mehrere programme laufen nicht mehr, und "avast"-virenschutz hat sich vom acker gemacht : (

kingwilli

so leute,

nachdem mir hier schon einmal vor ca. 2 jahren kompetent geholfen wurde (merci!), muss ich mich leider schon wieder an euch wenden.

ein bekannter hat meinen rechner vor ca. 6 monaten gewartet und mir den virenscanner "avast" aufgespielt, weil er den wohl ganz toll findet.

es lief nun ein paar monte einwandfrei, aber neulich fing der rechner an zu spinnen. symptom 1: das dvd-laufwerk war einfach weg. es war im explorer einfach verschwunden, tauchte zwar bei ca. jedem 5. rechnerstart wieder auf, aber prinzipell war es weg.
symptom 2: vor ein paar tagen war mein "HP solution center" verschwunden. ich kann zwar noch drucken, aber nicht mehr scannen. aha.
symptom 3: seit gestern hat es mir auch den adobe reader zerschossen. kein pdf ist mehr zu öffnen. neuinstallation hilft auch nichts.
naja und dann ist mir aufgefallen, dass das "avast"-symbol auf der taskleiste verschwunden ist. windows defender sagt auch "kein virenprogramm aktiv".
naja ich hab mal avira installiert und spybot laufen lassen, aber mangels wirklicher kenntnis, was ich da tue, habe ich nun lieber doch die anleitung bon diesem board befolgt und hier sind nun die logfiles:

(meine freundin hat ein ähnliches problem auf ihrem rechner, aber das folgt dann extra...)

dds.txt:

.
DDS (Ver_2011-08-26.01) - NTFSx86
Internet Explorer: 9.0.8112.16421 BrowserJavaVersion: 1.6.0_23
Run by Florian at 15:59:49 on 2012-04-17
Microsoft Windows 7 Enterprise 6.1.7601.1.1252.49.1031.18.1983.877 [GMT 2:00]
.
AV: Avira Desktop *Enabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
SP: Avira Desktop *Enabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\rundll32.exe
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Windows\system32\srvany.exe
C:\Windows\KMService.exe
C:\Windows\system32\conhost.exe
C:\Program Files\HP\QuickPlay\Kernel\TV\QPCapSvc.exe
C:\Windows\system32\DRIVERS\xaudio.exe
C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
C:\Program Files\HP\QuickPlay\Kernel\TV\QPSched.exe
C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
C:\Windows\system32\conhost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Windows\System32\svchost.exe -k secsvcs
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCtrl.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\HP\Digital Imaging\bin\HpqSRmon.exe
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\Common Files\Apple\Internet Services\ubd.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Users\Florian\AppData\Roaming\Dropbox\bin\Dropbox.exe
C:\Program Files\Common Files\Apple\Apple Application Support\distnoted.exe
C:\Windows\system32\conhost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\Program Files\julitec\julitecCRM\julitecCONTACT.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\svchost.exe -k SDRSVC
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe
C:\Program Files\Foxit Software\Foxit Reader\Foxit Reader.exe
C:\Program Files\IrfanView\i_view32.exe
C:\Windows\system32\WUDFHost.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\conhost.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\SearchFilterHost.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.google.de/
uInternet Settings,ProxyOverride = *.local
BHO: HP Print Enhancer: {0347c33e-8762-4905-bf09-768834316c61} - c:\program files\hp\digital imaging\smart web printing\hpswp_printenhancer.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: HP Smart BHO Class: {ffffffff-cf4e-4f2b-bdc2-0e72e116a856} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll
EB: HP Smart Web Printing: {555d4d79-4bd2-4094-a395-cfc534424a05} - c:\program files\hp\digital imaging\smart web printing\hpswp_bho.dll
uRun: [MobileDocuments] c:\program files\common files\apple\internet services\ubd.exe
mRun: [avast5] "c:\program files\alwil software\avast5\avastUI.exe" /nogui
mRun: [SynTPEnh] %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe
mRun: [QlbCtrl.exe] c:\program files\hewlett-packard\hp quick launch buttons\QlbCtrl.exe /Start
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [AppleSyncNotifier] c:\program files\common files\apple\mobile device support\AppleSyncNotifier.exe
mRun: [APSDaemon] "c:\program files\common files\apple\apple application support\APSDaemon.exe"
mRun: [hpqSRMon] c:\program files\hp\digital imaging\bin\hpqSRMon.exe
mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [avgnt] "c:\program files\avira\antivir desktop\avgnt.exe" /min
StartupFolder: c:\users\florian\appdata\roaming\micros~1\windows\startm~1\programs\startup\dropbox.lnk - c:\users\florian\appdata\roaming\dropbox\bin\Dropbox.exe
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\hpdigi~1.lnk - c:\program files\hp\digital imaging\bin\hpqtra08.exe
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\mcafee~1.lnk - c:\program files\mcafee security scan\2.0.181\SSScheduler.exe
mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: Nach Microsoft &Excel exportieren - c:\progra~1\micros~2\office11\EXCEL.EXE/3000
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
IE: {DDE87865-83C5-48c4-8357-2F5B1AA84522} - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab
TCP: DhcpNameServer = 192.168.178.1
TCP: Interfaces\{A2310DDD-CDD1-485B-942C-B997E90D8780} : DhcpNameServer = 192.168.178.1
TCP: Interfaces\{D5A85DFC-2DA9-414F-A624-BCCF37DDC456} : DhcpNameServer = 192.168.178.1
TCP: Interfaces\{D5A85DFC-2DA9-414F-A624-BCCF37DDC456}\1427265696475627D2E45647 : DhcpNameServer = 192.168.2.1
TCP: Interfaces\{D5A85DFC-2DA9-414F-A624-BCCF37DDC456}\14962777F6C666 : DhcpNameServer = 192.168.178.1
Hosts: 127.0.0.1 www.spywareinfo.com
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\users\florian\appdata\roaming\mozilla\firefox\profiles\x9tel1l1.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.tagesschau.de/
FF - prefs.js: keyword.URL - hxxp://de.search.yahoo.com/search?fr=greentree_ff1&ei=utf-8&type=827316&p=
FF - component: c:\program files\common files\spigot\wtxpcom\components\WidgiToolbarFF.dll
FF - plugin: c:\program files\adobe\reader 10.0\reader\air\nppdf32.dll
FF - plugin: c:\program files\foxit software\foxit reader\plugins\npFoxitReaderPlugin.dll
FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\microsoft silverlight\4.0.50401.0\npctrlui.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npdeployJava1.dll
FF - plugin: c:\windows\system32\macromed\flash\NPSWF32_11_2_202_233.dll
.
============= SERVICES / DRIVERS ===============
.
R1 avkmgr;avkmgr;c:\windows\system32\drivers\avkmgr.sys [2012-4-16 36000]
R1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\drivers\vwififlt.sys [2009-7-14 48128]
R2 AntiVirSchedulerService;Avira Planer;c:\program files\avira\antivir desktop\sched.exe [2012-4-16 86224]
R2 AntiVirService;Avira Echtzeit Scanner;c:\program files\avira\antivir desktop\avguard.exe [2012-4-16 110032]
R2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2011-2-11 51280]
R2 avgntflt;avgntflt;c:\windows\system32\drivers\avgntflt.sys [2012-4-16 74640]
R2 KMService;KMService;c:\windows\system32\srvany.exe [2012-1-30 8192]
R2 SBSDWSCService;SBSD Security Center Service;c:\program files\spybot - search & destroy\SDWinSec.exe [2011-2-12 1153368]
R3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\drivers\vwifimp.sys [2009-7-14 14336]
S2 avast! Antivirus;avast! Antivirus;"c:\program files\alwil software\avast5\avastsvc.exe" --> c:\program files\alwil software\avast5\AvastSvc.exe [?]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\macromed\flash\FlashPlayerUpdateService.exe [2012-4-16 253088]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2009-7-14 229888]
S3 hcw95bda;Hauppauge MOD7700 Tuner Driver;c:\windows\system32\drivers\hcw95bda.sys [2011-2-16 573440]
S3 hcw95rc;Hauppauge MOD7700 IR Driver;c:\windows\system32\drivers\hcw95rc.sys [2011-2-16 15616]
S3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\mcafee security scan\2.0.181\McCHSvc.exe [2010-1-15 227232]
S3 PAC207;SoC PC-Camera;c:\windows\system32\drivers\PFC027.SYS [2006-12-5 507136]
S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2011-4-28 15872]
S3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\drivers\VSTAZL3.SYS [2009-7-14 207360]
S3 SrvHsfV92;SrvHsfV92;c:\windows\system32\drivers\VSTDPV3.SYS [2009-7-14 980992]
S3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\drivers\VSTCNXT3.SYS [2009-7-14 661504]
S3 StorSvc;Speicherdienst;c:\windows\system32\svchost.exe -k LocalSystemNetworkRestricted [2009-7-14 20992]
S3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\TsUsbFlt.sys [2011-4-28 52224]
S3 WatAdminSvc;Windows-Aktivierungstechnologieservice;c:\windows\system32\wat\WatAdminSvc.exe [2011-2-18 1343400]
.
=============== Created Last 30 ================
.
2012-04-17 08:46:29 -------- d-----w- c:\users\florian\.thumbnails
2012-04-17 08:45:01 -------- d-----w- c:\users\florian\.gimp-2.6
2012-04-17 08:23:58 -------- d-----w- c:\users\florian\appdata\roaming\Avira
2012-04-16 21:02:25 70304 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-04-16 21:02:25 418464 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2012-04-16 20:58:27 -------- d-----w- c:\program files\Foxit Software
2012-04-16 20:41:31 -------- d-----w- c:\programdata\McAfee Security Scan
2012-04-16 20:41:29 -------- d-----w- c:\program files\McAfee Security Scan
2012-04-16 20:26:32 74640 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2012-04-16 20:26:32 36000 ----a-w- c:\windows\system32\drivers\avkmgr.sys
2012-04-16 20:26:31 -------- d-----w- c:\programdata\Avira
2012-04-16 20:26:31 -------- d-----w- c:\program files\Avira
2012-04-16 04:51:11 -------- d-----w- c:\programdata\AVAST Software
2012-04-15 19:35:17 -------- d--h--w- c:\programdata\Common Files
2012-04-13 05:43:59 6582328 ----a-w- c:\programdata\microsoft\windows defender\definition updates\{ca727b0c-3e65-467c-a7e0-c5e750aa7422}\mpengine.dll
2012-04-13 05:33:41 19824 ----a-w- c:\windows\system32\drivers\fs_rec.sys
2012-04-13 05:33:40 5120 ----a-w- c:\windows\system32\wmi.dll
2012-04-13 05:33:40 172544 ----a-w- c:\windows\system32\wintrust.dll
2012-04-13 05:33:39 159232 ----a-w- c:\windows\system32\imagehlp.dll
2012-04-02 07:43:58 -------- d-----w- c:\program files\iPod
2012-04-02 07:43:56 -------- d-----w- c:\program files\iTunes
2012-03-27 09:36:15 -------- d-----w- c:\users\florian\appdata\roaming\julitec
2012-03-27 09:36:15 -------- d-----w- c:\users\florian\appdata\local\julitec
2012-03-27 09:35:57 -------- d-----w- c:\programdata\julitec
2012-03-27 09:35:57 -------- d-----w- c:\program files\julitec
2012-03-27 09:07:30 493056 ----a-w- c:\windows\system32\dhRichClient3.dll
2012-03-27 09:07:30 338432 ----a-w- c:\windows\system32\sqlite36_engine.dll
2012-03-25 09:37:12 -------- d-----w- c:\users\florian\appdata\roaming\Samsung
2012-03-25 09:34:40 -------- d-----w- c:\windows\system32\Samsung_USB_Drivers
2012-03-25 09:34:19 5632 ----a-w- c:\windows\system32\drivers\StarOpen.sys
2012-03-25 09:12:03 -------- d-----w- c:\programdata\WEBREG
2012-03-25 09:11:49 -------- d-----w- c:\users\florian\appdata\local\HP
2012-03-25 09:06:14 -------- d-----w- c:\program files\common files\HP
2012-03-25 09:06:10 -------- d-----w- c:\program files\common files\Hewlett-Packard
2012-03-25 09:03:46 307200 ----a-w- c:\windows\system32\spool\prtprocs\w32x86\hpzppw72.dll
2012-03-25 09:01:45 452408 ----a-w- c:\windows\system32\hpzids01.dll
2012-03-25 09:01:44 737280 ----a-w- c:\windows\system32\hposwia_p01b.dll
2012-03-25 09:01:44 372736 ----a-w- c:\windows\system32\hppldcoi.dll
2012-03-25 09:01:43 974848 ----a-w- c:\windows\system32\hpost_p01b.dll
2012-03-25 09:01:43 307200 ----a-w- c:\windows\system32\hposc_p01a.dll
2012-03-21 13:01:19 592824 ----a-w- c:\program files\mozilla firefox\gkmedias.dll
2012-03-21 13:01:19 44472 ----a-w- c:\program files\mozilla firefox\mozglue.dll
2012-03-20 20:42:12 -------- d-----r- c:\users\florian\Dropbox
2012-03-20 20:39:22 -------- d-----w- c:\users\florian\appdata\roaming\Dropbox
.
==================== Find3M ====================
.
2012-02-28 01:18:55 1799168 ----a-w- c:\windows\system32\jscript9.dll
2012-02-28 01:11:21 1427456 ----a-w- c:\windows\system32\inetcpl.cpl
2012-02-28 01:11:07 1127424 ----a-w- c:\windows\system32\wininet.dll
2012-02-28 01:03:16 2382848 ----a-w- c:\windows\system32\mshtml.tlb
2012-02-23 08:18:36 237072 ------w- c:\windows\system32\MpSigStub.exe
2012-02-17 05:34:22 919040 ----a-w- c:\windows\system32\rdpcorets.dll
2012-02-17 05:34:22 826880 ----a-w- c:\windows\system32\rdpcore.dll
2012-02-17 04:14:08 183808 ----a-w- c:\windows\system32\drivers\rdpwd.sys
2012-02-17 04:13:22 24576 ----a-w- c:\windows\system32\drivers\tdtcp.sys
2012-02-15 10:01:50 4547944 ----a-w- c:\windows\system32\usbaaplrc.dll
2012-02-15 10:01:50 43520 ----a-w- c:\windows\system32\drivers\usbaapl.sys
2012-02-10 05:38:43 1077248 ----a-w- c:\windows\system32\DWrite.dll
2012-02-03 03:54:27 2343424 ----a-w- c:\windows\system32\win32k.sys
2012-01-30 18:09:15 8192 ----a-w- c:\windows\system32\srvany.exe
2012-01-30 18:09:15 151552 ----a-w- c:\windows\KMService.exe
2012-01-25 05:32:35 58880 ----a-w- c:\windows\system32\rdpwsx.dll
2012-01-25 05:32:34 129536 ----a-w- c:\windows\system32\rdpcorekmts.dll
2012-01-25 05:27:51 8192 ----a-w- c:\windows\system32\rdrmemptylst.exe
.
============= FINISH: 16:01:02,02 ===============



attach.txt

.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2011-08-26.01)
.
Microsoft Windows 7 Enterprise
Boot Device: \Device\HarddiskVolume1
Install Date: 11.02.2011 20:35:05
System Uptime: 17.04.2012 11:22:19 (5 hours ago)
.
Motherboard: Quanta | | 30D1
Processor: AMD Turion(tm) 64 X2 Mobile Technology TL-58 | Socket S1 | 1900/200mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 98 GiB total, 59,112 GiB free.
D: is FIXED (NTFS) - 135 GiB total, 30,691 GiB free.
E: is Removable
.
==== Disabled Device Manager Items =============
.
Class GUID: {36fc9e60-c465-11cf-8056-444553540000}
Description: Unknown Device
Device ID: USB\VID_0000&PID_0000\5&2175A365&0&2
Manufacturer: (Standard-USB-Hostcontroller)
Name: Unknown Device
PNP Device ID: USB\VID_0000&PID_0000\5&2175A365&0&2
Service:
.
==== System Restore Points ===================
.
RP185: 13.04.2012 07:32:19 - Windows Update
RP186: 14.04.2012 08:29:25 - TouchCopy 11 wird entfernt
RP187: 15.04.2012 21:36:25 - TuneUp Utilities 2012 wird installiert
RP188: 15.04.2012 22:35:48 - Wiederherstellungsvorgang
RP189: 16.04.2012 06:50:17 - avast! Free Antivirus Setup
RP190: 16.04.2012 06:51:36 - avast! Free Antivirus Setup
RP191: 16.04.2012 18:09:40 - Wiederherstellungsvorgang
RP192: 16.04.2012 18:38:12 - Windows-Sicherung
RP193: 16.04.2012 21:38:44 - Windows-Sicherung
RP194: 16.04.2012 22:20:56 - Removed Adobe Reader X (10.0.1) - Deutsch.
RP195: 16.04.2012 22:22:53 - TuneUp Utilities 2012 wird entfernt
RP196: 16.04.2012 22:23:31 - TuneUp Utilities Language Pack (de-DE) wird entfernt
RP197: 16.04.2012 22:47:54 - Removed Adobe Reader X (10.1.3) - Deutsch.
.
==== Installed Programs ======================
.
32 Bit HP CIO Components Installer
7-Zip 9.20
Adobe Flash Player 11 Plugin
Apple Application Support
Apple Mobile Device Support
Apple Software Update
Avira Free Antivirus
Bonjour
BufferChm
C5300
CDBurnerXP
Conexant HD Audio
Destinations
DeviceDiscovery
Dropbox
Foxit Reader 5.1
GIMP 2.6.12
GPBaseService2
HDAUDIO Soft Data Fax Modem with SmartCP
HP Customer Participation Program 13.0
HP Imaging Device Functions 13.0
HP Photosmart C5300 All-In-One Driver Software 13.0 Rel. 4
HP Photosmart Essential 3.5
HP Quick Launch Buttons
HP QuickPlay 3.6
HP Smart Web Printing 4.51
HP Solution Center 13.0
HP Update
HPPhotoGadget
HPPhotoSmartDiscLabel_PaperLabel
HPPhotoSmartDiscLabel_PrintOnDisc
HPPhotoSmartDiscLabelContent1
hpphotosmartdisclabelplugin
HPPhotosmartEssential
HPProductAssistant
iCloud
IrfanView (remove only)
iTunes
Java Auto Updater
Java(TM) 6 Update 22
Java(TM) 6 Update 23
julitecCRM 6.0
MarketResearch
McAfee Security Scan Plus
Microsoft .NET Framework 4 Client Profile
Microsoft .NET Framework 4 Client Profile DEU Language Pack
Microsoft Application Error Reporting
Microsoft Office Professional Edition 2003
Microsoft Silverlight
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
MobileMe Control Panel
Mozilla Firefox 11.0 (x86 de)
MSXML 4.0 SP2 (KB973688)
NVIDIA Drivers
NVIDIA PhysX
PDFCreator
PlayReady PC Runtime x86
PS_AIO_04_C5300_Software_Min
QLBCASL
QuickPlay SlingPlayer 0.4.6
QuickTime
Real Alternative 2.0.2
RICOH R5C83x/84x Flash Media Controller Driver Ver.3.51.01
Scan
Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368)
Security Update for Microsoft .NET Framework 4 Client Profile DEU Language Pack (KB2478663)
Security Update for Microsoft .NET Framework 4 Client Profile DEU Language Pack (KB2518870)
SmartWebPrinting
SolutionCenter
Spybot - Search & Destroy
Status
Synaptics Pointing Device Driver
Toolbox
TrayApp
UnloadSupport
VLC media player 1.1.5
WebReg
.
==== End Of File ===========================



gmer.txt

GMER 1.0.15.15641 - hxxp://www.gmer.net
Rootkit scan 2012-04-17 16:49:57
Windows 6.1.7601 Service Pack 1 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 WDC_WD2500BEVS-60UST0 rev.01.01A01
Running: cww3hq49.exe; Driver: C:\Users\Florian\AppData\Local\Temp\pwdiyfob.sys


---- System - GMER 1.0.15 ----

SSDT 8CE53156 ZwCreateSection
SSDT 8CE53160 ZwRequestWaitReplyPort
SSDT 8CE5315B ZwSetContextThread
SSDT 8CE53165 ZwSetSecurityObject
SSDT 8CE5316A ZwSystemDebugControl
SSDT 8CE530F7 ZwTerminateProcess

---- Kernel code sections - GMER 1.0.15 ----

.text ntkrnlpa.exe!ZwSaveKey + 13D1 82C51369 1 Byte [06]
.text ntkrnlpa.exe!KiDispatchInterrupt + 5A2 82C8AD52 19 Bytes [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3}
.text ntkrnlpa.exe!KeRemoveQueueEx + 11F7 82C91EAC 4 Bytes [56, 31, E5, 8C]
.text ntkrnlpa.exe!KeRemoveQueueEx + 1553 82C92208 2 Bytes [60, 31]
.text ntkrnlpa.exe!KeRemoveQueueEx + 1556 82C9220B 1 Byte [8C]
.text ntkrnlpa.exe!KeRemoveQueueEx + 1597 82C9224C 4 Bytes [5B, 31, E5, 8C]
.text ntkrnlpa.exe!KeRemoveQueueEx + 1613 82C922C8 4 Bytes [65, 31, E5, 8C]
.text ...
.text C:\Windows\system32\DRIVERS\nvlddmkm.sys section is writeable [0x91A32340, 0x3EE217, 0xE8000020]
? C:\Users\Florian\AppData\Local\Temp\mbr.sys Das System kann die angegebene Datei nicht finden. !

---- Devices - GMER 1.0.15 ----

AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 Wdf01000.sys (Kernelmodustreiber-Frameworklaufzeit/Microsoft Corporation)
AttachedDevice \Driver\kbdclass \Device\KeyboardClass1 Wdf01000.sys (Kernelmodustreiber-Frameworklaufzeit/Microsoft Corporation)
AttachedDevice \Driver\tdx \Device\Tcp aswRdr.SYS (avast! TDI RDR Driver/AVAST Software)

Device \Driver\ACPI_HAL \Device\00000049 halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation)

AttachedDevice \Driver\volmgr \Device\HarddiskVolume1 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume2 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume3 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume5 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)

---- EOF - GMER 1.0.15 ----



wie auch immer ihr es schafft, damit etwas anzufangen: ich danke euch!

gruß

willi