Trojaner-Board - TR/Kazy.mekml.1

Trojaner-Board (https://www.trojaner-board.de/)

- Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)

- - TR/Kazy.mekml.1 (https://www.trojaner-board.de/97638-tr-kazy-mekml-1-a.html)

Combofix Logfile:

Code:

ComboFix 11-04-17.03 - *** 18.04.2011  19:14:47.2.4 - x86

Microsoft Windows 7 Home Premium   6.1.7600.0.1252.49.1031.18.3061.1949 [GMT 2:00]

ausgeführt von:: c:\users\***\Desktop\Cofi.exe

AV: AntiVir Desktop *Disabled/Updated* {090F9C29-64CE-6C6F-379C-5901B49A85B7}

SP: AntiVir Desktop *Disabled/Updated* {B26E7DCD-42F4-63E1-0D2C-6273CF1DCF0A}

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

.

(((((((((((((((((((((((   Dateien erstellt von 2011-03-18 bis 2011-04-18  ))))))))))))))))))))))))))))))

.

.

2011-04-18 17:21 . 2011-04-18 17:21        --------        d-----w-        c:\users\Default\AppData\Local\temp

2011-04-18 17:03 . 2011-04-18 17:03        --------        d-----w-        c:\program files\CCleaner

2011-04-18 16:36 . 2011-04-18 16:48        --------        d-----w-        C:\Cofi

2011-04-18 15:35 . 2011-04-18 15:35        --------        d-----w-        C:\_OTL

2011-04-18 13:27 . 2011-04-18 13:27        --------        d-----w-        c:\users\***\AppData\Roaming\Malwarebytes

2011-04-18 13:27 . 2010-12-20 16:09        38224        ----a-w-        c:\windows\system32\drivers\mbamswissarmy.sys

2011-04-18 13:27 . 2011-04-18 13:27        --------        d-----w-        c:\programdata\Malwarebytes

2011-04-18 13:27 . 2011-04-18 13:27        --------        d-----w-        c:\program files\Malwarebytes' Anti-Malware

2011-04-18 13:27 . 2010-12-20 16:08        20952        ----a-w-        c:\windows\system32\drivers\mbam.sys

2011-04-15 19:42 . 2011-03-15 04:05        6792528        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{E5963DEC-1C80-4408-B82D-C8ED1D48C0A7}\mpengine.dll

2011-04-13 21:46 . 2011-02-23 05:05        309760        ----a-w-        c:\windows\system32\drivers\srv2.sys

2011-04-13 21:46 . 2011-02-23 05:06        311296        ----a-w-        c:\windows\system32\drivers\srv.sys

2011-04-13 21:46 . 2011-02-23 05:05        113664        ----a-w-        c:\windows\system32\drivers\srvnet.sys

2011-04-13 21:46 . 2011-02-18 05:36        428032        ----a-w-        c:\windows\system32\vbscript.dll

2011-04-12 22:06 . 2011-04-12 22:06        --------        d-----w-        c:\users\***\AppData\Local\DDMSettings

2011-04-05 15:20 . 2011-04-05 15:20        --------        d-----w-        c:\program files\ConvertHelper

2011-04-03 22:36 . 2011-04-03 22:36        --------        d-----w-        c:\users\***\AppData\Local\Apple Computer

2011-04-03 22:35 . 2011-04-03 22:35        --------        d-----w-        c:\users\***\AppData\Roaming\Apple Computer

2011-04-01 14:19 . 2011-04-01 14:19        --------        d-----w-        c:\users\***\AppData\Local\Cisco

2011-04-01 14:18 . 2011-04-01 14:18        --------        d-----w-        c:\program files\Cisco

2011-04-01 14:18 . 2011-04-01 14:18        --------        d-----w-        c:\programdata\Cisco

.

.

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2011-03-21 16:12 . 2010-06-19 21:35        137656        ----a-w-        c:\windows\system32\drivers\avipbb.sys

2011-02-19 05:33 . 2011-03-09 18:22        802304        ----a-w-        c:\windows\system32\FntCache.dll

2011-02-19 05:32 . 2011-03-09 18:22        1074176        ----a-w-        c:\windows\system32\DWrite.dll

2011-02-19 05:32 . 2011-03-09 18:22        739840        ----a-w-        c:\windows\system32\d2d1.dll

2011-02-11 15:45 . 2011-02-11 15:45        8952        ----a-w-        c:\windows\system32\vpncategories.dll

2011-02-11 15:44 . 2011-02-11 15:44        28920        ----a-w-        c:\windows\system32\vpnevents.dll

2011-02-11 15:27 . 2011-02-11 15:27        19680        ----a-w-        c:\windows\system32\drivers\vpnva.sys

2011-02-03 05:45 . 2011-02-09 23:00        219008        ----a-w-        c:\windows\system32\drivers\dxgmms1.sys

2011-02-02 17:11 . 2010-06-19 21:49        222080        ------w-        c:\windows\system32\MpSigStub.exe

2010-08-07 00:09 . 2010-08-07 00:09        6        ----a-w-        c:\program files\Common Files\UnInstallCompleted.tmp

2010-06-22 08:35 . 2010-06-22 08:35        138304        ----a-w-        c:\program files\Common Files\osdinst.dll

.

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]

@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]

2010-10-06 23:36        94208        ----a-w-        c:\users\***\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]

@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]

2010-10-06 23:36        94208        ----a-w-        c:\users\***\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]

@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]

2010-10-06 23:36        94208        ----a-w-        c:\users\***\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]

@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]

2010-10-06 23:36        94208        ----a-w-        c:\users\***\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]

"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\DTLite.exe" [2010-04-01 357696]

"VeohPlugin"="c:\program files\Veoh Networks\VeohWebPlayer\veohwebplayer.exe" [2010-07-06 2634048]

"RESTART_STICKY_NOTES"="c:\windows\System32\StikyNot.exe" [2009-07-14 354304]

"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-07-14 1173504]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2009-12-15 8120864]

"UpdateLBPShortCut"="c:\program files\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe" [2009-05-19 222504]

"CLMLServer"="c:\program files\CyberLink\Power2Go\CLMLSvc.exe" [2009-06-03 103720]

"UpdateP2GoShortCut"="c:\program files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" [2009-05-19 222504]

"UpdatePDRShortCut"="c:\program files\CyberLink\PowerDirector\MUITransfer\MUIStartMenu.exe" [2008-01-04 222504]

"RemoteControl8"="c:\program files\CyberLink\PowerDVD8\PDVD8Serv.exe" [2009-04-15 91432]

"PDVD8LanguageShortcut"="c:\program files\CyberLink\PowerDVD8\Language\Language.exe" [2009-04-15 50472]

"UpdatePPShortCut"="c:\program files\CyberLink\PowerProducer\MUITransfer\MUIStartMenu.exe" [2008-12-03 218408]

"UpdatePSTShortCut"="c:\program files\CyberLink\DVD Suite\MUITransfer\MUIStartMenu.exe" [2009-07-21 210216]

"APLangApp"="c:\program files\AnyPC Client\APLangApp.exe" [2009-11-20 13312]

"UCam_Menu"="c:\program files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" [2009-05-19 222504]

"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2010-11-07 281768]

"Eraser"="c:\progra~1\Eraser\Eraser.exe" [2010-04-10 979344]

"fsn"="c:\program files\Phoenix Technologies Ltd\FailSafe\FailSafeNotifier.exe" [2010-06-22 137792]

"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-03-17 421888]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-01-31 35760]

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-20 932288]

"WinampAgent"="c:\program files\Winamp\winampa.exe" [2010-12-09 74752]

"DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2011-03-21 1230704]

"Malwarebytes' Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2010-12-20 963976]

.

c:\users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

Dropbox.lnk - c:\users\***\AppData\Roaming\Dropbox\bin\Dropbox.exe [2010-12-17 23343848]

OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2009-2-26 97680]

.

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

VPN Client.lnk - c:\windows\Installer\{B0BF7057-6869-4E4B-920C-EA2A58DA07F0}\Icon3E5562ED7.ico [2010-11-8 6144]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 5 (0x5)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]

Security Packages        REG_MULTI_SZ           kerberos msv1_0 schannel wdigest tspkg pku2u livessp

.

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]

R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-06-29 135664]

R3 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance;c:\program files\Common Files\MAGIX Services\Database\bin\fbserver.exe [2008-08-07 3276800]

R3 ggflt;SEMC USB Flash Driver Filter;c:\windows\system32\DRIVERS\ggflt.sys [2010-07-28 13224]

R3 Impcd;Impcd;c:\windows\system32\DRIVERS\Impcd.sys [2009-11-25 125824]

R3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt86win7.sys [2009-07-13 139776]

R3 s0017bus;Sony Ericsson Device 0017 driver (WDM);c:\windows\system32\DRIVERS\s0017bus.sys [2008-10-21 86824]

R3 s0017mdfl;Sony Ericsson Device 0017 USB WMC Modem Filter;c:\windows\system32\DRIVERS\s0017mdfl.sys [2008-10-21 15016]

R3 s0017mdm;Sony Ericsson Device 0017 USB WMC Modem Driver;c:\windows\system32\DRIVERS\s0017mdm.sys [2008-10-21 114600]

R3 s0017mgmt;Sony Ericsson Device 0017 USB WMC Device Management Drivers (WDM);c:\windows\system32\DRIVERS\s0017mgmt.sys [2008-10-21 108328]

R3 s0017nd5;Sony Ericsson Device 0017 USB Ethernet Emulation SEMC0017 (NDIS);c:\windows\system32\DRIVERS\s0017nd5.sys [2008-10-21 26024]

R3 s0017obex;Sony Ericsson Device 0017 USB WMC OBEX Interface;c:\windows\system32\DRIVERS\s0017obex.sys [2008-10-21 104616]

R3 s0017unic;Sony Ericsson Device 0017 USB Ethernet Emulation SEMC0017 (WDM);c:\windows\system32\DRIVERS\s0017unic.sys [2008-10-21 109736]

S1 SABI;SAMSUNG Kernel Driver For Windows 7;c:\windows\system32\Drivers\SABI.sys [2009-05-28 10752]

S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-13 48128]

S2 AntiVirSchedulerService;Avira AntiVir Planer;c:\program files\Avira\AntiVir Desktop\sched.exe [2010-11-07 135336]

S2 Fabs;FABS - Helping agent for MAGIX media database;c:\program files\Common Files\MAGIX Services\Database\bin\FABS.exe [2009-08-27 1253376]

S2 Giraffic;Giraffic Video Accelerator;c:\program files\Giraffic\GirafficWatchdog.exe [2011-04-12 2316432]

S2 SBSDWSCService;SBSD Security Center Service;c:\program files\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368]

S2 vpnagent;Cisco AnyConnect VPN Agent;c:\program files\Cisco\Cisco AnyConnect VPN Client\vpnagent.exe [2011-02-11 603896]

S3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda32v.sys [2010-11-11 122984]

S3 seehcri;Sony Ericsson seehcri Device Driver;c:\windows\system32\DRIVERS\seehcri.sys [2010-07-28 27632]

S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [2009-07-13 14336]

S3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x86.sys [2009-09-28 315392]

.

.

--- Andere Dienste/Treiber im Speicher ---

.

*NewlyCreated* - KLMDB

*Deregistered* - klmdb

.

Inhalt des "geplante Tasks" Ordners

.

2011-04-18 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files\Google\Update\GoogleUpdate.exe [2010-06-29 22:27]

.

2011-04-18 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files\Google\Update\GoogleUpdate.exe [2010-06-29 22:27]

.

.

------- Zusätzlicher Suchlauf -------

.

uStart Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT2653012

IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200

IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_D183CA64F05FDD98.dll/cmsidewiki.html

IE: Nach Microsoft &Excel exportieren - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000

IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000

FF - ProfilePath - c:\users\***\AppData\Roaming\Mozilla\Firefox\Profiles\1wcky341.default\

FF - prefs.js: browser.search.selectedEngine - DAEMON Search

FF - prefs.js: browser.startup.homepage - hxxp://www.google.de/

FF - prefs.js: keyword.URL - hxxp://www.google.com/search?sourceid=navclient&hl=de&q=

FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}

FF - Ext: Adblock Plus: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} - %profile%\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}

FF - Ext: Google Toolbar for Firefox: {3112ca9c-de6d-4884-a869-9855de68056c} - %profile%\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}

FF - Ext: DownloadHelper: {b9db16a4-6edc-47ec-a1f4-b86292ed211d} - %profile%\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}

FF - Ext: Free Hide IP: support@free-hideip.com - %profile%\extensions\support@free-hideip.com

FF - Ext: DivX Plus Web Player HTML5 &lt;video&gt;: {23fcfd51-4958-4f00-80a3-ae97e717ed8b} - c:\program files\DivX\DivX Plus Web Player\firefox\html5video

FF - Ext: DivX HiQ: {6904342A-8307-11DF-A508-4AE2DFD72085} - c:\program files\DivX\DivX Plus Web Player\firefox\wpa

.

.

--------------------- Gesperrte Registrierungsschluessel ---------------------

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

--------------------- Durch laufende Prozesse gestartete DLLs ---------------------

.

- - - - - - - > 'Explorer.exe'(4296)

c:\users\***\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll

.

Zeit der Fertigstellung: 2011-04-18  19:23:14

ComboFix-quarantined-files.txt  2011-04-18 17:23

ComboFix2.txt  2011-04-18 16:48

.

Vor Suchlauf: 14 Verzeichnis(se), 57.532.354.560 Bytes frei

Nach Suchlauf: 15 Verzeichnis(se), 57.475.026.944 Bytes frei

.

- - End Of File - - 307B4D811C9925258C334BB1A5589B49

--- --- ---

Ok. Bitte nun Logs mit GMER und OSAM erstellen und posten.
GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus - die Online-Abfrage durch OSAM bitte überspringen.
Bei OSAM bitte darauf auch achten, dass Du das Log auch als *.log und nicht *.html oder so abspeicherst.

Downloade Dir danach bitte MBRCheck (by a_d_13) und speichere die Datei auf dem Desktop.

Doppelklick auf die MBRCheck.exe.
Vista und Win7 User mit Rechtsklick "als Administrator starten"
Das Tool braucht nur wenige Sekunden.
Danach solltest du eine MBRCheck_<Datum>_<Uhrzeit>.txt auf dem Desktop finden.

Poste mir bitte den Inhalt des .txt Dokumentes

OSAM Logfile:

Code:

Report of OSAM: Autorun Manager v5.0.11926.0

Online Solutions. Complex Protection for Information Systems

Saved at 20:05:45 on 18.04.2011
 

OS: Windows 7 Home Premium Edition (Build 7600), 32-bit

Default Browser: Microsoft Corporation Internet Explorer 8.00.7600.16385
 

Scanner Settings

[x] Rootkits detection (hidden registry)

[x] Rootkits detection (hidden files)

[x] Retrieve files information

[x] Check Microsoft signatures
 

Filters

[ ] Trusted entries

[ ] Empty entries

[x] Hidden registry entries (rootkit activity)

[x] Exclusively opened files

[x] Not found files

[x] Files without detailed information

[x] Existing files

[ ] Non-startable services

[ ] Non-startable drivers

[x] Active entries

[x] Disabled entries
 
 

[Common]

-----( %SystemRoot%\Tasks )-----

"GoogleUpdateTaskMachineCore.job" - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe

"GoogleUpdateTaskMachineUA.job" - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe
 

[Control Panel Objects]

-----( %SystemRoot%\system32 )-----

"DivXControlPanelApplet.cpl" - "DivX, Inc." - C:\windows\system32\DivXControlPanelApplet.cpl

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )-----

"mlcfg32.cpl" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\Office12\MLCFG32.CPL

"QuickTime" - "Apple Inc." - C:\Program Files\QuickTime\QTSystem\QuickTime.cpl
 

[Drivers]

-----( HKLM\SYSTEM\CurrentControlSet\Services )-----

"avgntflt" (avgntflt) - "Avira GmbH" - C:\windows\System32\DRIVERS\avgntflt.sys

"avipbb" (avipbb) - "Avira GmbH" - C:\windows\System32\DRIVERS\avipbb.sys

"catchme" (catchme) - ? - C:\Users\***\AppData\Local\Temp\catchme.sys  (File not found)

"Cisco Systems Inc. IPSec Driver" (CVPNDRVA) - "Cisco Systems, Inc." - C:\windows\system32\Drivers\CVPNDRVA.sys

"FssFltr" (fssfltr) - "Microsoft Corporation" - C:\windows\System32\DRIVERS\fssfltr.sys

"mbr" (mbr) - ? - C:\Cofi9001C\mbr.sys  (Hidden registry entry, rootkit activity | File not found)

"ssmdrv" (ssmdrv) - "Avira GmbH" - C:\windows\System32\DRIVERS\ssmdrv.sys
 

[Explorer]

-----( HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----

{FB314ED9-A251-47B7-93E1-CDD82E34AF8B} "DropboxExt" - ? -   (File not found | COM-object registry key not found)

{FB314EDA-A251-47B7-93E1-CDD82E34AF8B} "DropboxExt" - ? -   (File not found | COM-object registry key not found)

{FB314EDB-A251-47B7-93E1-CDD82E34AF8B} "DropboxExt" - ? -   (File not found | COM-object registry key not found)

{FB314EDC-A251-47B7-93E1-CDD82E34AF8B} "DropboxExt" - ? -   (File not found | COM-object registry key not found)

-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----

{F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll

-----( HKLM\Software\Classes\Protocols\Filter )-----

{807553E5-5146-11D5-A672-00B0D022E945} "text/xml" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL

-----( HKLM\Software\Classes\Protocols\Handler )-----

{32505114-5902-49B2-880A-1F7738E5A384} "Data Page Plugable Protocal mso-offdap11 Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\WEBCOM~1\11\OWC11.DLL

{314111c7-a502-11d2-bbca-00c04f8ec294} "HxProtocol Class" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll

{FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} "IEProtocolHandler Class" - "Skype Technologies" - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL

{828030A1-22C1-4009-854F-8E305202313F} "livecall" - "Microsoft Corporation" - C:\PROGRA~1\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL

{0A9007C0-4076-11D3-8789-0000F8105754} "Microsoft Infotech Storage Protocol for IE 4.0" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll

{828030A1-22C1-4009-854F-8E305202313F} "msnim" - "Microsoft Corporation" - C:\PROGRA~1\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL

{03C514A3-1EFB-4856-9F99-10D7BE1653C0} "Windows Live Mail HTML Asynchronous Pluggable Protocol Handler" - "Microsoft Corporation" - C:\Program Files\Windows Live\Mail\mailcomm.dll

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks )-----

{AEB6717E-7E19-11d0-97EE-00C04FD91972} "{AEB6717E-7E19-11d0-97EE-00C04FD91972}" - ? -   (File not found | COM-object registry key not found)

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----

{23170F69-40C1-278A-1000-000100020000} "7-Zip Shell Extension" - "Igor Pavlov" - C:\Program Files\7-Zip\7-zip.dll

{0563DB41-F538-4B37-A92D-4659049B7766} "CLSID_WLMCMimeFilter" - "Microsoft Corporation" - C:\Program Files\Windows Live\Mail\mailcomm.dll

{A70C977A-BF00-412C-90B7-034C51DA2439} "DesktopContext Class" - "NVIDIA Corporation" - C:\Program Files\NVIDIA Corporation\Display\nvui.dll

{D8D1CE8C-B1EB-4E95-B63B-1531BA60E992} "DivX Property Handler" - "DivX, Inc." - C:\Program Files\DivX\DivX Plus Media Foundation Components\DivXPropertyHandler.dll

{83238FAE-D346-4E12-8734-D42F7554B3E6} "DivX Thumbnail Provider" - "DivX, Inc." - C:\Program Files\DivX\DivX Plus Media Foundation Components\DivXThumbnailProvider.dll

{42042206-2D85-11D3-8CFF-005004838597} "Microsoft Office HTML Icon Handler" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\OFFICE11\msohev.dll

{993BE281-6695-4BA5-8A2A-7AACBFAAB69E} "Microsoft Office Metadata Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll

{5858A72C-C2B4-4dd7-B2BF-B76DB1BD9F6C} "Microsoft Office OneNote Namespace Extension for Windows Desktop Search" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\Office12\ONFILTER.DLL

{00020D75-0000-0000-C000-000000000046} "Microsoft Office Outlook" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\Office12\MLSHEXT.DLL

{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97} "Microsoft Office Thumbnail Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll

{3D1975AF-48C6-4f8e-A182-BE0E08FA86A9} "NVIDIA CPL Context Menu Extension" - "NVIDIA Corporation" - C:\windows\system32\nvshext.dll

{0006F045-0000-0000-C000-000000000046} "Outlook File Icon Extension" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\Office12\OLKFSTUB.DLL

{45AC2688-0253-4ED8-97DE-B5370FA7D48A} "Shell Extension for Malware scanning" - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\shlext.dll

{BDEADF00-C265-11D0-BCED-00A0C90AB50F} "Webordner" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\WEBFOL~1\MSONSEXT.DLL

{2BE99FD4-A181-4996-BFA9-58C5FFD11F6C} "Windows Live Photo Gallery Autoplay Drop Target" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\WLXPhotoGallery.exe

{00F30F64-AC33-42F5-8FD1-5DC2D3FDE06C} "Windows Live Photo Gallery Editor Drop Target" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\WLXPhotoGallery.exe

{00F3712A-CA79-45B4-9E4D-D7891E7F8B9D} "Windows Live Photo Gallery Editor Shim" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\PhotoViewerShim.dll

{00F30F90-3E96-453B-AFCD-D71989ECC2C7} "Windows Live Photo Gallery Viewer Autoplay Shim" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\PhotoViewerShim.dll

{00F33137-EE26-412F-8D71-F84E4C2C6625} "Windows Live Photo Gallery Viewer Autoplay Shim" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\PhotoViewerShim.dll

{00F374B7-B390-4884-B372-2FC349F2172B} "Windows Live Photo Gallery Viewer Drop Target" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\WLXPhotoGallery.exe

{00F346CB-35A4-465B-8B8F-65A29DBAB1F6} "Windows Live Photo Gallery Viewer Shim" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\PhotoViewerShim.dll

{06A2568A-CED6-4187-BB20-400B8C02BE5A} "{06A2568A-CED6-4187-BB20-400B8C02BE5A}" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\WLXPhotoAcquireWizard.exe

Eraser Shell Extension "{BC9B776A-90D7-4476-A791-79D835F30650}" - ? -   (File not found | COM-object registry key not found)
 

[Internet Explorer]

-----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )-----

<binary data> "Google Toolbar" - "Google Inc." - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll

ITBar7Height "ITBar7Height" - ? -   (File not found | COM-object registry key not found)

<binary data> "ITBar7Layout" - ? -   (File not found | COM-object registry key not found)

<binary data> "{32099AAC-C132-4136-9E9A-4E364A424E17}" - ? -   (File not found | COM-object registry key not found)

-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----

{8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.6.0_15" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab

{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} "Java Plug-in 1.6.0_15" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab

{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_15" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\npjpi160_15.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab

{E77F23EB-E7AB-4502-8F37-247DBAF1A147} "Windows Live Hotmail Photo Upload Tool" - "Microsoft® Corporation" - C:\Windows\Downloaded Program Files\MsnPUpld.dll / hxxp://gfx2.hotmail.com/mail/w4/m3/photouploadcontrol/VistaMSNPUpldde-de.cab

-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----

{48E73304-E1D6-4330-914C-F5F514E3486C} "An OneNote senden" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll

{53707962-6F74-2D53-2644-206D7942484F} "ClsidExtension" - "Safer Networking Limited" - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

{5F7B1267-94A9-47F5-98DB-E99415F33AEC} "In Blog veröffentlichen" - "Microsoft Corporation" - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll

{FF059E31-CC5A-4E2E-BF3B-96E929D65503} "Recherchieren" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL

-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar )-----

<binary data> "Google Toolbar" - "Google Inc." - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----

{18DF081C-E8AD-4283-A596-FA578C2EBDC3} "Adobe PDF Link Helper" - "Adobe Systems Incorporated" - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

{593DDEC6-7468-4cdd-90E1-42DADAA222E9} "DivX HiQ" - "DivX, LLC" - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll

{326E768D-4182-46FD-9C16-1449A49795F4} "DivX Plus Web Player HTML5 <video>" - "DivX, LLC" - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll

{AA58ED58-01DD-4d91-8333-CF10577473F7} "Google Toolbar Helper" - "Google Inc." - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll

{AF69DE43-7D58-4638-B6FA-CE66B5AD205D} "Google Toolbar Notifier BHO" - "Google Inc." - C:\Program Files\Google\GoogleToolbarNotifier\5.6.6209.1142\swg.dll

{DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2ssv.dll

{53707962-6F74-2D53-2644-206D7942484F} "Spybot-S&D IE Protection" - "Safer Networking Limited" - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

{9030D464-4C02-4ABF-8ECC-5164760863C6} "Windows Live ID-Anmelde-Hilfsprogramm" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

{5C255C8A-E604-49b4-9D64-90988571CECB} "{5C255C8A-E604-49b4-9D64-90988571CECB}" - ? -   (File not found | COM-object registry key not found)
 

[LSA Providers]

-----( HKLM\SYSTEM\CurrentControlSet\Control\Lsa )-----

"Security Packages" - "Microsoft Corporation" - C:\windows\system32\livessp.dll
 

[Logon]

-----( %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup )-----

"OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE  (Shortcut exists | File exists)

"desktop.ini" - ? - C:\Users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini

"Dropbox.lnk" - "Dropbox, Inc." - C:\Users\***\AppData\Roaming\Dropbox\bin\Dropbox.exe  (Shortcut exists | File exists)

-----( %AllUsersProfile%\Microsoft\Windows\Start Menu\Programs\Startup )-----

"desktop.ini" - ? - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini

"VPN Client.lnk" - "Cisco Systems, Inc." - C:\Program Files\Cisco Systems\VPN Client\vpngui.exe  (Shortcut exists | File exists)

-----( HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run )-----

"DAEMON Tools Lite" - "DT Soft Ltd" - "C:\Program Files\DAEMON Tools Lite\DTLite.exe" -autorun

"SpybotSD TeaTimer" - "Safer-Networking Ltd." - C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

"VeohPlugin" - "Veoh Networks" - "C:\Program Files\Veoh Networks\VeohWebPlayer\veohwebplayer.exe"

-----( HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\Wds\rdpwd )-----

"StartupPrograms" - ? - rdpclip  (File not found)

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----

"Adobe ARM" - "Adobe Systems Incorporated" - "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

"Adobe Reader Speed Launcher" - "Adobe Systems Incorporated" - "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"

"APLangApp" - "DoctorSoft" - "C:\Program Files\AnyPC Client\APLangApp.exe"

"avgnt" - "Avira GmbH" - "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min

"CLMLServer" - "CyberLink" - "C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe"

"DivXUpdate" - ? - "C:\Program Files\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW

"Eraser" - "The Eraser Project" - "C:\PROGRA~1\Eraser\Eraser.exe" --atRestart

"fsn" - ? - C:\Program Files\Phoenix Technologies Ltd\FailSafe\FailSafeNotifier.exe

"Malwarebytes' Anti-Malware (reboot)" - "Malwarebytes Corporation" - "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript

"PDVD8LanguageShortcut" - "CyberLink Corp." - "C:\Program Files\CyberLink\PowerDVD8\Language\Language.exe"

"QuickTime Task" - "Apple Inc." - "C:\Program Files\QuickTime\QTTask.exe" -atboottime

"RemoteControl8" - "CyberLink Corp." - "C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe"

"UCam_Menu" - "CyberLink Corp." - "C:\Program Files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\YouCam" UpdateWithCreateOnce "Software\CyberLink\YouCam\2.0"

"UpdateLBPShortCut" - "CyberLink Corp." - "C:\Program Files\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\LabelPrint" UpdateWithCreateOnce "Software\CyberLink\LabelPrint\2.5"

"UpdateP2GoShortCut" - "CyberLink Corp." - "C:\Program Files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\Power2Go" UpdateWithCreateOnce "SOFTWARE\CyberLink\Power2Go\6.0"

"UpdatePDRShortCut" - "CyberLink Corp." - "C:\Program Files\CyberLink\PowerDirector\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\PowerDirector" UpdateWithCreateOnce "Software\CyberLink\PowerDirector\7.0"

"UpdatePPShortCut" - "CyberLink Corp." - "C:\Program Files\CyberLink\PowerProducer\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\PowerProducer" UpdateWithCreateOnce "Software\CyberLink\PowerProducer\5.0"

"UpdatePSTShortCut" - "CyberLink Corp." - "C:\Program Files\CyberLink\DVD Suite\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\DVD Suite" UpdateWithCreateOnce "Software\CyberLink\PowerStarter"

"WinampAgent" - "Nullsoft, Inc." - "C:\Program Files\Winamp\winampa.exe"
 

[Print Monitors]

-----( HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors )-----

"Microsoft Document Imaging Writer Monitor" - "Microsoft Corporation" - C:\windows\system32\mdimon.dll

"Send To Microsoft OneNote Monitor" - "Microsoft Corporation" - C:\windows\system32\msonpmon.dll
 

[Services]

-----( HKLM\SYSTEM\CurrentControlSet\Services )-----

"Avira AntiVir Guard" (AntiVirService) - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\avguard.exe

"Avira AntiVir Planer" (AntiVirSchedulerService) - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\sched.exe

"Cisco AnyConnect VPN Agent" (vpnagent) - "Cisco Systems, Inc." - C:\Program Files\Cisco\Cisco AnyConnect VPN Client\vpnagent.exe

"Cisco Systems, Inc. VPN Service" (CVPND) - "Cisco Systems, Inc." - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe

"Cyberlink RichVideo Service(CRVS)" (RichVideo) - ? - C:\Program Files\CyberLink\Shared files\RichVideo.exe

"FABS - Helping agent for MAGIX media database" (Fabs) - "MAGIX AG" - C:\Program Files\Common Files\MAGIX Services\Database\bin\FABS.exe

"Firebird Server - MAGIX Instance" (FirebirdServerMAGIXInstance) - "MAGIX®" - C:\Program Files\Common Files\MAGIX Services\Database\bin\fbserver.exe

"Giraffic Video Accelerator" (Giraffic) - "Giraffic" - C:\Program Files\Giraffic\GirafficWatchdog.exe

"Google Software Updater" (gusvc) - "Google" - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

"Google Update Service (gupdate)" (gupdate) - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe

"InstallDriver Table Manager" (IDriverT) - "Macrovision Corporation" - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe

"Microsoft .NET Framework NGEN v4.0.30319_X86" (clr_optimization_v4.0.30319_32) - "Microsoft Corporation" - C:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

"Microsoft Office Diagnostics Service" (odserv) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE

"NVIDIA Driver Helper Service" (NVSvc) - "NVIDIA Corporation" - C:\windows\system32\nvvsvc.exe

"Office Source Engine" (ose) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE

"SBSD Security Center Service" (SBSDWSCService) - "Safer Networking Ltd." - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe

"Windows Live Family Safety-Dienst" (fsssvc) - "Microsoft Corporation" - C:\Program Files\Windows Live\Family Safety\fsssvc.exe

"Windows Live ID Sign-in Assistant" (wlidsvc) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
 

[Winsock Providers]

-----( HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries )-----

"WindowsLive Local NSP" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL

"WindowsLive NSP" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL
 

===[ Logfile end ]=========================================[ Logfile end ]===

--- --- ---
If You have questions or want to get some help, You can visit Online Solutions :: Index

Command-line:
Windows Version: Windows 7 Home Premium Edition
Windows Information: (build 7600), 32-bit
Base Board Manufacturer: SAMSUNG ELECTRONICS CO., LTD.
BIOS Manufacturer: Phoenix Technologies Ltd.
System Manufacturer: SAMSUNG ELECTRONICS CO., LTD.
System Product Name: R530/R730/P590
Logical Drives Mask: 0x0000001c

Kernel Drivers (total 196):
0x8364A000 \SystemRoot\system32\ntkrnlpa.exe
0x83613000 \SystemRoot\system32\halmacpi.dll
0x80BBE000 \SystemRoot\system32\kdcom.dll
0x8B835000 \SystemRoot\system32\mcupdate_GenuineIntel.dll
0x8B8AD000 \SystemRoot\system32\PSHED.dll
0x8B8BE000 \SystemRoot\system32\BOOTVID.dll
0x8B8C6000 \SystemRoot\system32\CLFS.SYS
0x8B908000 \SystemRoot\system32\CI.dll
0x8B9B3000 \SystemRoot\system32\drivers\klmdb.sys
0x8BA29000 \SystemRoot\system32\drivers\Wdf01000.sys
0x8BA9A000 \SystemRoot\system32\drivers\WDFLDR.SYS
0x8BAA8000 \SystemRoot\System32\Drivers\sptd.sys
0x8BB9B000 \SystemRoot\System32\Drivers\WMILIB.SYS
0x8BBA4000 \SystemRoot\System32\Drivers\SCSIPORT.SYS
0x8BC02000 \SystemRoot\system32\DRIVERS\ACPI.sys
0x8BC4A000 \SystemRoot\system32\DRIVERS\msisadrv.sys
0x8BC52000 \SystemRoot\system32\DRIVERS\vdrvroot.sys
0x8BC5D000 \SystemRoot\system32\DRIVERS\pci.sys
0x8BC87000 \SystemRoot\System32\drivers\partmgr.sys
0x8BC98000 \SystemRoot\system32\DRIVERS\compbatt.sys
0x8BCA0000 \SystemRoot\system32\DRIVERS\BATTC.SYS
0x8BCAB000 \SystemRoot\system32\DRIVERS\volmgr.sys
0x8BCBB000 \SystemRoot\System32\drivers\volmgrx.sys
0x8BD06000 \SystemRoot\System32\drivers\mountmgr.sys
0x8BE17000 \SystemRoot\system32\DRIVERS\iaStor.sys
0x8BFCA000 \SystemRoot\system32\DRIVERS\atapi.sys
0x8BFD3000 \SystemRoot\system32\DRIVERS\ataport.SYS
0x8BFF6000 \SystemRoot\system32\DRIVERS\msahci.sys
0x8BE00000 \SystemRoot\system32\DRIVERS\PCIIDEX.SYS
0x8BE0E000 \SystemRoot\system32\DRIVERS\amdxata.sys
0x8BD1C000 \SystemRoot\system32\drivers\fltmgr.sys
0x8BD50000 \SystemRoot\system32\drivers\fileinfo.sys
0x8C001000 \SystemRoot\System32\Drivers\Ntfs.sys
0x8C130000 \SystemRoot\System32\Drivers\msrpc.sys
0x8C15B000 \SystemRoot\System32\Drivers\ksecdd.sys
0x8C16E000 \SystemRoot\System32\Drivers\cng.sys
0x8C1CB000 \SystemRoot\System32\drivers\pcw.sys
0x8C1D9000 \SystemRoot\System32\Drivers\Fs_Rec.sys
0x8C20E000 \SystemRoot\system32\drivers\ndis.sys
0x8C2C5000 \SystemRoot\system32\drivers\NETIO.SYS
0x8C303000 \SystemRoot\System32\Drivers\ksecpkg.sys
0x8C328000 \SystemRoot\system32\DRIVERS\volsnap.sys
0x8C367000 \SystemRoot\System32\Drivers\spldr.sys
0x8C36F000 \SystemRoot\System32\drivers\rdyboost.sys
0x8C39C000 \SystemRoot\System32\Drivers\mup.sys
0x8C3AC000 \SystemRoot\System32\drivers\hwpolicy.sys
0x8C3B4000 \SystemRoot\System32\DRIVERS\fvevol.sys
0x8C3E6000 \SystemRoot\system32\DRIVERS\disk.sys
0x8BD61000 \SystemRoot\system32\DRIVERS\CLASSPNP.SYS
0x90800000 \SystemRoot\system32\DRIVERS\cdrom.sys
0x9081F000 \SystemRoot\System32\Drivers\Null.SYS
0x90826000 \SystemRoot\System32\Drivers\Beep.SYS
0x8C1E2000 \SystemRoot\System32\drivers\vga.sys
0x8BD86000 \SystemRoot\System32\drivers\VIDEOPRT.SYS
0x8C1EE000 \SystemRoot\System32\drivers\watchdog.sys
0x909F6000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0x8C3F7000 \SystemRoot\system32\drivers\rdpencdd.sys
0x8BDA7000 \SystemRoot\system32\drivers\rdprefmp.sys
0x8BDAF000 \SystemRoot\System32\Drivers\Msfs.SYS
0x8BDBA000 \SystemRoot\System32\Drivers\Npfs.SYS
0x90C3D000 \SystemRoot\System32\drivers\tcpip.sys
0x90D86000 \SystemRoot\System32\drivers\fwpkclnt.sys
0x90DB7000 \SystemRoot\system32\DRIVERS\tdx.sys
0x90DCE000 \SystemRoot\system32\DRIVERS\TDI.SYS
0x91427000 \SystemRoot\system32\drivers\afd.sys
0x91481000 \SystemRoot\System32\DRIVERS\netbt.sys
0x914B3000 \SystemRoot\system32\DRIVERS\wfplwf.sys
0x914BA000 \SystemRoot\system32\DRIVERS\pacer.sys
0x914D9000 \SystemRoot\system32\DRIVERS\vwififlt.sys
0x914EA000 \SystemRoot\system32\DRIVERS\netbios.sys
0x914F8000 \SystemRoot\system32\DRIVERS\wanarp.sys
0x9150B000 \SystemRoot\system32\DRIVERS\termdd.sys
0x9151B000 \SystemRoot\system32\DRIVERS\ssmdrv.sys
0x91521000 \??\C:\windows\system32\Drivers\SABI.sys
0x91529000 \SystemRoot\system32\DRIVERS\rdbss.sys
0x9156A000 \SystemRoot\system32\drivers\nsiproxy.sys
0x91574000 \SystemRoot\system32\DRIVERS\mssmbios.sys
0x9157E000 \SystemRoot\System32\drivers\discache.sys
0x9158A000 \SystemRoot\System32\Drivers\dfsc.sys
0x915A2000 \SystemRoot\system32\DRIVERS\blbdrive.sys
0x915B0000 \SystemRoot\system32\DRIVERS\avipbb.sys
0x915D6000 \SystemRoot\system32\DRIVERS\tunnel.sys
0x93004000 \SystemRoot\system32\DRIVERS\nvlddmkm.sys
0x939FE000 \SystemRoot\System32\Drivers\nvBridge.kmd
0x9223C000 \SystemRoot\System32\drivers\dxgkrnl.sys
0x922F3000 \SystemRoot\System32\drivers\dxgmms1.sys
0x9232C000 \SystemRoot\system32\DRIVERS\HDAudBus.sys
0x9234B000 \SystemRoot\system32\DRIVERS\usbehci.sys
0x9235A000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
0x91E21000 \SystemRoot\system32\DRIVERS\athr.sys
0x91F55000 \SystemRoot\system32\DRIVERS\vwifibus.sys
0x91F5F000 \SystemRoot\system32\DRIVERS\yk62x86.sys
0x91FB0000 \SystemRoot\system32\DRIVERS\CmBatt.sys
0x91FB4000 \SystemRoot\system32\DRIVERS\i8042prt.sys
0x91FCC000 \SystemRoot\system32\DRIVERS\kbdclass.sys
0x923A5000 \SystemRoot\system32\DRIVERS\SynTP.sys
0x91FD9000 \SystemRoot\system32\DRIVERS\USBD.SYS
0x91FDB000 \SystemRoot\system32\DRIVERS\mouclass.sys
0x91FE8000 \SystemRoot\system32\DRIVERS\intelppm.sys
0x91E00000 \SystemRoot\system32\DRIVERS\CompositeBus.sys
0x923DF000 \SystemRoot\system32\DRIVERS\dne2000.sys
0x91E0D000 \SystemRoot\system32\DRIVERS\AgileVpn.sys
0x92200000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
0x92218000 \SystemRoot\system32\DRIVERS\ndistapi.sys
0x91400000 \SystemRoot\system32\DRIVERS\ndiswan.sys
0x92223000 \SystemRoot\system32\DRIVERS\raspppoe.sys
0x90DD9000 \SystemRoot\system32\DRIVERS\raspptp.sys
0x90C00000 \SystemRoot\system32\DRIVERS\rassstp.sys
0x91FFA000 \SystemRoot\system32\DRIVERS\seehcri.sys
0x91E1F000 \SystemRoot\system32\DRIVERS\swenum.sys
0x8BDC8000 \SystemRoot\system32\DRIVERS\ks.sys
0x90C17000 \SystemRoot\system32\DRIVERS\umbus.sys
0x94C24000 \SystemRoot\system32\DRIVERS\usbhub.sys
0x94C68000 \SystemRoot\System32\Drivers\NDProxy.SYS
0x94C79000 \SystemRoot\system32\drivers\nvhda32v.sys
0x94C9A000 \SystemRoot\system32\drivers\portcls.sys
0x94CC9000 \SystemRoot\system32\drivers\drmk.sys
0x96017000 \SystemRoot\system32\drivers\RTKVHDA.sys
0x83170000 \SystemRoot\System32\win32k.sys
0x962ED000 \SystemRoot\System32\drivers\Dxapi.sys
0x962F7000 \SystemRoot\System32\Drivers\crashdmp.sys
0x9082D000 \SystemRoot\System32\Drivers\dump_iaStor.sys
0x96304000 \SystemRoot\System32\Drivers\dump_dumpfve.sys
0x96315000 \SystemRoot\system32\DRIVERS\monitor.sys
0x96320000 \SystemRoot\system32\DRIVERS\usbccgp.sys
0x96337000 \SystemRoot\System32\Drivers\usbvideo.sys
0x833D0000 \SystemRoot\System32\TSDDD.dll
0x9635B000 \SystemRoot\system32\DRIVERS\hidusb.sys
0x96366000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
0x96379000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
0x96380000 \SystemRoot\system32\DRIVERS\mouhid.sys
0x83000000 \SystemRoot\System32\cdd.dll
0x9638B000 \SystemRoot\system32\DRIVERS\USBSTOR.SYS
0x963A2000 \SystemRoot\system32\drivers\luafv.sys
0x963BD000 \SystemRoot\system32\DRIVERS\avgntflt.sys
0x963D2000 \SystemRoot\system32\drivers\WudfPf.sys
0x963EC000 \SystemRoot\system32\DRIVERS\lltdio.sys
0x94CE2000 \SystemRoot\system32\DRIVERS\nwifi.sys
0x96000000 \SystemRoot\system32\DRIVERS\ndisuio.sys
0x94D28000 \SystemRoot\system32\DRIVERS\rspndr.sys
0x94D3B000 \SystemRoot\System32\Drivers\fastfat.SYS
0x94D65000 \SystemRoot\system32\drivers\HTTP.sys
0x94DEA000 \SystemRoot\system32\DRIVERS\vwifimp.sys
0x94C00000 \SystemRoot\system32\DRIVERS\bowser.sys
0x90C25000 \SystemRoot\System32\drivers\mpsdrv.sys
0x8BBCA000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
0x8B9C5000 \SystemRoot\system32\DRIVERS\mrxsmb10.sys
0x8BA00000 \SystemRoot\system32\DRIVERS\mrxsmb20.sys
0x9CE22000 \??\C:\windows\system32\Drivers\CVPNDRVA.sys
0x9CEB2000 \SystemRoot\system32\drivers\peauth.sys
0x9CF49000 \SystemRoot\System32\Drivers\secdrv.SYS
0x9CF53000 \SystemRoot\System32\DRIVERS\srvnet.sys
0x9CF74000 \SystemRoot\System32\drivers\tcpipreg.sys
0x9CF81000 \SystemRoot\System32\DRIVERS\srv2.sys
0xA3A13000 \SystemRoot\System32\DRIVERS\srv.sys
0xA3AF0000 \??\C:\windows\system32\Drivers\PROCEXP113.SYS
0xA3AF2000 \??\C:\Users\***\AppData\Local\Temp\catchme.sys
0x77AA0000 \Windows\System32\ntdll.dll
0x484A0000 \Windows\System32\smss.exe
0x77CE0000 \Windows\System32\apisetschema.dll
0x004E0000 \Windows\System32\autochk.exe
0x77C70000 \Windows\System32\shlwapi.dll
0x779D0000 \Windows\System32\msctf.dll
0x77830000 \Windows\System32\setupapi.dll
0x77C20000 \Windows\System32\Wldap32.dll
0x77BF0000 \Windows\System32\imagehlp.dll
0x77760000 \Windows\System32\user32.dll
0x77680000 \Windows\System32\kernel32.dll
0x77520000 \Windows\System32\ole32.dll
0x77480000 \Windows\System32\usp10.dll
0x77BE0000 \Windows\System32\psapi.dll
0x77460000 \Windows\System32\imm32.dll
0x773D0000 \Windows\System32\oleaut32.dll
0x77290000 \Windows\System32\urlmon.dll
0x771E0000 \Windows\System32\rpcrt4.dll
0x77190000 \Windows\System32\gdi32.dll
0x77100000 \Windows\System32\clbcatq.dll
0x77050000 \Windows\System32\msvcrt.dll
0x77040000 \Windows\System32\lpk.dll
0x763F0000 \Windows\System32\shell32.dll
0x763E0000 \Windows\System32\nsi.dll
0x763C0000 \Windows\System32\sechost.dll
0x761C0000 \Windows\System32\iertutil.dll
0x76120000 \Windows\System32\advapi32.dll
0x760C0000 \Windows\System32\difxapi.dll
0x76040000 \Windows\System32\comdlg32.dll
0x76000000 \Windows\System32\ws2_32.dll
0x75F00000 \Windows\System32\wininet.dll
0x75EF0000 \Windows\System32\normaliz.dll
0x75EC0000 \Windows\System32\cfgmgr32.dll
0x75E70000 \Windows\System32\KernelBase.dll
0x75DE0000 \Windows\System32\comctl32.dll
0x75DC0000 \Windows\System32\devobj.dll
0x75CA0000 \Windows\System32\crypt32.dll
0x75C70000 \Windows\System32\wintrust.dll
0x75C60000 \Windows\System32\msasn1.dll

Processes (total 70):
0 System Idle Process
4 System
312 C:\Windows\System32\smss.exe
460 csrss.exe
532 C:\Windows\System32\wininit.exe
540 csrss.exe
592 C:\Windows\System32\services.exe
600 C:\Windows\System32\lsass.exe
612 C:\Windows\System32\lsm.exe
736 C:\Windows\System32\svchost.exe
836 C:\Windows\System32\nvvsvc.exe
876 C:\Windows\System32\svchost.exe
944 C:\Windows\System32\svchost.exe
976 C:\Windows\System32\svchost.exe
1008 C:\Windows\System32\svchost.exe
1120 C:\Windows\System32\svchost.exe
1204 C:\Windows\System32\winlogon.exe
1212 C:\Program Files\Cisco\Cisco AnyConnect VPN Client\vpnagent.exe
1272 C:\Windows\System32\svchost.exe
1540 C:\Windows\System32\spoolsv.exe
1708 C:\Program Files\Avira\AntiVir Desktop\sched.exe
1732 C:\Windows\System32\svchost.exe
1868 C:\Program Files\Avira\AntiVir Desktop\avguard.exe
1920 C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe
1932 C:\Windows\System32\nvvsvc.exe
2016 C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
2024 C:\Windows\System32\conhost.exe
504 C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
372 C:\Program Files\Common Files\MAGIX Services\Database\bin\FABS.exe
1560 C:\Program Files\Giraffic\GirafficWatchdog.exe
892 C:\Program Files\CyberLink\Shared files\RichVideo.exe
1168 C:\Windows\System32\svchost.exe
860 C:\Windows\System32\svchost.exe
2132 C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
2220 C:\Program Files\Giraffic\Giraffic.exe
2516 C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
2576 C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
2804 C:\Windows\System32\SearchIndexer.exe
3624 C:\Windows\System32\taskhost.exe
3724 C:\Windows\System32\dwm.exe
3772 C:\Windows\System32\taskeng.exe
3916 C:\Windows\System32\svchost.exe
4032 C:\Program Files\Samsung\Samsung Support Center\SSCKbdHk.exe
4068 C:\Program Files\Samsung\Samsung Recovery Solution 4\WCScheduler.exe
1528 C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
1512 C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
3452 C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe
1108 C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe
3588 C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
1548 C:\Program Files\Eraser\Eraser.exe
1416 C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
2444 C:\Program Files\Winamp\winampa.exe
3660 C:\Program Files\Windows Media Player\wmpnetwk.exe
2644 C:\Program Files\DivX\DivX Update\DivXUpdate.exe
2680 C:\Program Files\Veoh Networks\VeohWebPlayer\veohwebplayer.exe
344 C:\Windows\System32\StikyNot.exe
1064 C:\Program Files\Windows Sidebar\sidebar.exe
2564 C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
4296 C:\Windows\explorer.exe
2928 C:\Program Files\Mozilla Firefox\firefox.exe
2000 C:\Windows\System32\audiodg.exe
3260 C:\Windows\System32\SearchProtocolHost.exe
5236 C:\Windows\System32\taskhost.exe
5896 C:\Program Files\Winamp\winamp.exe
5080 C:\Windows\System32\notepad.exe
5072 C:\Windows\System32\SearchFilterHost.exe
1496 dllhost.exe
5288 dllhost.exe
1948 C:\Users\***\Desktop\MBRCheck.exe
4220 C:\Windows\System32\conhost.exe

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000003`c6500000 (NTFS)
\\.\D: --> \\.\PhysicalDrive0 at offset 0x00000028`90300000 (NTFS)

PhysicalDrive0 Model Number: SAMSUNGHM321HI, Rev: 2AJ10001

Size Device Name MBR Status
--------------------------------------------
298 GB \\.\PhysicalDrive0 Unknown MBR code
SHA1: F5C09ACABD4A5370BDD907E8EDFE0C1DA0F9D3F5

Found non-standard or infected MBR.
Enter 'Y' and hit ENTER for more options, or 'N' to exit:

Nein, es funktionierte nicht.

Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SASW und poste die Logs.
Denk dran beide Tools zu updaten vor dem Scan!!

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Datenbank Version: 6391

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

18.04.2011 21:45:25
mbam-log-2011-04-18 (21-45-25).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|)
Durchsuchte Objekte: 289977
Laufzeit: 1 Stunde(n), 4 Minute(n), 3 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)

SUPERAntiSpyware Scan Log
SUPERAntiSpyware.com | Remove Malware | Remove Spyware - AntiMalware, AntiSpyware, AntiAdware!

Generated 04/18/2011 at 10:11 PM

Application Version : 4.50.1002

Core Rules Database Version : 6865
Trace Rules Database Version: 4677

Scan type : Quick Scan
Total Scan Time : 00:13:23

Memory items scanned : 750
Memory threats detected : 0
Registry items scanned : 2698
Registry threats detected : 0
File items scanned : 8900
File threats detected : 1

Adware.Tracking Cookie
C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\***@atdmt.combing[2].txt

Zitat:

Scan type : Quick Scan

Du solltest einen Vollscan mit SASW machen!

SUPERAntiSpyware Scann-Protokoll
hxxp://www.superantispyware.com

Generiert 04/18/2011 bei 11:24 PM

Version der Applikation : 4.50.1002

Version der Kern-Datenbank : 6865
Version der Spur-Datenbank : 4677

Scan Art : kompletter Scann
Totale Scann-Zeit : 00:44:45

Gescannte Speicherelemente : 784
Erfasste Speicher-Bedrohungen : 0
Gescannte Register-Elemente : 10513
Erfasste Register-Bedrohungen : 0
Gescannte Datei-Elemente : 27411
Erfasste Datei-Elemente : 0

Ok. Noch probleme offen?

Nein, es läuft wieder!

Vielen Dank für deine Hilfe!!! :D

Dann wären wir durch! :abklatsch:

Bitte abschließend die Updates prüfen, unten mein Leitfaden dazu.
Für noch mehr Sicherheit solltest Du nach der beseitigten Infektion auch möglichst alle Passwörter ändern.

Microsoftupdate

Windows XP: Besuch mit dem IE die MS-Updateseite und lass Dir alle wichtigen Updates installieren.

Windows Vista/7: Anleitung Windows-Update

PDF-Reader aktualisieren
Dein Adobe Reader ist nicht aktuell, was ein großes Sicherheitsrisiko darstellt. Du solltest daher besser die alte Version über Systemsteuerung => Software deinstallieren, indem Du dort auf "Adobe Reader x.0" klickst und das Programm entfernst.

Ich empfehle einen alternativen PDF-Reader wie SumatraPDF oder Foxit PDF Reader, beide sind sehr viel schlanker und flotter als der AdobeReader.

Bitte überprüf bei der Gelegenheit auch die Aktualität des Flashplayers, hier der direkte Downloadlink:

Mozilla und andere Browser => http://filepony.de/?q=Flash+Player
Internet Explorer => http://fpdownload.adobe.com/get/flas..._player_ax.exe

Java-Update
Veraltete Java-Installationen sind ein Sicherheitsrisiko, daher solltest Du die alten Versionen löschen (falls vorhanden, am besten mit JavaRa) und auf die neuste aktualisieren. Beende dazu alle Programme (v.a. die Browser), klick danach auf Start, Systemsteuerung, Software und deinstalliere darüber alle aufgelisteten Java-Versionen. Lad Dir danach von hier das aktuelle Java SE Runtime Environment (JRE) herunter und installiere es.