SweetPCFix auf dem Desktop

Cyberrider

Hallo zusammen,

nachdem mein Sylvester-Gast mich und das Gästezimmer verließ hatte ich von ihm noch ein nettes Geschenk auf den Desktop bekommen. Zwei Internet-Verlinkungen waren drauf, einmal SweetPCFix und eine Suchmaschine (Search the Web). Spybot gab mir sofort nach dem hochfahren die Meldung, dass es einen Vorgang gestoppt hat (ich glaube, Program Files (x86)\SweetIM\Messenger hieß er), ich habe reflexhaft "Datei löschen" gewählt.

Über SweetPCFix-google bin ich dann hier gelandet.

In der Hilfe stand ja drin, ich soll keine Anleitungen befolgen, die anderen Opfern schon gegeben wurden, also hab ich eigentlich noch nix gemacht, außer die Anleitung für die Hilfesuchenden zu befolgen.

MalwareBytes hat zwei Infizierungen gefungen, die aber nichts mit SweetIM zu tun haben, zweimal PUP.RiskwareTool.CK in .dll Dateien (hab die infizierten Objekte gelöscht).
Ich muss vielleicht dazu sagen, dass ich vorher schon mit deffoger disabled hab !

Nach MalwareByte hab ich den Rechner neu gestartet und hatte beim Herunterfahren einen Blue Screen mit Text, den ich aber nicht schnell genug lesen konnte, aber halt irgendwas mit Systemfehler, Systemdatei und so. Das Hochfahren klappte aber und ich hatte wieder die Spybot-Meldung SweetIM messenger gestoppt.

Dann OTL mit QuickScan laufen lassen. Leider gab's keine OTL.Extra.txt! Hier das OTL-Ergebniss (ich poste nur mal den Anfang, das ist ja ein ganzer Roman!):

OTL logfile created on: 05.01.2013 12:49:05 - Run 3
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\***\Desktop
64bit- Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

7,96 Gb Total Physical Memory | 6,13 Gb Available Physical Memory | 76,95% Memory free
15,93 Gb Paging File | 13,48 Gb Available in Paging File | 84,66% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 673,37 Gb Total Space | 598,53 Gb Free Space | 88,89% Space Free | Partition Type: NTFS

Computer Name: *** | User Name: *** | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Users\***\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe (Malwarebytes Corporation)
PRC - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe (NVIDIA Corporation)
PRC - C:\Program Files (x86)\SweetIM\Communicator\SweetPacksUpdateManager.exe (SweetIM Technologies Ltd.)
PRC - C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe (OpenOffice.org)
PRC - C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin (OpenOffice.org)
PRC - C:\Program Files (x86)\Lenovo\Lenovo BrgVolOSD\BrgVolOSD.exe (Quanta Computer Inc.)
PRC - C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe (Intel Corporation)
PRC - C:\Program Files (x86)\Lenovo\YouCam\YCMMirage.exe (CyberLink)
PRC - C:\Program Files (x86)\Lenovo\Rapidboot\FBService.exe (1206 Lab)
PRC - C:\Program Files (x86)\Lenovo\Rapidboot\FBConsole.exe (Lenovo)
PRC - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Intel Corporation)
PRC - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Intel Corporation)
PRC - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe ()
PRC - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe (Intel Corporation)
PRC - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe (Intel Corporation)
PRC - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Intel Corporation)
PRC - C:\Program Files (x86)\Lenovo\Lenovo Silver Silk Wireless Keyboard\skd8861.exe (Lenovo)
PRC - C:\Program Files (x86)\Cyberlink\Shared files\brs.exe (cyberlink)
PRC - C:\Program Files (x86)\Lenovo\PowerDVD10\PDVD10Serv.exe (CyberLink Corp.)
PRC - C:\Program Files (x86)\Lenovo\Power2Go\CLMLSvc.exe (CyberLink)
PRC - C:\Program Files (x86)\Lenovo\Lenovo EBook&QuickNotes\TMCMonitor.exe ()
PRC - C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
PRC - C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe (Safer Networking Ltd.)


========== Modules (No Company Name) ==========

MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Management\66694f9192bd0dddc2eaf90fbcbcd555\System.Management.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web\03cfab5534482e8fc313ead6edc19100\System.Web.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\413288993ff690e8251d2dbe32bee01f\System.Runtime.Remoting.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\b311b783e1efaa9527f4c2c9680c44d1\WindowsBase.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\IAStorCommon\e88f87e9200afb5ede994c89c92e22b8\IAStorCommon.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\IAStorUtil\4a443c775f768ede71bde8e10f50ec0b\IAStorUtil.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\d040079bc7148afeca03c5abb6fc3c61\System.Windows.Forms.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\4e80768a2d88c7a333e43cbb7a6c0705\System.Drawing.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\25e672ea505e50ab058258ac72a54f02\System.Xml.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\c64ca3678261c8ffcd9e7efd1af6ed54\System.Configuration.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System\9dd758ac0bf7358ac6e4720610fcc63c\System.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\187d7c66735c533de851c76384f86912\mscorlib.ni.dll ()
MOD - C:\Program Files (x86)\OpenOffice.org 3\program\libxml2.dll ()
MOD - C:\Program Files (x86)\OpenOffice.org 3\program\libxslt.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\System.Runtime.Remoting.resources\2.0.0.0_de_b77a5c561934e089\System.Runtime.Remoting.resources.dll ()
MOD - C:\Program Files (x86)\Lenovo\Lenovo BrgVolOSD\CD_DLL.dll ()
MOD - C:\Program Files (x86)\Lenovo\Rapidboot\FBServiceps.dll ()
MOD - C:\Program Files (x86)\Lenovo\Lenovo Silver Silk Wireless Keyboard\skfunc.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll ()
MOD - C:\Program Files (x86)\Lenovo\Power2Go\CLMLSvcPS.dll ()
MOD - C:\Program Files (x86)\Lenovo\Power2Go\CLMediaLibrary.dll ()
MOD - C:\Program Files (x86)\Lenovo\Lenovo EBook&QuickNotes\TMCMonitor.exe ()


========== Services (SafeList) ==========

SRV:64bit: - (mfevtp) -- C:\Windows\SysNative\mfevtps.exe (McAfee, Inc.)
SRV:64bit: - (mfefire) -- C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe ()
SRV:64bit: - (McShield) -- C:\Program Files\Common Files\McAfee\SystemCore\\mcshield.exe ()
SRV:64bit: - (McProxy) -- C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe (McAfee, Inc.)
SRV:64bit: - (McOobeSv) -- C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe (McAfee, Inc.)
SRV:64bit: - (McNASvc) -- C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe (McAfee, Inc.)
SRV:64bit: - (McNaiAnn) -- C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe (McAfee, Inc.)
SRV:64bit: - (mcmscsvc) -- C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe (McAfee, Inc.)
SRV:64bit: - (McMPFSvc) -- C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe (McAfee, Inc.)
SRV:64bit: - (McAfee SiteAdvisor Service) -- C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe (McAfee, Inc.)
SRV:64bit: - (AppMgmt) -- C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)
SRV - (MozillaMaintenance) -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (MBAMService) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
SRV - (MBAMScheduler) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe (Malwarebytes Corporation)
SRV - (AdobeFlashPlayerUpdateSvc) -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (McODS) -- C:\Programme\mcafee\virusscan\mcods.exe (McAfee, Inc.)
SRV - (nvUpdatusService) -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe (NVIDIA Corporation)
SRV - (SkypeUpdate) -- C:\Program Files (x86)\Skype\Updater\Updater.exe (Skype Technologies)
SRV - (FastbootService) -- C:\Program Files (x86)\Lenovo\Rapidboot\FBService.exe (1206 Lab)
SRV - (UNS) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Intel Corporation)
SRV - (LMS) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Intel Corporation)
SRV - (Intel(R) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe ()
SRV - (jhi_service) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe (Intel Corporation)
SRV - (btwdins) -- C:\Programme\Lenovo\Bluetooth Software\btwdins.exe (Broadcom Corporation.)
SRV - (Intel(R) -- C:\Programme\Intel\iCLS Client\HeciServer.exe (Intel(R) Corporation)
SRV - (IAStorDataMgrSvc) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe (Intel Corporation)
SRV - (CLKMSVC10_3A60B698) -- C:\Program Files (x86)\Lenovo\PowerDVD10\NavFilter\kmsvc.exe (CyberLink)
SRV - (McAWFwk) -- c:\Programme\mcafee\msc\McAWFwk.exe (McAfee, Inc.)
SRV - (wlcrasvc) -- C:\Programme\Windows Live\Mesh\wlcrasvc.exe (Microsoft Corporation)
SRV - (wlidsvc) -- C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Microsoft Corp.)
SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (SwitchBoard) -- C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)
SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)


========== Driver Services (SafeList) ==========

DRV:64bit: - (MBAMProtector) -- C:\Windows\SysNative\drivers\mbam.sys (Malwarebytes Corporation)
DRV:64bit: - (cfwids) -- C:\Windows\SysNative\drivers\cfwids.sys (McAfee, Inc.)
DRV:64bit: - (mfewfpk) -- C:\Windows\SysNative\drivers\mfewfpk.sys (McAfee, Inc.)
DRV:64bit: - (mferkdet) -- C:\Windows\SysNative\drivers\mferkdet.sys (McAfee, Inc.)
DRV:64bit: - (mfehidk) -- C:\Windows\SysNative\drivers\mfehidk.sys (McAfee, Inc.)
DRV:64bit: - (mfefirek) -- C:\Windows\SysNative\drivers\mfefirek.sys (McAfee, Inc.)
DRV:64bit: - (mfeavfk) -- C:\Windows\SysNative\drivers\mfeavfk.sys (McAfee, Inc.)
DRV:64bit: - (mfeapfk) -- C:\Windows\SysNative\drivers\mfeapfk.sys (McAfee, Inc.)
DRV:64bit: - (nvpciflt) -- C:\Windows\SysNative\drivers\nvpciflt.sys (NVIDIA Corporation)
DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (HipShieldK) -- C:\Windows\SysNative\drivers\HipShieldK.sys (McAfee, Inc.)
DRV:64bit: - (Fs_Rec) -- C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation)
DRV:64bit: - (iusb3xhc) -- C:\Windows\SysNative\drivers\iusb3xhc.sys (Intel Corporation)
DRV:64bit: - (iusb3hub) -- C:\Windows\SysNative\drivers\iusb3hub.sys (Intel Corporation)
DRV:64bit: - (iusb3hcs) -- C:\Windows\SysNative\drivers\iusb3hcs.sys (Intel Corporation)
DRV:64bit: - (clwvd) -- C:\Windows\SysNative\drivers\clwvd.sys (CyberLink Corporation)
DRV:64bit: - (RTL8192cu) -- C:\Windows\SysNative\drivers\rtwlanu.sys (Realtek Semiconductor Corporation )
DRV:64bit: - (btwampfl) -- C:\Windows\SysNative\drivers\btwampfl.sys (Broadcom Corporation.)
DRV:64bit: - (btwavdt) -- C:\Windows\SysNative\drivers\btwavdt.sys (Broadcom Corporation.)
DRV:64bit: - (btwaudio) -- C:\Windows\SysNative\drivers\btwaudio.sys (Broadcom Corporation.)
DRV:64bit: - (btwl2cap) -- C:\Windows\SysNative\drivers\btwl2cap.sys (Broadcom Corporation.)
DRV:64bit: - (btwrchid) -- C:\Windows\SysNative\drivers\btwrchid.sys (Broadcom Corporation.)
DRV:64bit: - (iaStor) -- C:\Windows\SysNative\drivers\iaStor.sys (Intel Corporation)
DRV:64bit: - (MEIx64) -- C:\Windows\SysNative\drivers\HECIx64.sys (Intel Corporation)
DRV:64bit: - (RSP2STOR) -- C:\Windows\SysNative\drivers\RtsP2Stor.sys (Realtek Semiconductor Corp.)
DRV:64bit: - (RTL8167) -- C:\Windows\SysNative\drivers\Rt64win7.sys (Realtek )
DRV:64bit: - (NVHDA) -- C:\Windows\SysNative\drivers\nvhda64v.sys (NVIDIA Corporation)
DRV:64bit: - (AVer7231_x64) -- C:\Windows\SysNative\drivers\AVer7231_x64.sys (AVerMedia TECHNOLOGIES, Inc.)
DRV:64bit: - (TsUsbFlt) -- C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (TsUsbGD) -- C:\Windows\SysNative\drivers\TsUsbGD.sys (Microsoft Corporation)
DRV:64bit: - (fssfltr) -- C:\Windows\SysNative\drivers\fssfltr.sys (Microsoft Corporation)
DRV:64bit: - (wsvd) -- C:\Windows\SysNative\drivers\wsvd.sys (CyberLink)
DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (TPM) -- C:\Windows\SysNative\drivers\tpm.sys (Microsoft Corporation)
DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)

Vorher hatte ich schon vollständige Scans laufen lassen. Da gab's zwar beide Reporte aber die sind ja noch länger!

GMER schließlich hat mir das hier angezeigt (Netzwerkverbindung/Internet getrennt)

GMER 2.0.18327 - hxxp://www.gmer.net
Rootkit scan 2013-01-05 13:12:42
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 WDC_WD75 rev.03.0 698,64GB
Running: 2ufd7027.exe; Driver: C:\Users\***~1\AppData\Local\Temp\uwlyaaob.sys


---- User code sections - GMER 2.0 ----

.text C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[4136] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 00000000754c1401 2 bytes [4C, 75]
.text C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[4136] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 00000000754c1419 2 bytes [4C, 75]
.text C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[4136] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 00000000754c1431 2 bytes [4C, 75]
.text ... * 9
.text C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[4136] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000754c14dd 2 bytes [4C, 75]
.text C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[4136] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000754c14f5 2 bytes [4C, 75]
.text C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[4136] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 00000000754c150d 2 bytes [4C, 75]
.text C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[4136] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 00000000754c1525 2 bytes [4C, 75]
.text C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[4136] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 00000000754c153d 2 bytes [4C, 75]
.text C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[4136] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 00000000754c1555 2 bytes [4C, 75]
.text C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[4136] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 00000000754c156d 2 bytes [4C, 75]
.text C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[4136] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 00000000754c1585 2 bytes [4C, 75]
.text C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[4136] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 00000000754c159d 2 bytes [4C, 75]
.text C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[4136] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000754c15b5 2 bytes [4C, 75]
.text C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[4136] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000754c15cd 2 bytes [4C, 75]
.text C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[4136] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000754c16b2 2 bytes [4C, 75]

---- Threads - GMER 2.0 ----

Thread C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [3472:1712] 00000000734ec59c
---- Processes - GMER 2.0 ----

Library ? (*** suspicious ***) @ C:\Program Files (x86)\Lenovo\Rapidboot\FBService.exe [1228] 0000000075790000
Library ? (*** suspicious ***) @ C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [2060] 0000000076910000
Library ? (*** suspicious ***) @ C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [2088] 0000000075280000
Library ? (*** suspicious ***) @ C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [2160] 00000000732e0000
Library ? (*** suspicious ***) @ C:\Windows\SysWOW64\rundll32.exe [2836] 0000000071d20000
Library ? (*** suspicious ***) @ C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [3760] 000000006a740000
Library ? (*** suspicious ***) @ C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe [4276] 0000000076910000
Library ? (*** suspicious ***) @ C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe [6024] 0000000071a10000
Library ? (*** suspicious ***) @ C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [3472] 000000006beb0000

---- Registry - GMER 2.0 ----

Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\642737828c99
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\642737828c99 (not active ControlSet)

---- EOF - GMER 2.0 ----

Dabei waren Festplatte C: (gibt nur die) angehakt, aber Show all und IAT/EAT waren ohne Haken.

Hab dann auch nochmal den gleichen Scan mit GMER laufen lassen, aber zusätzlich noch McAffe und Spybot aus, WinDefender konnte ich nicht abschalten. Kam nur das raus:

GMER 2.0.18327 - hxxp://www.gmer.net
Rootkit scan 2013-01-05 13:52:49
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 WDC_WD75 rev.03.0 698,64GB
Running: 2ufd7027.exe; Driver: C:\Users\SVENUN~1\AppData\Local\Temp\uwlyaaob.sys


---- Registry - GMER 2.0 ----

Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\642737828c99
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\642737828c99 (not active ControlSet)

---- EOF - GMER 2.0 ----

Was meint Ihr? Was soll ich machen? Einfach die komplette Datei SweetIM in Program Files (x86) löschen? Spybot meldet jedenfalls nach jedem neuen Hochfahren, dass er den selben Vorgang stoppt. Und warum findet eigentlich SpybotSD "SweetIM" aber nicht MalwareBytes???

Hoffe, jemand von Euch kann mir sagen, dass das alles halb so schlimm ist. Oder, dass ich einfah nur den Rechner plattmachen sollte (er ist noch ziemlich neu und es gibt nicht viel zu verlieren).

Und, darf ich wieder die Treiber mit dem defogger enablen?

Also, Danke schon mal im Voraus
Sven