Trojaner-Board - JAVA-Virus

Trojaner-Board (https://www.trojaner-board.de/)

- Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)

- - JAVA-Virus (https://www.trojaner-board.de/97197-java-virus.html)

Zitat:

* Im Speicher befindliches AV aktiv.

hast du AntiVir nicht deaktiviert?

doch hatte ich gemacht. ich kann mir das nur so vorstellen, dass sich av nach dem neustart selbst aktiviert hat.
gruß
tom

Ok. Bitte nun Logs mit GMER und OSAM erstellen und posten.
GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus - die Online-Abfrage durch OSAM bitte überspringen.
Bei OSAM bitte darauf auch achten, dass Du das Log auch als *.log und nicht *.html oder so abspeicherst.

Downloade Dir danach bitte MBRCheck (by a_d_13) und speichere die Datei auf dem Desktop.

Doppelklick auf die MBRCheck.exe.
Vista und Win7 User mit Rechtsklick "als Administrator starten"
Das Tool braucht nur wenige Sekunden.
Danach solltest du eine MBRCheck_<Datum>_<Uhrzeit>.txt auf dem Desktop finden.

Poste mir bitte den Inhalt des .txt Dokumentes

hier das log von gmer

GMER Logfile:

Code:

GMER 1.0.15.15570 - hxxp://www.gmer.net

Rootkit scan 2011-04-09 18:54:57

Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP1T0L0-e TOSHIBA_MK1646GSX rev.LB112D

Running: 96hy17lm.exe; Driver: C:\DOKUME~1\Tom\LOKALE~1\Temp\uwtdipod.sys
 
 

---- System - GMER 1.0.15 ----
 

SSDT            BA6CA4C6                                                                                                                                                                  ZwCreateKey

SSDT            BA6CA4BC                                                                                                                                                                  ZwCreateThread

SSDT            BA6CA4CB                                                                                                                                                                  ZwDeleteKey

SSDT            BA6CA4D5                                                                                                                                                                  ZwDeleteValueKey

SSDT            BA6CA4DA                                                                                                                                                                  ZwLoadKey

SSDT            BA6CA4A8                                                                                                                                                                  ZwOpenProcess

SSDT            BA6CA4AD                                                                                                                                                                  ZwOpenThread

SSDT            BA6CA4E4                                                                                                                                                                  ZwReplaceKey

SSDT            BA6CA4DF                                                                                                                                                                  ZwRestoreKey

SSDT            BA6CA4D0                                                                                                                                                                  ZwSetValueKey
 

---- Kernel code sections - GMER 1.0.15 ----
 

.text           C:\WINDOWS\system32\DRIVERS\nv4_mini.sys                                                                                                                                  section is writeable [0xB8E33360, 0x2F26B7, 0xE8000020]

init            C:\WINDOWS\system32\Drivers\OEM02Afx.sys                                                                                                                                  entry point in "init" section [0xB76AC310]
 

---- Devices - GMER 1.0.15 ----
 

AttachedDevice  \Driver\Kbdclass \Device\KeyboardClass0                                                                                                                                   SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.)

AttachedDevice  \Driver\Kbdclass \Device\KeyboardClass1                                                                                                                                   SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.)

AttachedDevice  \Driver\Ftdisk \Device\HarddiskVolume1                                                                                                                                    tdrpman.sys (Acronis Try&Decide and Restore Points Volume Filter Driver/Acronis)

AttachedDevice  \Driver\Ftdisk \Device\HarddiskVolume2                                                                                                                                    tdrpman.sys (Acronis Try&Decide and Restore Points Volume Filter Driver/Acronis)

AttachedDevice  \Driver\Ftdisk \Device\HarddiskVolume3                                                                                                                                    tdrpman.sys (Acronis Try&Decide and Restore Points Volume Filter Driver/Acronis)

AttachedDevice  \Driver\Ftdisk \Device\HarddiskVolume4                                                                                                                                    tdrpman.sys (Acronis Try&Decide and Restore Points Volume Filter Driver/Acronis)

AttachedDevice  \FileSystem\Fastfat \Fat                                                                                                                                                  fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
 

---- Services - GMER 1.0.15 ----
 

Service         C:\Programme\Dell (*** hidden *** )                                                                                                                                       [AUTO] sprtsvc_dellsupportcenter                                                   <-- ROOTKIT !!!
 

---- Registry - GMER 1.0.15 ----
 

Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04                                                                                          

Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@h0                                                                                       0

Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@ujdew                                                                                    0x75 0xEC 0x9E 0x64 ...

Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04 (not active ControlSet)                                                                      

Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@h0                                                                                           0

Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@ujdew                                                                                        0x75 0xEC 0x9E 0x64 ...
 
 

---- EOF - GMER 1.0.15 ----

--- --- ---

hi arne
beim ausführen von osam habe ich ein problem.
nach punkt 6, nachdem die onlinedatenbank abgefragt wurde habe ich das fenster mit close geschlossen.
punkt 7 kann ich nicht ausführen keine möglichkeit weitere next zu drücken. soll ich jetzt logfile sichern?

Was hab ich zu OSAM geschrieben?!

hier das logfile von osam
OSAM Logfile:

Code:

Report of OSAM: Autorun Manager v5.0.11926.0

Online Solutions. Complex Protection for Information Systems

Saved at 19:46:49 on 09.04.2011
 

OS: Windows XP Professional Service Pack 3 (Build 2600)

Default Browser: Mozilla Corporation Firefox 4.0
 

Scanner Settings

[x] Rootkits detection (hidden registry)

[x] Rootkits detection (hidden files)

[x] Retrieve files information

[x] Check Microsoft signatures
 

Filters

[ ] Trusted entries

[ ] Empty entries

[x] Hidden registry entries (rootkit activity)

[x] Exclusively opened files

[x] Not found files

[x] Files without detailed information

[x] Existing files

[ ] Non-startable services

[ ] Non-startable drivers

[x] Active entries

[x] Disabled entries
 
 

[Common]

-----( %SystemRoot%\Tasks )-----

"GlaryInitialize.job" - "Glarysoft Ltd" - C:\Programme\Glary Utilities\initialize.exe

"GoogleUpdateTaskMachineCore.job" - "Google Inc." - C:\Programme\Google\Update\GoogleUpdate.exe

"GoogleUpdateTaskMachineUA.job" - "Google Inc." - C:\Programme\Google\Update\GoogleUpdate.exe

"Google Software Updater.job" - "Google" - C:\Programme\Google\Common\Google Updater\GoogleUpdaterService.exe
 

[Control Panel Objects]

-----( %SystemRoot%\system32 )-----

"btcpl.cpl" - "Broadcom Corporation." - C:\WINDOWS\system32\btcpl.cpl

"infocardcpl.cpl" - "Microsoft Corporation" - C:\WINDOWS\system32\infocardcpl.cpl

"javacpl.cpl" - "Sun Microsystems, Inc." - C:\WINDOWS\system32\javacpl.cpl

"nvcpl.cpl" - "NVIDIA Corporation" - C:\WINDOWS\system32\nvcpl.cpl

"nvtuicpl.cpl" - "NVIDIA Corporation" - C:\WINDOWS\system32\nvtuicpl.cpl

"stacgui.cpl" - "SigmaTel, Inc." - C:\WINDOWS\system32\stacgui.cpl

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )-----

"Avira AntiVir Personal" - "Avira GmbH" - C:\PROGRA~1\Avira\ANTIVI~1\avconfig.cpl

"Nero BurnRights" - "Nero AG" - C:\Programme\Nero\Nero 7\Nero Toolkit\NeroBurnRights.cpl

"QuickTime" - "Apple Inc." - C:\Programme\QuickTime\QTSystem\QuickTime.cpl
 

[Drivers]

-----( HKLM\SYSTEM\CurrentControlSet\Services )-----

"Acronis Snapshots Manager" (snapman) - "Acronis" - C:\WINDOWS\System32\DRIVERS\snapman.sys

"Acronis True Image Backup Archive Explorer" (timounter) - "Acronis" - C:\WINDOWS\System32\DRIVERS\timntr.sys

"Acronis True Image FS Filter" (tifsfilter) - "Acronis" - C:\WINDOWS\System32\DRIVERS\tifsfilt.sys

"Acronis Try&Decide and Restore Points filter" (tdrpman) - "Acronis" - C:\WINDOWS\System32\DRIVERS\tdrpman.sys

"adfs" (adfs) - "Adobe Systems, Inc." - C:\WINDOWS\system32\drivers\adfs.sys

"AEGIS Protocol (IEEE 802.1x) v3.6.0.0" (AegisP) - "Meetinghouse Data Communications" - C:\WINDOWS\System32\DRIVERS\AegisP.sys

"APPDRV" (APPDRV) - "Dell Inc" - C:\WINDOWS\SYSTEM32\DRIVERS\APPDRV.SYS

"avgio" (avgio) - "Avira GmbH" - C:\Programme\Avira\AntiVir Desktop\avgio.sys

"avgntflt" (avgntflt) - "Avira GmbH" - C:\WINDOWS\System32\DRIVERS\avgntflt.sys

"avipbb" (avipbb) - "Avira GmbH" - C:\WINDOWS\System32\DRIVERS\avipbb.sys

"catchme" (catchme) - ? - C:\cofi\catchme.sys  (File not found)

"cercsr6" (cercsr6) - "Adaptec, Inc." - C:\WINDOWS\system32\drivers\cercsr6.sys

"Changer" (Changer) - ? - C:\WINDOWS\system32\drivers\Changer.sys  (File not found)

"Conexant Setup API" (UIUSys) - ? - C:\WINDOWS\System32\DRIVERS\UIUSYS.SYS  (File not found)

"DSproct" (DSproct) - "Gteko Ltd." - C:\Programme\DellSupport\GTAction\triggers\DSproct.sys

"i2omgmt" (i2omgmt) - ? - C:\WINDOWS\system32\drivers\i2omgmt.sys  (File not found)

"Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows XP 32 Bit" (NETw5x32) - "Intel Corporation" - C:\WINDOWS\System32\DRIVERS\NETw5x32.sys

"lbrtfdc" (lbrtfdc) - ? - C:\WINDOWS\system32\drivers\lbrtfdc.sys  (File not found)

"PCIDump" (PCIDump) - ? - C:\WINDOWS\system32\drivers\PCIDump.sys  (File not found)

"PDCOMP" (PDCOMP) - ? - C:\WINDOWS\system32\drivers\PDCOMP.sys  (File not found)

"PDFRAME" (PDFRAME) - ? - C:\WINDOWS\system32\drivers\PDFRAME.sys  (File not found)

"PDRELI" (PDRELI) - ? - C:\WINDOWS\system32\drivers\PDRELI.sys  (File not found)

"PDRFRAME" (PDRFRAME) - ? - C:\WINDOWS\system32\drivers\PDRFRAME.sys  (File not found)

"PxHelp20" (PxHelp20) - "Sonic Solutions" - C:\WINDOWS\System32\Drivers\PxHelp20.sys

"sptd" (sptd) - ? - C:\WINDOWS\System32\Drivers\sptd.sys  (File not found)

"ssmdrv" (ssmdrv) - "Avira GmbH" - C:\WINDOWS\System32\DRIVERS\ssmdrv.sys

"uwtdipod" (uwtdipod) - ? - C:\DOKUME~1\Tom\LOKALE~1\Temp\uwtdipod.sys  (Hidden registry entry, rootkit activity | File not found)

"WDICA" (WDICA) - ? - C:\WINDOWS\system32\drivers\WDICA.sys  (File not found)

"WLAN-Transport" (s24trans) - "Intel Corporation" - C:\WINDOWS\System32\DRIVERS\s24trans.sys
 

[Explorer]

-----( HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components )-----

{89B4C1CD-B018-4511-B0A1-5476DBF70820} "StubPath" - "Microsoft Corporation" - c:\WINDOWS\system32\Rundll32.exe c:\WINDOWS\system32\mscories.dll,Install

-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----

{F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\PDFShell.dll

-----( HKLM\Software\Classes\Protocols\Filter )-----

{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll

{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll

{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll

{807553E5-5146-11D5-A672-00B0D022E945} "text/xml" - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE11\MSOXMLMF.DLL

-----( HKLM\Software\Classes\Protocols\Handler )-----

{32505114-5902-49B2-880A-1F7738E5A384} "Data Page Plugable Protocal mso-offdap11 Handler" - "Microsoft Corporation" - C:\PROGRA~1\GEMEIN~1\MICROS~1\WEBCOM~1\11\OWC11.DLL

{3D9F03FA-7A94-11D3-BE81-0050048385D1} "Data Page Pluggable Protocol mso-offdap Handler" - "Microsoft Corporation" - C:\PROGRA~1\GEMEIN~1\MICROS~1\WEBCOM~1\10\OWC10.DLL

{FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} "IEProtocolHandler Class" - "Skype Technologies" - C:\PROGRA~1\GEMEIN~1\Skype\SKYPE4~1.DLL

{0A9007C0-4076-11D3-8789-0000F8105754} "Microsoft Infotech Storage Protocol for IE 4.0" - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Information Retrieval\MSITSS.DLL

{91774881-D725-4E58-B298-07617B9B86A8} "Skype IE add-on Pluggable Protocol" - "Skype Technologies S.A." - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----

{C539A15A-3AF9-4c92-B771-50CB78F5C751} "Acronis True Image Shell Context Menu Extension" - "Acronis" - C:\Programme\Acronis\TrueImageHome\tishell.dll

{C539A15B-3AF9-4c92-B771-50CB78F5C751} "Acronis True Image Shell Extension" - "Acronis" - C:\Programme\Acronis\TrueImageHome\tishell.dll

{6af09ec9-b429-11d4-a1fb-0090960218cb} "Bluetooth-Umgebung" - "Broadcom Corporation." - C:\WINDOWS\system32\BTNEIG~1.DLL

{42071714-76d4-11d1-8b24-00a0c9068ff3} "CPL-Erweiterung für Anzeigeverschiebung" - ? - deskpan.dll  (File not found)

{1CDB2949-8F65-4355-8456-263E7C208A5D} "Desktop Explorer" - "NVIDIA Corporation" - C:\WINDOWS\system32\nvshell.dll

{1E9B04FB-F9E5-4718-997B-B8DA88302A47} "Desktop Explorer Menu" - "NVIDIA Corporation" - C:\WINDOWS\system32\nvshell.dll

{72923739-5A47-40A3-9895-25AF0DFBB9E4} "Glary Utilities Context Menu Shell Extension" - "Glarysoft Ltd" - C:\PROGRA~1\GLARYU~1\CONTEX~1.DLL

{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA} "Kontextmenü für die Verschlüsselung" - ? -   (File not found | COM-object registry key not found)

{42042206-2D85-11D3-8CFF-005004838597} "Microsoft Office HTML Icon Handler" - "Microsoft Corporation" - C:\Programme\Microsoft Office\OFFICE11\msohev.dll

{00020D75-0000-0000-C000-000000000046} "Microsoft Office Outlook" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\OFFICE11\MLSHEXT.DLL

{7842554E-6BED-11D2-8CDB-B05550C10000} "Monitor Class" - "Broadcom Corporation." - C:\WINDOWS\system32\btncopy.dll

{78237F62-8EC8-438C-83B0-1DECB4303076} "My Private Folder" - "Microsoft Corporation" - F:\PROG\MY PRIVATE FOLDER\ShellExt.dll

{B0FAF2DA-13EA-41CA-A62F-850DC01D1C01} "My Private Folder" - "Microsoft Corporation" - F:\PROG\MY PRIVATE FOLDER\ShellExt.dll

{1E9B04FB-F9E5-4718-997B-B8DA88302A48} "nView Desktop Context Menu" - "NVIDIA Corporation" - C:\WINDOWS\system32\nvshell.dll

{0006F045-0000-0000-C000-000000000046} "Outlook-Dateisymbolerweiterung" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\OFFICE11\OLKFSTUB.DLL

{3B153CB3-A551-4fe6-A68B-F5C96650FF39} "Private Folder" - "Microsoft Corporation" - F:\PROG\MY PRIVATE FOLDER\ShellExt.dll

{A02DEEEB-DD87-4a4f-8F2E-B633A59BA18A} "Private Folder" - "Microsoft Corporation" - F:\PROG\MY PRIVATE FOLDER\ShellExt.dll

{45AC2688-0253-4ED8-97DE-B5370FA7D48A} "Shell Extension for Malware scanning" - "Avira GmbH" - C:\Programme\Avira\AntiVir Desktop\shlext.dll

{E37E2028-CE1A-4f42-AF05-6CEABC4E5D75} "Shell Icon Handler for Application References" - "Microsoft Corporation" - c:\WINDOWS\system32\dfshim.dll

{764BF0E1-F219-11ce-972D-00AA00A14F56} "Shellerweiterungen für die Dateikomprimierung" - ? -   (File not found | COM-object registry key not found)

{e82a2d71-5b2f-43a0-97b8-81be15854de8} "ShellLink for Application References" - "Microsoft Corporation" - c:\WINDOWS\system32\dfshim.dll

{8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} "SnagIt" - "TechSmith Corporation" - C:\Programme\TechSmith\SnagIt 9\SnagItIEAddin.dll

{CF74B903-3389-469c-B3B6-0204D204FCBD} "SnagItShellExt Class" - "TechSmith Corporation" - C:\Programme\TechSmith\SnagIt 9\SnagItShellExt.dll

{BDEADF00-C265-11D0-BCED-00A0C90AB50F} "Webordner" - "Microsoft Corporation" - C:\PROGRA~1\GEMEIN~1\MICROS~1\WEBFOL~1\MSONSEXT.DLL

{B41DB860-8EE4-11D2-9906-E49FADC173CA} "WinRAR" - ? - C:\Programme\WinRAR\rarext.dll  (File found, but it contains no detailed information)
 

[Internet Explorer]

-----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )-----

ITBar7Height "ITBar7Height" - ? -   (File not found | COM-object registry key not found)

<binary data> "ITBar7Layout" - ? -   (File not found | COM-object registry key not found)

<binary data> "ITBarLayout" - ? -   (File not found | COM-object registry key not found)

-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----

{8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.6.0_24" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\npjpi160_24.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab

{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} "Java Plug-in 1.6.0_24" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\npjpi160_24.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab

{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_24" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\npjpi160_24.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab

{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} "{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA}" - ? -   (File not found | COM-object registry key not found) / hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab

-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----

"@btrez.dll,-4015" - ? - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm

"ICQ6" - "ICQ, LLC." - C:\Programme\ICQ6.5\ICQ.exe

{FF059E31-CC5A-4E2E-BF3B-96E929D65503} "Recherchieren" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

{898EA8C8-E7FF-479B-8935-AEC46303B9E5} "Skype Plug-In" - "Skype Technologies S.A." - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar )-----

{327C2873-E90D-4c37-AA9D-10AC9BABA46C} "Easy-WebPrint" - ? - C:\Programme\Canon\Easy-WebPrint\Toolband.dll

{8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} "SnagIt" - "TechSmith Corporation" - C:\Programme\TechSmith\SnagIt 9\SnagItIEAddin.dll

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----

{18DF081C-E8AD-4283-A596-FA578C2EBDC3} "Adobe PDF Link Helper" - "Adobe Systems Incorporated" - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

{AF69DE43-7D58-4638-B6FA-CE66B5AD205D} "Google Toolbar Notifier BHO" - "Google Inc." - C:\Programme\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll

{DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\jp2ssv.dll

{E7E6F031-17CE-4C07-BC86-EABFE594F69C} "JQSIEStartDetectorImpl Class" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

{AE805869-2E5C-4ED4-8F7B-F1F7851A4497} "Skype Plug-In" - "Skype Technologies S.A." - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

{00C6482D-C502-44C8-8409-FCE54AD9C208} "SnagIt Toolbar Loader" - "TechSmith Corporation" - C:\Programme\TechSmith\SnagIt 9\SnagItBHO.dll
 

[Logon]

-----( %AllUsersProfile%\Startmenü\Programme\Autostart )-----

"BTTray.lnk" - "Broadcom Corporation." - C:\Programme\WIDCOMM\Bluetooth Software\BTTray.exe  (Shortcut exists | File exists)

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----

"Acronis Scheduler2 Service" - "Acronis" - "C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedhlp.exe"

"AcronisTimounterMonitor" - "Acronis" - C:\Programme\Acronis\TrueImageHome\TimounterMonitor.exe

"avgnt" - "Avira GmbH" - "C:\Programme\Avira\AntiVir Desktop\avgnt.exe" /min

"dellsupportcenter" - "SupportSoft, Inc." - "C:\Programme\Dell Support Center\bin\sprtcmd.exe" /P dellsupportcenter

"IntelWireless" - "Intel Corporation" - "C:\Programme\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless

"IntelZeroConfig" - "Intel Corporation" - "C:\Programme\Intel\Wireless\bin\ZCfgSvc.exe"

"NVHotkey" - "NVIDIA Corporation" - rundll32.exe nvHotkey.dll,Start

"nwiz" - "NVIDIA Corporation" - nwiz.exe /installquiet

"SigmatelSysTrayApp" - "SigmaTel, Inc." - stsystra.exe

"SunJavaUpdateSched" - "Sun Microsystems, Inc." - "C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe"

"TrueImageMonitor.exe" - "Acronis" - C:\Programme\Acronis\TrueImageHome\TrueImageMonitor.exe
 

[Network Providers]

-----( HKLM\SYSTEM\CurrentControlSet\Control\NetworkProvider\Order )-----

"Adobe Drive CS4 Network" - "Adobe Systems Incorporated" - C:\Programme\Gemeinsame Dateien\Adobe\Adobe Drive CS4\AdobeDriveCS4_NP.dll
 

[Print Monitors]

-----( HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors )-----

"Bluetooth-Druckeranschluss" - "Broadcom Corporation." - C:\WINDOWS\system32\bthcrp.dll

"Microsoft Document Imaging Writer Monitor" - ? - mdimon.dll  (File not found)
 

[Services]

-----( HKLM\SYSTEM\CurrentControlSet\Services )-----

".NET Runtime Optimization Service v2.0.50727_X86" (clr_optimization_v2.0.50727_32) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

"Acronis Scheduler2 Service" (AcrSch2Svc) - "Acronis" - C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedul2.exe

"Acronis Try And Decide Service" (TryAndDecideService) - ? - C:\Programme\Gemeinsame Dateien\Acronis\Fomatik\TrueImageTryStartService.exe  (File found, but it contains no detailed information)

"ASP.NET-Zustandsdienst" (aspnet_state) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe

"Avira AntiVir Guard" (AntiVirService) - "Avira GmbH" - C:\Programme\Avira\AntiVir Desktop\avguard.exe

"Avira AntiVir Planer" (AntiVirSchedulerService) - "Avira GmbH" - C:\Programme\Avira\AntiVir Desktop\sched.exe

"Bluetooth Service" (btwdins) - "Broadcom Corporation." - C:\Programme\WIDCOMM\Bluetooth Software\bin\btwdins.exe

"Cyberlink RichVideo Service(CRVS)" (RichVideo) - ? - C:\Programme\CyberLink\Shared Files\RichVideo.exe

"DSBrokerService" (DSBrokerService) - ? - C:\Programme\DellSupport\brkrsvc.exe

"FABS - Helping agent for MAGIX media database" (Fabs) - "MAGIX AG" - C:\Programme\Gemeinsame Dateien\MAGIX Shared\Database2\bin\FABS.exe

"Firebird Server - MAGIX Instance" (FirebirdServerMAGIXInstance) - "MAGIX®" - C:\Programme\Gemeinsame Dateien\MAGIX Shared\Database2\bin\fbserver.exe

"FLEXnet Licensing Service" (FLEXnet Licensing Service) - "Acresso Software Inc." - C:\Programme\Gemeinsame Dateien\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

"Google Software Updater" (gusvc) - "Google" - C:\Programme\Google\Common\Google Updater\GoogleUpdaterService.exe

"Google Update Service (gupdate1c9b79fec91e63c)" (gupdate1c9b79fec91e63c) - "Google Inc." - C:\Programme\Google\Update\GoogleUpdate.exe

"Intel(R) PROSet/Wireless Event Log" (EvtEng) - "Intel Corporation" - C:\Programme\Intel\Wireless\Bin\EvtEng.exe

"Intel(R) PROSet/Wireless Registry Service" (RegSrvc) - "Intel Corporation" - C:\Programme\Intel\Wireless\Bin\RegSrvc.exe

"Intel(R) PROSet/Wireless Service" (S24EventMonitor) - "Intel Corporation " - C:\Programme\Intel\Wireless\Bin\S24EvMon.exe

"Intel(R) PROSet/Wireless SSO Service" (WLANKEEPER) - "Intel(R) Corporation" - C:\Programme\Intel\Wireless\Bin\WLKeeper.exe

"Java Quick Starter" (JavaQuickStarterService) - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\jqs.exe

"Machine Debug Manager" (MDM) - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7DEBUG\MDM.EXE

"Office Source Engine" (ose) - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE

"Private Folder Service" (prfldsvc) - ? - F:\PROG\MY PRIVATE FOLDER\PrfldSvc.exe  (File found, but it contains no detailed information)

"SupportSoft Sprocket Service (dellsupportcenter)" (sprtsvc_dellsupportcenter) - "SupportSoft, Inc." - C:\Programme\Dell Support Center\bin\sprtsvc.exe

"UPnPService" (UPnPService) - "Magix AG" - C:\Programme\Gemeinsame Dateien\MAGIX Shared\UPnPService\UPnPService.exe

"Windows CardSpace" (idsvc) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe

"Windows Presentation Foundation Font Cache 3.0.0.0" (FontCache3.0.0.0) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
 

[Winlogon]

-----( HKCU\Control Panel\IOProcs )-----

"MVB" - ? - mvfs32.dll  (File not found)

-----( HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify )-----

"WgaLogon" - "Microsoft Corporation" - C:\WINDOWS\system32\WgaLogon.dll
 

===[ Logfile end ]=========================================[ Logfile end ]===

--- --- ---
If You have questions or want to get some help, You can visit Online Solutions :: Index

und zuletzt das logfile von mbrcheck

MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:
Windows Version: Windows XP Professional
Windows Information: Service Pack 3 (build 2600)
Logical Drives Mask: 0x00000034

Kernel Drivers (total 150):
0x804D7000 \WINDOWS\system32\ntkrnlpa.exe
0x806E6000 \WINDOWS\system32\hal.dll
0xBA5A8000 \WINDOWS\system32\KDCOM.DLL
0xBA4B8000 \WINDOWS\system32\BOOTVID.dll
0xB9F78000 ACPI.sys
0xBA5AA000 \WINDOWS\system32\DRIVERS\WMILIB.SYS
0xB9F67000 pci.sys
0xBA0A8000 ohci1394.sys
0xBA0B8000 \WINDOWS\system32\DRIVERS\1394BUS.SYS
0xBA0C8000 isapnp.sys
0xBA4BC000 compbatt.sys
0xBA4C0000 \WINDOWS\system32\DRIVERS\BATTC.SYS
0xBA670000 pciide.sys
0xBA328000 \WINDOWS\system32\DRIVERS\PCIIDEX.SYS
0xBA0D8000 MountMgr.sys
0xB9F48000 ftdisk.sys
0xBA5AC000 dmload.sys
0xB9F22000 dmio.sys
0xBA330000 PartMgr.sys
0xBA0E8000 VolSnap.sys
0xB9F0A000 atapi.sys
0xBA338000 cercsr6.sys
0xB9EF2000 \WINDOWS\System32\Drivers\SCSIPORT.SYS
0xBA0F8000 disk.sys
0xBA108000 \WINDOWS\system32\DRIVERS\CLASSPNP.SYS
0xB9ED2000 fltmgr.sys
0xB9EC0000 sr.sys
0xBA118000 PxHelp20.sys
0xB9EA9000 KSecDD.sys
0xB9E96000 WudfPf.sys
0xB9E09000 Ntfs.sys
0xB9DDC000 NDIS.sys
0xB9D71000 timntr.sys
0xB9D18000 tdrpman.sys
0xB9CFA000 snapman.sys
0xB9CE0000 Mup.sys
0xBA2C8000 \SystemRoot\system32\DRIVERS\intelppm.sys
0xB8E33000 \SystemRoot\system32\DRIVERS\nv4_mini.sys
0xB8E1F000 \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS
0xBA3E0000 \SystemRoot\system32\DRIVERS\usbuhci.sys
0xB8DFB000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
0xBA3E8000 \SystemRoot\system32\DRIVERS\usbehci.sys
0xB8DD3000 \SystemRoot\system32\DRIVERS\HDAudBus.sys
0xB8BB9000 \SystemRoot\system32\DRIVERS\NETw4x32.sys
0xBA2D8000 \SystemRoot\system32\DRIVERS\bcm4sbxp.sys
0xBA2E8000 \SystemRoot\system32\DRIVERS\nic1394.sys
0xB8BA5000 \SystemRoot\system32\DRIVERS\sdbus.sys
0xBA2F8000 \SystemRoot\system32\DRIVERS\rimmptsk.sys
0xB8B91000 \SystemRoot\system32\DRIVERS\rimsptsk.sys
0xB8B40000 \SystemRoot\system32\DRIVERS\rixdptsk.sys
0xBA308000 \SystemRoot\system32\DRIVERS\i8042prt.sys
0xB8B0E000 \SystemRoot\system32\DRIVERS\SynTP.sys
0xBA5D4000 \SystemRoot\system32\DRIVERS\USBD.SYS
0xBA3F0000 \SystemRoot\system32\DRIVERS\mouclass.sys
0xBA3F8000 \SystemRoot\system32\DRIVERS\kbdclass.sys
0xBA318000 \SystemRoot\system32\DRIVERS\imapi.sys
0xBA138000 \SystemRoot\system32\DRIVERS\cdrom.sys
0xBA148000 \SystemRoot\system32\DRIVERS\redbook.sys
0xB8AEB000 \SystemRoot\system32\DRIVERS\ks.sys
0xB9C23000 \SystemRoot\system32\DRIVERS\CmBatt.sys
0xB9C1F000 \SystemRoot\system32\DRIVERS\wmiacpi.sys
0xB8A1A000 \SystemRoot\system32\DRIVERS\btkrnl.sys
0xBA71B000 \SystemRoot\system32\DRIVERS\audstub.sys
0xBA158000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
0xB9C1B000 \SystemRoot\system32\DRIVERS\ndistapi.sys
0xB8A03000 \SystemRoot\system32\DRIVERS\ndiswan.sys
0xBA168000 \SystemRoot\system32\DRIVERS\raspppoe.sys
0xBA178000 \SystemRoot\system32\DRIVERS\raspptp.sys
0xBA400000 \SystemRoot\system32\DRIVERS\TDI.SYS
0xB89F2000 \SystemRoot\system32\DRIVERS\psched.sys
0xBA188000 \SystemRoot\system32\DRIVERS\msgpc.sys
0xBA408000 \SystemRoot\system32\DRIVERS\ptilink.sys
0xBA410000 \SystemRoot\system32\DRIVERS\raspti.sys
0xB8922000 \SystemRoot\system32\DRIVERS\rdpdr.sys
0xBA198000 \SystemRoot\system32\DRIVERS\termdd.sys
0xBA5D6000 \SystemRoot\system32\DRIVERS\swenum.sys
0xB88C4000 \SystemRoot\system32\DRIVERS\update.sys
0xB9BFF000 \SystemRoot\system32\DRIVERS\mssmbios.sys
0xBA418000 \SystemRoot\system32\DRIVERS\btport.sys
0xB8844000 \SystemRoot\system32\drivers\btaudio.sys
0xB8820000 \SystemRoot\system32\drivers\portcls.sys
0xBA1A8000 \SystemRoot\system32\drivers\drmk.sys
0xBA1B8000 \SystemRoot\System32\Drivers\NDProxy.SYS
0xBA1C8000 \SystemRoot\system32\DRIVERS\usbhub.sys
0xB76B2000 \SystemRoot\system32\drivers\sthda.sys
0xB768F000 \??\C:\WINDOWS\system32\Drivers\OEM02Afx.sys
0xB765B000 \SystemRoot\system32\DRIVERS\HSFHWAZL.sys
0xB7569000 \SystemRoot\system32\DRIVERS\HSF_DPV.sys
0xB74B6000 \SystemRoot\system32\DRIVERS\HSF_CNXT.sys
0xBA428000 \SystemRoot\System32\Drivers\Modem.SYS
0xBA5E4000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
0xBA69B000 \SystemRoot\System32\Drivers\Null.SYS
0xBA5E6000 \SystemRoot\System32\Drivers\Beep.SYS
0xBA448000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
0xBA450000 \SystemRoot\System32\drivers\vga.sys
0xBA5E8000 \SystemRoot\System32\Drivers\mnmdd.SYS
0xBA5EA000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0xBA458000 \SystemRoot\System32\Drivers\Msfs.SYS
0xBA460000 \SystemRoot\System32\Drivers\Npfs.SYS
0xB9C4F000 \SystemRoot\system32\DRIVERS\rasacd.sys
0xB745B000 \SystemRoot\system32\DRIVERS\ipsec.sys
0xB7402000 \SystemRoot\system32\DRIVERS\tcpip.sys
0xB73DA000 \SystemRoot\system32\DRIVERS\netbt.sys
0xB73B4000 \SystemRoot\system32\DRIVERS\ipnat.sys
0xB7392000 \SystemRoot\System32\drivers\afd.sys
0xBA1D8000 \SystemRoot\system32\DRIVERS\netbios.sys
0xBA468000 \SystemRoot\system32\DRIVERS\ssmdrv.sys
0xB7367000 \SystemRoot\system32\DRIVERS\rdbss.sys
0xB72F7000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
0xBA1E8000 \SystemRoot\System32\Drivers\Fips.SYS
0xB72D1000 \SystemRoot\system32\DRIVERS\avipbb.sys
0xBA478000 \SystemRoot\system32\DRIVERS\usbccgp.sys
0xBA218000 \SystemRoot\system32\DRIVERS\wanarp.sys
0xBA228000 \SystemRoot\system32\DRIVERS\arp1394.sys
0xBA5F2000 \??\C:\Programme\Avira\AntiVir Desktop\avgio.sys
0xB880C000 \SystemRoot\SYSTEM32\DRIVERS\APPDRV.SYS
0xB8808000 \SystemRoot\system32\DRIVERS\hidusb.sys
0xBA248000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
0xB726F000 \SystemRoot\system32\DRIVERS\OEM02Dev.sys
0xBA606000 \SystemRoot\system32\DRIVERS\OEM02Vfx.sys
0xB8800000 \SystemRoot\system32\DRIVERS\mouhid.sys
0xBA258000 \SystemRoot\System32\Drivers\Cdfs.SYS
0xB71B7000 \SystemRoot\System32\Drivers\dump_atapi.sys
0xBA608000 \SystemRoot\System32\Drivers\dump_WMILIB.SYS
0xBF800000 \SystemRoot\System32\win32k.sys
0xB77E0000 \SystemRoot\System32\drivers\Dxapi.sys
0xBA4A0000 \SystemRoot\System32\watchdog.sys
0xBF000000 \SystemRoot\System32\drivers\dxg.sys
0xBA7A1000 \SystemRoot\System32\drivers\dxgthk.sys
0xBF012000 \SystemRoot\System32\nv4_disp.dll
0xBF549000 \SystemRoot\System32\ATMFD.DLL
0xB4D65000 \SystemRoot\system32\DRIVERS\prvflder.sys
0xB4D50000 \SystemRoot\system32\DRIVERS\avgntflt.sys
0xB722F000 \SystemRoot\system32\DRIVERS\tifsfilt.sys
0xBA388000 \SystemRoot\system32\DRIVERS\AegisP.sys
0xB4D48000 \SystemRoot\system32\DRIVERS\s24trans.sys
0xB4BF0000 \SystemRoot\system32\DRIVERS\ndisuio.sys
0xB48C3000 \SystemRoot\system32\DRIVERS\mrxdav.sys
0xB4886000 \SystemRoot\system32\drivers\wdmaud.sys
0xB4B88000 \SystemRoot\system32\drivers\sysaudio.sys
0xB4827000 \SystemRoot\System32\Drivers\adfs.SYS
0xBA5F0000 \SystemRoot\system32\DRIVERS\dsunidrv.sys
0xB4617000 \SystemRoot\system32\DRIVERS\srv.sys
0xB4817000 \SystemRoot\system32\DRIVERS\mdmxsdk.sys
0xB3ED5000 \SystemRoot\System32\Drivers\HTTP.sys
0xB399D000 \SystemRoot\System32\Drivers\Fastfat.SYS
0xB00F2000 \??\C:\DOKUME~1\Tom\LOKALE~1\Temp\uwtdipod.sys
0xB4197000 \SystemRoot\System32\Drivers\btwusb.sys
0xB489F000 \SystemRoot\system32\DRIVERS\kbdhid.sys
0x7C910000 \WINDOWS\system32\ntdll.dll

Processes (total 53):
0 System Idle Process
4 System
960 C:\WINDOWS\system32\smss.exe
1024 csrss.exe
1056 C:\WINDOWS\system32\winlogon.exe
1100 C:\WINDOWS\system32\services.exe
1112 C:\WINDOWS\system32\lsass.exe
1296 C:\WINDOWS\system32\svchost.exe
1364 svchost.exe
1404 C:\WINDOWS\system32\svchost.exe
1428 C:\Programme\WIDCOMM\Bluetooth Software\bin\btwdins.exe
1448 C:\WINDOWS\system32\svchost.exe
1508 C:\Programme\Intel\Wireless\Bin\EvtEng.exe
1768 C:\WINDOWS\explorer.exe
1880 C:\Programme\Intel\Wireless\Bin\S24EvMon.exe
1920 C:\Programme\Intel\Wireless\Bin\WLKEEPER.exe
292 svchost.exe
392 svchost.exe
656 C:\WINDOWS\system32\spoolsv.exe
728 C:\Programme\Avira\AntiVir Desktop\sched.exe
772 svchost.exe
908 C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedul2.exe
932 C:\Programme\Avira\AntiVir Desktop\avguard.exe
972 C:\Programme\Gemeinsame Dateien\MAGIX Shared\Database2\bin\FABS.exe
1328 C:\Programme\Java\jre6\bin\jqs.exe
1480 C:\Programme\Avira\AntiVir Desktop\avshadow.exe
1548 C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7DEBUG\MDM.EXE
2000 C:\WINDOWS\system32\nvsvc32.exe
2080 F:\PROG\MY PRIVATE FOLDER\PrfldSvc.exe
2104 C:\Programme\Intel\Wireless\Bin\RegSrvc.exe
2132 C:\Programme\CyberLink\Shared Files\RichVideo.exe
2156 C:\Programme\Dell Support Center\bin\sprtsvc.exe
2232 C:\WINDOWS\system32\svchost.exe
2248 C:\Programme\Gemeinsame Dateien\Acronis\Fomatik\TrueImageTryStartService.exe
3052 C:\WINDOWS\system32\wbem\wmiapsrv.exe
3360 alg.exe
3808 C:\WINDOWS\system32\rundll32.exe
3816 C:\WINDOWS\system32\rundll32.exe
3836 C:\Programme\Intel\Wireless\Bin\ZCfgSvc.exe
3844 C:\Programme\Intel\Wireless\Bin\iFrmewrk.exe
3852 C:\WINDOWS\stsystra.exe
3868 C:\Programme\Synaptics\SynTP\SynTPEnh.exe
3896 C:\Programme\Acronis\TrueImageHome\TrueImageMonitor.exe
3956 C:\Programme\Acronis\TrueImageHome\TimounterMonitor.exe
3964 C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedhlp.exe
3976 C:\Programme\Avira\AntiVir Desktop\avgnt.exe
3984 C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe
3996 C:\Programme\Dell Support Center\bin\sprtcmd.exe
1692 C:\Programme\WIDCOMM\Bluetooth Software\BTTray.exe
3216 C:\Programme\Intel\Wireless\Bin\Dot1XCfg.exe
4056 C:\Programme\Mozilla Firefox\firefox.exe
2608 C:\Dokumente und Einstellungen\Tom\desktop\osam_autorun_manager_5_0_portable\osam.exe
3168 C:\Dokumente und Einstellungen\Tom\desktop\MBRCheck.exe

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`075a9e00 (NTFS)
\\.\F: --> \\.\PhysicalDrive0 at offset 0x0000000c`3c4de800 (NTFS)

PhysicalDrive0 Model Number: TOSHIBAMK1646GSX, Rev: LB112D

Size Device Name MBR Status
--------------------------------------------
149 GB \\.\PhysicalDrive0 Windows XP MBR code detected
SHA1: ADFE55CD0C6ED2E00B22375835E4C2736CE9AD11

Done!

Sieht ok aus. Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SASW und poste die Logs.
Denk dran beide Tools zu updaten vor dem Scan!!

ok, aber was ist mit dem rootkit das gmer gefunden hat? (Dell)

Das ist ein Fehlalarm.

Mach bitte die Kontrollscans.

SUPERAntiSpyware Scann-Protokoll
SUPERAntiSpyware.com | Remove Malware | Remove Spyware - AntiMalware, AntiSpyware, AntiAdware!

Generiert 04/09/2011 bei 10:19 PM

Version der Applikation : 4.50.1002

Version der Kern-Datenbank : 6797
Version der Spur-Datenbank : 4609

Scan Art : kompletter Scann
Totale Scann-Zeit : 01:57:38

Gescannte Speicherelemente : 595
Erfasste Speicher-Bedrohungen : 0
Gescannte Register-Elemente : 8383
Erfasste Register-Bedrohungen : 0
Gescannte Datei-Elemente : 117627
Erfasste Datei-Elemente : 0

Ok - das von Malwarebytes bitte auch noch