"= 0 (0x0)
 

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]

"aux"=wdmaud.drv
 

2;2 pgsql-8.3;PostgreSQL Database Server 8.3;c:\program files (x86)\PostgreSQL\8.3\bin\pg_ctl.exe [x]

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]

R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]

R3 DAUpdaterSvc;Dragon Age: Origins - Inhaltsupdater;e:\games\Dragon Age\bin_ship\DAUpdaterSvc.Service.exe [2009-07-26 25832]

S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2010-04-08 834544]

S1 aswSP;aswSP; [x]

S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2009-08-18 203264]

S2 aswFsBlk;aswFsBlk; [x]

S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2011-01-13 62032]

S2 ES lite Service;ES lite Service for program management.;c:\program files (x86)\Gigabyte\EasySaver\ESSVR.EXE [2009-02-05 68136]

S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2009-03-01 187392]
 

.
 

--------- x86-64 -----------
 
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2009-01-20 6963744]

"Skytel"="c:\program files\Realtek\Audio\HDA\Skytel.exe" [2009-01-20 1833504]
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]

"LoadAppInit_DLLs"=0x0

.

------- Zusätzlicher Suchlauf -------

.

uLocal Page = c:\windows\system32\blank.htm

mLocal Page = c:\windows\SysWOW64\blank.htm

IE: Nach Microsoft &Excel exportieren - c:\progra~2\MICROS~1\OFFICE11\EXCEL.EXE/3000

IE: Nach Microsoft E&xel exportieren - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000

FF - ProfilePath - c:\users\HerrBert\AppData\Roaming\Mozilla\Firefox\Profiles\lalgv0rp.default\

FF - prefs.js: browser.startup.homepage - hxxp://www.google.de

FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files (x86)\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} - c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}

.

- - - - Entfernte verwaiste Registrierungseinträge - - - -
 

URLSearchHooks-{ba14329e-9550-4989-b3f2-9732e92d17cc} - (no file)

WebBrowser-{BA14329E-9550-4989-B3F2-9732E92D17CC} - (no file)

AddRemove-PunkBusterSvc - c:\windows\system32\pbsvc_bc2.exe
 
 

.

--------------------- Gesperrte Registrierungsschluessel ---------------------
 

[HKEY_USERS\S-1-5-21-3484260538-3109235418-2342597073-1001\Software\SecuROM\License information*]

"datasecu"=hex:58,7e,f1,6c,da,7c,45,77,d4,0a,fc,e1,24,32,b9,a9,e5,69,54,bc,6e,

   77,e2,97,ff,ab,0a,cd,6e,ff,64,60,52,c2,6b,bd,f3,3a,c8,d9,39,ca,26,d3,2f,f8,\

"rkeysecu"=hex:44,fe,a3,ab,5b,e0,c9,17,c1,f6,ee,ad,2c,6e,9c,a3
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Shockwave Flash Object"
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash9f.ocx"

"ThreadingModel"="Apartment"
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]

@="0"
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]

@="ShockwaveFlash.ShockwaveFlash.9"
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash9f.ocx, 1"
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="ShockwaveFlash.ShockwaveFlash"
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Macromedia Flash Factory Object"
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash9f.ocx"

"ThreadingModel"="Apartment"
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]

@="FlashFactory.FlashFactory.1"
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash9f.ocx, 1"
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="FlashFactory.FlashFactory"
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D4304BCF-B8E9-4B35-BEA0-DC5B522670C2}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil9f.exe,-101"
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D4304BCF-B8E9-4B35-BEA0-DC5B522670C2}\Elevation]

"Enabled"=dword:00000001
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D4304BCF-B8E9-4B35-BEA0-DC5B522670C2}\LocalServer32]

@="c:\\Windows\\SysWow64\\Macromed\\Flash\\FlashUtil9f.exe"
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D4304BCF-B8E9-4B35-BEA0-DC5B522670C2}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2E4BB6BE-A75F-4DC0-9500-68203655A2C4}]

@Denied: (A 2) (Everyone)

@="IFlashBroker"
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2E4BB6BE-A75F-4DC0-9500-68203655A2C4}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2E4BB6BE-A75F-4DC0-9500-68203655A2C4}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"
 

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

------------------------ Weitere laufende Prozesse ------------------------

.

c:\program files\Alwil Software\Avast5\AvastSvc.exe

c:\program files\Alwil Software\Avast5\setup\avast.setup

c:\program files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe

c:\windows\SysWOW64\PnkBstrA.exe

.

**************************************************************************

.

Zeit der Fertigstellung: 2011-03-01  16:08:36 - PC wurde neu gestartet

ComboFix-quarantined-files.txt  2011-03-01 15:08
 

Vor Suchlauf: 7 Verzeichnis(se), 75.138.490.368 Bytes frei

Nach Suchlauf: 11 Verzeichnis(se), 74.753.445.888 Bytes frei
 

- - End Of File - - 13216D9622E651D97D91352FCBCB6747

--- --- ---

Bitte nun Logs mit GMER und mbrcheck erstellen und posten.
GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg

Anleitung zu mbrcheck:
Downloade Dir MBRCheck (by a_d_13) und speichere die Datei auf dem Desktop.

Doppelklick auf die MBRCheck.exe.
Vista und Win7 User mit Rechtsklick "als Administrator starten"
Das Tool braucht nur wenige Sekunden.
Danach solltest du eine MBRCheck_<Datum>_<Uhrzeit>.txt auf dem Desktop finden.

Poste mir bitte den Inhalt des .txt Dokumentes

GMER Logfile:

Code:

GMER 1.0.15.15530 - hxxp://www.gmer.net

Rootkit scan 2011-03-01 18:14:10

Windows 6.1.7600  

Running: ebk8shb5.exe
 
 

---- Registry - GMER 1.0.15 ----
 

Reg  HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg@s1                                                                                                                                                            771343423

Reg  HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg@s2                                                                                                                                                            285507792

Reg  HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg@h0                                                                                                                                                            1

Reg  HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC                                                                                                                              

Reg  HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0                                                                                                                           0x00 0x00 0x00 0x00 ...

Reg  HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0                                                                                                                           0

Reg  HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12                                                                                                                        0xE3 0x38 0x8D 0x92 ...

Reg  HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0                                                                                                                           C:\Program Files (x86)\DAEMON Tools Lite\

Reg  HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001                                                                                                                     

Reg  HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0                                                                                                                  0x20 0x01 0x00 0x00 ...

Reg  HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12                                                                                                               0xBF 0x39 0x66 0xF0 ...

Reg  HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0                                                                                                                

Reg  HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12                                                                                                          0xBB 0x18 0x5E 0xAB ...

Reg  HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)                                                                                                          

Reg  HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0                                                                                                                               0x00 0x00 0x00 0x00 ...

Reg  HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0                                                                                                                               0

Reg  HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12                                                                                                                            0xE3 0x38 0x8D 0x92 ...

Reg  HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0                                                                                                                               C:\Program Files (x86)\DAEMON Tools Lite\

Reg  HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001 (not active ControlSet)                                                                                                 

Reg  HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0                                                                                                                      0x20 0x01 0x00 0x00 ...

Reg  HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12                                                                                                                   0xBF 0x39 0x66 0xF0 ...

Reg  HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0 (not active ControlSet)                                                                                            

Reg  HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12                                                                                                              0xBB 0x18 0x5E 0xAB ...

Reg  HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Persisted@E:\Games\Der Herr der Ringe\xae - Die Eroberung\x2122\Support\The Lord of the Rings - Conquest_uninst.exe  1
 

---- EOF - GMER 1.0.15 ----

--- --- ---

MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:
Windows Version: Windows 7 Ultimate Edition
Windows Information: (build 7600), 64-bit
Base Board Manufacturer: Gigabyte Technology Co., Ltd.
BIOS Manufacturer: Award Software International, Inc.
System Manufacturer: Gigabyte Technology Co., Ltd.
System Product Name: GA-MA770T-UD3P
Logical Drives Mask: 0x000000fd

Kernel Drivers (total 160):
0x02E19000 \SystemRoot\system32\ntoskrnl.exe
0x033F6000 \SystemRoot\system32\hal.dll
0x00BC8000 \SystemRoot\system32\kdcom.dll
0x00C2E000 \SystemRoot\system32\mcupdate_AuthenticAMD.dll
0x00C3B000 \SystemRoot\system32\PSHED.dll
0x00C4F000 \SystemRoot\system32\CLFS.SYS
0x00CAD000 \SystemRoot\system32\CI.dll
0x00EFF000 \SystemRoot\system32\drivers\Wdf01000.sys
0x00FA3000 \SystemRoot\system32\drivers\WDFLDR.SYS
0x010D0000 \SystemRoot\System32\Drivers\spbf.sys
0x011F6000 \SystemRoot\System32\Drivers\WMILIB.SYS
0x01000000 \SystemRoot\System32\Drivers\SCSIPORT.SYS
0x0102F000 \SystemRoot\system32\DRIVERS\ACPI.sys
0x01086000 \SystemRoot\system32\DRIVERS\msisadrv.sys
0x01090000 \SystemRoot\system32\DRIVERS\vdrvroot.sys
0x0109D000 \SystemRoot\system32\DRIVERS\pci.sys
0x00FB2000 \SystemRoot\System32\drivers\partmgr.sys
0x00FC7000 \SystemRoot\system32\DRIVERS\volmgr.sys
0x00E00000 \SystemRoot\System32\drivers\volmgrx.sys
0x00E5C000 \SystemRoot\system32\DRIVERS\pciide.sys
0x00E63000 \SystemRoot\system32\DRIVERS\PCIIDEX.SYS
0x00E73000 \SystemRoot\System32\drivers\mountmgr.sys
0x00E8D000 \SystemRoot\system32\DRIVERS\atapi.sys
0x00E96000 \SystemRoot\system32\DRIVERS\ataport.SYS
0x00EC0000 \SystemRoot\system32\DRIVERS\amdxata.sys
0x00D6D000 \SystemRoot\system32\drivers\fltmgr.sys
0x00ECB000 \SystemRoot\system32\drivers\fileinfo.sys
0x0123F000 \SystemRoot\System32\Drivers\Ntfs.sys
0x01455000 \SystemRoot\System32\Drivers\msrpc.sys
0x014B3000 \SystemRoot\System32\Drivers\ksecdd.sys
0x014CD000 \SystemRoot\System32\Drivers\cng.sys
0x01540000 \SystemRoot\System32\drivers\pcw.sys
0x01551000 \SystemRoot\System32\Drivers\Fs_Rec.sys
0x0167B000 \SystemRoot\system32\drivers\ndis.sys
0x0176D000 \SystemRoot\system32\drivers\NETIO.SYS
0x017CD000 \SystemRoot\System32\Drivers\ksecpkg.sys
0x01801000 \SystemRoot\System32\drivers\tcpip.sys
0x01600000 \SystemRoot\System32\drivers\fwpkclnt.sys
0x0164A000 \SystemRoot\system32\DRIVERS\vmstorfl.sys
0x0155B000 \SystemRoot\system32\DRIVERS\volsnap.sys
0x0165A000 \SystemRoot\System32\Drivers\spldr.sys
0x015A7000 \SystemRoot\System32\drivers\rdyboost.sys
0x01662000 \SystemRoot\System32\Drivers\mup.sys
0x015E1000 \SystemRoot\System32\drivers\hwpolicy.sys
0x01400000 \SystemRoot\System32\DRIVERS\fvevol.sys
0x0143A000 \SystemRoot\system32\DRIVERS\disk.sys
0x01200000 \SystemRoot\system32\DRIVERS\CLASSPNP.SYS
0x00DB9000 \SystemRoot\system32\DRIVERS\cdrom.sys
0x00EDF000 \SystemRoot\System32\Drivers\Null.SYS
0x01674000 \SystemRoot\System32\Drivers\Beep.SYS
0x00EE8000 \SystemRoot\System32\drivers\vga.sys
0x00C00000 \SystemRoot\System32\drivers\VIDEOPRT.SYS
0x00FDC000 \SystemRoot\System32\drivers\watchdog.sys
0x00FEC000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0x00FF5000 \SystemRoot\system32\drivers\rdpencdd.sys
0x00EF6000 \SystemRoot\system32\drivers\rdprefmp.sys
0x00DE3000 \SystemRoot\System32\Drivers\Msfs.SYS
0x00DEE000 \SystemRoot\System32\Drivers\Npfs.SYS
0x03E9B000 \SystemRoot\system32\DRIVERS\tdx.sys
0x03EB9000 \SystemRoot\system32\DRIVERS\TDI.SYS
0x03EC6000 \SystemRoot\System32\Drivers\aswTdi.SYS
0x03ED6000 \SystemRoot\system32\drivers\afd.sys
0x03F60000 \SystemRoot\System32\Drivers\aswRdr.SYS
0x03F6A000 \SystemRoot\System32\DRIVERS\netbt.sys
0x03FAF000 \SystemRoot\system32\DRIVERS\wfplwf.sys
0x03FB8000 \SystemRoot\system32\DRIVERS\pacer.sys
0x03FDE000 \SystemRoot\system32\DRIVERS\netbios.sys
0x03E00000 \SystemRoot\system32\DRIVERS\serial.sys
0x03E1D000 \SystemRoot\system32\DRIVERS\wanarp.sys
0x03E38000 \SystemRoot\system32\DRIVERS\termdd.sys
0x02C92000 \SystemRoot\system32\DRIVERS\rdbss.sys
0x02CE3000 \SystemRoot\system32\drivers\nsiproxy.sys
0x02CEF000 \SystemRoot\system32\DRIVERS\mssmbios.sys
0x02CFA000 \SystemRoot\System32\drivers\discache.sys
0x02D09000 \SystemRoot\system32\drivers\csc.sys
0x02D8C000 \SystemRoot\System32\Drivers\dfsc.sys
0x02DAA000 \SystemRoot\system32\DRIVERS\blbdrive.sys
0x02C00000 \SystemRoot\System32\Drivers\aswSP.SYS
0x02C49000 \SystemRoot\system32\DRIVERS\tunnel.sys
0x02C6F000 \SystemRoot\system32\DRIVERS\amdppm.sys
0x02C84000 \SystemRoot\system32\DRIVERS\wmiacpi.sys
0x04866000 \SystemRoot\system32\DRIVERS\atikmdag.sys
0x04E7D000 \SystemRoot\System32\drivers\dxgkrnl.sys
0x04F71000 \SystemRoot\System32\drivers\dxgmms1.sys
0x04FB7000 \SystemRoot\system32\DRIVERS\HDAudBus.sys
0x04800000 \SystemRoot\system32\DRIVERS\Rt64win7.sys
0x04832000 \SystemRoot\system32\DRIVERS\usbohci.sys
0x042B4000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
0x0430A000 \SystemRoot\system32\DRIVERS\usbehci.sys
0x0431B000 \SystemRoot\system32\DRIVERS\1394ohci.sys
0x04359000 \SystemRoot\System32\Drivers\annuwqn7.SYS
0x0439E000 \SystemRoot\system32\DRIVERS\fdc.sys
0x043AB000 \SystemRoot\system32\DRIVERS\serenum.sys
0x043B7000 \SystemRoot\system32\DRIVERS\parport.sys
0x043D4000 \SystemRoot\system32\DRIVERS\i8042prt.sys
0x04200000 \SystemRoot\system32\DRIVERS\kbdclass.sys
0x0420F000 \SystemRoot\system32\DRIVERS\CompositeBus.sys
0x0421F000 \SystemRoot\system32\DRIVERS\AgileVpn.sys
0x04235000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
0x04259000 \SystemRoot\system32\DRIVERS\ndistapi.sys
0x04265000 \SystemRoot\system32\DRIVERS\ndiswan.sys
0x04294000 \SystemRoot\system32\DRIVERS\raspppoe.sys
0x0483D000 \SystemRoot\system32\DRIVERS\raspptp.sys
0x04FDB000 \SystemRoot\system32\DRIVERS\rassstp.sys
0x043F2000 \SystemRoot\system32\DRIVERS\rdpbus.sys
0x02DBB000 \SystemRoot\system32\DRIVERS\mouclass.sys
0x043FD000 \SystemRoot\system32\DRIVERS\swenum.sys
0x03E4C000 \SystemRoot\system32\DRIVERS\ks.sys
0x02DCA000 \SystemRoot\system32\DRIVERS\umbus.sys
0x04416000 \SystemRoot\system32\DRIVERS\usbhub.sys
0x04470000 \SystemRoot\system32\DRIVERS\flpydisk.sys
0x0447B000 \SystemRoot\System32\Drivers\NDProxy.SYS
0x04490000 \SystemRoot\system32\drivers\RtHDMIVX.sys
0x044BD000 \SystemRoot\system32\drivers\portcls.sys
0x044FA000 \SystemRoot\system32\drivers\drmk.sys
0x0451C000 \SystemRoot\system32\drivers\ksthunk.sys
0x05013000 \SystemRoot\system32\drivers\RTKVHD64.sys
0x051B1000 \SystemRoot\system32\DRIVERS\hidusb.sys
0x051BF000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
0x051D8000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
0x051E1000 \SystemRoot\system32\DRIVERS\USBD.SYS
0x051E3000 \SystemRoot\system32\DRIVERS\mouhid.sys
0x00000000 \SystemRoot\System32\win32k.sys
0x051F0000 \SystemRoot\System32\drivers\Dxapi.sys
0x05000000 \SystemRoot\system32\DRIVERS\monitor.sys
0x00410000 \SystemRoot\System32\TSDDD.dll
0x00610000 \SystemRoot\System32\cdd.dll
0x04522000 \SystemRoot\system32\drivers\luafv.sys
0x04545000 \??\C:\Windows\system32\drivers\aswMonFlt.sys
0x0457F000 \SystemRoot\System32\Drivers\aswFsBlk.SYS
0x04588000 \SystemRoot\system32\drivers\WudfPf.sys
0x045A9000 \SystemRoot\system32\DRIVERS\lltdio.sys
0x02685000 \SystemRoot\system32\DRIVERS\nwifi.sys
0x026D8000 \SystemRoot\system32\DRIVERS\ndisuio.sys
0x026EB000 \SystemRoot\system32\DRIVERS\rspndr.sys
0x02703000 \SystemRoot\system32\DRIVERS\udfs.sys
0x02757000 \SystemRoot\System32\Drivers\crashdmp.sys
0x02765000 \SystemRoot\System32\Drivers\dump_dumpata.sys
0x02771000 \SystemRoot\System32\Drivers\dump_atapi.sys
0x0277A000 \SystemRoot\System32\Drivers\dump_dumpfve.sys
0x040D4000 \SystemRoot\system32\drivers\HTTP.sys
0x0419C000 \SystemRoot\system32\DRIVERS\bowser.sys
0x041BA000 \SystemRoot\System32\drivers\mpsdrv.sys
0x041D2000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
0x04000000 \SystemRoot\system32\DRIVERS\mrxsmb10.sys
0x0404E000 \SystemRoot\system32\DRIVERS\mrxsmb20.sys
0x04071000 \SystemRoot\system32\DRIVERS\atksgt.sys
0x040C0000 \SystemRoot\system32\DRIVERS\lirsgt.sys
0x068BE000 \SystemRoot\system32\drivers\peauth.sys
0x06964000 \SystemRoot\System32\Drivers\secdrv.SYS
0x0696F000 \SystemRoot\System32\DRIVERS\srvnet.sys
0x0699C000 \SystemRoot\System32\drivers\tcpipreg.sys
0x06800000 \SystemRoot\System32\DRIVERS\srv2.sys
0x06C23000 \SystemRoot\System32\DRIVERS\srv.sys
0x06D2A000 \??\C:\Windows\system32\Drivers\PROCEXP113.SYS
0x06D32000 \??\C:\Windows\gdrv.sys
0x776E0000 \Windows\System32\ntdll.dll
0x47AF0000 \Windows\System32\smss.exe
0xFFA00000 \Windows\System32\apisetschema.dll
0xFFB80000 \Windows\System32\autochk.exe

Processes (total 41):
0 System Idle Process
4 System
304 C:\Windows\System32\smss.exe
452 csrss.exe
516 C:\Windows\System32\wininit.exe
540 csrss.exe
576 C:\Windows\System32\services.exe
592 C:\Windows\System32\lsass.exe
600 C:\Windows\System32\lsm.exe
716 C:\Windows\System32\winlogon.exe
752 C:\Windows\System32\svchost.exe
856 C:\Windows\System32\svchost.exe
920 C:\Windows\System32\atiesrxx.exe
984 C:\Windows\System32\svchost.exe
1016 C:\Windows\System32\svchost.exe
328 C:\Windows\System32\svchost.exe
268 C:\Windows\System32\svchost.exe
1136 C:\Windows\System32\svchost.exe
1264 C:\Windows\System32\atieclxx.exe
1396 C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
1540 C:\Windows\explorer.exe
1772 C:\Windows\System32\taskhost.exe
1904 C:\Windows\System32\spoolsv.exe
1932 C:\Windows\System32\svchost.exe
1100 C:\Program Files (x86)\Gigabyte\EasySaver\essvr.exe
1128 C:\Windows\System32\svchost.exe
1316 C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe
1524 C:\Windows\System32\dwm.exe
2244 C:\Windows\SysWOW64\PnkBstrA.exe
2356 C:\Windows\System32\svchost.exe
2772 C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
2224 C:\Program Files\Windows Sidebar\sidebar.exe
2436 C:\Windows\System32\SearchIndexer.exe
2640 C:\Windows\System32\svchost.exe
3360 C:\Program Files\Windows Media Player\wmpnetwk.exe
3648 C:\Windows\System32\svchost.exe
4024 C:\Program Files\Alwil Software\Avast5\AvastUI.exe
2292 C:\Windows\System32\svchost.exe
3372 C:\Users\HerrBert\Desktop\MBRCheck.exe
3000 C:\Windows\System32\conhost.exe
2668 C:\Windows\System32\dllhost.exe

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`06500000 (NTFS)
\\.\D: --> \\.\PhysicalDrive0 at offset 0x00000018`69e61600 (NTFS)
\\.\E: --> \\.\PhysicalDrive0 at offset 0x0000003d`08be7a00 (NTFS)
\\.\F: --> \\.\PhysicalDrive0 at offset 0x00000061`a796de00 (NTFS)

PhysicalDrive0 Model Number: WDCWD6400AAKS-65A7B2, Rev: 01.03B01

Size Device Name MBR Status
--------------------------------------------
596 GB \\.\PhysicalDrive0 Windows 7 MBR code detected
SHA1: 4379A3D43019B46FA357F7DD6A53B45A3CA8FB79

Done!

Sieht ok aus. Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SASW und poste die Logs.
Denk dran beide Tools zu updaten vor dem Scan!!

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Datenbank Version: 5920

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

01.03.2011 22:27:59
mbam-log-2011-03-01 (22-27-59).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|F:\|)
Durchsuchte Objekte: 292216
Laufzeit: 17 Minute(n), 29 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)

SUPERAntiSpyware Scann-Protokoll
hxxp://www.superantispyware.com

Generiert 03/01/2011 bei 11:21 PM

Version der Applikation : 4.49.1000

Version der Kern-Datenbank : 6508
Version der Spur-Datenbank : 4320

Scan Art : kompletter Scann
Totale Scann-Zeit : 00:47:36

Gescannte Speicherelemente : 564
Erfasste Speicher-Bedrohungen : 0
Gescannte Register-Elemente : 13228
Erfasste Register-Bedrohungen : 0
Gescannte Datei-Elemente : 118100
Erfasste Datei-Elemente : 0

Keine Funde. Rechner wieder ok? :)

Alles wieder gut, vielen Dank! :-)

Dann wären wir durch! :abklatsch:

Bitte abschließend die Updates prüfen, unten mein Leitfaden dazu.
Für noch mehr Sicherheit solltest Du nach der beseitigten Infektion auch möglichst alle Passwörter ändern.

Microsoftupdate

Windows XP: Besuch mit dem IE die MS-Updateseite und lass Dir alle wichtigen Updates installieren.

Windows Vista/7: Anleitung Windows-Update

PDF-Reader aktualisieren
Dein Adobe Reader ist nicht aktuell, was ein großes Sicherheitsrisiko darstellt. Du solltest daher besser die alte Version über Systemsteuerung => Software deinstallieren, indem Du dort auf "Adobe Reader x.0" klickst und das Programm entfernst.

Ich empfehle einen alternativen PDF-Reader wie SumatraPDF oder Foxit PDF Reader, beide sind sehr viel schlanker und flotter als der AdobeReader.

Bitte überprüf bei der Gelegenheit auch die Aktualität des Flashplayers, hier der direkte Downloadlink:

Mozilla und andere Browser => http://filepony.de/?q=Flash+Player
Internet Explorer => http://fpdownload.adobe.com/get/flas..._player_ax.exe

Java-Update
Veraltete Java-Installationen sind ein Sicherheitsrisiko, daher solltest Du die alten Versionen löschen (falls vorhanden, am besten mit JavaRa) und auf die neuste aktualisieren. Beende dazu alle Programme (v.a. die Browser), klick danach auf Start, Systemsteuerung, Software und deinstalliere darüber alle aufgelisteten Java-Versionen. Lad Dir danach von hier das aktuelle Java SE Runtime Environment (JRE) herunter und installiere es.