GVU-Trojaner eingefangen

cosinus · 10.07.2012, 07:24

Dann bitte jetzt CF ausführen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix

Lade dir ComboFix hier herunter auf deinen Desktop.

Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.

Starte combofix.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.

Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.

Wichtiger Hinweis:

Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!

Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

Solltest du nach der Ausführung von Combofix Probleme beim Starten von Anwendungen haben und Meldungen erhalten wie

Zitat:

Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.

startest du Windows dann manuell neu und die Fehlermeldungen sollten nicht mehr auftauchen.

Selior · 11.07.2012, 11:00

So, hier ist das Combofix Log:

Code:

ATTFilter

ComboFix 12-07-11.02 - Lukas 11.07.2012  11:50:16.1.4 - x64
Microsoft Windows 7 Home Premium   6.1.7600.0.1252.49.1031.18.3767.2462 [GMT 2:00]
ausgeführt von:: c:\users\Lukas\Downloads\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 * Neuer Wiederherstellungspunkt wurde erstellt
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Lukas\AppData\Local\Temp\{739A481D-BD4B-4018-AE07-E36B847634E6}\fpb.tmp
.
.
(((((((((((((((((((((((   Dateien erstellt von 2012-06-11 bis 2012-07-11  ))))))))))))))))))))))))))))))
.
.
2012-07-11 09:52 . 2012-07-11 09:52	--------	d-----w-	c:\users\Default\AppData\Local\temp
2012-07-10 17:43 . 2012-07-10 17:43	--------	d-----w-	c:\users\Lukas\AppData\Local\CrashDumps
2012-07-07 16:46 . 2012-07-07 16:46	--------	d-----w-	c:\windows\Sun
2012-07-07 13:01 . 2012-07-10 15:42	--------	d-----w-	c:\programdata\boost_interprocess
2012-07-07 12:54 . 2012-07-07 12:54	--------	d-----w-	c:\users\Lukas\AppData\Roaming\Avira
2012-07-07 12:51 . 2012-07-07 12:51	--------	d-----w-	c:\programdata\Avira
2012-07-07 12:51 . 2012-07-07 12:51	--------	d-----w-	c:\program files (x86)\Avira
2012-07-07 12:51 . 2012-05-02 13:24	27760	----a-w-	c:\windows\system32\drivers\avkmgr.sys
2012-07-07 12:51 . 2012-04-27 08:20	132832	----a-w-	c:\windows\system32\drivers\avipbb.sys
2012-07-07 12:51 . 2012-04-24 22:32	98848	----a-w-	c:\windows\system32\drivers\avgntflt.sys
2012-07-07 10:11 . 2012-04-04 13:56	24904	----a-w-	c:\windows\system32\drivers\mbam.sys
2012-07-07 10:11 . 2012-07-07 10:11	--------	d-----w-	c:\program files (x86)\Common Files\Java
2012-07-07 10:10 . 2012-05-04 17:29	772504	----a-w-	c:\windows\SysWow64\npDeployJava1.dll
2012-07-07 10:10 . 2012-07-07 10:10	--------	d-----w-	c:\program files (x86)\Java
2012-07-07 10:07 . 2012-05-31 04:04	9013136	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{CB6E2A3B-6381-4B76-BD92-90D677D49FF1}\mpengine.dll
2012-07-06 17:49 . 2012-07-06 17:49	--------	d-----w-	c:\program files (x86)\Oracle
2012-07-05 17:44 . 2012-07-07 10:12	--------	d-----w-	c:\program files\CCleaner
2012-07-05 15:38 . 2012-07-05 15:38	--------	d-----w-	c:\program files (x86)\ESET
2012-07-05 13:45 . 2012-07-07 10:05	--------	d-----w-	c:\users\Lukas\weiter Software
2012-07-04 18:49 . 2012-07-04 18:49	--------	d-----w-	c:\users\Lukas\AppData\Roaming\Malwarebytes
2012-07-04 18:49 . 2012-07-04 18:49	--------	d-----w-	c:\programdata\Malwarebytes
2012-07-04 18:49 . 2012-07-07 10:11	--------	d-----w-	c:\program files (x86)\Malwarebytes' Anti-Malware
2012-06-22 11:24 . 2012-06-02 22:19	2428952	----a-w-	c:\windows\system32\wuaueng.dll
2012-06-22 11:24 . 2012-06-02 22:19	57880	----a-w-	c:\windows\system32\wuauclt.exe
2012-06-22 11:24 . 2012-06-02 22:19	44056	----a-w-	c:\windows\system32\wups2.dll
2012-06-22 11:24 . 2012-06-02 22:15	2622464	----a-w-	c:\windows\system32\wucltux.dll
2012-06-22 11:24 . 2012-06-02 22:19	38424	----a-w-	c:\windows\system32\wups.dll
2012-06-22 11:24 . 2012-06-02 22:19	701976	----a-w-	c:\windows\system32\wuapi.dll
2012-06-22 11:24 . 2012-06-02 22:15	99840	----a-w-	c:\windows\system32\wudriver.dll
2012-06-22 11:24 . 2012-06-02 13:19	186752	----a-w-	c:\windows\system32\wuwebv.dll
2012-06-22 11:24 . 2012-06-02 13:15	36864	----a-w-	c:\windows\system32\wuapp.exe
2012-06-18 17:05 . 2012-06-18 17:05	770384	----a-w-	c:\program files (x86)\Mozilla Firefox\msvcr100.dll
2012-06-18 17:05 . 2012-06-18 17:05	421200	----a-w-	c:\program files (x86)\Mozilla Firefox\msvcp100.dll
2012-06-13 08:29 . 2012-06-13 08:29	--------	d-----w-	C:\2194756f52c55284dcf5
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-06-12 18:14 . 2012-04-09 18:19	426184	----a-w-	c:\windows\SysWow64\FlashPlayerApp.exe
2012-06-12 18:14 . 2011-05-17 19:38	70344	----a-w-	c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2012-05-04 17:29 . 2010-10-12 16:08	687504	----a-w-	c:\windows\SysWow64\deployJava1.dll
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP]
@="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}"
[HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}]
2010-05-27 02:40	120176	----a-w-	c:\program files (x86)\EgisTec MyWinLocker\x86\PSDProtect.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpybotSD TeaTimer"="c:\program files (x86)\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]
"OfficeSyncProcess"="c:\program files (x86)\Microsoft Office\Office14\MSOSYNC.EXE" [2011-07-21 718720]
"swg"="c:\program files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2011-09-21 39408]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"IAStorIcon"="c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe" [2010-03-04 284696]
"LManager"="c:\program files (x86)\Launch Manager\LManager.exe" [2010-03-03 1300560]
"SuiteTray"="c:\program files (x86)\EgisTec MyWinLockerSuite\x86\SuiteTray.exe" [2010-05-27 337264]
"EgisUpdate"="c:\program files (x86)\EgisTec IPS\EgisUpdate.exe" [2010-03-11 201584]
"EgisTecPMMUpdate"="c:\program files (x86)\EgisTec IPS\PmmUpdate.exe" [2010-03-11 407920]
"BackupManagerTray"="c:\program files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe" [2010-05-25 265984]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2010-04-21 98304]
"MDS_Menu"="c:\program files (x86)\Acer Arcade Deluxe\MediaShow Espresso\MUITransfer\MUIStartMenu.exe" [2009-05-19 222504]
"ArcadeMovieService"="c:\program files (x86)\Acer Arcade Deluxe\Arcade Movie\ArcadeMovieService.exe" [2010-04-23 124136]
"BCSSync"="c:\program files (x86)\Microsoft Office\Office14\BCSSync.exe" [2010-03-13 91520]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-06-06 937920]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-01-17 252296]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2012-05-01 348624]
.
c:\users\Lukas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk - c:\program files (x86)\Microsoft Office\Office14\ONENOTEM.EXE [2010-12-21 227712]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Acer VCM.lnk - c:\program files (x86)\Acer\Acer VCM\AcerVCM.exe [2010-7-2 704032]
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2012-4-1 1390368]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Notification Packages	REG_MULTI_SZ   	scecli c:\program files\WIDCOMM\Bluetooth Software\BtwProximityCP.dll
Security Packages	REG_MULTI_SZ   	kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-08-11 136176]
R2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [2010-03-04 13336]
R2 UNS;Intel(R) Management & Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2009-09-30 2314240]
R3 AmUStor;AM USB Stroage Driver;c:\windows\system32\drivers\AmUStor.SYS [2009-05-26 40448]
R3 btwampfl;Bluetooth AMP USB Filter;c:\windows\system32\drivers\btwampfl.sys [2012-04-08 594472]
R3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys [2012-04-08 39976]
R3 gupdatem;Google Update-Dienst (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-08-11 136176]
R3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files (x86)\Microsoft Office\Office14\GROOVE.EXE [2011-06-12 31125880]
R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-06-25 113120]
R3 MWLService;MyWinLocker Service;c:\program files (x86)\EgisTec MyWinLocker\x86\MWLService.exe [2010-05-27 305520]
R3 NTIBackupSvc;NTI Backup Now 5 Backup Service;c:\program files (x86)\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe [2010-04-17 50432]
R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4925184]
R3 WatAdminSvc;Windows-Aktivierungstechnologieservice;c:\windows\system32\Wat\WatAdminSvc.exe [2011-12-28 1255736]
R4 MSSQLServerADHelper100;SQL Server Hilfsdienst für Active Directory;c:\program files (x86)\Microsoft SQL Server\100\Shared\SQLADHLP.EXE [2009-03-31 47128]
R4 SQLAgent$MSSMLBIZ;SQL Server-Agent (MSSMLBIZ);c:\program files (x86)\Microsoft SQL Server\MSSQL10.MSSMLBIZ\MSSQL\Binn\SQLAGENT.EXE [2011-09-22 370024]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys [2012-05-02 27760]
S1 mwlPSDFilter;mwlPSDFilter;c:\windows\system32\DRIVERS\mwlPSDFilter.sys [2009-06-03 22576]
S1 mwlPSDNServ;mwlPSDNServ;c:\windows\system32\DRIVERS\mwlPSDNServ.sys [2009-06-03 20016]
S1 mwlPSDVDisk;mwlPSDVDisk;c:\windows\system32\DRIVERS\mwlPSDVDisk.sys [2009-06-03 60464]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-14 59904]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-06-06 64952]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2010-04-20 202752]
S2 AntiVirSchedulerService;Avira Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [2012-05-01 86224]
S2 DsiWMIService;Dritek WMI Service;c:\program files (x86)\Launch Manager\dsiwmis.exe [2010-03-03 325200]
S2 ePowerSvc;Acer ePower Service;c:\program files\Acer\Acer PowerSmart Manager\ePowerSvc.exe [2010-06-11 821792]
S2 GREGService;GREGService;c:\program files (x86)\Acer\Registration\GREGsvc.exe [2010-01-08 23584]
S2 NTI IScheduleSvc;NTI IScheduleSvc;c:\program files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe [2010-05-25 255744]
S2 NTISchedulerSvc;NTI Backup Now 5 Scheduler Service;c:\program files (x86)\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe [2010-04-17 144640]
S2 ODDPwrSvc;Acer ODD Power Service;c:\program files\Acer\Optical Drive Power Management\ODDPWRSvc.exe [2010-04-22 171040]
S2 RS_Service;Raw Socket Service;c:\program files (x86)\Acer\Acer VCM\RS_Service.exe [2010-01-29 260640]
S2 SBSDWSCService;SBSD Security Center Service;c:\program files (x86)\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368]
S2 Updater Service;Updater Service;c:\program files\Acer\Acer Updater\UpdaterService.exe [2010-01-28 243232]
S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atipmdag.sys [2010-04-21 6406144]
S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [2010-04-20 188928]
S3 dc3d;MS Hardware Device Detection Driver (USB);c:\windows\system32\DRIVERS\dc3d.sys [2011-05-18 47616]
S3 HECIx64;Intel(R) Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [2009-09-17 56344]
S3 Impcd;Impcd;c:\windows\system32\DRIVERS\Impcd.sys [2009-10-26 151936]
S3 intelkmd;intelkmd;c:\windows\system32\DRIVERS\igdpmd64.sys [2010-04-20 10322848]
S3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\L1C62x64.sys [2009-12-22 74280]
S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [2009-07-14 17920]
.
.
Inhalt des "geplante Tasks" Ordners
.
2012-07-11 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-08-11 12:05]
.
2012-07-10 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-08-11 12:05]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP]
@="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}"
[HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}]
2010-05-27 02:42	137584	----a-w-	c:\program files (x86)\EgisTec MyWinLocker\x64\PSDProtect.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2010-04-22 10775072]
"RtHDVBg"="c:\program files\Realtek\Audio\HDA\RAVBg64.exe" [2010-04-22 2040352]
"AmIcoSinglun64"="c:\program files (x86)\AmIcoSingLun\AmIcoSinglun64.exe" [2009-04-09 320000]
"ODDPwr"="c:\program files\Acer\Optical Drive Power Management\ODDPwr.exe" [2010-04-22 223264]
"mwlDaemon"="c:\program files (x86)\EgisTec MyWinLocker\x86\mwlDaemon.exe" [2010-05-27 349552]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2010-04-20 166424]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2010-04-20 391192]
"Persistence"="c:\windows\system32\igfxpers.exe" [2010-04-20 413720]
"Acer ePower Management"="c:\program files\Acer\Acer PowerSmart Manager\ePowerTrayLauncher.exe" [2010-06-11 496160]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x0
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_4820tg&r=27361010k806l0443z1j5t7711j693
uLocal Page = c:\windows\system32\blank.htm
mStart Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_4820tg&r=27361010k806l0443z1j5t7711j693
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: An OneNote s&enden - c:\progra~2\MICROS~2\Office14\ONBttnIE.dll/105
IE: Nach Microsoft E&xcel exportieren - c:\progra~2\MICROS~2\Office14\EXCEL.EXE/3000
IE: {{7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - c:\program files (x86)\ICQ7.5\ICQ.exe
TCP: DhcpNameServer = 82.212.62.62 78.42.43.62
FF - ProfilePath - c:\users\Lukas\AppData\Roaming\Mozilla\Firefox\Profiles\mclysl1s.default\
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Toolbar-Locked - (no file)
Toolbar-Locked - (no file)
WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\S-1-5-21-3772388013-4205554985-1094341838-1000\Software\SecuROM\License information*]
"datasecu"=hex:52,19,78,42,49,5f,e4,da,8d,58,36,ba,33,44,50,30,85,c9,a9,85,9f,
   7f,b1,fb,c4,ab,0c,bb,08,b2,dd,86,16,a9,54,42,94,60,37,69,9b,8b,f9,62,91,9b,\
"rkeysecu"=hex:87,24,72,46,06,bd,9f,16,cd,05,31,65,0d,f8,82,37
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_3_300_257_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_3_300_257_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_257.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_257.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_257.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_3_300_257.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\McAfee]
"SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
   00,5c,00,6d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,6f,00,66,00,\
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
@Denied: (A) (Everyone)
"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
"Key"="ActionsPane3"
"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\program files (x86)\Avira\AntiVir Desktop\avguard.exe
c:\program files (x86)\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe
c:\program files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
c:\program files (x86)\Cyberlink\Shared files\RichVideo.exe
c:\program files (x86)\Launch Manager\LMworker.exe
c:\windows\SysWOW64\RunDll32.exe
c:\program files (x86)\Internet Explorer\iexplore.exe
c:\program files (x86)\Internet Explorer\iexplore.exe
c:\windows\SysWOW64\Macromed\Flash\FlashUtil32_11_3_300_257_ActiveX.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2012-07-11  11:55:39 - PC wurde neu gestartet
ComboFix-quarantined-files.txt  2012-07-11 09:55
.
Vor Suchlauf: 14 Verzeichnis(se), 75.873.861.632 Bytes frei
Nach Suchlauf: 20 Verzeichnis(se), 75.865.006.080 Bytes frei
.
- - End Of File - - 87B6A451D32C30054D08337E33F5C8F9

cosinus · 11.07.2012, 12:44

Bitte nun Logs mit GMER und OSAM erstellen und posten.
GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus - die Online-Abfrage durch OSAM bitte überspringen.
Bei OSAM bitte darauf auch achten, dass Du das Log auch als *.log und nicht *.html oder so abspeicherst.

Hinweis: Zum Entpacken von OSAM bitte WinRAR oder 7zip verwenden! Stell auch unbedingt den Virenscanner ab, besonders der Scanner von McAfee meldet oft einen Fehalarm in OSAM!

Downloade dir bitte

aswMBR.exe und speichere die Datei auf deinem Desktop.

Starte die aswMBR.exe - (aswMBR.exe Anleitung)
Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten".
Das Tool wird dich fragen, ob Du mit der aktuellen Virendefinition von AVAST! dein System scannen willst. Beantworte diese Frage bitte mit Ja. (Sollte deine Firewall fragen, bitte den Zugriff auf das Internet zulassen )
Der Download der Definitionen kann je nach Verbindung eine Weile dauern.
Klicke auf Scan.
Warte bitte bis Scan finished successfully im DOS-Fenster steht.
Drücke auf Save Log und speichere diese auf dem Desktop.

Poste mir die aswMBR.txt in deiner nächsten Antwort.

Wichtig: Drücke keinesfalls einen der Fix Buttons ohne Anweisung

Hinweis: Sollte der Scan Button ausgeblendet sein, schließe das Tool und starte es erneut. Sollte der Scan abbrechen und das Programm abstürzen, dann teile mir das mit und wähle unter AV Scan die Einstellung (none).

Noch ein Hinweis: Sollte aswMBR abstürzen und es kommt eine Meldung wie "aswMBR.exe funktioniert nicht mehr, dann mach Folgendes:
Starte aswMBR neu, wähle unten links im Drop-Down-Menü (unten links im Fenster von aswMBR) bei "AV scan" (none) aus und klick nochmal auf den Scan-Button.

Selior · 11.07.2012, 18:35

Hier das GMER-log:

Code:

ATTFilter

GMER 1.0.15.15641 - hxxp://www.gmer.net
Rootkit scan 2012-07-11 19:14:28
Windows 6.1.7600  
Running: 1yitq8bf.exe


---- Registry - GMER 1.0.15 ----

Reg  HKLM\SYSTEM\CurrentControlSet\Control\Network\{4d36e975-e325-11ce-bfc1-08002be10318}\{2B07FAA1-8217-4E30-B5EC-FD4501E773BB}\Linkage@Bind    ?????i??USB\UNKNOWN??????????g??????????????Root\*6TO4MP\0263????????????i?????e?l??? ???????t?????v?u???????????????????????????????????????9??????48??????????????*6to4mp??n???e????????????X??????????????????????o???????o????N????????????D????text??????N??????T??????0????????????????????????????x?????e?y???????????F???e???????????????j??Microsoft???6-21-2006???Microsoft-6zu4-Adapter #184??2??????"{??????????6-21-2006?????????????$??????????????????????3??????te??????????????????????????????????Root\*6TO4MP\0264????????????B??????????Microsoft-6zu4-Adaptertreiber???@netvwifimp.inf,%vwifimp.devicedesc%;Microsoft Virtual WiFi Miniport Adapter????????????????????????? ????????????????????N??????z???????????????????????B??????lA???????????????????????????5??????????Microsoft???Microsoft???11??????? ???????????????????????????????????????????????2???????????p??????so??Root\*6TO4MP\0266????????????????5?????eFF??????????*6to4mp?????Typ??????????????2?????s?7??? ??????????????????????????????????????????Root\*6TO4M
Reg  HKLM\SYSTEM\CurrentControlSet\Control\Network\{4d36e975-e325-11ce-bfc1-08002be10318}\{2B07FAA1-8217-4E30-B5EC-FD4501E773BB}\Linkage@Route   ????????????#?????$LAN-Verbindung* 22???????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????4Microsoft-6zu4-Adapter #14????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????
Reg  HKLM\SYSTEM\CurrentControlSet\Control\Network\{4d36e975-e325-11ce-bfc1-08002be10318}\{2B07FAA1-8217-4E30-B5EC-FD4501E773BB}\Linkage@Export  ??????????*?????????????????????.NTAMD64?\??vga?framebuf?vga256?vga64k????????<?????????????????????Standard VGA Graphics Adapter???? ???????a???????????a??????????????????o???? ???????a???????????????? ?????????&???????????????????????? ???????????????????????? ???B?|???????ce??{4d36e97d-e325-11ce-bfc1-08002be10318}??????*6to4mp???????:???????????h??????????n???????e???????????????r??? ??????????????????MP550 series?????????????b?????s45??{00000000-0000-0000-ffff-ffffffffffff}???????????l???????e????N??????y???????????????z???z???z???????????????????????????????????.??????????????????{4d36e97d-e325-11ce-bfc1-08002be10318}\0014?EN??Interner High Definition Audio-Bus??????04??????????? ??????????????????????????????????????????????????????????????vga??????????&??????????????@nettun.inf,%msft%;Microsoft?S??????????????ve???????????3??????????????????? ???????a???????????a?,?????? ?:???&????????????????????,????:?????????????????LocalSystemNetworkRestricted??????8??????i????hel_??%windir%\system32\DFDTS.dll?en?
Reg  HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\c44619c95772                                                                 
Reg  HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\c44619c95772@0021fe496935                                                    0x12 0xC3 0xD9 0x11 ...
Reg  HKLM\SYSTEM\CurrentControlSet\services\LanmanServer\Linkage@Bind                                                                            ?????????????????????????????&?? ???25??? ???????t???????????t?9?????????????????????????t?????????????????????????????????????????? ??????????? ???????????????@?????????@??????????????? ????????????????????t???t???t????????? ???????n?????t?????t??????????R???????????%SystemRoot%\system32\lsass.exe???????R??t?????????n????@%SystemRoot%\System32\netlogon.dll,-103????? ???t??????????????LocalSystem????????????????????????????????????????????? ????????????t?t?t?t?t?t?t?t?t????&??????????????e?????????t??????R??t?????????e??????6??t??????p?????@??t????????h??????????????t??????????@%SystemRoot%\System32\netlogon.dll,-102????MS_WindowsRemoteValidation??????????????????t????t??? ???????t???????????t????????*????? ???????????????????????????????e?????????????????????????????????????????????l??????t?t?t???t????????????????????????????????????????l??????t?t?t?t?t?t?t????????????????????l?????? ???????n?????t?????t????????$???????????????N??t?????????e????@%SystemRoot%\system32\netman.dll,-109???????????t????????h????
Reg  HKLM\SYSTEM\CurrentControlSet\services\LanmanServer\Linkage@Route                                                                           ????ir???????????????????{???????????????????k?k??????>??k???1?gCA???????????@????????????N????????????D????1.3M WebCam?_A????6??j????????h?????????????????re???????????????????????d???&??s0??? `??j???????????????????j??????????????6&294876e0&0?6??*6to4mp??n??????????????????????t?????????'??f????j????????g????System32\DRIVERS\netbt.sys??????????Video????????h???????e???????????????????e???????????????????j??????????? l??????????????????????g???????e????j????????g??????X??????3?g?3???????????2?????s2}??2}???????|??????????????{00000000-0000-0000-FFFF-FFFFFFFFFFFF}???????e?f?f?g?h?h?j?j?j?j?j????N??j?????????D????STORAGE\VolumeSnapshot??0???DiskDrive???tunnel???\???????????????f????????????s??????????????B??????08??USBSTOR??????????????{?|?{???{???????????????h??????????7&33793b7b&0?????????????????e???????????????????|???????|????X??????????????  ??j??????????$???Net???????????????????????P??u?????????n???????????????????????????????????????s?P??? 0??j???z????????????????????????:??????????????????g?????????
Reg  HKLM\SYSTEM\CurrentControlSet\services\LanmanServer\Linkage@Export                                                                          ? ??????tunnel??????????????????????*6to4mp?06??? ???????s?????usb?????????????????????s???s????Video Save???????3?v?v?v?u?????????????v?????v??? ???????s?????s???????????????????? ?????? ????? ???????s??????????????????????????????????????? ???????s???????? ??s????????r?p??? ?????????????H??s?????????????????????????4?????????? ???????????????????H??s???????????/?????????????4?????????? ???????????????????????????0??s???????????????????????????????????????????9p??s????????????????????????????????/????????????????\???(??????P??????????????????? ????????????????????s???s??????l??s??????????????/??????????????X???(??????P????????????(??????P???????????????l??s?????????????????????????????X???(??????P????????????(??????P??????????????????s????????????l??s??????????????/??????????????X???(??????P????????????(??????P??????????????'0??s???,???????????????????/???????????????????????????;????????????????????????D??s?????????????????????????????0???(??????P???????????????D??s????????????????/????????????????0???(???
Reg  HKLM\SYSTEM\CurrentControlSet\services\LanmanWorkstation\Linkage@Bind                                                                       ?????&??.NT?0????????????7??????????????dO???|?|????HD????"??z??????????????p????????????7???????????z????????????h??????z??d?????T??{????????h?????????????v2.10|Action=Allow|Active=FALSE|Dir=In|Protocol=6|Profile=Domain|LPort=135|App=%systemroot%\system32\svchost.exe|Svc=rpcss|Name=@FirewallAPI.dll,-34755|Desc=@FirewallAPI.dll,-34756|EmbedCtxt=@FirewallAPI.dll,-34752|????????????????????????P????? ????????????????????????????~??????n???????????z??? ???i???????????????????????z???????????????????/????????????????X??????n???????????e???l??????11???????????????a????????????????????????????????X??????b???t????`?????????????????P???Microsoft USB-Druckerklasse?????? ???z??????????1????????????????????????????0???#???z??????????????v2.10|Action=Allow|Active=FALSE|Dir=Out|Protocol=6|Profile=Domain|App=%SystemRoot%\system32\svchost.exe|Svc=Msiscsi|Name=@FirewallAPI.dll,-29007|Desc=@FirewallAPI.dll,-29010|EmbedCtxt=@FirewallAPI.dll,-29002|??????????????????????????????????????????????????????????????X??????.???t????t
Reg  HKLM\SYSTEM\CurrentControlSet\services\LanmanWorkstation\Linkage@Route                                                                      ???????????m????? ???????m?????m???????0????????????????????? ???????2??????D7??? ???????m???????????l?0????????4????????????????k??????????????????????????????????????????????????s??????m????? ???????m?????m???????0????????????????????? ???????m???????????l?0?????????????????????????k????????????????????????0??n??????p??????????????m????? ???????m?????m???????0????????????????????????????????????????????????????? ???????m???????????l?0????????"????????????????????????????????k??HIDClass????Net????????m????? ???????m?????m???????0????????????????????? ???????m???????????l?0?????????????????????!??????????????????????????????????????????t??????m?????????????????????????m??????????????? ???????m?????m???????0????????????????????? ???????m???????????l?0?????????????????????????????????????????????F??4820TG-PC??????m????? ???????m?????m???????0????????????????????? ?m???m???m???m???m???m???m???m???m???m????????? ???????m???????????l?0?????????????????????????????????????h?????m????? ???????m?????m???????0???????
Reg  HKLM\SYSTEM\CurrentControlSet\services\LanmanWorkstation\Linkage@Export                                                                     ? ?????????k?&??? ???????k???????????i?,????????N???????????? ???????k???????????k?0?????????????????????????k???????????k?kdl?????k????? ???????k?????k???????0????????????????????? ???????k???????????k?0?????????????????????k?k????.NTAMD64????? ???????j?????k?????k?,??????????a? ???????D0??? j?????????????????? ???????k???????????i?,????????\????????????????j??????????????????G????r?????????k?&????N??l????????D????????????????g????????????????????????system32\DRIVERS\ACPI.sys????N???k???k??{36fc9e60-c465-11cf-8056-444553540000}\0004?????????????????t????????d???m???????~?~?k???k?k?????????????????????????????~?~tB???????4??? ???????j???????????i?,??????????b? ???????0??????????????????????k?&???k??????????????USB\Class_0e&SubClass_03&Prot_00?USB\Class_0e&SubClass_03?USB\Class_0e??????.NTAMD64????????????????t????????????(????????????????????????????*??????:?????????n05??? ??????????????????.NTAMD64????usbccgp?ho???????????l??? ???????l?????k???????0????????????&????????????????????????????????????????????k?
Reg  HKLM\SYSTEM\CurrentControlSet\services\NetBIOS\Linkage@Bind                                                                                 ??????????X??????|????????????????????????????????????????????????P???????N??????????????????????f???s???e????????????????????$??????9???????8????H?????????????????????????????????Root\*6TO4MP\0005????????~??????????????????????1????{?C?????????????s???????????9??????9.??USB\VID_8087&PID_0020\5&1daeb0c0&0&1? ????????????????????????????????????N??????i????Damd????????????????????????????????????????????????????????.??????????t????z??????9??????85????????????????????????X??????????t???????0??????????????????disk.inf????? ???????n??????????????????????????????????????ro??OpenPerformanceData??|??v2.10|Action=Allow|Active=TRUE|Dir=Out|Protocol=6|Profile=Private|RPort=5358|RA4=LocalSubnet|RA6=LocalSubnet|App=System|Name=@FirewallAPI.dll,-32815|Desc=@FirewallAPI.dll,-32816|EmbedCtxt=@FirewallAPI.dll,-32752|??????????????$??????c???????_????P?????????????????????????????????????? ???n?????????alP??Root\*6TO4MP\0006???? ???j???6?????-76???????????????i??????s???%SystemRoot%\System32\drivers\ati2erec.dll?ell??? ?????
Reg  HKLM\SYSTEM\CurrentControlSet\services\NetBIOS\Linkage@Route                                                                                ??????????????????????????????????????X??????z???????????h??????????????????????int?????Net?????????????? ???????.?????????????*??"?????p?7???????????$??????????????????????????o???????o??*6to4mp?0???? ???????.?????????????*??"?????p?4???????????N?????????????????????????????????? ?????????????????????0??L????????? ???????????????????Microsoft-6zu4-Adaptertreiber???????????????????????????????????????Typ?????Net?????????????????????????????11?? #??????????????????????????????????????????11??????????????? ???????0?????e?????????????????????i???????????????t??? ?????????????????????,????????P????????p??? P??????e?????o?o??????? ?????????????????????0????????????&????????????????????p??????????????{4d36e972-e325-11ce-bfc1-08002be10318}\0050??5???????????D??????09???????????????????????????????????N??????????df???y?z?z?z?????????????????????????o???????o????N????????????D????? ???????8????? 99??tunnel???????????????????????????????????????t????????????????????N??????n????D 79???????? ????????????????????????????
Reg  HKLM\SYSTEM\CurrentControlSet\services\NetBIOS\Linkage@Export                                                                               ??????????????????????????????????????X???????????????:?????????????????????@nettun.inf,%msft%;Microsoft?|??*6to4mp??o???????????????????????????????????????B???????d????(??????j??? ??Typ?????????????6-21-2006?????????????????(??????????????????????????????????????????????B???????A?????????????????????????e? ???????????d????????????????N??????d????????????????N??????d????????????&??????????????????????.???????????????????????????????????????B????????????????????????????????????????X??????n??????????????????????tunnel?A0-????????????????X??????????t?????????????????s^????????????????? ??????e???e??????E???????????un???????o??? ???????|???????????i?:????????????&????????????????????????????y????????????????????????????????????????N??????????????????????3.?????? P??????e?????{C4??????? ???????B?????3C2????8?????????????16???????????|???e??-4??????????????????????????LAN-Verbindung* 134?4A????X??????????????????????????e???????????5???????s????????????????????&??????p???t??nettun.inf:Microsoft.NTamd64:6to4mp.ndi
Reg  HKLM\SYSTEM\CurrentControlSet\services\NetBT\Linkage@Bind                                                                                   ????????????????Microsoft?????:??????2?g11??????????????????????-4????X??????5???????????????B??? P??????#?????848????$?????????????????????????{4d36e972-e325-11ce-bfc1-08002be10318}\0164?\\??text????????????????????t????????????????????????{???????????????????????"??Microsoft????????????????t????N????????????D*i???????????????????????????????????~??????????????????Root\*6TO4MP\0231???????????????????????????6-21-2006????????????????????4???????????c??11????????$??????0???????0??????????*6to4mp?6???11???????????????y???t?????????????????s??????X??????????????????m??? ???????h?????????????*??"?????p????????????????????????e??RasAgileVpn?????Root\*6TO4MP\0232????????d??????????*6to4mp?????????????tunnel??????11??????*6to4mp?cp??????????????????? ?????????????????????,????????????????????????????? ??????????????? ??? ?????????????????????,?????????????????f??text????????{4d36e972-e325-11ce-bfc1-08002be10318}\0093?? ??? ??????????????????????????????????????? ??? ?????????????????????0??????????E?&??????????????
Reg  HKLM\SYSTEM\CurrentControlSet\services\NetBT\Linkage@Route                                                                                  ??????????????????N??????????????????????j????<?????????????? ???????n??????? ??*6to4mp??b??????????? ???????h?????????????,????????????(???????????????????????? ?????????????????????,??"???&?????????????????@system32\DRIVERS\pci.sys,#65536;PCI bus %1, device %2, function %3;(0,0,0)?t???PCI\VEN_8086&DEV_0044&SUBSYS_03591025&REV_18?PCI\VEN_8086&DEV_0044&SUBSYS_03591025?PCI\VEN_8086&DEV_0044&CC_060000?PCI\VEN_8086&DEV_0044&CC_0600????PCI\VEN_8086&DEV_0044&REV_18?PCI\VEN_8086&DEV_0044?PCI\VEN_8086&CC_060000?PCI\VEN_8086&CC_0600?PCI\VEN_8086?PCI\CC_060000?PCI\CC_0600???? ??@oem6.inf,%pci\ven_8086&dev_0045.devicedesc%;Intel(R) processor PCI Express Root Port - 0045?D??@system32\DRIVERS\pci.sys,#65536;PCI bus %1, device %2, function %3;(0,1,0)??4??PCI\VEN_8086&DEV_0045&SUBSYS_03591025&REV_18?PCI\VEN_8086&DEV_0045&SUBSYS_03591025?PCI\VEN_8086&DEV_0045&CC_060400?PCI\VEN_8086&DEV_0045&CC_0604????{4d36e97d-e325-11ce-bfc1-08002be10318}??? ??{4d36e97d-e325-11ce-bfc1-08002be10318}????????N??????_?????e???????????????????
Reg  HKLM\SYSTEM\CurrentControlSet\services\NetBT\Linkage@Export                                                                                 ??????????????????N??????b??????39????X??????n??????????????Root\*6TO4MP\0032????????????????d??????s???Microsoft-6zu4-Adapter #60?p6_??text????????????????6-21-2006???11??NN??????text?????????????1??????7B??????Microsoft????????????????????????z???h??? P??????y????????????:??????????o??Microsoft???????????????????????????????????????? ???????????????????????????a?????s\T??????????????????????@oem6.inf,%pci\ven_8086&dev_2d12.devicedesc%;Reserved - 2D12??????X?????????????8&cf1c145&0???????????????`??????z??????? 0???????????????????X??????d???d??6-21-2006???WUDFCoinstaller.dll?????? ???n???c??????to????(???????????????`?????????????????????????????????????{4d36e97d-e325-11ce-bfc1-08002be10318}??????? 0??????y?????y?{????N????????????D?????????????&??? ???????|?????????????,?????????????????f????.??????????t????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????Interface Un-quarantine filter???????????????????????????????
Reg  HKLM\SYSTEM\CurrentControlSet\services\Smb\Linkage@Bind                                                                                     ??????????N??????D?????D"{???????????B??6-21-2006????????z???y???y???????????????u??????????????????????????Microsoft???????text????*6to4mp??????????????B?????s-4???????????c???e??ht??11???????????????????????????B??????Se????8?????????????????????????Root\*6TO4MP\0221???O4MP\0221???????25??????????????te??????????\0??????\0????$LAN-Verbindung* 79???????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????4Microsoft-6zu4-Adapter #71????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????
Reg  HKLM\SYSTEM\CurrentControlSet\services\Smb\Linkage@Route                                                                                    ??????????N?????????????????? ???????????????????????????????j??????????????? ?????????????????????,??????????????????????s?????????ne??? ?????????????????????,????????????????????????????????? ?????????????????????0??L????????? ???????? ????????????????ineO??? ?????????????????????-????????????&???????????????????????? ?????????????????????-????????????????????? ?????????????????????-????????`????????????????????????/????`??????.???/??@system32\DRIVERS\pci.sys,#1536;PCI HOST Bridge?_c??????????????????? ?????????????????????0????????????&???????????????????????????????????? ?????????????????????0????????????????????? ?????????????????????0????????????????????????????????????????????????????oem6.inf:INTEL_SYS.NTamd64:NO_DRV:9.1.1.1022:pci\ven_8086&dev_2d11??? ??????????????????? ?????????????????????0????????????????????????????????? ?????????????????????0????????????????????????????????????????????????ID??????\\??????????? ?????????????????????0??????????????????????????????????B02&??? ?????????????????????
Reg  HKLM\SYSTEM\CurrentControlSet\services\Smb\Linkage@Export                                                                                   ?????e???f??????08??11??0A??????????????{6FC0BF13-D4EC-4D87-9ACD-D7F6B9C9F88B}??????\Device\{6FC0BF13-D4EC-4D87-9ACD-D7F6B9C9F88B}??12??????????? P??????0?????250??{2311269E-2B9E-47F3-9D63-A3AE3E82C3A0}??B6????*??????E????dDD1??TCPIP6TUNNEL?Tcpip6??}??\Device\{2311269E-2B9E-47F3-9D63-A3AE3E82C3A0}??DD???????????????????$???????1??????????????????nm??{4d36e972-e325-11ce-bfc1-08002be10318}?-28???????????????????????????B???????d??????????8&13ae5785&0??????N??????7?????D08??{4d36e972-e325-11ce-bfc1-08002be10318}\0096?te??????????????????????49???????????????????&???e????????????????????*??????1????d8-8???????????@??????{4d36e972-e325-11ce-bfc1-08002be10318}\0091??&????8??????????????????????????????????????i???????????????????????e??@nettun.inf,%msft%;Microsoft????{4d36e972-e325-11ce-bfc1-08002be10318}?y?y????8??????1??????7???*6to4mp??&??????????????~???{4d36e972-e325-11ce-bfc1-08002be10318}\0105?? ??tunnel??????????????tunnel??"{??????????11???????????????m???????m??????6-21-2006??????????????????e????@nettun
Reg  HKLM\SYSTEM\CurrentControlSet\services\TCPIP6\Linkage@Bind                                                                                  ?????????????'?????????????????F????11???????|???????????????|??STORAGE\VolumeSnapshot??k.???|??????????????????????????????????AmUStor???????????????????????????????????`??????????????|????6?????????????D7??????????????????Microsoft????????????????????????|????X??????n???????????????????????????i??????????????????????????????*6to4mp??????|???????0??? ?????????????l???????,?????????????????????????4????N??|???f?????D.e??{00000000-0000-0000-0000-000000000000}??????? ???????|?????k???????0??L????????? ???????C:??? ???????|?????????????0????????????&????????????????????????????s???2??s????|??? ???????????????????j???????? ??????????p???????????s?????????inS???????????x???????????|?????? ?????????????,??|???????????????????u???????????e??????????????????????? B??|???????????????|????V??|??????????????????SeRestorePrivilege?SeImpersonatePrivilege????????????????????????????????u?u?u?u?u?|?|?|?|?|?|?|????? ???????u???????????u?0??????,?B??? ???????????%SystemRoot%\System32\trkwks.dll????????????????????????????? ?
Reg  HKLM\SYSTEM\CurrentControlSet\services\TCPIP6\Linkage@Route                                                                                 ????????????????????????????42???????????????????m?????s?m??????????????????WM??????????????????????@nettun.inf,%msft%;Microsoft??????:?????????????????????{4d36e972-e325-11ce-bfc1-08002be10318}\0080??B????N??????c?????DP6??*6to4mp?????????????????????????????11??????????? ??????? ???????????????????????e??????C3???????????????????m???????m??@nettun.inf,%msft%;Microsoft??????8??????????????}???????????????????B??tunnel????????????????????????????????????????????????????X??????z???????????h??????????????????????int?????Net?????????????? ???????.?????????????*??"?????p?7???????????$??????????????????????????o???????o??*6to4mp?0???? ???????.?????????????*??"?????p?4???????????N?????????????????????????????????? ?????????????????????0??L????????? ???????????????????Microsoft-6zu4-Adaptertreiber???????????????????????????????????????Typ?????Net?????????????????????????????11?? #??????????????????????????????????????????11??????????????? ???????0?????e?????????????????????i???????????????t??? ?????????????????????
Reg  HKLM\SYSTEM\CurrentControlSet\services\TCPIP6\Linkage@Export                                                                                ????????? ?????????????????????0????????????????????????????????????????????????????? ?????????????????????0????????????????????????????????????? ?????????????????????0????????????????????? ?????????????????????0????????????????????????????????????????????????????????????????????????????? ?????????????????????0????????????????????? ?????????????????????0????????????????????????????????????????????????????Microsoft???????????????????????????? ?????????????????????0??????????????????????.?????????????????????????????? ?????????????????????0????????????????????6.1.7600.16385??????????????????????Monitor?????? .??????0???????0??????@monitor.inf,%generic%;(Standardmonitortypen)???????????????????????*pnp09ff?s??? ?????????????????????0????????????????????? ?????????????????????0????????????????????????????????????????? ??????????????????*pnp09ff????? ?????????????????????0????????????????????? ?????????????????????0????????????????????????????????????? ??????????????????????? ?????????????????????0???????????????
Reg  HKLM\SYSTEM\ControlSet002\Control\Network\{4d36e975-e325-11ce-bfc1-08002be10318}\{2B07FAA1-8217-4E30-B5EC-FD4501E773BB}\Linkage@Bind        ???5????*6to4mp??????????@???????????????????????????????????5???m???l???????5???;???????5?9?:??AtiHdmi.sys?e\????*??5???2??d1???y?y?????Z??? ???5???i?????TEL??{2AB20C9E-6688-4474-9D8C-78ED8197511A}-{5CBF81BF-5055-47CD-9055-A76B2B4E3698}-0000?{2AB20C9E-6688-4474-9D8C-78ED8197511A}-{E475CF9A-60CD-4439-A75F-0079CE0E18A1}-0000?{2AB20C9E-6688-4474-9D8C-78ED8197511A}-{B5F4D659-7DAA-4565-8E41-BE220ED60542}-0000?{2AB20C9E-6688-4474-9D8C-78ED8197511A}-{B70D6460-3635-4D42-B866-B8AB1A24454C}-0000??2AB20C9E-6688-4474-9D8C-78ED8197511A}-{B70D6460-3635-4D42-B866-B8AB1A24454C}-0000???????5?5?5?5? ????~??5????????????????d??5?????????????6????????? ???9???????????}??? ???????3?????5???????0????????????????????? ???????5???????????5?0????????B???????????Broadcom 802.11n-Netzwerkadapter?5????`??5???????,???5?5tr??? ???????3?????6???????3????????????&??????????????????????????????????????????????-???7????@oem7.inf,%bcm430n_devicedesc%;Broadcom 802.11n-Netzwerkadapter?-0???3?3?3?3?3?3?3?3?3?3?3?3?3?3?3?3?4?4?3?4?4?4?4?4?4?4?4?
Reg  HKLM\SYSTEM\ControlSet002\Control\Network\{4d36e975-e325-11ce-bfc1-08002be10318}\{2B07FAA1-8217-4E30-B5EC-FD4501E773BB}\Linkage@Route       ???0?????9??????????????????????????????????Mouse???@%SystemRoot%\system32\tcpipcfg.dll,-50001??????? ???????/???????????-?9????????*??? ???????????? *??9??????????????ndis5,ndis5_ip,flpp4??????V??9?????????n????@%SystemRoot%\system32\tcpipcfg.dll,-50003??????? ???????????????????9?9????????D????????????r?????9???????????9???????????????????y????? ??????????????y???? ??????????????y???? ??????????????y????3?9?9?9?3?9?9????D??9??????????????%SystemRoot%\System32\wsock32.dll???? ???????????????????7?0?????????????????e??? ?????????????9?????????? ???????=??????????r??? ???????9???????????3????????"?????????r??????9??????????????????????s?????? ???9??????????r???Tcpip???????? ?????????????????????9?????????????????????????9?9?????9????D??9??????????????%SystemRoot%\System32\drivers\etc????9?9?????9????????????????????????????????????????s??????????:???9??????????????????????????? ?????????????????????9??L??????????????????9?9?????9?9?=???9???????????????????????????????/?????????????????????????? ??????????? ??
Reg  HKLM\SYSTEM\ControlSet002\Control\Network\{4d36e975-e325-11ce-bfc1-08002be10318}\{2B07FAA1-8217-4E30-B5EC-FD4501E773BB}\Linkage@Export      ???:????????????????????????Mouse???atiumd64.dll?igdumd64.dll?atidxx64.dll?igd10umd64.dll????????????:???;??????????`????e??????25??????????? ??????????????????? ???????,???????????;?,??????????@??????????6???????????/???????????@?@?@?@?:???????????2?2?2?:ve??? ???????,?????;?????;?,??????????a? ???????D0???????????_??????7C??{17CCA71B-ECD7-11D0-B908-00A0C9223196}???????)J??;????????????????????????0??????:??? ???????:?????:?????????????????????????:?????;0??????:?=?:?=???:???????????:??? ???????:???????????;????????P?N?????0-A5???(N??:???3??????????????????????{00000000-0000-0000-0000-000000000000}?pac???????;???????????:?????;????????????????????????si???????????r???????????????????I???????????:?:?:?:?:?:?:?:?:?:ms??? ???????:????????????????L?????????????????????? ???????:???????????:??????????????&???????????????????????????????????? ???????:???????????:??????????????&???????????????????????????????????? ???:??????????d????:??? ???????:???????????:??????????????&???????????????????????? ???|?????????????
Reg  HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\c44619c95772 (not active ControlSet)                                             
Reg  HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\c44619c95772@0021fe496935                                                        0x12 0xC3 0xD9 0x11 ...
Reg  HKLM\SYSTEM\ControlSet002\services\LanmanServer\Linkage@Bind                                                                                ?????????????????9???????e???e??????????????????$???4????? ??????? ??????????????? ????????????????????????????????????????? ??????????? ????????????? ?????????????????$???4????? ??????? ??????????????? ????????????????????????????????????????? ??????????? ????????????? ??????????????$???e???????????????????????????$???e??????????????????????????*6to4mp?????????$???4????? ??????? ??????????????? ????????????????????????????????????????? ??????????? ???????????????????????????????$???4????? ??????? ??????????????? ????????????????????????????????????????? ??????????? ????????????????????????????$???e???????????????????????????$???e??????????????????????????tunnel???r??????$???4????? ??????? ??????????????? ????????????????????????????????????????? ??????????? ????????????? ?????????????????$???4????? ??????? ??????????????? ????????????????????????????????????????? ??????????? ????????????????????????????$???e???????????????????????????$???e??????????????????????????kbdhid??????????$???4????? ??????? ????????
Reg  HKLM\SYSTEM\ControlSet002\services\LanmanServer\Linkage@Route                                                                               ????????????????????t??????????????g????Net??????????????i?j?m?n?r?l?n??System32\Drivers\ksecdd.sys??????????????????????????????????????Z???e???????:??????????RPCSS??,?-????????????5??????o????????????????b??o?????????e?????????h???????:??*6to4mp?????? ???????o?????o?????n?????????????? ??????????????o????? ???????o???????????o????????4??????????????????????????????u????????????????????d?????? ?????????????????????????????????????????? ????????????????n?o?o?o?o?o?o?o??????8??s????????h????????????????????????s????? ???????????????????????????!???!??? ???????o???????????o??????????????????????????????????????????? ???????n?????o?????n??????????T????????????o??@%SystemRoot%\system32\drivers\fltmgr.sys,-10000??????<??o????????h???????N??????_????Dl????Net?????oem7.inf?????????|???????????????Z???n???n??Net?????????????6-21-2006????????o??????????RPCSS??,?-??? ???????o?????o?????o?????????????? ??????????????????????????????o????? ???????o???????????o???????????????????????????????????????????o?????o????? ?????
Reg  HKLM\SYSTEM\ControlSet002\services\LanmanServer\Linkage@Export                                                                              ? ???????????u???????u??????????{00000000-0000-0000-FFFF-FFFFFFFFFFFF}??????{00000000-0000-0000-FFFF-FFFFFFFFFFFF}???????????????D???2????V????????g?????????????????????????????????c???2?????????????g?????i???????????B??*6to4mp??????????m??????????Network??????????????-???2???????f??????????? Z??????????????????????????????????h????>????????g?????????????8?????s85????P??s?????????e????????????304?????CompositeBus?????h???????????????????g?h?h?h???????????? ????l?????sm????????g??????????{4d36e966-e325-11ce-bfc1-08002be10318}???????????z?z?z??{4d36e97d-e325-11ce-bfc1-08002be10318}???????????h???8??????DETECTEDInternal\blbdrive?DETECTED\blbdrive??????????d?????????r?????????????l?????sRe???????????-?????s1c???????h???2??s0??Net?ic???????????????????e???????n??avkmgr?t?i??tunnel?n?{???????????z??1???HIDClass????11??????{4d36e97d-e325-11ce-bfc1-08002be10318}?vr.????X?????????????HIDClass????LegacyDriver?E?????????????4?????????? ?????????????????? R??j??????????s????????????????????????????????????????h??????s\?
Reg  HKLM\SYSTEM\ControlSet002\services\LanmanWorkstation\Linkage@Bind                                                                           ????????FSFilter Bottom?????? ???????n???????? ????,?????? ?X?7??????X??????????????????????????????<???????????????????????????@%systemroot%\system32\browser.dll,-103?????@%SystemRoot%\system32\clfs.sys,-101????Net???????8??o?????????e?????????g???????????????n???:???:??????????????????11????????????????b??n?????????e??????>??n?????????e?????????n??????p????????t??? ???i???.?????.42???????g???t??sr??????27???????????????>??????t???System32\Drivers\mup.sys?????????????????????n??????????????????h????????????????????????????????????????????????????????????&x??n??????????????????????????????h???????,????????????????????????????????????????????????????&x??n??????????????????????????????h???????.??????????????????????????????????????????????????????????????g?????????????????h???????????????????????????????????????????????????????????????????????????????????????????????????????&???n??????????????????????????cdrom.inf_amd64_neutral_8363d00ecae4322d??????????????&??????????????e???&???n?????????????????????????????
Reg  HKLM\SYSTEM\ControlSet002\services\LanmanWorkstation\Linkage@Route                                                                          ?????????????????????????????????Z???e???????:??????????RPCSS??,?-????????????5??????o????????????????b??o?????????e?????????h???????:??*6to4mp?????? ???????o?????o?????n?????????????? ??????????????o????? ???????o???????????o????????4??????????????????????????????u????????????????????d?????? ?????????????????????????????????????????? ????????????????n?o?o?o?o?o?o?o??????8??s????????h????????????????????????s????? ???????????????????????????!???!??? ???????o???????????o??????????????????????????????????????????? ???????n?????o?????n??????????T????????????o??@%SystemRoot%\system32\drivers\fltmgr.sys,-10000??????<??o????????h???????N??????_????Dl????Net?????oem7.inf?????????|???????????????Z???n???n??Net?????????????6-21-2006????????o??????????RPCSS??,?-??? ???????o?????o?????o?????????????? ??????????????????????????????o????? ???????o???????????o???????????????????????????????????????????o?????o????? ???????o?????o????????????????????????????? ???????o???????????o????????0????????M???????????????????????????
Reg  HKLM\SYSTEM\ControlSet002\services\LanmanWorkstation\Linkage@Export                                                                         ? ??? ?????????????????g?????????f?f?f??ROOT\BLBDRIVE????/????????????????????????>????????g????? ??????????????????????????usbehci??-??{00000000-0000-0000-ffff-ffffffffffff}?00&????N???????????D???????@??????????h???h??int???????????????????????????N??g??????????????{00000000-0000-0000-ffff-ffffffffffff}???????????:??????s????????h?????????????n????amdkmdag??????X??t?????????e????????????gr???h?h?????????g ??V????????rEV_??? ???f???0??????????????????n?????Q?????????R?????????S?????????T?????????U?????????V?????????W?????????X?????????Y?????????Z?????????[?????????\?????????]?????????^?????????_?????????`?????????a?????????b?????????c?????????d?????????e?????????f?????????g?????????h?????????i?????????j?????????k?????????l?????????m?????????n?????????o?????????p?????????q?????????r?????????s?????????t?????????u?????????v?????????w?????????x?????????y?????????z?????????{?????????|?????????}?????????~??????????????????????????????????????????????????????????????????????????????????????????????????????????????
Reg  HKLM\SYSTEM\ControlSet002\services\NetBIOS\Linkage@Bind                                                                                     ???f?s???????t??????????????????????????h?????r??k?????g????? 0??j??????????????????????????ir???????????????????{???????????????????k?k??????>??k???1?gCA???????????@????????????N????????????D????1.3M WebCam?_A????6??j????????h?????????????????re???????????????????????d???&??s0??? `??j???????????????????j??????????????6&294876e0&0?6??*6to4mp??n??????????????????????t?????????'??f????j????????g????System32\DRIVERS\netbt.sys??????????Video????????h???????e???????????????????e???????????????????j??????????? l??????????????????????g???????e????j????????g??????X??????3?g?3???????????2?????s2}??2}???????|??????????????{00000000-0000-0000-FFFF-FFFFFFFFFFFF}???????e?f?f?g?h?h?j?j?j?j?j????N??j?????????D????STORAGE\VolumeSnapshot??0???DiskDrive???tunnel???\???????????????f????????????s??????????????B??????08??USBSTOR??????????????{?|?{???{???????????????h??????????7&33793b7b&0?????????????????e???????????????????|???????|????X??????????????  ??j??????????$???Net???????????????????????P??u?????????n???????????????????
Reg  HKLM\SYSTEM\ControlSet002\services\NetBIOS\Linkage@Route                                                                                    ????e????????t??Net??????????s????????????(?????????????????????????t1????????????????????????????X??????f????????????????,??s????????????????????X??????n????????X??????n???????????????????|?|?|?|?|??ReadyBoost?????????????????????s????? 0??|????????????????z?????????????????ua??????????\SystemRoot\system32\drivers\luafv.sys???????o?r?t?s?t?t?s??? ???????s????????????????????:?B??? ????????????? ??e??????p????????????????????????d??,???????????????????????????????????????????????t???????????????g??????{?????s???????????????o?r?s?s?t???s???????????????????????????????????????????????????????????s???????2??@%SystemRoot%\system32\drivers\mountmgr.sys,-101????@%systemroot%\system32\wkssvc.dll,-1002???????b??u?????????n????????????????t???????????????????machine.inf_amd64_neutral_9e6bb86c3b39a3e9????????6??s????????h??????????????????????????h??tunnel??????????????????????????????int???????????&??f??????????*6to4mp?????????????NETFXPerf.dll???Microsoft????????:??Mixer????????s?????????????g????@%systemroot%\syste
Reg  HKLM\SYSTEM\ControlSet002\services\NetBIOS\Linkage@Export                                                                                   ??????????"????????????????e????????s???????????? ??????????????t???????????????????????????@system32\DRIVERS\pci.sys,#65536;PCI bus %1, device %2, function %3;(0,27,0)?f????N??????l????D??????????????????????g???????e???????????????????????a??????????????? ?????????????????????,??????$???????????????s6&C???????????I?????????&CC??? ?????????????????????,?????????????????f??? ?????????????????????0??L????????? ???????????????????????????????? ?????????????????????0????????????&????????????????????7??? ?????????????????????0????????????????????? ?????????????????????0????????~????????????????????U??De????~??????????8??acpi.inf:Microsoft.NTamd64:WMIMAP_Inst:6.1.7600.16385:*pnp0c14??????????????????????? ?????????????????????0?????????????????????????8??????? ?????????????????????0?????????????????????????????-???8???????????8??????????????????????????????????????????? ?????????????????????0????????????????????????????????????????? ?????????????????????0?????????????????????????????????????????????8??? ?????????
Reg  HKLM\SYSTEM\ControlSet002\services\NetBT\Linkage@Bind                                                                                       ???h????????????????????? ??????????????????tunnel?)?????g?h???j????sf??? ???[??????????????????????????????????{8ECC055D-047F-11D1-A537-0000F8753ED1}?7CB??????????WUDFRd?wor???????k???????{???h???h????????????????N??h???\????Dist???h?h?h?h?????h??Net??y??????????????????????? 0??h???3?????3}\????P??o?????????e????????????Net??????????????????|??*6to4mp??????????????????h???D??sE???????0???????????d?f?h?h?h?h?f???????h???-???????.???????h?????????????? ??????????s6e???????????????????????????????1?????sED???p?p????HIDClass????Bluetooth???MEDIA????h??? ???????h?????h???????,?? ?????????(???????????????????????? ???????h?????h???????,??"???&?????????????????PCI\VEN_1969&DEV_1073&SUBSYS_03591025&REV_C0?PCI\VEN_1969&DEV_1073&SUBSYS_03591025?PCI\VEN_1969&DEV_1073&CC_020000?PCI\VEN_1969&DEV_1073&CC_0200????? ???????3??????s0??????????????????????mrxsmb??????HidUsb???????????????w?????sto??LegacyDriver?n??os??????????? ???f???e???????????????????????????????????f???????e????N??t?????????e????????????tunnel?????????
Reg  HKLM\SYSTEM\ControlSet002\services\NetBT\Linkage@Route                                                                                      ??????????$????????????e?????????????V??e0??????????????????6-21-2006???????????????????????????? ??????????????s??????????????????????????????????e????? ???????????????????n?0????????????????????? ???????????????????h?0??????????????????????:?????????????????????????????V2.0|Action=Block|Dir=Out|App=%SystemRoot%\system32\svchost.exe|Svc=WcsPlugInService|Name=@mscms.dll,-161|?&?&?????????????????????????r????????????? ?????????????n???????0??L????????? ??????{?{???????????????????????n???n??????? ???????????????C????<????????????n????Microsoft .NET Framework NGEN???????????????????????????6.1.7600.16385?ss_??????????????????????????????????????????????????*6to4mp?????? P??????3??????24????????N?????????????????LegacyDriver?????????????????????????????????????????????????B???B????????????????????????????????????????????X??????n???t??????#????????????B????`??????\???????\???????????????????????m????N????????????D????????????????????tunnel???e??????????usb.inf??&??????????*6to4mp?????STORAGE#VOLUME#_??_USBSTOR#
Reg  HKLM\SYSTEM\ControlSet002\services\NetBT\Linkage@Export                                                                                     ????71??11?????????????????????????e????MTP???????N??????d??????????????? ???????????????????j????????&????????????????????0????????????????????v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=6|Profile=Public|LPort=5357|RA4=LocalSubnet|RA6=LocalSubnet|App=System|Name=@FirewallAPI.dll,-32817|Desc=@FirewallAPI.dll,-32818|EmbedCtxt=@FirewallAPI.dll,-32752|????????????????????????????????6?????????????16????N?????????????????????????|R???????????????????B???????????????????4?g?y????$??????h???????l???????e???f???e??{4d36e972-e325-11ce-bfc1-08002be10318}??????? ???j???????????????????????????????????d???????u????? ?3???h??8&1e4ae00b&0?6????*??????u?????????n?v??? l??????D???????????????????v?????s??????N??????6???????????????????????????2????????????????????????????X??????n??????tunnel?????????????????????????????s?P??? 0??????f?????e?e???????????f???h??? ???????????????????????????????????????????????????6??????0-???????????????_?????????e????????????????????????P??????????????????????????????????????????????????
Reg  HKLM\SYSTEM\ControlSet002\services\Smb\Linkage@Bind                                                                                         ???k?????????k??????????????? ???????j???????????i?,??????????]? ???????E???? ???????k???????????k?0?????????????????????k?k6e?????k????? ???????n?????l???????,??"?????????????????????????? ???????k?????k?? ????,??"???&???????????????0?????USB\VID_0402&PID_9665&REV_0009&MI_00?USB\VID_0402&PID_9665&MI_00??????N???????????D??????????k???????n??????????????t????~?~0???????s???? ???????j?????k?????k?,??????????^? ????????????????j???-???????.??? ???????k???????????i?,????????P??????????????????????????????r????? ?????????k?&??? ???????k???????????i?,????????N???????????? ???????k???????????k?0?????????????????????????k???????????k?kdl?????k????? ???????k?????k???????0????????????????????? ???????k???????????k?0?????????????????????k?k????.NTAMD64????? ???????j?????k?????k?,??????????a? ???????D0??? j?????????????????? ???????k???????????i?,????????\????????????????j??????????????????G????r?????????k?&????N??l????????D????????????????g????????????????????????system32\DRIVERS\ACPI.sys????N???k???k??{36fc9e60-c465-
Reg  HKLM\SYSTEM\ControlSet002\services\Smb\Linkage@Route                                                                                        ???l?????????u??Net?????? ???i???????????????i?i?????????????h?i?i?i?i?l?i???????j??????p?????????????N???????????D?????LegacyDriver?E?????l??????N??????e????D_Tc???f?h?i?h?????h????4??y????????h?????Net?0????????????s??USBSTOR?? ??LegacyDriver????C0??WPD??????i?j?i?i?l?l?j??????????????t????????{?????????n??????????????????????????N??????n????D 96??Net?? ??? ???????l???????????l?3?????????????????????????l???0???0???l?l?????l?l???????k?&???????????????????????l??????????6.1.7600.16385????????????????????????(??l???o?? (??WAN Miniport (SSTP)??3???l?l?l??????? ???????k???????????l?,??????????????????????s?????? ??????????????x???? ???????k?????????????,?????????????????f??? ???????k?????l???????0??L????????? ??????????????l???l???l????????? ???????l?????l???????0????????????&???????????????????????? ???????l?????l???????0????????????????????????????? ???????l???????????k?0?????????????????????????l???????1?????l????? ???????l?????l???????0???????????????????????l???l????? ???????l???????????l?0???????????????
Reg  HKLM\SYSTEM\ControlSet002\services\Smb\Linkage@Export                                                                                       ???l??????N??????e????D_Tc???f?h?i?h?????h????4??y????????h?????Net?0????????????s??USBSTOR?? ??LegacyDriver????C0??WPD??????i?j?i?i?l?l?j??????????????t????????{?????????n??????????????????????????N??????n????D 96??Net?? ??? ???????l???????????l?3?????????????????????????l???0???0???l?l?????l?l???????k?&???????????????????????l??????????6.1.7600.16385????????????????????????(??l???o?? (??WAN Miniport (SSTP)??3???l?l?l??????? ???????k???????????l?,??????????????????????s?????? ??????????????x???? ???????k?????????????,?????????????????f??? ???????k?????l???????0??L????????? ??????????????l???l???l????????? ???????l?????l???????0????????????&???????????????????????? ???????l?????l???????0????????????????????????????? ???????l???????????k?0?????????????????????????l???????1?????l????? ???????l?????l???????0???????????????????????l???l????? ???????l???????????l?0?????????????????????????????????????????l???????????l?l???????l????? ???????l?????l???????0????????????&??????????????????????????l???l????? ???????l?
Reg  HKLM\SYSTEM\ControlSet002\services\TCPIP6\Linkage@Bind                                                                                      ???:?t??????e????????t??Net??????????s????????????(?????????????????????????t1????????????????????????????X??????f????????????????,??s????????????????????X??????n????????X??????n???????????????????|?|?|?|?|??ReadyBoost?????????????????????s????? 0??|????????????????z?????????????????ua??????????\SystemRoot\system32\drivers\luafv.sys???????o?r?t?s?t?t?s??? ???????s????????????????????:?B??? ????????????? ??e??????p????????????????????????d??,???????????????????????????????????????????????t???????????????g??????{?????s???????????????o?r?s?s?t???s???????????????????????????????????????????????????????????s???????2??@%SystemRoot%\system32\drivers\mountmgr.sys,-101????@%systemroot%\system32\wkssvc.dll,-1002???????b??u?????????n????????????????t???????????????????machine.inf_amd64_neutral_9e6bb86c3b39a3e9????????6??s????????h??????????????????????????h??tunnel??????????????????????????????int???????????&??f??????????*6to4mp?????????????NETFXPerf.dll???Microsoft????????:??Mixer????????s?????????????g????@%systemroo
Reg  HKLM\SYSTEM\ControlSet002\services\TCPIP6\Linkage@Route                                                                                     ???h?t????N??i???-????D11c???????z????????????????????N??g?????????D??????N??h????????D??????????<???c??sf???????f???????e???? ??d?????????e????????????????????EN???????[???n??????2 ???????b??????????? ???h???????????????????f???????????j?j6.??NdisWan?????????????????????{4d36e97d-e325-11ce-bfc1-08002be10318}\0030?????????????????0??????????????n????? ???????f?????f???????,?????????????????3??? ???????f?????f???????,??"?????|?????0?????? (??f???-?????11D???????????????????????????????f?????????????????????f0????????Z???v??s???? ??????????????????? `??????M?????_SP??? ???h???????????????????????r???????????????????????????????????d???*???e???????????????????????y??????????? ???i???*??????s??????f???f?????????`???1??s1??? ???j??? ??????s???????????????????????COMPOSITE_BATTERY??y) ??????s???????????NdisTapi????????es??te??Microsoft???? ???????f???????????f?,??????$???????????????s??????????????????f????????????????H??f ????????????.????H???????????????????????????????????????? ???????f???????????f?,??????$????
Reg  HKLM\SYSTEM\ControlSet002\services\TCPIP6\Linkage@Export                                                                                    ???t?????????????????????????????t??????????Net??????????????????t???????4??Net?r????t??????????????Extended base???Net?18??system32\drivers\modem.sys??????*6to4mp?????? ???????n?????t???????,????????b????????r??system32\DRIVERS\ndisuio.sys????@%SystemRoot%\system32\drivers\nsiproxy.sys,-2?????????????????????e?????????t??????????6-21-2006???????t????t???????????}?}?}??????????????????? ???????t?????????????,???????????? ??????????????t????? ???????n??????????????????????V???????????\SystemRoot\system32\DRIVERS\msahci.sys?????system32\drivers\MSPCLOCK.sys????? ??e??????p??????????????g????Summe??????t??????:??t????????h??????????????????????????????t?????????t?????????t??BTAUDIO?????tunnel?48E????6??t?????????e?????????;?????????????w?????????????????????????d??????????????????????ve??????*pnp09ff????? ???????n?????t????????????????V?????????????<??t????????h????????????????????s?????;??????????????????????t???@%SystemRoot%\system32\drivers\ndis.sys,-201???????????????g?????????u???9?????????????????????????

das OSAM-log:

Code:

ATTFilter

Report of OSAM: Autorun Manager v5.0.11926.0
hxxp://www.online-solutions.ru/en/
Saved at 19:22:10 on 11.07.2012

OS: Windows 7 Home Premium Edition (Build 7600), 64-bit
Default Browser: Microsoft Corporation Internet Explorer 9.00.8112.16421

Scanner Settings
[x] Rootkits detection (hidden registry)
[x] Rootkits detection (hidden files)
[x] Retrieve files information
[x] Check Microsoft signatures

Filters
[ ] Trusted entries
[ ] Empty entries
[x] Hidden registry entries (rootkit activity)
[x] Exclusively opened files
[x] Not found files
[x] Files without detailed information
[x] Existing files
[ ] Non-startable services
[ ] Non-startable drivers
[x] Active entries
[x] Disabled entries


[Common]
-----( %SystemRoot%\Tasks )-----
"GoogleUpdateTaskMachineCore.job" - "Google Inc." - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
"GoogleUpdateTaskMachineUA.job" - "Google Inc." - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

[Control Panel Objects]
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )-----
"mlcfg32.cpl" - "Microsoft Corporation" - C:\PROGRA~2\MICROS~2\Office14\MLCFG32.CPL

[Drivers]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"avgntflt" (avgntflt) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avgntflt.sys
"avipbb" (avipbb) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avipbb.sys
"avkmgr" (avkmgr) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avkmgr.sys
"catchme" (catchme) - ? - C:\ComboFix\catchme.sys  (File not found)
"NTIDrvr" (NTIDrvr) - "NTI Corporation" - C:\Windows\system32\drivers\NTIDrvr.sys
"UBHelper" (UBHelper) - "NTI Corporation" - C:\Windows\system32\drivers\UBHelper.sys

[Explorer]
-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----
{F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll
-----( HKLM\Software\Classes\Protocols\Filter )-----
{807573E5-5146-11D5-A672-00B0D022E945} "Microsoft Office InfoPath XML Mime Filter" - "Microsoft Corporation" - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
-----( HKLM\Software\Classes\Protocols\Handler )-----
{314111c7-a502-11d2-bbca-00c04f8ec294} "HxProtocol Class" - "Microsoft Corporation" - C:\Program Files (x86)\Common Files\Microsoft Shared\Help\hxds.dll
{FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} "IEProtocolHandler Class" - "Skype Technologies" - C:\Program Files (x86)\Acer\Acer VCM\Skype4COM.dll
{828030A1-22C1-4009-854F-8E305202313F} "livecall" - "Microsoft Corporation" - C:\PROGRA~2\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL
{828030A1-22C1-4009-854F-8E305202313F} "msnim" - "Microsoft Corporation" - C:\PROGRA~2\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL
{03C514A3-1EFB-4856-9F99-10D7BE1653C0} "Windows Live Mail HTML Asynchronous Pluggable Protocol Handler" - "Microsoft Corporation" - C:\Program Files (x86)\Windows Live\Mail\mailcomm.dll
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks )-----
{B5A7F190-DDA6-4420-B3BA-52453494E6CD} "Groove GFS Stub Execution Hook" - "Microsoft Corporation" - C:\PROGRA~2\MICROS~2\Office14\GROOVEEX.DLL
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----
{23170F69-40C1-278A-1000-000100020000} "7-Zip Shell Extension" - "Igor Pavlov" - C:\Program Files (x86)\7-Zip\7-zip.dll
{3D60EDA7-9AB4-4DA8-864C-D9B5F2E7281D} "Arbeitsbereiche" - "Microsoft Corporation" - C:\PROGRA~2\MICROS~2\Office14\GROOVEEX.DLL
{5E2121EE-0300-11D4-8D3B-444553540000} "Catalyst Context Menu extension" - ? -   (File not found | COM-object registry key not found)
{D66DC78C-4F61-447F-942B-3FB6980118CF} "CInfoTipShellExt Class" - "Microsoft Corporation" - C:\Program Files (x86)\Microsoft Office\Office14\VISSHE.DLL
{0563DB41-F538-4B37-A92D-4659049B7766} "CLSID_WLMCMimeFilter" - "Microsoft Corporation" - C:\Program Files (x86)\Windows Live\Mail\mailcomm.dll
{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA} "DragDropProtect Class" - "Egis Technology Inc." - C:\Program Files (x86)\EgisTec MyWinLocker\x86\psdprotect.dll
{99FD978C-D287-4F50-827F-B2C658EDA8E7} "Groove Explorer Icon Overlay 1 (GFS Unread Stub)" - "Microsoft Corporation" - C:\PROGRA~2\MICROS~2\Office14\GROOVEEX.DLL
{AB5C5600-7E6E-4B06-9197-9ECEF74D31CC} "Groove Explorer Icon Overlay 2 (GFS Stub)" - "Microsoft Corporation" - C:\PROGRA~2\MICROS~2\Office14\GROOVEEX.DLL
{920E6DB1-9907-4370-B3A0-BAFC03D81399} "Groove Explorer Icon Overlay 2.5 (GFS Unread Folder)" - "Microsoft Corporation" - C:\PROGRA~2\MICROS~2\Office14\GROOVEEX.DLL
{16F3DD56-1AF5-4347-846D-7C10C4192619} "Groove Explorer Icon Overlay 3 (GFS Folder)" - "Microsoft Corporation" - C:\PROGRA~2\MICROS~2\Office14\GROOVEEX.DLL
{2916C86E-86A6-43FE-8112-43ABE6BF8DCC} "Groove Explorer Icon Overlay 4 (GFS Unread Mark)" - "Microsoft Corporation" - C:\PROGRA~2\MICROS~2\Office14\GROOVEEX.DLL
{2A541AE1-5BF6-4665-A8A3-CFA9672E4291} "Groove Folder Synchronization" - "Microsoft Corporation" - C:\PROGRA~2\MICROS~2\Office14\GROOVEEX.DLL
{72853161-30C5-4D22-B7F9-0BBC1D38A37E} "Groove GFS Browser Helper" - "Microsoft Corporation" - C:\PROGRA~2\MICROS~2\Office14\GROOVEEX.DLL
{6C467336-8281-4E60-8204-430CED96822D} "Groove GFS Context Menu Handler" - "Microsoft Corporation" - C:\PROGRA~2\MICROS~2\Office14\GROOVEEX.DLL
{B5A7F190-DDA6-4420-B3BA-52453494E6CD} "Groove GFS Stub Execution Hook" - "Microsoft Corporation" - C:\PROGRA~2\MICROS~2\Office14\GROOVEEX.DLL
{A449600E-1DC6-4232-B948-9BD794D62056} "Groove GFS Stub Icon Handler" - "Microsoft Corporation" - C:\PROGRA~2\MICROS~2\Office14\GROOVEEX.DLL
{387E725D-DC16-4D76-B310-2C93ED4752A0} "Groove XML Icon Handler" - "Microsoft Corporation" - C:\PROGRA~2\MICROS~2\Office14\GROOVEEX.DLL
{506F4668-F13E-4AA1-BB04-B43203AB3CC0} "ImageExtractorShellExt Class" - "Microsoft Corporation" - C:\Program Files (x86)\Microsoft Office\Office14\VISSHE.DLL
{42042206-2D85-11D3-8CFF-005004838597} "Microsoft Office HTML Icon Handler" - "Microsoft Corporation" - C:\Program Files (x86)\Microsoft Office\Office14\msohevi.dll
{993BE281-6695-4BA5-8A2A-7AACBFAAB69E} "Microsoft Office Metadata Handler" - "Microsoft Corporation" - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\msoshext.dll
{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97} "Microsoft Office Thumbnail Handler" - "Microsoft Corporation" - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\msoshext.dll
{0875DCB6-C686-4243-9432-ADCCF0B9F2D7} "Microsoft OneNote Namespace Extension for Windows Desktop Search" - "Microsoft Corporation" - C:\Program Files (x86)\Microsoft Office\Office14\ONFILTER.DLL
{00020D75-0000-0000-C000-000000000046} "Microsoft Outlook" - "Microsoft Corporation" - C:\PROGRA~2\MICROS~2\Office14\MLSHEXT.DLL
{0006F045-0000-0000-C000-000000000046} "Outlook File Icon Extension" - "Microsoft Corporation" - C:\Program Files (x86)\Microsoft Office\Office14\OLKFSTUB.DLL
{2BE99FD4-A181-4996-BFA9-58C5FFD11F6C} "Windows Live Photo Gallery Autoplay Drop Target" - "Microsoft Corporation" - C:\Program Files (x86)\Windows Live\Photo Gallery\WLXPhotoGallery.exe
{00F30F64-AC33-42F5-8FD1-5DC2D3FDE06C} "Windows Live Photo Gallery Editor Drop Target" - "Microsoft Corporation" - C:\Program Files (x86)\Windows Live\Photo Gallery\WLXPhotoGallery.exe
{00F3712A-CA79-45B4-9E4D-D7891E7F8B9D} "Windows Live Photo Gallery Editor Shim" - "Microsoft Corporation" - C:\Program Files (x86)\Windows Live\Photo Gallery\PhotoViewerShim.dll
{00F30F90-3E96-453B-AFCD-D71989ECC2C7} "Windows Live Photo Gallery Viewer Autoplay Shim" - "Microsoft Corporation" - C:\Program Files (x86)\Windows Live\Photo Gallery\PhotoViewerShim.dll
{00F33137-EE26-412F-8D71-F84E4C2C6625} "Windows Live Photo Gallery Viewer Autoplay Shim" - "Microsoft Corporation" - C:\Program Files (x86)\Windows Live\Photo Gallery\PhotoViewerShim.dll
{00F374B7-B390-4884-B372-2FC349F2172B} "Windows Live Photo Gallery Viewer Drop Target" - "Microsoft Corporation" - C:\Program Files (x86)\Windows Live\Photo Gallery\WLXPhotoGallery.exe
{00F346CB-35A4-465B-8B8F-65A29DBAB1F6} "Windows Live Photo Gallery Viewer Shim" - "Microsoft Corporation" - C:\Program Files (x86)\Windows Live\Photo Gallery\PhotoViewerShim.dll
{06A2568A-CED6-4187-BB20-400B8C02BE5A} "{06A2568A-CED6-4187-BB20-400B8C02BE5A}" - "Microsoft Corporation" - C:\Program Files (x86)\Windows Live\Photo Gallery\WLXPhotoAcquireWizard.exe

[Internet Explorer]
-----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )-----
<binary data> "Google Toolbar" - "Google Inc." - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
ITBar7Height "ITBar7Height" - ? -   (File not found | COM-object registry key not found)
<binary data> "ITBar7Layout" - ? -   (File not found | COM-object registry key not found)
<binary data> "ITBar7Layout64" - ? -   (File not found | COM-object registry key not found)
<binary data> "{D4027C7F-154A-4066-A1AD-4243D8127440}" - ? -   (File not found | COM-object registry key not found)
-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----
{D27CDB6E-AE6D-11CF-96B8-444553540000} "Shockwave Flash Object" - "Adobe Systems, Inc." - C:\Windows\SysWOW64\Macromed\Flash\Flash32_11_3_300_257.ocx / hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
{E2883E8F-472F-4FB0-9522-AC9BF37916A7} "{E2883E8F-472F-4FB0-9522-AC9BF37916A7}" - ? -   (File not found | COM-object registry key not found) / hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----
{48E73304-E1D6-4330-914C-F5F514E3486C} "An OneNote senden" - "Microsoft Corporation" - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll
{53707962-6F74-2D53-2644-206D7942484F} "ClsidExtension" - "Safer Networking Limited" - C:\PROGRA~2\SPYBOT~1\SDHelper.dll
"ICQ7.5" - "ICQ, LLC." - C:\Program Files (x86)\ICQ7.5\ICQ.exe
{5F7B1267-94A9-47F5-98DB-E99415F33AEC} "In Blog veröffentlichen" - "Microsoft Corporation" - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
{FFFDC614-B694-4AE6-AB38-5D6374584B52} "Verknüpfte &OneNote-Notizen" - "Microsoft Corporation" - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar )-----
<binary data> "Google Toolbar" - "Google Inc." - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
Locked "Locked" - ? -   (File not found | COM-object registry key not found)
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----
{18DF081C-E8AD-4283-A596-FA578C2EBDC3} "Adobe PDF Link Helper" - "Adobe Systems Incorporated" - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
{AA58ED58-01DD-4d91-8333-CF10577473F7} "Google Toolbar Helper" - "Google Inc." - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
{72853161-30C5-4D22-B7F9-0BBC1D38A37E} "Groove GFS Browser Helper" - "Microsoft Corporation" - C:\PROGRA~2\MICROS~2\Office14\GROOVEEX.DLL
{DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Oracle Corporation" - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dll
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} "Java(tm) Plug-In SSV Helper" - "Oracle Corporation" - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\ssv.dll
{B4F3A835-0E21-4959-BA22-42B3008E02FF} "Office Document Cache Handler" - "Microsoft Corporation" - C:\PROGRA~2\MICROS~2\Office14\URLREDIR.DLL
{53707962-6F74-2D53-2644-206D7942484F} "Spybot-S&D IE Protection" - "Safer Networking Limited" - C:\PROGRA~2\SPYBOT~1\SDHelper.dll
{9030D464-4C02-4ABF-8ECC-5164760863C6} "Windows Live ID Sign-in Helper" - "Microsoft Corporation" - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
{5C255C8A-E604-49b4-9D64-90988571CECB} "{5C255C8A-E604-49b4-9D64-90988571CECB}" - ? -   (File not found | COM-object registry key not found)

[LSA Providers]
-----( HKLM\SYSTEM\CurrentControlSet\Control\Lsa )-----
"Notification packages" - "Broadcom Corporation." - C:\Program Files\WIDCOMM\Bluetooth Software\BtwProximityCP.dll
"Security Packages" - "Microsoft Corporation" - C:\Windows\system32\livessp.dll

[Logon]
-----( %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup )-----
"OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk" - "Microsoft Corporation" - C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE  (Shortcut exists | File exists)
"desktop.ini" - ? - C:\Users\Lukas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
-----( %AllUsersProfile%\Microsoft\Windows\Start Menu\Programs\Startup )-----
"Acer VCM.lnk" - "Acer Incorporated" - C:\Program Files (x86)\Acer\Acer VCM\AcerVCM.exe  (Shortcut exists | File exists)
"desktop.ini" - ? - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
"Bluetooth.lnk" - ? - C:\Program Files (x86)\WIDCOMM\Bluetooth Software\BTTray.exe  (Shortcut exists | File not found)
-----( HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run )-----
"OfficeSyncProcess" - "Microsoft Corporation" - "C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE"
"SpybotSD TeaTimer" - "Safer-Networking Ltd." - C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe
"swg" - "Google Inc." - "C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
-----( HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\Wds\rdpwd )-----
"StartupPrograms" - ? - rdpclip  (File not found)
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----
"Adobe ARM" - "Adobe Systems Incorporated" - "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
"ArcadeMovieService" - "CyberLink Corp." - "C:\Program Files (x86)\Acer Arcade Deluxe\Arcade Movie\ArcadeMovieService.exe"
"avgnt" - "Avira Operations GmbH & Co. KG" - "C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min
"BackupManagerTray" - "NewTech Infosystems, Inc." - "C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe" -h -k
"BCSSync" - "Microsoft Corporation" - "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe" /DelayServices
"EgisTecPMMUpdate" - "Egis Technology Inc." - "C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe"
"EgisUpdate" - "Egis Technology Inc." - "C:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe" -d
"IAStorIcon" - "Intel Corporation" - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
"LManager" - "Dritek System Inc." - C:\Program Files (x86)\Launch Manager\LManager.exe
"MDS_Menu" - "CyberLink Corp." - "C:\Program Files (x86)\Acer Arcade Deluxe\MediaShow Espresso\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\Acer Arcade Deluxe\MediaShow Espresso" UpdateWithCreateOnce "Software\CyberLink\MediaShow Espresso\5.6"
"StartCCC" - "Advanced Micro Devices, Inc." - "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
"SuiteTray" - "Egis Technology Inc." - "C:\Program Files (x86)\EgisTec MyWinLockerSuite\x86\SuiteTray.exe"
"SunJavaUpdateSched" - "Sun Microsystems, Inc." - "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"

[Services]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"@%ProgramFiles%\Windows Defender\MsMpRes.dll,-103" (WinDefend) - ? - C:\Program Files (x86)\Windows Defender\mpsvc.dll  (File not found)
"@%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101" (WMPNetworkSvc) - ? - "C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe"  (File not found)
"Acer ePower Service" (ePowerSvc) - "Acer Incorporated" - C:\Program Files\Acer\Acer PowerSmart Manager\ePowerSvc.exe
"Acer ODD Power Service" (ODDPwrSvc) - "Acer Incorporated" - C:\Program Files\Acer\Optical Drive Power Management\ODDPWRSvc.exe
"Adobe Acrobat Update Service" (AdobeARMservice) - "Adobe Systems Incorporated" - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
"ASP.NET-Zustandsdienst" (aspnet_state) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
"Avira Echtzeit Scanner" (AntiVirService) - "Avira Operations GmbH & Co. KG" - C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
"Avira Planer" (AntiVirSchedulerService) - "Avira Operations GmbH & Co. KG" - C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
"Bluetooth Service" (btwdins) - "Broadcom Corporation." - C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
"Business Contact Manager SQL Server Startup Service" (BcmSqlStartupSvc) - "Microsoft Corporation" - C:\Program Files (x86)\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe
"Cyberlink RichVideo Service(CRVS)" (RichVideo) - ? - C:\Program Files (x86)\Cyberlink\Shared files\RichVideo.exe
"Dritek WMI Service" (DsiWMIService) - "Dritek System Inc." - C:\Program Files (x86)\Launch Manager\dsiwmis.exe
"Google Software Updater" (gusvc) - "Google" - C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe
"Google Update Service (gupdate)" (gupdate) - "Google Inc." - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
"Google Update-Dienst (gupdatem)" (gupdatem) - "Google Inc." - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
"GREGService" (GREGService) - "Acer Incorporated" - C:\Program Files (x86)\Acer\Registration\GREGsvc.exe
"Intel(R) Management & Security Application User Notification Service" (UNS) - "Intel Corporation" - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
"Intel(R) Management and Security Application Local Management Service" (LMS) - "Intel Corporation" - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
"Intel(R) Rapid Storage Technology" (IAStorDataMgrSvc) - "Intel Corporation" - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
"Microsoft .NET Framework NGEN v4.0.30319_X64" (clr_optimization_v4.0.30319_64) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
"Microsoft .NET Framework NGEN v4.0.30319_X86" (clr_optimization_v4.0.30319_32) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
"Microsoft SharePoint Workspace Audit Service" (Microsoft SharePoint Workspace Audit Service) - "Microsoft Corporation" - C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE
"Mozilla Maintenance Service" (MozillaMaintenance) - "Mozilla Foundation" - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"MyWinLocker Service" (MWLService) - "Egis Technology Inc." - C:\Program Files (x86)\EgisTec MyWinLocker\x86\MWLService.exe
"NTI Backup Now 5 Backup Service" (NTIBackupSvc) - "NewTech InfoSystems, Inc." - C:\Program Files (x86)\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe
"NTI Backup Now 5 Scheduler Service" (NTISchedulerSvc) - "NTI, Inc." - C:\Program Files (x86)\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe
"NTI IScheduleSvc" (NTI IScheduleSvc) - "NewTech Infosystems, Inc." - C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe
"Office  Source Engine" (ose) - "Microsoft Corporation" - C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"Office Software Protection Platform" (osppsvc) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
"Raw Socket Service" (RS_Service) - "Acer Incorporated" - C:\Program Files (x86)\Acer\Acer VCM\RS_Service.exe
"SBSD Security Center Service" (SBSDWSCService) - "Safer Networking Ltd." - C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe
"SQL Server (MSSMLBIZ)" (MSSQL$MSSMLBIZ) - "Microsoft Corporation" - C:\Program Files (x86)\Microsoft SQL Server\MSSQL10.MSSMLBIZ\MSSQL\Binn\sqlservr.exe
"SQL Server VSS Writer" (SQLWriter) - "Microsoft Corporation" - C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
"Steam Client Service" (Steam Client Service) - "Valve Corporation" - C:\Program Files (x86)\Common Files\Steam\SteamService.exe
"Updater Service" (Updater Service) - "Acer Group" - C:\Program Files\Acer\Acer Updater\UpdaterService.exe
"Windows Live ID Sign-in Assistant" (wlidsvc) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

[Winsock Providers]
-----( HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries )-----
"WindowsLive Local NSP" - "Microsoft Corporation" - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL
"WindowsLive NSP" - "Microsoft Corporation" - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL

===[ Logfile end ]=========================================[ Logfile end ]===

If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru

die aswmbr-txt:

Code:

ATTFilter

aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software
Run date: 2012-07-11 19:26:00
-----------------------------
19:26:00.194    OS Version: Windows x64 6.1.7600 
19:26:00.194    Number of processors: 4 586 0x2505
19:26:00.194    ComputerName: 4820TG-PC  UserName: Lukas
19:26:00.494    Initialize success
19:26:03.907    AVAST engine defs: 12071101
19:26:11.910    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1
19:26:11.913    Disk 0 Vendor: INTEL_SS 2CV1 Size: 152627MB BusType: 3
19:26:11.921    Disk 0 MBR read successfully
19:26:11.925    Disk 0 MBR scan
19:26:11.932    Disk 0 Windows 7 default MBR code
19:26:11.940    Disk 0 Partition 1 00     27 Hidden NTFS WinRE NTFS        13312 MB offset 2048
19:26:11.949    Disk 0 Partition 2 80 (A) 07    HPFS/NTFS NTFS          100 MB offset 27265024
19:26:11.958    Disk 0 Partition 3 00     07    HPFS/NTFS NTFS       139213 MB offset 27469824
19:26:11.978    Disk 0 scanning C:\Windows\system32\drivers
19:26:17.438    Service scanning
19:26:30.106    Modules scanning
19:26:30.111    Disk 0 trace - called modules:
19:26:30.118    ntoskrnl.exe CLASSPNP.SYS disk.sys iaStor.sys hal.dll 
19:26:30.446    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa8004463060]
19:26:30.455    3 CLASSPNP.SYS[fffff88001aab43f] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-1[0xfffffa8004229050]
19:26:30.462    Scan finished successfully
19:27:34.523    Disk 0 MBR has been saved successfully to "C:\Users\Lukas\Downloads\MBR.dat"
19:27:34.526    The log file has been saved successfully to "C:\Users\Lukas\Downloads\aswMBR.txt"

cosinus · 12.07.2012, 09:58

Sieht ok aus. Wir sollten fast durch sein. Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SUPERAntiSpyware und poste die Logs.
Denk dran beide Tools zu updaten vor dem Scan!!

12.07.2012, 09:58	#20
cosinus /// Winkelfunktion /// TB-Süch-Tiger™	GVU-Trojaner eingefangen Sieht ok aus. Wir sollten fast durch sein. Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SUPERAntiSpyware und poste die Logs. Denk dran beide Tools zu updaten vor dem Scan!! __________________ Logfiles bitte immer in CODE-Tags posten

GVU-Trojaner eingefangen

Plagegeister aller Art und deren Bekämpfung: GVU-Trojaner eingefangen