Kaspersky Gefunden: trojanisches Programm Exploit.Win32.IMG-WMF.bvv

ronscha

Hallo,

wie ihr alle seht ich bin neu hier und habe folgendes Problem.
Ich warn schonmal vor... eigentlich habe ich kaum ne Ahnung von dem ganzen Pc-Kram...

Seit ein paar Wochen passiert es immer wieder dass mein PC quasi einfriert. Es reagiert nichts mehr, Firefox und sonstige Programme wie qip und so stehen auf "(Keine Rückmeldung)", Strg+Alt+Entf bringt nichts auch stundenlanges warten oder Alt+F4 oder so hilft nix... Drücke dann immer den Aus-Knopf...

Heute hat mir Kaspersky endlich mal was gezeigt und zwar dass er "trojanisches Programm Exploit.Win32.IMG-WMF.bvv" gefunden und gelöscht hat (3x Gefunden in:
1. C:\Documents and Settings\***\Downloads\Curl-Router-Reconnect-version-0.2.9.rar\Curl-Router-Reconnect-version-0.2.9.rar/progs.cab/

2. C:\Documents and Settings\***\Downloads\Curl-Router-Reconnect-version-0.2.9.rar\progs.cab/

3. C:\Documents and Settings\***\Downloads\Curl-Router-Reconnect-version-0.2.9.rar\router\)

die Datei hab ich aber schon länger also denke ich dass das Problem damit vielleicht zusammenhängt..

Google hilft mir nicht... findet das Ding nicht...und Boardsuche ebenso nicht...

NACHDEM Kaspersky gesagt hat is gelöscht und so hab ich C:\Documents and Settings\***\Downloads\Curl-Router-Reconnect-version-0.2.9.rar\progs.cab/ mal bei h**p://w*w.virustotal.com hochgeladen und siehe da...
Hier mal der Bericht:

Datei progs.cab empfangen 2010.02.21 18:28:16 (UTC)
Status: Beendet
Ergebnis: 16/41 (39.02%)
Filter Filter
Drucken der Ergebnisse Drucken der Ergebnisse
Antivirus Version letzte aktualisierung Ergebnis
a-squared 4.5.0.50 2010.02.21 -
AhnLab-V3 5.0.0.2 2010.02.20 -
AntiVir 8.2.1.170 2010.02.19 -
Antiy-AVL 2.0.3.7 2010.02.19 -
Authentium 5.2.0.5 2010.02.20 -
Avast 4.8.1351.0 2010.02.21 -
AVG 9.0.0.730 2010.02.21 -
BitDefender 7.2 2010.02.21 Trojan.Generic.1216011
CAT-QuickHeal 10.00 2010.02.19 -
ClamAV 0.96.0.0-git 2010.02.21 -
Comodo 4014 2010.02.21 UnclassifiedMalware
DrWeb 5.0.1.12222 2010.02.21 -
eSafe 7.0.17.0 2010.02.21 Win32.Banker
eTrust-Vet 35.2.7315 2010.02.20 -
F-Prot 4.5.1.85 2010.02.20 -
F-Secure 9.0.15370.0 2010.02.19 Trojan.Generic.1216011
Fortinet 4.0.14.0 2010.02.21 -
GData 19 2010.02.21 Trojan.Generic.1216011
Ikarus T3.1.1.80.0 2010.02.21 -
Jiangmin 13.0.900 2010.02.21 Worm/Kido.ru
K7AntiVirus 7.10.979 2010.02.20 -
Kaspersky 7.0.0.125 2010.02.17 -
McAfee 5899 2010.02.21 Generic Downloader.x
McAfee+Artemis 5899 2010.02.21 Generic Downloader.x
McAfee-GW-Edition 6.8.5 2010.02.19 Heuristic.BehavesLike.Win32.ModifiedUPX.B!88
Microsoft 1.5406 2010.02.21 TrojanDownloader:Win32/Troxen!rts
NOD32 4884 2010.02.21 -
Norman 6.04.08 2010.02.21 Startpage.MJK
nProtect 2009.1.8.0 2010.02.21 -
Panda 10.0.2.2 2010.02.21 Trj/Agent.LJK
PCTools 7.0.3.5 2010.02.21 Downloader.Generic
Prevx 3.0 2010.02.21 -
Rising 22.34.01.03 2010.02.11 -
Sophos 4.50.0 2010.02.21 Sus/DelpDldr-A
Sunbelt 5690 2010.02.20 -
Symantec 20091.2.0.41 2010.02.21 Downloader
TheHacker 6.5.1.5.202 2010.02.21 -
TrendMicro 9.120.0.1004 2010.02.21 PAK_Generic.001
VBA32 3.12.12.2 2010.02.21 -
ViRobot 2010.2.19.2194 2010.02.19 -
VirusBuster 5.0.27.0 2010.02.21 -
weitere Informationen
File size: 219712 bytes
MD5 : 63c693ac31fbdda520e753f84be479c4
SHA1 : 27d2c23bb808dc2072958054ed5af687d9603c9a
SHA256: 7c372cf70f6683ba6000f357157d611b1939e2fcc129e8819fbdaabdbbffd8a4
TrID : File type identification
Microsoft Cabinet Archive (99.9%)
Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%)
ssdeep: 6144:xRN33BF23YbJvw9p6cLEcvo3+EnxiP4XJ:xRV3a38yEMoRHJ
sigcheck: publisher....: n/a
copyright....: n/a
product......: n/a
description..: n/a
original name: n/a
internal name: n/a
file version.: n/a
comments.....: n/a
signers......: -
signing date.: -
verified.....: Unsigned
PEiD : -
packers (Kaspersky): UPX, UPX, UPX, UPX
packers (F-Prot): UPX_LZMA
RDS : NSRL Reference Data Set
-

Habe dann dieses Forum gefunden und mir die Anleitung für Hilfesuchende zu Herzen genommen und

CCleaner durchlaufen lassen bis keine Fehler mehr zu sehen waren.

Dann Malwarebytes:

Malwarebytes' Anti-Malware 1.44
Datenbank Version: 3772
Windows 6.0.6002 Service Pack 2
Internet Explorer 8.0.6001.18865

21.02.2010 21:25:05
mbam-log-2010-02-21 (21-25-05).txt

Scan-Methode: Vollständiger Scan (C:\|D:\|G:\|H:\|I:\|J:\|K:\|L:\|)
Durchsuchte Objekte: 300474
Laufzeit: 1 hour(s), 25 minute(s), 23 second(s)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 1

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
C:\Program Files\setup.exe (Rogue.Installer) -> Quarantined and deleted successfully.


Zu guter letzt dann RSIT:

Logfile of random's system information tool 1.06 (written by random/random)
Run by *** at 2010-02-21 21:34:25
Microsoft® Windows Vista™ Home Premium Service Pack 2
System drive C: has 602 GB (85%) free of 705 GB
Total RAM: 3071 MB (56% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:34:51, on 21.02.2010
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v8.00 (8.00.6001.18865)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\hp\support\hpsysdrv.exe
C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe
C:\Windows\RtHDVCpl.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Program Files\Adobe\Reader 9.0\Reader\reader_sl.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\QIP Infium\infium.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\McAfee Security Scan\1.0.150\SSScheduler.exe
C:\Windows\System32\rundll32.exe
C:\Windows\System32\mobsync.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\klwtblfs.exe
C:\Windows\system32\SearchFilterHost.exe
C:\hp\kbd\kbd.exe
C:\Users\***\Downloads\RSIT.exe
C:\Program Files\trend micro\***.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=de_de&c=81&bd=Pavilion&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=de_de&c=81&bd=Pavilion&pf=desktop
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - (no file)
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - (no file)
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [hpsysdrv] c:\hp\support\hpsysdrv.exe
O4 - HKLM\..\Run: [OsdMaestro] "C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe"
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [IAAnotif] "C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KbdStub.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [Infium] "C:\Program Files\QIP Infium\infium.exe" /isolated /autorun /autorun
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETZWERKDIENST')
O4 - Global Startup: McAfee Security Scan.lnk = ?
O8 - Extra context menu item: Hinzufügen zu Anti-Banner - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\ie_banner_deny.htm
O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe
O9 - Extra button: &Virtuelle Tastatur - {4248FE82-7FCB-46AC-B270-339F08212110} - (no file)
O9 - Extra button: Li&nks untersuchen - {CCF151D8-D089-449F-A5A4-D9909053F20F} - (no file)
O13 - Gopher Prefix:
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O18 - Protocol: fluxhttp - {8E2D00A0-82C6-4821-90BC-07F290841BB6} - C:\Program Files\Common Files\fluxDVD\Lib\XEB\xebnavigation.ax
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~2\mzvkbd3.dll,C:\PROGRA~1\KASPER~1\KASPER~2\kloehk.dll
O23 - Service: Kaspersky Internet Security (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe
O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files\HP Games\My HP Game Console\GameConsoleService.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe

--
End of file - 6470 bytes

======Scheduled tasks folder======

C:\Windows\tasks\User_Feed_Synchronization-{68939236-9FB1-447A-9AEE-73689298917F}.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-02-27 75128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{602ADB0E-4AFF-4217-8AA1-95DAC4DFA408}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-10-11 41760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA}

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"=C:\Program Files\Windows Defender\MSASCui.exe [2008-01-19 1008184]
"hpsysdrv"=c:\hp\support\hpsysdrv.exe [2007-04-18 65536]
"OsdMaestro"=C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe [2007-02-15 118784]
"RtHDVCpl"=C:\Windows\RtHDVCpl.exe [2008-01-15 4874240]
""= []
"HP Software Update"=C:\Program Files\HP\HP Software Update\HPWuSchd2.exe [2007-05-08 54840]
"IAAnotif"=C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe [2008-06-02 178712]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2009-10-03 35696]
"KBD"=C:\HP\KBD\KbdStub.EXE [2006-12-08 65536]
"SunJavaUpdateSched"=C:\Program Files\Java\jre6\bin\jusched.exe [2009-10-11 149280]
"AVP"=C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe [2009-10-20 340456]
"Adobe ARM"=C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2009-09-04 935288]
"NvSvc"=C:\Windows\system32\nvsvc.dll [2008-01-10 92704]
"NvCplDaemon"=C:\Windows\system32\NvCpl.dll [2008-01-10 8530464]
"NvMediaCenter"=C:\Windows\system32\NvMcTray.dll [2008-01-10 88608]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"=C:\Program Files\Windows Sidebar\sidebar.exe [2009-04-11 1233920]
"ehTray.exe"=C:\Windows\ehome\ehTray.exe [2008-01-19 125952]
"Infium"=C:\Program Files\QIP Infium\infium.exe [2009-09-22 5661184]
"WMPNSCFG"=C:\Program Files\Windows Media Player\WMPNSCFG.exe [2008-01-19 202240]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
McAfee Security Scan.lnk - C:\Program Files\McAfee Security Scan\1.0.150\SSScheduler.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLS"="C:\PROGRA~1\KASPER~1\KASPER~2\mzvkbd3.dll,C:\PROGRA~1\KASPER~1\KASPER~2\kloehk.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\klogon]
C:\Windows\system32\klogon.dll [2009-10-20 219664]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfPf]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfRd]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfUsbccidDriver]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"EnableUIADesktopToggle"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"BindDirectlyToPropertySetStorage"=
"NoDriveTypeAutoRun"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

======File associations======

.js - edit - C:\Windows\System32\Notepad.exe %1
.js - open - C:\Windows\System32\WScript.exe "%1" %*

======List of files/folders created in the last 1 months======

2010-02-21 21:26:29 ----D---- C:\rsit
2010-02-21 21:26:29 ----D---- C:\Program Files\trend micro
2010-02-21 19:47:42 ----D---- C:\Users\***\AppData\Roaming\Malwarebytes
2010-02-21 19:47:36 ----D---- C:\ProgramData\Malwarebytes
2010-02-21 19:47:36 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2010-02-21 19:38:01 ----D---- C:\Program Files\CCleaner
2010-02-15 20:11:48 ----D---- C:\Windows\CheckSur
2010-02-10 20:14:11 ----A---- C:\Windows\system32\ntoskrnl.exe
2010-02-10 20:14:11 ----A---- C:\Windows\system32\ntkrnlpa.exe
2010-02-10 20:14:01 ----A---- C:\Windows\system32\tsbyuv.dll
2010-02-10 20:14:01 ----A---- C:\Windows\system32\quartz.dll
2010-02-10 20:14:01 ----A---- C:\Windows\system32\msvidc32.dll
2010-02-10 20:14:00 ----A---- C:\Windows\system32\msyuv.dll
2010-02-10 20:14:00 ----A---- C:\Windows\system32\msvfw32.dll
2010-02-10 20:14:00 ----A---- C:\Windows\system32\msrle32.dll
2010-02-10 20:14:00 ----A---- C:\Windows\system32\mciavi32.dll
2010-02-10 20:14:00 ----A---- C:\Windows\system32\iyuv_32.dll
2010-02-10 20:14:00 ----A---- C:\Windows\system32\avifil32.dll
2010-02-04 16:46:33 ----D---- C:\9f10e685ea3465b824b815582e2d4863
2010-01-29 21:25:08 ----D---- C:\f6787f2cdd2b2dbf84636f903f2cb9
2010-01-27 19:42:26 ----D---- C:\Users\***\AppData\Roaming\jeak.de

======List of files/folders modified in the last 1 months======

2010-02-21 21:34:22 ----D---- C:\Windows\Temp
2010-02-21 21:33:54 ----D---- C:\Windows\Prefetch
2010-02-21 21:33:24 ----D---- C:\ProgramData\Kaspersky Lab
2010-02-21 21:30:39 ----D---- C:\Windows
2010-02-21 21:30:18 ----SHD---- C:\Windows\Installer
2010-02-21 21:30:18 ----D---- C:\Windows\system32\drivers
2010-02-21 21:26:29 ----RD---- C:\Program Files
2010-02-21 19:49:11 ----D---- C:\Windows\System32
2010-02-21 19:49:11 ----D---- C:\Windows\inf
2010-02-21 19:49:11 ----A---- C:\Windows\system32\PerfStringBackup.INI
2010-02-21 19:47:36 ----HD---- C:\ProgramData
2010-02-21 19:41:02 ----D---- C:\Windows\Minidump
2010-02-21 19:41:02 ----D---- C:\Windows\Debug
2010-02-21 19:15:49 ----D---- C:\Program Files\Mozilla Firefox
2010-02-21 17:16:39 ----SHD---- C:\System Volume Information
2010-02-14 17:17:13 ----D---- C:\Windows\winsxs
2010-02-14 17:03:37 ----D---- C:\Windows\system32\catroot
2010-02-14 17:03:31 ----D---- C:\Program Files\Windows Mail
2010-02-13 13:37:23 ----D---- C:\Windows\system32\catroot2
2010-02-02 20:48:41 ----SHD---- C:\Config.Msi
2010-02-02 20:48:41 ----RSD---- C:\Windows\assembly
2010-02-02 20:40:41 ----D---- C:\Program Files\Common Files\fluxDVD
2010-02-02 20:40:38 ----SD---- C:\Windows\Downloaded Program Files
2010-02-02 20:23:33 ----D---- C:\ProgramData\CITYGUIDE
2010-02-01 20:13:46 ----D---- C:\Windows\Logs
2010-01-27 19:14:43 ----D---- C:\Program Files\Internet Explorer
2010-01-22 20:59:55 ----D---- C:\ProgramData\mpDRM

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 kl1;kl1; C:\Windows\system32\DRIVERS\kl1.sys [2009-09-01 128016]
R1 KLIF;Kaspersky Lab Driver; C:\Windows\system32\DRIVERS\klif.sys [2009-11-11 311312]
R1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter; C:\Windows\system32\DRIVERS\klim6.sys [2009-11-03 21520]
R3 HCW85BDA;Hauppauge WinTV 885 Video Capture; C:\Windows\system32\drivers\HCW85BDA.sys [2007-10-01 1129344]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHDA.sys [2008-01-15 2047576]
R3 klmouflt;Kaspersky Lab KLMOUFLT; C:\Windows\system32\DRIVERS\klmouflt.sys [2009-10-02 19472]
R3 MSPQM;Microsoft Proxy für Streaming Quality Manager; C:\Windows\system32\drivers\MSPQM.sys [2008-01-19 5504]
R3 netr73;USB Wireless 802.11 b/g Adaptor Driver for Vista; C:\Windows\system32\DRIVERS\netr73.sys [2008-02-26 493568]
R3 nvlddmkm;nvlddmkm; C:\Windows\system32\DRIVERS\nvlddmkm.sys [2008-01-10 8237120]
R3 RTL8169;Realtek 8169 NT Driver; C:\Windows\system32\DRIVERS\Rtlh86.sys [2007-08-03 91648]
R3 WUDFRd;WUDFRd; C:\Windows\system32\DRIVERS\WUDFRd.sys [2008-01-19 83328]
S3 amp81zws;amp81zws; C:\Windows\system32\drivers\amp81zws.sys []
S3 drmkaud;Microsoft Kernel-DRM-Audioentschlüsselung; C:\Windows\system32\drivers\drmkaud.sys [2008-01-19 5632]
S3 HdAudAddService;Microsoft 1.1 UAA-Funktionstreiber für High Definition Audio-Dienst; C:\Windows\system32\drivers\HdAudio.sys [2006-11-02 235520]
S3 MSKSSRV;Microsoft Streaming Service Proxy; C:\Windows\system32\drivers\MSKSSRV.sys [2008-01-19 8192]
S3 MSPCLOCK;Microsoft Proxy für Streaming Clock; C:\Windows\system32\drivers\MSPCLOCK.sys [2008-01-19 5888]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink-Konvertierung; C:\Windows\system32\drivers\MSTEE.sys [2008-01-19 6016]
S3 SymIM;Symantec Network Security Intermediate Filter Service; C:\Windows\system32\DRIVERS\SymIM.sys []
S3 SymIMMP;SymIMMP; C:\Windows\system32\DRIVERS\SymIM.sys []
S3 usbaudio;USB-Audiotreiber (WDM); C:\Windows\system32\drivers\usbaudio.sys [2009-04-11 73216]
S3 usbvideo;USB-Videogerät (WDM); C:\Windows\System32\Drivers\usbvideo.sys [2008-01-19 134016]
S3 WpdUsb;WpdUsb; C:\Windows\system32\DRIVERS\wpdusb.sys [2009-10-01 40448]
S4 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\Windows\system32\drivers\wmiacpi.sys [2006-11-02 11264]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AVP;Kaspersky Internet Security; C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe [2009-10-20 340456]
R2 HP Health Check Service;HP Health Check Service; c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe [2007-09-19 65536]
R2 IAANTMON;Intel(R) Matrix Storage Event Monitor; C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe [2008-06-02 354840]
R2 LightScribeService;LightScribeService Direct Disc Labeling Service; C:\Program Files\Common Files\LightScribe\LSSrvc.exe [2009-03-17 73728]
S3 FontCache;@%systemroot%\system32\FntCache.dll,-100; C:\Windows\system32\svchost.exe [2008-01-19 21504]
S3 GameConsoleService;GameConsoleService; C:\Program Files\HP Games\My HP Game Console\GameConsoleService.exe [2007-07-24 181800]

-----------------EOF-----------------


Falls mir jemand helfen kann, wäre ich sehr dankbar... allein fürs lesen schon mal ein dickes

Gruß
ronscha