Hallo zusammen,

nun hat es anscheinend auch mich getroffen. Seit heute Mittag habe ich auch dieses Zero Access Rootkit wie es scheint. Zumindest behauptet AntiVir dies.

TR/Sirefef.BP.1
und ähnliche
sowie
Exp/JAVA.Vedenbi.Gen

wurden gefunden.

Im Moment läuft noch Malwarebytes Anti Malware. OTL steht auch noch aus. Da mir die Zeit drängt (bin mitten in der Klausurphase und bräuchte mein Notebook in den nächsten Tagen) hier schonmal der Thread - die fehlenden Logfiles werden noch nachgereicht.

GMER:

GMER 1.0.15.15641 - hxxp://www.gmer.net
Rootkit quick scan 2012-02-29 17:58:24
Windows 6.1.7601 Service Pack 1 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP3T0L0-6 ST9160821AS rev.3.ALC
Running: gmerkyborl0k.exe; Driver: C:\Users\xxx\AppData\Local\Temp\fwlcypoc.sys


---- System - GMER 1.0.15 ----

Code            874C8C4C                                                      ZwTraceEvent
Code            874C8C4B                                                      NtTraceEvent

---- Devices - GMER 1.0.15 ----

Device          \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-2                   86E531F8
Device          \Driver\atapi \Device\Ide\IdePort0                            86E531F8
Device          \Driver\atapi \Device\Ide\IdePort1                            86E531F8
Device          \Driver\atapi \Device\Ide\IdePort2                            86E531F8
Device          \Driver\atapi \Device\Ide\IdePort3                            86E531F8
Device          \Driver\atapi \Device\Ide\IdePort4                            86E531F8
Device          \Driver\atapi \Device\Ide\IdePort5                            86E531F8
Device          \Driver\msahci \Device\Ide\PciIde2Channel0                    86E541F8
Device          \Driver\msahci \Device\Ide\PciIde2Channel1                    86E541F8
Device          \Driver\msahci \Device\Ide\PciIde2Channel2                    86E541F8
Device          \Driver\atapi \Device\Ide\IdeDeviceP3T0L0-6                   86E531F8
Device          \Driver\agmnf4e5 \Device\Scsi\agmnf4e51                       873D91F8
Device          \Driver\agmnf4e5 \Device\Scsi\agmnf4e51Port7Path0Target0Lun0  873D91F8
Device          \FileSystem\Ntfs \Ntfs                                        86E571F8

AttachedDevice  \FileSystem\Ntfs \Ntfs                                        AsDsm.sys (Data Security Manager Driver/Windows (R) Codename Longhorn DDK provider)

Device          \FileSystem\fastfat \Fat                                      865711F8

AttachedDevice  \FileSystem\fastfat \Fat                                      fltmgr.sys (Microsoft Dateisystem-Filter-Manager/Microsoft Corporation)
AttachedDevice  \FileSystem\fastfat \Fat                                      AsDsm.sys (Data Security Manager Driver/Windows (R) Codename Longhorn DDK provider)

---- Threads - GMER 1.0.15 ----

Thread          System [4:424]                                                873E6540
Thread          System [4:428]                                                873E6540

---- EOF - GMER 1.0.15 ----
         

MBR:

Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, hxxp://www.gmer.net
Windows 6.1.7601 Disk: ST9160821AS rev.3.ALC -> Harddisk0\DR0 -> \Device\Ide\IdeDeviceP3T0L0-6 

device: opened successfully
user: MBR read successfully

Disk trace:
called modules: >>UNKNOWN [0x83406000]<< >>UNKNOWN [0x8C7B8000]<< >>UNKNOWN [0x8C7A7000]<< >>UNKNOWN [0x873E5BC0]<< 
1 ntkrnlpa!IofCallDriver[0x8343D52A] -> \Device\Harddisk0\DR0[0x87091030]
\Driver\Disk[0x87090F38] -> IRP_MJ_CREATE -> 0x8C7BC39F
3 [0x8C7BC59E] -> ntkrnlpa!IofCallDriver[0x8343D52A] -> [0x873A1C28]
\Driver\00000995[0x873B0DE8] -> IRP_MJ_CREATE -> 0x873E5BC0
kernel: MBR read successfully
user & kernel MBR OK 
Warning: possible TDL3 rootkit infection !
         

Wie kann ich weiter vorgehen? (wie gesagt, MBAM und OTL Logs kommen gleich)
Ich habe eine Sicherung des Notebooks auf einer externen HDD von vor ca. 1 Monat via Acronis True Image 2009. Kann ich diese verwenden? Wenn ja, wie? Erst Windows 7 neu installieren und dann Backup wiederherstellen? Muss ich meinen MBR vor der Windows Installation von Hand löschen? Oder einfach Win7 DVD rein - und dann neu installieren? Reparieren wird ja wohl nicht ausreichen, oder?
Leider hatte ich zum Zeitpunkt der Erstmeldung des Virus meine große externe HDD angeschlossen. Muss ich nun Angst haben, dass alle Daten dort verseucht sind? Unter anderem ist dort die Installationsdatei meines Office drauf (Downloadversion, gekauft! also legal.).

Vielen Dank schonmal für die Hilfe!

dummesschaf


EDIT:

MBAM:

Malwarebytes Anti-Malware 1.60.1.1000
www.malwarebytes.org

Datenbank Version: v2012.01.13.04

Windows 7 Service Pack 1 x86 NTFS
Internet Explorer 9.0.8112.16421
Andreas :: ANDREASNOTEBOOK [Administrator]

29.02.2012 18:02:17
mbam-log-2012-02-29 (20-33-20).txt

Art des Suchlaufs: Vollständiger Suchlauf
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 539461
Laufzeit: 2 Stunde(n), 30 Minute(n), 15 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 1
C:\Windows\System32\backupexecalertserver.dll (Rootkit.0Access) -> Keine Aktion durchgeführt.

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 1
HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon|Shell (Backdoor.Agent) -> Daten: C:\Users\Andreas\AppData\Local\75422588\X -> Keine Aktion durchgeführt.

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 20
C:\Windows\System32\backupexecalertserver.dll (Rootkit.0Access) -> Keine Aktion durchgeführt.
C:\Windows\System32\hpci.dll (Rootkit.0Access) -> Keine Aktion durchgeführt.
C:\Windows\System32\incdrec.dll (Rootkit.0Access) -> Keine Aktion durchgeführt.
C:\Windows\System32\wwsecsvc.dll (Rootkit.0Access) -> Keine Aktion durchgeführt.
C:\Users\Andreas\AppData\Local\75422588\U\00000001.@ (Backdoor.0Access) -> Keine Aktion durchgeführt.
C:\Users\Andreas\AppData\Local\75422588\U\000000c0.@ (Trojan.Agent) -> Keine Aktion durchgeführt.
C:\Users\Andreas\AppData\Local\75422588\U\000000cb.@ (Trojan.Agent) -> Keine Aktion durchgeführt.
C:\Users\Andreas\AppData\Local\75422588\U\000000cf.@ (Trojan.Agent) -> Keine Aktion durchgeführt.
C:\Users\Andreas\AppData\Local\75422588\U\800000c0.@ (Rootkit.0Access) -> Keine Aktion durchgeführt.
C:\Windows\assembly\GAC_MSIL\Desktop.ini (Rootkit.0Access) -> Keine Aktion durchgeführt.
C:\Windows\System32\adihdaudaddservice.dll.VIR (Rootkit.0Access) -> Keine Aktion durchgeführt.
C:\Windows\System32\belgium_id_card_service.dll (Rootkit.0Access) -> Keine Aktion durchgeführt.
C:\Windows\System32\hap17v2k.dll (Rootkit.0Access) -> Keine Aktion durchgeführt.
C:\Windows\System32\lightscribeservice.dll (Rootkit.0Access) -> Keine Aktion durchgeführt.
C:\Windows\System32\svchost.dll (Rootkit.0Access) -> Keine Aktion durchgeführt.
C:\Windows\System32\tosrfcom.dll (Rootkit.0Access) -> Keine Aktion durchgeführt.
C:\Windows\System32\usbatapi2000.dll (Rootkit.0Access) -> Keine Aktion durchgeführt.
C:\Windows\System32\v124.dll (Rootkit.0Access) -> Keine Aktion durchgeführt.
C:\Windows\System32\windrvNT.dll (Rootkit.0Access) -> Keine Aktion durchgeführt.
C:\Windows\System32\venturi2.dll (Rootkit.0Access) -> Keine Aktion durchgeführt.

(Ende)
         

OTL Logs im Anhang

Guten Morgen,

ich bins nochmal. Habe eben gesehen, dass man noch eine DDS.txt und eine Attach.txt beifügen sollte. (siehe unten)

Noch eine weitere Frage: wenn ich meine Daten via Linux Live CD gesichert habe (auf externe HDD), wie kann ich dann sicher gehen, dass ich keinen Virus/... mit auf diese HDD gepackt habe. In Linux kann ich ja schlecht nach Viren suchen, oder?


DDS:

.
DDS (Ver_2011-08-26.01) - NTFSx86 
Internet Explorer: 9.0.8112.16421  BrowserJavaVersion: 1.6.0_25
Run by Andreas at 8:42:07 on 2012-03-01
Microsoft Windows 7 Professional   6.1.7601.1.1252.49.1031.18.3055.2071 [GMT 1:00]
.
AV: AntiVir Desktop *Enabled/Updated* {090F9C29-64CE-6C6F-379C-5901B49A85B7}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: AntiVir Desktop *Enabled/Updated* {B26E7DCD-42F4-63E1-0D2C-6273CF1DCF0A}
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Program Files\Fingerprint Sensor\AtService.exe
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe -k NetworkService
C:\Program Files\ASUS\ASUS Data Security Manager\ADSMSrv.exe
C:\Program Files\ATK Hotkey\ASLDRSrv.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k WbioSvcGroup
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\Prey\platform\windows\cronsvc.exe
C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\Windows\system32\conhost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\CDBurnerXP\NMSAccessU.exe
C:\Windows\system32\PnkBstrA.exe
D:\Solidworks\SolidWorks Flow Simulation\binCFW\StandAloneSlv.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\Program Files\Sandboxie\SbieSvc.exe
C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\System32\StkCSrv.exe
C:\Program Files\TeamViewer\Version6\TeamViewer_Service.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files\Wyse\PocketCloud Windows Companion\PocketCloudService.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskhost.exe
C:\Windows\explorer.exe
C:\Program Files\ATK Hotkey\Hcontrol.exe
C:\Program Files\ATKOSD2\ATKOSD2.exe
C:\Program Files\P4G\BatteryLife.exe
C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
C:\Program Files\ASUS\Splendid\ACMON.exe
C:\Program Files\ASUS\ATK Media\DMedia.exe
C:\Windows\System32\ACEngSvr.exe
C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
C:\Windows\WindowsMobile\wmdc.exe
C:\Program Files\ATK Hotkey\ATKOSD.exe
C:\Windows\system32\svchost.exe -k WindowsMobile
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Windows\System32\StikyNot.exe
C:\Program Files\ATK Hotkey\KBFiltr.exe
C:\Users\Andreas\AppData\Roaming\Dropbox\bin\Dropbox.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\conhost.exe
C:\Windows\system32\wbem\wmiprvse.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = about:blank
uWinlogon: Shell=c:\users\andreas\appdata\local\75422588\X
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: {31FF080D-12A3-439A-A2EF-4BA95A3148E8} - No File
BHO: DivX Plus Web Player HTML5 <video>: {326e768d-4182-46fd-9c16-1449a49795f4} - c:\program files\divx\divx plus web player\ie\divxhtml5\DivXHTML5.dll
BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\progra~1\micros~1\office14\GROOVEEX.DLL
BHO: Windows Live ID-Anmelde-Hilfsprogramm: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Office Document Cache Handler: {b4f3a835-0e21-4959-ba22-42b3008e02ff} - c:\progra~1\micros~1\office14\URLREDIR.DLL
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
TB: TerraTec Home Cinema: {ad6e6555-fb2c-47d4-8339-3e2965509877} - c:\progra~1\terratec\terrat~1\THCDES~1.DLL
TB: {D4027C7F-154A-4066-A1AD-4243D8127440} - No File
uRun: [RESTART_STICKY_NOTES] c:\windows\system32\StikyNot.exe
mRun: [SMSERIAL] c:\program files\motorola\smserial\sm56hlpr.exe
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [JMB36X IDE Setup] c:\windows\raidtool\xInsIDE.exe
mRun: [ATKMEDIA] c:\program files\asus\atk media\DMEDIA.EXE
mRun: [RtHDVCpl] c:\program files\realtek\audio\hda\RtHDVCpl.exe -s
mRun: [Windows Mobile Device Center] %windir%\WindowsMobile\wmdc.exe
mRun: [<NO NAME>] 
mRun: [avgnt] "c:\program files\avira\antivir desktop\avgnt.exe" /min
mRun: [BCSSync] "c:\program files\microsoft office\office14\BCSSync.exe" /DelayServices
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
StartupFolder: c:\users\andreas\appdata\roaming\micros~1\windows\startm~1\programs\startup\dropbox.lnk - c:\users\andreas\appdata\roaming\dropbox\bin\Dropbox.exe
mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
mPolicies-system: PromptOnSecureDesktop = 0 (0x0)
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: An OneNote s&enden - c:\progra~1\micros~1\office14\ONBttnIE.dll/105
IE: Free YouTube Download - c:\users\andreas\appdata\roaming\dvdvideosoftiehelpers\freeyoutubedownload.htm
IE: Free YouTube to MP3 Converter - c:\users\andreas\appdata\roaming\dvdvideosoftiehelpers\freeyoutubetomp3converter.htm
IE: Nach Microsoft &Excel exportieren - c:\progra~1\mi3dfc~1\office11\EXCEL.EXE/3000
IE: Nach Microsoft E&xcel exportieren - c:\progra~1\micros~1\office14\EXCEL.EXE/3000
IE: Nach Microsoft E&xel exportieren - c:\progra~1\micros~1\office12\EXCEL.EXE/3000
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\program files\microsoft office\office14\ONBttnIE.dll
IE: {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:\windows\windowsmobile\INetRepl.dll
IE: {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:\windows\windowsmobile\INetRepl.dll
IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - c:\program files\microsoft office\office14\ONBttnIELinkedNotes.dll
LSP: mswsock.dll
DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} - hxxp://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} - hxxp://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
TCP: DhcpNameServer = 192.168.1.1
TCP: Interfaces\{E6700137-9ECC-410F-BF8A-53E7790BEB0C} : DhcpNameServer = 192.168.1.1
TCP: Interfaces\{E6700137-9ECC-410F-BF8A-53E7790BEB0C}\465667F6C6F6D2030303243324441323132364 : DhcpNameServer = 192.168.2.1
TCP: Interfaces\{E6700137-9ECC-410F-BF8A-53E7790BEB0C}\642716E6A7F5745756E6475627374716C6 : DhcpNameServer = 192.168.0.1
TCP: Interfaces\{E6700137-9ECC-410F-BF8A-53E7790BEB0C}\6457371627F6 : DhcpNameServer = 192.168.1.1
TCP: Interfaces\{E6700137-9ECC-410F-BF8A-53E7790BEB0C}\757402B4F6D647572737472716373756 : DhcpNameServer = 192.168.178.1
TCP: Interfaces\{E6700137-9ECC-410F-BF8A-53E7790BEB0C}\75C414E4D23536861647A7 : DhcpNameServer = 192.168.2.1
Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - c:\program files\common files\microsoft shared\office14\MSOXMLMF.DLL
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\progra~1\micros~1\office14\GROOVEEX.DLL
mASetup: {10880D85-AAD9-4558-ABDC-2AB1552D831F} - "c:\program files\common files\lightscribe\LSRunOnce.exe"
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\users\andreas\appdata\roaming\mozilla\firefox\profiles\jgcaeez0.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.de/ig?hl=de&source=iglk
FF - plugin: c:\progra~1\micros~1\office14\NPAUTHZ.DLL
FF - plugin: c:\progra~1\micros~1\office14\NPSPWRAP.DLL
FF - plugin: c:\program files\adobe\reader 10.0\reader\air\nppdf32.dll
FF - plugin: c:\program files\common files\wolfram research\browser\8.0.1.2063897\npmathplugin.dll
FF - plugin: c:\program files\divx\divx ovs helper\npovshelper.dll
FF - plugin: c:\program files\divx\divx plus web player\npdivx32.dll
FF - plugin: c:\program files\google\google earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\google\picasa3\npPicasa3.dll
FF - plugin: c:\program files\google\update\1.3.21.99\npGoogleUpdate3.dll
FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\microsoft silverlight\4.1.10111.0\npctrlui.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npdeployJava1.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npEModelPlugin.dll
FF - plugin: c:\program files\windows live\photo gallery\NPWLPG.dll
FF - plugin: c:\programdata\id software\quakelive\npquakezero.dll
FF - plugin: c:\users\andreas\appdata\roaming\mozilla\firefox\profiles\jgcaeez0.default\extensions\battlefieldplay4free@ea.com\plugins\npBP4FUpdater.dll
.
---- FIREFOX POLICIES ----
FF - user.js: network.cookie.cookieBehavior - 0
FF - user.js: privacy.clearOnShutdown.cookies - false
FF - user.js: security.warn_viewing_mixed - false
FF - user.js: security.warn_viewing_mixed.show_once - false
FF - user.js: security.warn_submit_insecure - false
FF - user.js: security.warn_submit_insecure.show_once - false
.
============= SERVICES / DRIVERS ===============
.
R2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\common files\adobe\arm\1.0\armsvc.exe [2011-6-6 64952]
R2 AntiVirSchedulerService;Avira AntiVir Planer;c:\program files\avira\antivir desktop\sched.exe [2010-11-12 136360]
R2 AntiVirService;Avira AntiVir Guard;c:\program files\avira\antivir desktop\avguard.exe [2010-11-12 269480]
R2 ATService;AuthenTec Fingerprint Service;c:\program files\fingerprint sensor\AtService.exe [2009-3-16 1787128]
R2 avgntflt;avgntflt;c:\windows\system32\drivers\avgntflt.sys [2010-11-12 66616]
R2 CronService;Cron Service for Prey;c:\program files\prey\platform\windows\cronsvc.exe [2010-9-29 18432]
R2 Remote Solver for Flow Simulation 2010;Remote Solver for Flow Simulation 2010;d:\solidworks\solidworks flow simulation\bincfw\StandAloneSlv.exe [2010-4-19 71432]
R2 StkSSrv;Syntek AVStream USB2.0 WebCam Service;c:\windows\system32\StkCSrv.exe [2007-4-19 24576]
R2 sxuptp;SXUPTP Driver;c:\windows\system32\drivers\sxuptp.sys [2011-5-16 62464]
R2 TeamViewer6;TeamViewer 6;c:\program files\teamviewer\version6\TeamViewer_Service.exe [2011-6-1 2337144]
R2 WysePocketCloud;Wyse PocketCloud;c:\program files\wyse\pocketcloud windows companion\PocketCloudService.exe [2012-2-3 170400]
R3 ATSwpWDF;AuthenTec TruePrint USB WBF WDF Driver;c:\windows\system32\drivers\ATSwpWDF.sys [2009-9-1 625152]
R3 NETwLv32;    Intel(R) Wireless WiFi Link der Serie 5000 Adaptertreiber für Windows Vista 32-Bit;c:\windows\system32\drivers\NETwLv32.sys [2011-1-27 6639616]
R3 SbieDrv;SbieDrv;c:\program files\sandboxie\SbieDrv.sys [2010-2-3 115432]
R3 seehcri;Sony Ericsson seehcri Device Driver;c:\windows\system32\drivers\seehcri.sys [2010-4-9 27632]
R3 SMSCIRDA;SMSC Infrared Device Driver;c:\windows\system32\drivers\smscirda.sys [2007-4-25 31232]
R3 StkCMini;Syntek AVStream USB2.0 1.3M WebCam;c:\windows\system32\drivers\StkCMini.sys [2007-6-6 1260672]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 DivisCTS;Webrootcommagentservice;c:\windows\system32\svchost.exe -k netsvcs [2009-7-14 20992]
S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2011-2-16 136176]
S2 mcupdmgr.exe;Qfcoresvc;c:\windows\system32\svchost.exe -k netsvcs [2009-7-14 20992]
S2 SkypeUpdate;Skype Updater;c:\program files\skype\updater\Updater.exe [2012-2-15 158856]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2009-7-13 229888]
S3 BthAvrcp;Bluetooth-AVRCP-Profil;c:\windows\system32\drivers\BthAvrcp.sys [2009-8-13 22528]
S3 CoordinatorServiceHost;SW Distributed TS Coordinator Service;d:\solidworks\solidworks\swscheduler\DTSCoordinatorService.exe [2010-6-15 87336]
S3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);c:\windows\system32\drivers\ssudbus.sys [2011-12-30 80184]
S3 gupdatem;Google Update-Dienst (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2011-2-16 136176]
S3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files\microsoft office\office14\GROOVE.EXE [2011-6-12 31125880]
S3 MODRC;Cinergy HT USB XE IR Service;c:\windows\system32\drivers\modrc.sys [2007-7-11 13824]
S3 netw5v32;Intel(R) Wireless WiFi Link 5000-Serie - Adaptertreiber für Windows Vista 32 Bit;c:\windows\system32\drivers\netw5v32.sys [2009-6-10 4231168]
S3 osppsvc;Office Software Protection Platform;c:\program files\common files\microsoft shared\officesoftwareprotectionplatform\OSPPSVC.EXE [2010-1-9 4640000]
S3 ssudmdm;SAMSUNG  Mobile USB Modem Drivers (DEVGURU Ver.);c:\windows\system32\drivers\ssudmdm.sys [2011-12-30 181432]
S3 StorSvc;Speicherdienst;c:\windows\system32\svchost.exe -k LocalSystemNetworkRestricted [2009-7-14 20992]
S3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\TsUsbFlt.sys [2011-3-18 52224]
S3 vpcuxd;USB-Virtualisierungsstubdienst;c:\windows\system32\drivers\vpcuxd.sys [2011-3-18 12800]
S3 WatAdminSvc;Windows-Aktivierungstechnologieservice;c:\windows\system32\wat\WatAdminSvc.exe [2011-4-9 1343400]
S3 WSDPrintDevice;WSD-Druckunterstützung durch UMB;c:\windows\system32\drivers\WSDPrint.sys [2009-7-14 17920]
S4 msvsmon80;Visual Studio 2005 Remote Debugger;c:\program files\microsoft visual studio 8\common7\ide\remote debugger\x86\msvsmon.exe [2005-9-23 2799808]
.
=============== Created Last 30 ================
.
2012-02-29 17:01:41	--------	d-----w-	c:\users\andreas\appdata\roaming\Malwarebytes
2012-02-29 17:01:31	--------	d-----w-	c:\programdata\Malwarebytes
2012-02-29 17:01:30	20464	----a-w-	c:\windows\system32\drivers\mbam.sys
2012-02-29 17:01:30	--------	d-----w-	c:\program files\Malwarebytes' Anti-Malware
2012-02-29 16:59:30	89088	----a-w-	c:\windows\system32\mbr.exe
2012-02-29 13:12:39	--------	d-sh--w-	c:\windows\system32\%APPDATA%
2012-02-29 13:09:32	0	--sha-w-	c:\windows\system32\dds_log_trash.cmd
2012-02-29 13:07:10	--------	d-sh--w-	c:\users\andreas\appdata\local\75422588
2012-02-28 14:21:40	30940	----a-w-	C:\cc_20120228_152138.reg
2012-02-17 20:36:15	552960	----a-w-	c:\windows\Notepad2.exe
2012-02-15 13:41:39	478720	----a-w-	c:\windows\system32\timedate.cpl
2012-02-15 13:41:32	690688	----a-w-	c:\windows\system32\msvcrt.dll
2012-02-15 13:41:21	442880	----a-w-	c:\windows\system32\ntshrui.dll
2012-02-15 13:41:18	2343424	----a-w-	c:\windows\system32\win32k.sys
2012-02-12 18:41:01	--------	d-----w-	c:\program files\Wyse
2012-02-10 16:43:59	--------	d-----w-	c:\users\andreas\appdata\local\DDMSettings
2012-02-07 22:25:19	26408	----a-w-	c:\windows\system32\nitrolocalmon2.dll
2012-02-07 22:25:19	17704	----a-w-	c:\windows\system32\nitrolocalui2.dll
2012-02-07 22:04:34	--------	d-----w-	c:\program files\pdfsam
2012-02-01 20:20:14	--------	d-----w-	c:\users\andreas\appdata\roaming\e-academy Inc
2012-02-01 20:20:14	--------	d-----w-	c:\program files\SecureDownloadManagerUniversity
.
==================== Find3M  ====================
.
2012-03-01 07:39:44	29	----a-w-	c:\windows\system32\TempWmicBatchFile.bat
2012-02-29 16:29:28	45056	----a-w-	c:\windows\system32\acovcnt.exe
2012-02-29 13:08:17	414368	----a-w-	c:\windows\system32\FlashPlayerCPLApp.cpl
2012-02-28 09:21:38	138160	----a-w-	c:\windows\system32\drivers\PnkBstrK.sys
2012-02-28 09:21:28	271200	----a-w-	c:\windows\system32\PnkBstrB.xtr
2012-02-28 09:21:28	271200	----a-w-	c:\windows\system32\PnkBstrB.exe
2012-02-24 17:21:52	271200	----a-w-	c:\windows\system32\PnkBstrB.ex0
2012-01-14 21:14:41	75136	----a-w-	c:\windows\system32\PnkBstrA.exe
2012-01-04 00:48:42	354176	----a-w-	c:\windows\system32\DivXControlPanelApplet.cpl
2011-12-27 12:55:31	109408	----a-w-	C:\cc_20111227_135525.reg
2011-12-14 03:04:54	1798656	----a-w-	c:\windows\system32\jscript9.dll
2011-12-14 02:57:18	1127424	----a-w-	c:\windows\system32\wininet.dll
2011-12-14 02:56:58	1427456	----a-w-	c:\windows\system32\inetcpl.cpl
2011-12-14 02:50:04	2382848	----a-w-	c:\windows\system32\mshtml.tlb
2011-12-13 18:27:11	138056	----a-w-	c:\users\andreas\appdata\roaming\PnkBstrK.sys
2011-12-08 04:22:38	80184	----a-w-	c:\windows\system32\drivers\ssudbus.sys
2011-12-08 04:22:38	181432	----a-w-	c:\windows\system32\drivers\ssudmdm.sys
.
=================== ROOTKIT  ====================
.
Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, hxxp://www.gmer.net
Windows 6.1.7601 Disk: ST9160821AS rev.3.ALC -> Harddisk0\DR0 -> \Device\Ide\IdeDeviceP3T0L0-6 
.
device: opened successfully
user: MBR read successfully
.
Disk trace:
called modules: >>UNKNOWN [0x83404000]<< >>UNKNOWN [0x8BD93000]<< >>UNKNOWN [0x8BE00000]<< >>UNKNOWN [0x872C0BC0]<< 
_asm { DEC EBP; POP EDX; NOP ; ADD [EBX], AL; ADD [EAX], AL; ADD [EAX+EAX], AL; ADD [EAX], AL;  }
1 ntkrnlpa!IofCallDriver[0x8343B52A] -> \Device\Harddisk0\DR0[0x8700C768]
\Driver\Disk[0x8700BD40] -> IRP_MJ_CREATE -> 0x8BD9739F
3 [0x8BD9759E] -> ntkrnlpa!IofCallDriver[0x8343B52A] -> [0x87299C40]
\Driver\00000649[0x872994C0] -> IRP_MJ_CREATE -> 0x872C0BC0
kernel: MBR read successfully
_asm { XOR AX, AX; MOV SS, AX; MOV SP, 0x7c00; MOV ES, AX; MOV DS, AX; MOV SI, 0x7c00; MOV DI, 0x600; MOV CX, 0x200; CLD ; REP MOVSB ; PUSH AX; PUSH 0x61c; RETF ; STI ; MOV CX, 0x4; MOV BP, 0x7be; CMP BYTE [BP+0x0], 0x0;  }
user & kernel MBR OK 
Warning: possible TDL3 rootkit infection !
.
============= FINISH:  8:46:12,32 ===============
         

Attach.txt:

.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2011-08-26.01)
.
Microsoft Windows 7 Professional 
Boot Device: \Device\HarddiskVolume2
Install Date: 05.10.2009 12:36:20
System Uptime: 01.03.2012 08:38:55 (0 hours ago)
.
Motherboard: ASUSTeK Computer Inc.         |  | V1S       
Processor: Intel(R) Core(TM)2 Duo CPU     T7300  @ 2.00GHz | Socket 478 | 1580/200mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 78 GiB total, 7,166 GiB free.
D: is FIXED (NTFS) - 71 GiB total, 8,934 GiB free.
E: is CDROM ()
.
==== Disabled Device Manager Items =============
.
Class GUID: {4d36e972-e325-11ce-bfc1-08002be10318}
Description: Cisco Systems VPN Adapter
Device ID: ROOT\NET\0000
Manufacturer: Cisco Systems
Name: Cisco Systems VPN Adapter
PNP Device ID: ROOT\NET\0000
Service: CVirtA
.
Class GUID: 
Description: 
Device ID: ROOT\VIRTUALUSB\0000
Manufacturer: 
Name: 
PNP Device ID: ROOT\VIRTUALUSB\0000
Service: 
.
Class GUID: {eec5ad98-8080-425f-922a-dabf3de3f69a}
Description: Microsoft WPD erweiterter Speicherkennworttreiber
Device ID: ROOT\WPD\0000
Manufacturer: (Erweitertes Speichergerät)
Name: Microsoft WPD erweiterter Speicherkennworttreiber
PNP Device ID: ROOT\WPD\0000
Service: WUDFRd
.
==== System Restore Points ===================
.
RP383: 23.02.2012 13:25:31 - Geplanter Prüfpunkt
.
==== Installed Programs ======================
.
.
7-PDF Split & Merge Version 2.0.0 (Build 178)
Acronis*True*Image*Home
Adobe Digital Editions
Adobe Flash Player 10 Plugin
Adobe Flash Player 11 ActiveX
Adobe Reader X (10.1.0) - Deutsch
Adobe Shockwave Player 11.6
AnyDVD
ASUS Data Security Manager
ASUS Splendid Video Enhancement Technology
ATK Hotkey
ATK Media
ATKOSD2
AuthenTec Fingerprint Sensor Minimum Install
AuthenTec Fingerprint Software
AuthenTec TrueSuite
Avira AntiVir Personal - Free Antivirus
Battlefield Play4Free
Bombzone
Cadence SPB 16.2 (12-13-2011)
Call of Duty(R) 4 - Modern Warfare(TM)
Call of Duty(R) 4 - Modern Warfare(TM) 1.6 Patch
Call of Duty(R) 4 - Modern Warfare(TM) 1.7 Patch
CCleaner
CDBurnerXP
CIB pdf brewer 2.5.29
Cisco Systems VPN Client 5.0.05.0290
COMSOL 4.2
ConvertXtoDVD 4.0.10.324
Counter-Strike: Source
Crazy Machines - Neues aus dem Labor
Crystal XI
Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition
DivX-Setup
DivX Converter
DivX Plus DirectShow Filters
DivX Version Checker
dm-Fotowelt
Dr Kawashima
Dropbox
DVD Shrink 3.2
DVD Suite
DVDFab 6.0.2.0 (June 24, 2009)
EVEREST Ultimate Edition v4.60
Foxit Reader
Free eXPert PDF Reader
Free Studio version 5.0.9
Free YouTube to MP3 Converter version 3.10.15.1228
G-Force
GanttProject
GIMP 2.6.11
Google Earth
Google Update Helper
Hotfix for Microsoft .NET Framework 4 Client Profile (KB2461678)
Inkscape 0.48.0
IrfanView (remove only)
Java Auto Updater
Java(TM) 6 Update 25
JMB36X Raid Configurer
Lasers
LECTURNITY Player
LifeFrame2
LightScribe System Software
LightScribe Template Labeler
Little Fighter 2 version 2.0a
Lupas Rename 2000 v5.0 Release
MagicDisc 2.7.106
Malwarebytes Anti-Malware Version 1.60.1.1000
Mathematica Extras 8.0 (2063897)
MediaMonkey 4.0
MediaShow 3.0
Mein CEWE FOTOBUCH
Microsoft .NET Framework 4 Client Profile
Microsoft .NET Framework 4 Client Profile DEU Language Pack
Microsoft Application Error Reporting
Microsoft Choice Guard
Microsoft Mathematics-Add-In (32 Bit)
Microsoft Office 2003 Web Components
Microsoft Office 2010 Service Pack 1 (SP1)
Microsoft Office Access MUI (German) 2010
Microsoft Office Excel MUI (German) 2010
Microsoft Office Groove MUI (German) 2010
Microsoft Office InfoPath MUI (German) 2010
Microsoft Office OneNote MUI (German) 2010
Microsoft Office Outlook MUI (German) 2010
Microsoft Office PowerPoint MUI (German) 2010
Microsoft Office Professional Plus 2010
Microsoft Office Project MUI (German) 2010
Microsoft Office Project Professional 2010
Microsoft Office Proof (English) 2010
Microsoft Office Proof (French) 2010
Microsoft Office Proof (German) 2010
Microsoft Office Proof (Italian) 2010
Microsoft Office Proofing (German) 2010
Microsoft Office Publisher MUI (German) 2010
Microsoft Office Shared MUI (German) 2010
Microsoft Office Word MUI (German) 2010
Microsoft Project 2010 Service Pack 1 (SP1)
Microsoft Project Professional 2010
Microsoft Silverlight
Microsoft SQL Server 2005 Compact Edition [ENU]
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.30319
Microsoft Visual Studio 2005 Tools for Applications - ENU
Microsoft Visual Studio 2010-Tools für Office-Laufzeit (x86) Language Pack - DEU
Microsoft Visual Studio 2010 Tools for Office Runtime (x86)
Microsoft Visual Studio 2010 Tools for Office Runtime (x86) Language Pack - DEU
MiKTeX 2.9
Motorola SM56 Speakerphone Modem
MozBackup 1.4.9
Mozilla Firefox (3.5.3)
Mozilla Firefox 10.0.2 (x86 de)
Mozilla Thunderbird (3.0)
Mozilla Thunderbird 10.0.2 (x86 de)
MSVCRT
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
MyDefrag v4.3.1
MyFreeCodec
MyPhoneExplorer
National Instruments - Software
NB Probe
Nero 7 Essentials
Nero Installer
neroxml
NHL® 09
NI EULA Depot
NI MDF Support
NI TDM Excel Add-In 3.2.2
NI Uninstaller
NI VC2008MSMs x86
NVIDIA Drivers
OGA Notifier 2.0.0048.0
Orban/Coding Technologies AAC/aacPlus Player Plugin™ 1.0
Orcad Family Release 9.2 Lite Edition
Origin81
OriginPro 8.1G
pdfsam
PhotoView 360
Picasa 3
PlayReady PC Runtime x86
PocketCloud Windows Companion
Power4Gear eXtreme
PowerDVD
PPT Remote
PunkBuster Services
Quake Live Mozilla Plugin
QuickTime
Realtek High Definition Audio Driver
Reference Manager 11
Samsung Kies
SAMSUNG USB Driver for Mobile Phones
Sandboxie 3.44
Sansa Updater
Secure Download Manager
Security Update for CAPICOM (KB931906)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)
Security Update for Microsoft .NET Framework 4 Client Profile DEU Language Pack (KB2478663)
Security Update for Microsoft .NET Framework 4 Client Profile DEU Language Pack (KB2518870)
Security Update for Microsoft Office 2010 (KB2553091)
Security Update for Microsoft Office 2010 (KB2553096)
Security Update for Microsoft Office 2010 (KB2589320) 32-Bit Edition
Security Update for Microsoft PowerPoint 2010 (KB2553185) 32-Bit Edition
Security Update for Microsoft SharePoint Workspace 2010 (KB2566445)
Security Update for Microsoft Visio Viewer 2010 (KB2597170) 32-Bit Edition
Shutdown4U
Skype™ 5.8
SolidWorks 2010 SP04
SolidWorks eDrawings 2010
SolidWorks Flow Simulation 2010 SP04
Steam
swMSM
System Requirements Lab for Intel
Team Fortress 2
TeamViewer 6
TerraTec Home Cinema
TeXnicCenter Version 1.0 Stable RC1
Total Commander (Remove or Repair)
Trillian
Uninstall 1.0.0.1
Update for Microsoft .NET Framework 4 Client Profile (KB2468871)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217)
Update for Microsoft Excel 2010 (KB2553439) 32-Bit Edition
Update for Microsoft Office 2010 (KB2494150)
Update for Microsoft Office 2010 (KB2553065)
Update for Microsoft Office 2010 (KB2553092)
Update for Microsoft Office 2010 (KB2553181) 32-Bit Edition
Update for Microsoft Office 2010 (KB2553270) 32-Bit Edition
Update for Microsoft Office 2010 (KB2553310) 32-Bit Edition
Update for Microsoft Office 2010 (KB2553385) 32-Bit Edition
Update for Microsoft Office 2010 (KB2566458)
Update for Microsoft Office 2010 (KB2596964) 32-Bit Edition
Update for Microsoft Office 2010 (KB2597091) 32-Bit Edition
Update for Microsoft OneNote 2010 (KB2553290) 32-Bit Edition
Update for Microsoft Outlook 2010 (KB2553323) 32-Bit Edition
Update for Microsoft Outlook Social Connector (KB2583935)
Update Service
USB2.0 1.3M WebCam
VC80CRTRedist - 8.0.50727.6195
VLC media player 1.1.11
War Inc. Battlezone
WhiteCap
WIN7TS
Windows Live-Uploadtool
Windows Live Communications Platform
Windows Live Essentials
Windows Live Fotogalerie
Windows Live ID-Anmelde-Assistent
Windows Live Movie Maker
Windows Live Sync
Windows Mobile-Gerätecenter
Windows XP Mode
WinFlash
WinRAR archiver
WinSCP 4.2.3 beta
Wolfram Mathematica 8 (M-WIN-L 8.0.1 2063990)
.
==== End Of File ===========================
         

Nochmal Danke schonmal für die Hilfe!

Schade, dass sich keiner meinem Problem angenommen hatte...
Ich habe nun den PC komplett platt gemacht und neu aufgesetzt. Nur noch die Frage, woher der Virus/Trojaner/Rootkit eigentlich kam würde mich noch interessieren!