Neuer Trend: der 50€ Virus / Trojaner - Jetzt leider auch bei mir...

.
DDS (Ver_2011-08-26.01) - NTFSAMD64 NETWORK
Internet Explorer: 9.0.8112.16421
Run by dosenbier at 14:41:59 on 2012-03-31
Microsoft Windows 7 Ultimate   6.1.7601.1.1252.49.1031.18.2046.1148 [GMT 2:00]
.
AV: avast! Antivirus *Enabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
SP: avast! Antivirus *Enabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\Explorer.EXE
C:\Windows\system32\ctfmon.exe
C:\Windows\helppane.exe
C:\Windows\System32\svchost.exe -k secsvcs
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\conhost.exe
C:\Windows\SysWOW64\cscript.exe
C:\Windows\system32\wbem\wmiprvse.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://startpage.com/babylon/deu/
uInternet Settings,ProxyOverride = local
mWinlogon: Userinit=userinit.exe,
BHO: CescrtHlpr Object: {64182481-4f71-486b-a045-b233bd0da8fc} - C:\Program Files (x86)\facemoods.com\facemoods\1.4.17.11\bh\facemoods.dll
BHO: Java(tm) Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll
BHO: avast! WebRep: {8e5e2654-ad2d-48bf-ac2d-d17f00898d06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
TB: avast! WebRep: {8e5e2654-ad2d-48bf-ac2d-d17f00898d06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
TB: facemoods Toolbar: {db4e9724-f518-4dfd-9c7c-78b52103cab9} - C:\Program Files (x86)\facemoods.com\facemoods\1.4.17.11\facemoodsTlbr.dll
uRun: [AVMUSBFernanschluss] "C:\Users\dosenbier\AppData\Local\Apps\2.0\C9B1NDR9.N0J\2C79C08D.QX7\frit..tion_8488884cfbcefd60_0002.0002_8541bf1f4a1c673d\AVMAutoStart.exe"
uRun: [SkypePM] C:\Users\dosenbier\AppData\Local\Skype\SkypePM.exe
mRun: [OEM02Mon.exe] C:\Windows\OEM02Mon.exe
mRun: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui
mRun: [facemoods] "C:\Program Files (x86)\facemoods.com\facemoods\1.4.17.11\facemoodssrv.exe" /md I
mRun: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
mRun: [Malwarebytes' Anti-Malware] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
StartupFolder: C:\Users\DOSENB~1\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\OPENOF~1.LNK - C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe
mPolicies-explorer: NoActiveDesktop = 1 (0x1)
mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)
mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: Add to Google Photos Screensa&ver - C:\Windows\system32\GPhotos.scr/200
DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
TCP: Interfaces\{4BCBD830-6CB1-417F-AF20-8897E68BE9FB} : NameServer = 192.168.2.1
{64182481-4F71-486b-A045-B233BD0DA8FC}
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}
{8E5E2654-AD2D-48bf-AC2D-D17F00898D06}
{DBC80044-A445-435b-BC74-9C25C1C588A9}
{8E5E2654-AD2D-48bf-AC2D-D17F00898D06}
{DB4E9724-F518-4dfd-9C7C-78B52103CAB9}
mRun-x64: [OEM02Mon.exe] C:\Windows\OEM02Mon.exe
mRun-x64: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui
mRun-x64: [facemoods] "C:\Program Files (x86)\facemoods.com\facemoods\1.4.17.11\facemoodssrv.exe" /md I
mRun-x64: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
mRun-x64: [Malwarebytes' Anti-Malware] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
.
============= SERVICES / DRIVERS ===============
.
R0 oem-drv64;OEM-SLP2.1 Driver (HPD64);C:\Windows\system32\DRIVERS\oem-drv64.sys --> C:\Windows\system32\DRIVERS\oem-drv64.sys [?]
R1 vwififlt;Virtual WiFi Filter Driver;C:\Windows\system32\DRIVERS\vwififlt.sys --> C:\Windows\system32\DRIVERS\vwififlt.sys [?]
R3 bcm44amd64;Broadcom 440x 10/100-integrierter Controller-XP-Treiber;C:\Windows\system32\DRIVERS\b44amd64.sys --> C:\Windows\system32\DRIVERS\b44amd64.sys [?]
R3 netw5v64;Intel(R) Wireless WiFi Link 5000 Series - Adaptertreiber für Windows Vista 64 Bit;C:\Windows\system32\DRIVERS\netw5v64.sys --> C:\Windows\system32\DRIVERS\netw5v64.sys [?]
S1 aswSnx;aswSnx;C:\Windows\system32\drivers\aswSnx.sys --> C:\Windows\system32\drivers\aswSnx.sys [?]
S1 aswSP;aswSP;C:\Windows\system32\drivers\aswSP.sys --> C:\Windows\system32\drivers\aswSP.sys [?]
S2 aswFsBlk;aswFsBlk;C:\Windows\system32\drivers\aswFsBlk.sys --> C:\Windows\system32\drivers\aswFsBlk.sys [?]
S2 aswMonFlt;aswMonFlt;\??\C:\Windows\system32\drivers\aswMonFlt.sys --> C:\Windows\system32\drivers\aswMonFlt.sys [?]
S2 avast! Antivirus;avast! Antivirus;C:\Program Files\AVAST Software\Avast\AvastSvc.exe [2012-3-22 44768]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]
S2 gupdate;Google Update-Dienst (gupdate);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-3-23 136176]
S2 MBAMService;MBAMService;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-3-30 652360]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2011-8-3 379496]
S3 avmaudio;AVM Audio;C:\Windows\system32\DRIVERS\avmaudio.sys --> C:\Windows\system32\DRIVERS\avmaudio.sys [?]
S3 dmvsc;dmvsc;C:\Windows\system32\drivers\dmvsc.sys --> C:\Windows\system32\drivers\dmvsc.sys [?]
S3 EverestDriver;Lavalys EVEREST Kernel Driver;C:\Users\DOSENB~1\AppData\Local\Temp\EverestDriver.sys [2011-10-13 9728]
S3 gupdatem;Google Update-Dienst (gupdatem);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-3-23 136176]
S3 MBAMProtector;MBAMProtector;\??\C:\Windows\system32\drivers\mbam.sys --> C:\Windows\system32\drivers\mbam.sys [?]
S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;C:\Windows\system32\drivers\rdpvideominiport.sys --> C:\Windows\system32\drivers\rdpvideominiport.sys [?]
S3 SrvHsfHDA;SrvHsfHDA;C:\Windows\system32\DRIVERS\VSTAZL6.SYS --> C:\Windows\system32\DRIVERS\VSTAZL6.SYS [?]
S3 SrvHsfV92;SrvHsfV92;C:\Windows\system32\DRIVERS\VSTDPV6.SYS --> C:\Windows\system32\DRIVERS\VSTDPV6.SYS [?]
S3 SrvHsfWinac;SrvHsfWinac;C:\Windows\system32\DRIVERS\VSTCNXT6.SYS --> C:\Windows\system32\DRIVERS\VSTCNXT6.SYS [?]
S3 Synth3dVsc;Microsoft Virtual 3D Video Transport Driver;C:\Windows\system32\drivers\Synth3dVsc.sys --> C:\Windows\system32\drivers\Synth3dVsc.sys [?]
S3 terminpt;Microsoft Remote Desktop Input Driver;C:\Windows\system32\drivers\terminpt.sys --> C:\Windows\system32\drivers\terminpt.sys [?]
S3 TsUsbFlt;TsUsbFlt;C:\Windows\system32\drivers\tsusbflt.sys --> C:\Windows\system32\drivers\tsusbflt.sys [?]
S3 TsUsbGD;%TsUsbGD.DeviceDesc.Generic%;C:\Windows\system32\drivers\TsUsbGD.sys --> C:\Windows\system32\drivers\TsUsbGD.sys [?]
S3 tsusbhub;Remote Deskotop USB Hub;C:\Windows\system32\drivers\tsusbhub.sys --> C:\Windows\system32\drivers\tsusbhub.sys [?]
.
=============== Created Last 30 ================
.
2012-03-30 20:35:53	--------	d-----w-	C:\Program Files (x86)\ESET
2012-03-30 19:12:49	--------	d-----w-	C:\Users\dosenbier\AppData\Roaming\Malwarebytes
2012-03-30 19:12:44	23152	----a-w-	C:\Windows\System32\drivers\mbam.sys
2012-03-30 19:12:44	--------	d-----w-	C:\ProgramData\Malwarebytes
2012-03-30 19:12:44	--------	d-----w-	C:\Program Files (x86)\Malwarebytes' Anti-Malware
2012-03-30 08:58:37	8669240	----a-w-	C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{9556C1BC-94EC-4069-B0A0-8E5B20086865}\mpengine.dll
2012-03-22 17:38:39	53080	----a-w-	C:\Windows\System32\drivers\aswRdr2.sys
2012-03-14 12:03:31	3145728	----a-w-	C:\Windows\System32\win32k.sys
2012-03-14 12:03:29	1544192	----a-w-	C:\Windows\System32\DWrite.dll
2012-03-14 12:03:28	1077248	----a-w-	C:\Windows\SysWow64\DWrite.dll
2012-03-14 12:02:13	9216	----a-w-	C:\Windows\System32\rdrmemptylst.exe
2012-03-14 12:02:13	77312	----a-w-	C:\Windows\System32\rdpwsx.dll
2012-03-14 12:02:13	149504	----a-w-	C:\Windows\System32\rdpcorekmts.dll
2012-03-14 12:02:12	1112064	----a-w-	C:\Windows\System32\rdpcorets.dll
2012-03-14 12:02:11	826880	----a-w-	C:\Windows\SysWow64\rdpcore.dll
2012-03-14 12:02:11	23552	----a-w-	C:\Windows\System32\drivers\tdtcp.sys
2012-03-14 12:02:11	210944	----a-w-	C:\Windows\System32\drivers\rdpwd.sys
2012-03-14 12:02:11	1031680	----a-w-	C:\Windows\System32\rdpcore.dll
.
==================== Find3M  ====================
.
2012-03-31 09:41:02	42496	----a-w-	C:\Windows\System32\drivers\oem-drv64.sys
2012-03-25 11:16:46	414368	----a-w-	C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
2012-03-23 22:29:13	472808	----a-w-	C:\Windows\SysWow64\deployJava1.dll
2012-03-07 00:15:19	41184	----a-w-	C:\Windows\avastSS.scr
2012-03-07 00:04:06	819032	----a-w-	C:\Windows\System32\drivers\aswSnx.sys
2012-03-07 00:01:52	69976	----a-w-	C:\Windows\System32\drivers\aswMonFlt.sys
2012-02-23 08:18:36	279656	------w-	C:\Windows\System32\MpSigStub.exe
2012-01-20 01:13:07	4022504	----a-w-	C:\Windows\SysWow64\SpoonUninstall.exe
2011-04-23 20:10:03	22333089	----a-w-	C:\Program Files\Nero.Burning.ROM.v.10.6.3.100.exe
2010-07-29 10:57:00	2983429	----a-w-	C:\Program Files\Winamp_2.95_mini_portable.exe
2010-07-29 10:57:00	2983429	----a-w-	C:\Program Files (x86)\Winamp_2.95_mini_portable.exe
.
============= FINISH: 14:42:28,51 ===============
         

.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2011-08-26.01)
.
Microsoft Windows 7 Ultimate 
Boot Device: \Device\HarddiskVolume3
Install Date: 13.10.2011 19:55:40
System Uptime: 31.03.2012 11:40:58 (3 hours ago)
.
Motherboard: Dell Inc. |  | 0FP441
Processor: Intel(R) Core(TM)2 Duo CPU     T7300  @ 2.00GHz | Microprocessor | 1994/200mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 99 GiB total, 5,327 GiB free.
D: is FIXED (NTFS) - 112 GiB total, 5,036 GiB free.
E: is FIXED (NTFS) - 10 GiB total, 6,233 GiB free.
F: is CDROM ()
.
==== Disabled Device Manager Items =============
.
Class GUID: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Description: Security Processor Loader Driver
Device ID: ROOT\LEGACY_SPLDR\0000
Manufacturer: 
Name: Security Processor Loader Driver
PNP Device ID: ROOT\LEGACY_SPLDR\0000
Service: spldr
.
Class GUID: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Description: avast! Network Shield Support
Device ID: ROOT\LEGACY_ASWTDI\0000
Manufacturer: 
Name: avast! Network Shield Support
PNP Device ID: ROOT\LEGACY_ASWTDI\0000
Service: aswTdi
.
==== System Restore Points ===================
.
No restore point in system.
.
==== Installed Programs ======================
.
7-Zip 9.20
Audacity 1.3.14 (Unicode)
avast! Free Antivirus
AVM FRITZ!Box USB-Fernanschluss
Biet-O-Matic v2.14.8
CDBurnerXP
dBpoweramp DSP Effects
dBpoweramp Music Converter
DVD-lab PRO 2.51
DVD Flick 1.3.0.7
DVDStyler v2.1
ESET Online Scanner v3
EVEREST Home Edition v2.20
Facemoods Toolbar
FileZilla Client 3.5.1
Foxit Reader 5.0
Google Chrome
Google Update Helper
ID3-TagIT 3
Image Resizer for Windows
ImageShack Uploader 2.2.0
IrfanView (remove only)
Java Auto Updater
Java(TM) 6 Update 31
JDownloader 0.9
Light Image Resizer 4.0.9.8
Malwarebytes Anti-Malware Version 1.60.1.1000
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.30319
NVIDIA 3D Vision Controller Driver
NVIDIA PhysX
NVIDIA Stereoscopic 3D Driver
Nvu 0.8.1
OpenOffice.org 3.3
Picasa 3
RICOH R5C83x/84x Flash Media Controller Driver Ver.3.57.01
Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)
Security Update for Microsoft .NET Framework 4 Client Profile DEU Language Pack (KB2478663)
Security Update for Microsoft .NET Framework 4 Client Profile DEU Language Pack (KB2518870)
SRWare Iron 14.0.850.0
STOIK Smart Resizer 3
UltraStar Deluxe
Update for Microsoft .NET Framework 4 Client Profile (KB2468871)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523)
VLC media player 1.1.11
XBMC
.
==== End Of File ===========================
         

 Malwarebytes Anti-Malware  (Test) 1.60.1.1000
www.malwarebytes.org

Datenbank Version: v2012.03.31.05

Windows 7 Service Pack 1 x64 NTFS (Abgesichertenmodus/Netzwerkfähig)
Internet Explorer 9.0.8112.16421
dosenbier :: LAPTOP [Administrator]

Schutz: Deaktiviert

31.03.2012 12:05:58
mbam-log-2012-03-31 (12-05-58).txt

Art des Suchlaufs: Vollständiger Suchlauf
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 438755
Laufzeit: 1 Stunde(n), 2 Minute(n), 

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)
         

ESETSmartInstaller@High as CAB hook log:
OnlineScanner64.ocx - registred OK
OnlineScanner.ocx - registred OK
# version=7
# iexplore.exe=9.00.8112.16421 (WIN7_IE9_RTM.110308-0330)
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=d064ed7023c2814f8a7d4876cbddb606
# end=finished
# remove_checked=false
# archives_checked=false
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2012-03-30 10:27:01
# local_time=2012-03-31 12:27:01 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=5893 16776573 100 94 42391 84770158 0 0
# compatibility_mode=8192 67108863 100 0 555 555 0 0
# scanned=265321
# found=3
# cleaned=0
# scan_time=4140
C:\Users\dosenbier\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\J3TY201U\697463092ebcda42a52f83e306a7c1e3[1].htm	HTML/ScrInject.B.Gen virus (unable to clean)	00000000000000000000000000000000	I
C:\Users\dosenbier\AppData\Local\Temp\jar_cache6261645628767445033.tmp	Java/Exploit.CVE-2012-0507.D trojan (unable to clean)	00000000000000000000000000000000	I
C:\Users\dosenbier\AppData\Local\TempDIR\BetterInstaller.exe	Win32/Adware.Somoto.A application (unable to clean)	00000000000000000000000000000000	I
esets_scanner_update returned -1 esets_gle=53251
# version=7
# iexplore.exe=9.00.8112.16421 (WIN7_IE9_RTM.110308-0330)
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2012-03-31 05:06:35
# local_time=2012-03-31 07:06:35 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=5893 16776573 100 94 111106 84838873 0 0
# compatibility_mode=8192 67108863 100 0 69270 69270 0 0
# scanned=264372
# found=3
# cleaned=0
# scan_time=4572
C:\Users\dosenbier\AppData\Local\Skype\SkypePM.exe	Win32/LockScreen.AIG trojan (unable to clean)	00000000000000000000000000000000	I
C:\Users\dosenbier\AppData\Local\Temp\jar_cache6261645628767445033.tmp	Java/Exploit.CVE-2012-0507.D trojan (unable to clean)	00000000000000000000000000000000	I
C:\Users\dosenbier\AppData\Local\Temp\jar_cache6392414300976716270.tmp	Java/TrojanDownloader.Agent.NDR trojan (unable to clean)	00000000000000000000000000000000	I