Diese Link funktioniert aber => http://www2.online-solutions.ru/en/d...e.php?p=131115

hat geklappt, hier der Rest:

OSAM Logfile:

Report of OSAM: Autorun Manager v5.0.11926.0
hxxp://www.online-solutions.ru/en/
Saved at 13:36:04 on 02.03.2011

OS: Windows 7 Home Premium Edition (Build 7600), 32-bit
Default Browser: Mozilla Corporation Firefox 3.6.13

Scanner Settings
[x] Rootkits detection (hidden registry)
[x] Rootkits detection (hidden files)
[x] Retrieve files information
[x] Check Microsoft signatures

Filters
[ ] Trusted entries
[ ] Empty entries
[x] Hidden registry entries (rootkit activity)
[x] Exclusively opened files
[x] Not found files
[x] Files without detailed information
[x] Existing files
[ ] Non-startable services
[ ] Non-startable drivers
[x] Active entries
[x] Disabled entries


[AppInit DLLs]
-----( HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows )-----
"AppInit_DLLs" - "Google" - C:\PROGRA~1\Google\GOOGLE~4\GoogleDesktopNetwork3.dll

[Common]
-----( %SystemRoot%\Tasks )-----
"GoogleUpdateTaskMachineCore.job" - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe
"GoogleUpdateTaskMachineUA.job" - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe
"Google Software Updater.job" - "Google" - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

[Control Panel Objects]
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )-----
"mlcfg32.cpl" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\Office12\MLCFG32.CPL
"QuickTime" - "Apple Inc." - C:\Program Files\QuickTime\QTSystem\QuickTime.cpl

[Drivers]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"avgntflt" (avgntflt) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avgntflt.sys
"avipbb" (avipbb) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avipbb.sys
"AVM Eject" (avmeject) - "AVM Berlin" - C:\Windows\System32\drivers\avmeject.sys
"catchme" (catchme) - ? - C:\Users\***\AppData\Local\Temp\catchme.sys  (File not found)
"Initio Driver for USB Default Controller" (ivusb) - "Initio Corporation" - C:\Windows\System32\DRIVERS\ivusb.sys
"int15" (int15) - ? - C:\Windows\system32\drivers\int15.sys  (File found, but it contains no detailed information)
"ssmdrv" (ssmdrv) - "Avira GmbH" - C:\Windows\System32\DRIVERS\ssmdrv.sys
"Symantec Eraser Control driver" (eeCtrl) - "Symantec Corporation" - C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys
"Upper Class Filter Driver" (NTIDrvr) - "NewTech Infosystems, Inc." - C:\Windows\System32\DRIVERS\NTIDrvr.sys
"{95808DC4-FA4A-4c74-92FE-5B863F82066B}" ({95808DC4-FA4A-4c74-92FE-5B863F82066B}) - "Cyberlink Corp." - C:\Program Files\CyberLink\PowerDVD\000.fcl

[Explorer]
-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----
{F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll
-----( HKLM\Software\Classes\Protocols\Filter )-----
{807563E5-5146-11D5-A672-00B0D022E945} "Microsoft Office InfoPath XML Mime Filter" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
-----( HKLM\Software\Classes\Protocols\Handler )-----
{314111c7-a502-11d2-bbca-00c04f8ec294} "HxProtocol Class" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks )-----
{AEB6717E-7E19-11d0-97EE-00C04FD91972} "{AEB6717E-7E19-11d0-97EE-00C04FD91972}" - ? -   (File not found | COM-object registry key not found)
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----
{911051fa-c21c-4246-b470-070cd8df6dc4} ".cab or .zip files" - ? -   (File not found | COM-object registry key not found)
{79BC0345-1015-11D2-A299-006008312725} "///FAST project settings" - ? - C:\Program Files\Pinnacle\VideoSpin\Programs\BlueShellExt.dll  (File not found)
{23170F69-40C1-278A-1000-000100020000} "7-Zip Shell Extension" - "Igor Pavlov" - C:\Program Files\7-Zip\7-zip.dll
{1b24a030-9b20-49bc-97ac-1be4426f9e59} "ActiveDirectory Folder" - ? -   (File not found | COM-object registry key not found)
{34449847-FD14-4fc8-A75A-7432F5181EFB} "ActiveDirectory Folder" - ? -   (File not found | COM-object registry key not found)
{0F8604A5-4ECE-4DE1-BA7D-CF10F8AA4F48} "Contacts folder" - ? -   (File not found | COM-object registry key not found)
{2C2577C2-63A7-40e3-9B7F-586602617ECB} "Explorer Query Band" - ? -   (File not found | COM-object registry key not found)
{42042206-2D85-11D3-8CFF-005004838597} "Microsoft Office HTML Icon Handler" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\msohevi.dll
{993BE281-6695-4BA5-8A2A-7AACBFAAB69E} "Microsoft Office Metadata Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll
{5858A72C-C2B4-4dd7-B2BF-B76DB1BD9F6C} "Microsoft Office OneNote Namespace Extension for Windows Desktop Search" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\Office12\ONFILTER.DLL
{00020d75-0000-0000-c000-000000000046} "Microsoft Office Outlook" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\Office12\MLSHEXT.DLL
{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97} "Microsoft Office Thumbnail Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll
{0006F045-0000-0000-C000-000000000046} "Outlook File Icon Extension" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\Office12\OLKFSTUB.DLL
{CF822AB4-6DB5-4FDA-BC28-E61DF36D2583} "PDF-XChange PDF Preview Provider" - ? -   (File not found | COM-object registry key not found)
{67EB453C-1BE1-48EC-AAF3-23B10277FCC1} "PDF-XChange PDF Property Handler" - ? -   (File not found | COM-object registry key not found)
{EBD0B8F4-A9A0-41B7-9695-030CD264D9C8} "PDF-XChange PDF Thumbnail Provider" - ? -   (File not found | COM-object registry key not found)
{C8494E42-ACDD-4739-B0FB-217361E4894F} "Sam Account Folder" - ? -   (File not found | COM-object registry key not found)
{E29F9716-5C08-4FCD-955A-119FDB5A522D} "Sam Account Folder" - ? -   (File not found | COM-object registry key not found)
{45AC2688-0253-4ED8-97DE-B5370FA7D48A} "Shell Extension for Malware scanning" - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\shlext.dll
{da67b8ad-e81b-4c70-9b91b417b5e33527} "Windows Search Shell Service" - ? -   (File not found | COM-object registry key not found)
{B41DB860-8EE4-11D2-9906-E49FADC173CA} "WinRAR" - ? - C:\Program Files\WinRAR\rarext.dll  (File found, but it contains no detailed information)
XCShInfo "{B2F55D43-C7A4-4B7C-90D7-7A860DFA9F2A}" - ? -   (File not found | COM-object registry key not found)

[Internet Explorer]
-----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )-----
ITBar7Height "ITBar7Height" - ? -   (File not found | COM-object registry key not found)
<binary data> "ITBar7Layout" - ? -   (File not found | COM-object registry key not found)
<binary data> "{472734EA-242A-422B-ADF8-83D1E48CC825}" - ? -   (File not found | COM-object registry key not found)
-----( HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks )-----
{EF99BD32-C1FB-11D2-892F-0090271D4F88} "Yahoo! Toolbar mit Pop-Up-Blocker" - ? -   (File not found | COM-object registry key not found)
-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----
{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} "Java Plug-in 1.6.0_05" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab
{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} "Java Plug-in 1.6.0_07" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
{8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.6.0_20" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} "Java Plug-in 1.6.0_20" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_20" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\npjpi160_20.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
{CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} "{CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7}" - ? -   (File not found | COM-object registry key not found) / hxxp://wwwimages.adobe.com/www.adobe.com/products/acrobat/nos/gp.cab
{E2883E8F-472F-4FB0-9522-AC9BF37916A7} "{E2883E8F-472F-4FB0-9522-AC9BF37916A7}" - ? -   (File not found | COM-object registry key not found) / hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----
{48E73304-E1D6-4330-914C-F5F514E3486C} "An OneNote senden" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
{0B4350D1-055F-47A3-B112-5F2F2B0D6F08} "ClsidExtension" - "Google Inc." - C:\Program Files\Google\Google Gears\Internet Explorer\0.5.36.0\gears.dll
{53707962-6F74-2D53-2644-206D7942484F} "ClsidExtension" - "Safer Networking Limited" - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
{FF059E31-CC5A-4E2E-BF3B-96E929D65503} "Research" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----
{18DF081C-E8AD-4283-A596-FA578C2EBDC3} "Adobe PDF Link Helper" - "Adobe Systems Incorporated" - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
{E0FEFE40-FBF9-42AE-BA58-794CA7E3FB53} "Google Gears Helper" - "Google Inc." - C:\Program Files\Google\Google Gears\Internet Explorer\0.5.36.0\gears.dll
{AF69DE43-7D58-4638-B6FA-CE66B5AD205D} "Google Toolbar Notifier BHO" - "Google Inc." - C:\Program Files\Google\GoogleToolbarNotifier\5.2.4204.1700\swg.dll
{DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2ssv.dll
{53707962-6F74-2D53-2644-206D7942484F} "Spybot-S&D IE Protection" - "Safer Networking Limited" - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll

[Logon]
-----( %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup )-----
"desktop.ini" - ? - C:\Users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
"ERUNT AutoBackup.lnk" - ? - C:\Program Files\ERUNT\AUTOBACK.EXE  (Shortcut exists | File found, but it contains no detailed information | File exists)
"Mozilla Thunderbird.lnk" - "Mozilla Messaging" - C:\Program Files\Mozilla Thunderbird\thunderbird.exe  (Shortcut exists | File exists)
-----( %AllUsersProfile%\Microsoft\Windows\Start Menu\Programs\Startup )-----
"desktop.ini" - ? - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
"Empowering Technology Launcher.lnk" - "Acer Inc." - C:\Acer\Empowering Technology\eAPLauncher.exe  (Shortcut exists | File exists)
-----( HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run )-----
"SpybotSD TeaTimer" - "Safer Networking Limited" - C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
-----( HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\Wds\rdpwd )-----
"StartupPrograms" - ? - rdpclip  (File not found)
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----
"Adobe ARM" - "Adobe Systems Incorporated" - "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
"Adobe Reader Speed Launcher" - "Adobe Systems Incorporated" - "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
"avgnt" - "Avira GmbH" - "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
"Google Desktop Search" - "Google" - "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
"IAAnotif" - "Intel Corporation" - "C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe"
"LanguageShortcut" - ? - "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
"LManager" - "Dritek System Inc." - C:\PROGRA~1\LAUNCH~1\LManager.exe
"lxbkbmgr.exe" - "Lexmark International, Inc." - "C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe"
"Malwarebytes' Anti-Malware (reboot)" - "Malwarebytes Corporation" - "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
"NeroFilterCheck" - "Ahead Software Gmbh" - C:\Windows\system32\NeroCheck.exe
"OrderReminder" - "Hewlett-Packard" - C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe
"QuickTime Task" - "Apple Inc." - "C:\Program Files\QuickTime\QTTask.exe" -atboottime
"RemoteControl" - "Cyberlink Corp." - "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
"WarReg_PopUp" - "Acer Inc." - C:\Acer\WR_PopUp\WarReg_PopUp.exe

[Print Monitors]
-----( HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors )-----
"PDF995 Monitor" - ? - C:\Windows\system32\pdf995mon.dll  (File found, but it contains no detailed information)
"Send To Microsoft OneNote Monitor" - "Microsoft Corporation" - C:\Windows\system32\msonpmon.dll

[Services]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"@C:\Program Files\NOS\bin\getPlus_Helper.dll,-101" (getPlusHelper) - "NOS Microsystems Ltd." - C:\Program Files\NOS\bin\getPlus_Helper.dll
"Avira AntiVir Guard" (AntiVirService) - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
"Avira AntiVir Planer" (AntiVirSchedulerService) - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\sched.exe
"Cyberlink RichVideo Service(CRVS)" (RichVideo) - ? - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
"eRecovery Service" (eRecoveryService) - "Acer Inc." - C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
"Google Desktop Manager 5.9.1005.12335" (GoogleDesktopManager-051210-111108) - "Google" - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
"Google Software Updater" (gusvc) - "Google" - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
"Google Update Service (gupdate)" (gupdate) - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe
"Intel(R) Matrix Storage Event Monitor" (IAANTMON) - "Intel Corporation" - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
"LightScribeService Direct Disc Labeling Service" (LightScribeService) - "Hewlett-Packard Company" - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
"Microsoft .NET Framework NGEN v4.0.30319_X86" (clr_optimization_v4.0.30319_32) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
"Microsoft Office Diagnostics Service" (odserv) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE
"MobilityService" (MobilityService) - ? - C:\Acer\Mobility Center\MobilityService.exe  (File found, but it contains no detailed information)
"Office Source Engine" (ose) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"SBSD Security Center Service" (SBSDWSCService) - "Safer Networking Ltd." - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
"SQL Server (MSSMLBIZ)" (MSSQL$MSSMLBIZ) - "Microsoft Corporation" - C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
"SQL Server VSS Writer" (SQLWriter) - "Microsoft Corporation" - C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
"SQL Server-Browser" (SQLBrowser) - "Microsoft Corporation" - C:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
"SQL Server-Startdienst für Business Contact Manager" (BcmSqlStartupSvc) - "Microsoft Corporation" - C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe

===[ Logfile end ]=========================================[ Logfile end ]===
         

--- --- ---

If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru



und hier die MBR.txt


MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:
Windows Version: Windows 7 Home Premium Edition
Windows Information: (build 7600), 32-bit
Base Board Manufacturer: Acer
BIOS Manufacturer: Phoenix Technologies LTD
System Manufacturer: Acer
System Product Name: TravelMate 7720
Logical Drives Mask: 0x0000001c

Kernel Drivers (total 199):
0x82E3B000 \SystemRoot\system32\ntkrnlpa.exe
0x82E04000 \SystemRoot\system32\halmacpi.dll
0x80BA8000 \SystemRoot\system32\kdcom.dll
0x88822000 \SystemRoot\system32\mcupdate_GenuineIntel.dll
0x8889A000 \SystemRoot\system32\PSHED.dll
0x888AB000 \SystemRoot\system32\BOOTVID.dll
0x888B3000 \SystemRoot\system32\CLFS.SYS
0x888F5000 \SystemRoot\system32\CI.dll
0x88A1E000 \SystemRoot\system32\drivers\Wdf01000.sys
0x88A8F000 \SystemRoot\system32\drivers\WDFLDR.SYS
0x88A9D000 \SystemRoot\system32\DRIVERS\ACPI.sys
0x88AE5000 \SystemRoot\system32\DRIVERS\WMILIB.SYS
0x88AEE000 \SystemRoot\system32\DRIVERS\msisadrv.sys
0x88AF6000 \SystemRoot\system32\DRIVERS\pci.sys
0x88B20000 \SystemRoot\system32\DRIVERS\vdrvroot.sys
0x88B2B000 \SystemRoot\System32\drivers\partmgr.sys
0x88B3C000 \SystemRoot\system32\DRIVERS\compbatt.sys
0x88B44000 \SystemRoot\system32\DRIVERS\BATTC.SYS
0x88B4F000 \SystemRoot\system32\DRIVERS\volmgr.sys
0x88B5F000 \SystemRoot\System32\drivers\volmgrx.sys
0x88BAA000 \SystemRoot\system32\DRIVERS\intelide.sys
0x88BB1000 \SystemRoot\system32\DRIVERS\PCIIDEX.SYS
0x88BBF000 \SystemRoot\system32\DRIVERS\pcmcia.sys
0x88A00000 \SystemRoot\System32\drivers\mountmgr.sys
0x88BED000 \SystemRoot\system32\DRIVERS\atapi.sys
0x889A0000 \SystemRoot\system32\DRIVERS\ataport.SYS
0x88BF6000 \SystemRoot\system32\DRIVERS\amdxata.sys
0x889C3000 \SystemRoot\system32\drivers\fltmgr.sys
0x88800000 \SystemRoot\system32\drivers\fileinfo.sys
0x88C06000 \SystemRoot\System32\Drivers\Ntfs.sys
0x88D35000 \SystemRoot\System32\Drivers\msrpc.sys
0x88D60000 \SystemRoot\System32\Drivers\ksecdd.sys
0x88D73000 \SystemRoot\System32\Drivers\cng.sys
0x88DD0000 \SystemRoot\System32\drivers\pcw.sys
0x88DDE000 \SystemRoot\System32\Drivers\Fs_Rec.sys
0x88E19000 \SystemRoot\system32\drivers\ndis.sys
0x88ED0000 \SystemRoot\system32\drivers\NETIO.SYS
0x88F0E000 \SystemRoot\System32\Drivers\ksecpkg.sys
0x8901D000 \SystemRoot\System32\drivers\tcpip.sys
0x89166000 \SystemRoot\System32\drivers\fwpkclnt.sys
0x89197000 \SystemRoot\system32\DRIVERS\volsnap.sys
0x891D6000 \SystemRoot\System32\Drivers\spldr.sys
0x88F33000 \SystemRoot\System32\drivers\rdyboost.sys
0x891DE000 \SystemRoot\System32\Drivers\mup.sys
0x891EE000 \SystemRoot\System32\drivers\hwpolicy.sys
0x88F60000 \SystemRoot\System32\DRIVERS\fvevol.sys
0x89000000 \SystemRoot\system32\DRIVERS\disk.sys
0x88F92000 \SystemRoot\system32\DRIVERS\CLASSPNP.SYS
0x88FD5000 \SystemRoot\system32\DRIVERS\cdrom.sys
0x88FF4000 \SystemRoot\System32\Drivers\Null.SYS
0x88E00000 \SystemRoot\System32\Drivers\Beep.SYS
0x88E07000 \SystemRoot\System32\drivers\vga.sys
0x8EA29000 \SystemRoot\System32\drivers\VIDEOPRT.SYS
0x8EA4A000 \SystemRoot\System32\drivers\watchdog.sys
0x8EA57000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0x8EA5F000 \SystemRoot\system32\drivers\rdpencdd.sys
0x8EA67000 \SystemRoot\system32\drivers\rdprefmp.sys
0x8EA6F000 \SystemRoot\System32\Drivers\Msfs.SYS
0x8EA7A000 \SystemRoot\System32\Drivers\Npfs.SYS
0x8EA88000 \SystemRoot\system32\DRIVERS\tdx.sys
0x8EA9F000 \SystemRoot\system32\DRIVERS\TDI.SYS
0x8EAAA000 \SystemRoot\system32\drivers\afd.sys
0x8EB04000 \SystemRoot\System32\DRIVERS\netbt.sys
0x8EB36000 \SystemRoot\system32\DRIVERS\wfplwf.sys
0x8EB3D000 \SystemRoot\system32\DRIVERS\pacer.sys
0x8EB5C000 \SystemRoot\system32\DRIVERS\netbios.sys
0x8EB6A000 \SystemRoot\system32\DRIVERS\wanarp.sys
0x8EB7D000 \SystemRoot\system32\DRIVERS\termdd.sys
0x8EB8D000 \SystemRoot\system32\DRIVERS\ssmdrv.sys
0x8EB93000 \SystemRoot\system32\DRIVERS\rdbss.sys
0x8EBD4000 \SystemRoot\system32\drivers\nsiproxy.sys
0x8EBDE000 \SystemRoot\system32\DRIVERS\mssmbios.sys
0x8EC3D000 \??\C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys
0x8EC9D000 \SystemRoot\System32\drivers\discache.sys
0x8ECA9000 \SystemRoot\System32\Drivers\dfsc.sys
0x8ECC1000 \SystemRoot\system32\DRIVERS\blbdrive.sys
0x8ECCF000 \SystemRoot\system32\DRIVERS\avipbb.sys
0x8ECF5000 \SystemRoot\system32\DRIVERS\tunnel.sys
0x8ED16000 \SystemRoot\system32\DRIVERS\intelppm.sys
0x8ED28000 \SystemRoot\system32\DRIVERS\wmiacpi.sys
0x8F20B000 \SystemRoot\system32\DRIVERS\atikmdag.sys
0x8F720000 \SystemRoot\System32\drivers\dxgkrnl.sys
0x8ED31000 \SystemRoot\System32\Drivers\fastfat.SYS
0x8ED5B000 \SystemRoot\System32\drivers\dxgmms1.sys
0x8F7D7000 \SystemRoot\system32\DRIVERS\usbuhci.sys
0x8ED94000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
0x8F7E2000 \SystemRoot\system32\DRIVERS\usbehci.sys
0x8EDDF000 \SystemRoot\system32\DRIVERS\HDAudBus.sys
0x8EC00000 \SystemRoot\system32\DRIVERS\b57nd60x.sys
0x91013000 \SystemRoot\system32\DRIVERS\netw5v32.sys
0x91426000 \SystemRoot\system32\DRIVERS\1394ohci.sys
0x91452000 \SystemRoot\system32\drivers\tifm21.sys
0x9149E000 \SystemRoot\system32\DRIVERS\sdbus.sys
0x914B7000 \SystemRoot\system32\DRIVERS\CmBatt.sys
0x914BB000 \SystemRoot\system32\DRIVERS\i8042prt.sys
0x914D3000 \SystemRoot\system32\DRIVERS\DKbFltr.sys
0x914DD000 \SystemRoot\system32\DRIVERS\kbdclass.sys
0x914EA000 \SystemRoot\system32\DRIVERS\SynTP.sys
0x91515000 \SystemRoot\system32\DRIVERS\USBD.SYS
0x91517000 \SystemRoot\system32\DRIVERS\mouclass.sys
0x91524000 \SystemRoot\system32\DRIVERS\nscirda.sys
0x9152C000 \SystemRoot\system32\drivers\irenum.sys
0x91535000 \SystemRoot\system32\DRIVERS\NTIDrvr.sys
0x91537000 \SystemRoot\system32\DRIVERS\CompositeBus.sys
0x91544000 \SystemRoot\system32\DRIVERS\AgileVpn.sys
0x91556000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
0x9156E000 \SystemRoot\system32\DRIVERS\ndistapi.sys
0x91579000 \SystemRoot\system32\DRIVERS\ndiswan.sys
0x9159B000 \SystemRoot\system32\DRIVERS\raspppoe.sys
0x915B3000 \SystemRoot\system32\DRIVERS\raspptp.sys
0x915CA000 \SystemRoot\system32\DRIVERS\rassstp.sys
0x915E1000 \SystemRoot\system32\DRIVERS\swenum.sys
0x9562C000 \SystemRoot\system32\DRIVERS\ks.sys
0x95660000 \SystemRoot\system32\DRIVERS\umbus.sys
0x9566E000 \SystemRoot\system32\DRIVERS\usbhub.sys
0x956B2000 \SystemRoot\System32\Drivers\NDProxy.SYS
0x81E03000 \SystemRoot\system32\drivers\RTKVHDA.sys
0x81FB5000 \SystemRoot\system32\drivers\portcls.sys
0x81FE4000 \SystemRoot\system32\drivers\drmk.sys
0x956C3000 \SystemRoot\system32\DRIVERS\HSXHWAZL.sys
0x82236000 \SystemRoot\system32\DRIVERS\HSX_DPV.sys
0x82339000 \SystemRoot\system32\DRIVERS\HSX_CNXT.sys
0x823ED000 \SystemRoot\system32\drivers\modem.sys
0x824C0000 \SystemRoot\System32\win32k.sys
0x82200000 \SystemRoot\System32\drivers\Dxapi.sys
0x8220A000 \SystemRoot\System32\Drivers\crashdmp.sys
0x82217000 \SystemRoot\System32\Drivers\dump_dumpata.sys
0x82222000 \SystemRoot\System32\Drivers\dump_atapi.sys
0x95700000 \SystemRoot\System32\Drivers\dump_dumpfve.sys
0x95807000 \SystemRoot\system32\DRIVERS\snp2uvc.sys
0x959AE000 \SystemRoot\system32\DRIVERS\STREAM.SYS
0x959BC000 \SystemRoot\system32\DRIVERS\sncduvc.SYS
0x959C3000 \SystemRoot\system32\DRIVERS\monitor.sys
0x82720000 \SystemRoot\System32\TSDDD.dll
0x82750000 \SystemRoot\System32\cdd.dll
0x959CE000 \SystemRoot\system32\drivers\luafv.sys
0x959E9000 \SystemRoot\system32\DRIVERS\avgntflt.sys
0x95711000 \SystemRoot\system32\drivers\WudfPf.sys
0x9572B000 \SystemRoot\system32\DRIVERS\irda.sys
0x95749000 \SystemRoot\system32\DRIVERS\lltdio.sys
0x95759000 \SystemRoot\system32\DRIVERS\nwifi.sys
0x9579F000 \SystemRoot\system32\DRIVERS\ndisuio.sys
0x957AF000 \SystemRoot\system32\DRIVERS\rspndr.sys
0x9BC2C000 \SystemRoot\system32\drivers\HTTP.sys
0x9BCB1000 \SystemRoot\system32\DRIVERS\bowser.sys
0x9BCCA000 \SystemRoot\System32\drivers\mpsdrv.sys
0x9BCDC000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
0x9BCFF000 \SystemRoot\system32\DRIVERS\mrxsmb10.sys
0x9BD3A000 \SystemRoot\system32\DRIVERS\mrxsmb20.sys
0x9BD6D000 \??\C:\Windows\system32\drivers\int15.sys
0x9BD7E000 \SystemRoot\system32\DRIVERS\mdmxsdk.sys
0x9FA17000 \SystemRoot\system32\drivers\peauth.sys
0x9FAAE000 \SystemRoot\System32\Drivers\secdrv.SYS
0x9FAB8000 \SystemRoot\System32\DRIVERS\srvnet.sys
0x9FAD9000 \SystemRoot\System32\drivers\tcpipreg.sys
0x9FAE6000 \SystemRoot\system32\DRIVERS\xaudio.sys
0x9FAEE000 \??\C:\Program Files\CyberLink\PowerDVD\000.fcl
0x9FAF0000 \SystemRoot\System32\DRIVERS\srv2.sys
0x9FB3F000 \SystemRoot\System32\DRIVERS\srv.sys
0x9FA00000 \SystemRoot\system32\DRIVERS\asyncmac.sys
0x76F60000 \Windows\System32\ntdll.dll
0x47F70000 \Windows\System32\smss.exe
0x771A0000 \Windows\System32\apisetschema.dll
0x005E0000 \Windows\System32\autochk.exe
0x76D60000 \Windows\System32\iertutil.dll
0x770B0000 \Windows\System32\kernel32.dll
0x76CB0000 \Windows\System32\msvcrt.dll
0x76060000 \Windows\System32\shell32.dll
0x75EC0000 \Windows\System32\setupapi.dll
0x75E80000 \Windows\System32\ws2_32.dll
0x75E30000 \Windows\System32\gdi32.dll
0x75DB0000 \Windows\System32\comdlg32.dll
0x75CE0000 \Windows\System32\user32.dll
0x770A0000 \Windows\System32\nsi.dll
0x75CD0000 \Windows\System32\normaliz.dll
0x75C00000 \Windows\System32\msctf.dll
0x75B70000 \Windows\System32\oleaut32.dll
0x75B60000 \Windows\System32\lpk.dll
0x75B30000 \Windows\System32\imagehlp.dll
0x75A80000 \Windows\System32\rpcrt4.dll
0x75940000 \Windows\System32\urlmon.dll
0x758A0000 \Windows\System32\advapi32.dll
0x757A0000 \Windows\System32\wininet.dll
0x75740000 \Windows\System32\shlwapi.dll
0x756E0000 \Windows\System32\difxapi.dll
0x756C0000 \Windows\System32\imm32.dll
0x756A0000 \Windows\System32\sechost.dll
0x75610000 \Windows\System32\clbcatq.dll
0x75570000 \Windows\System32\usp10.dll
0x75410000 \Windows\System32\ole32.dll
0x753C0000 \Windows\System32\Wldap32.dll
0x753B0000 \Windows\System32\psapi.dll
0x75380000 \Windows\System32\wintrust.dll
0x75360000 \Windows\System32\devobj.dll
0x752D0000 \Windows\System32\comctl32.dll
0x751B0000 \Windows\System32\crypt32.dll
0x75180000 \Windows\System32\cfgmgr32.dll
0x75130000 \Windows\System32\KernelBase.dll
0x75120000 \Windows\System32\msasn1.dll

Processes (total 67):
0 System Idle Process
4 System
276 C:\Windows\System32\smss.exe
396 csrss.exe
472 C:\Windows\System32\wininit.exe
484 csrss.exe
528 C:\Windows\System32\services.exe
544 C:\Windows\System32\lsass.exe
552 C:\Windows\System32\lsm.exe
612 C:\Windows\System32\winlogon.exe
712 C:\Windows\System32\svchost.exe
812 C:\Windows\System32\svchost.exe
856 C:\Windows\System32\atiesrxx.exe
936 C:\Windows\System32\svchost.exe
984 C:\Windows\System32\svchost.exe
1024 C:\Windows\System32\svchost.exe
1104 C:\Windows\System32\audiodg.exe
1144 C:\Windows\System32\svchost.exe
1224 C:\Windows\System32\atieclxx.exe
1284 C:\Windows\System32\svchost.exe
1548 C:\Windows\System32\spoolsv.exe
1604 C:\Windows\System32\dwm.exe
1612 C:\Program Files\Avira\AntiVir Desktop\sched.exe
1624 C:\Windows\explorer.exe
1672 C:\Windows\System32\svchost.exe
1892 C:\Windows\System32\taskhost.exe
1928 C:\Program Files\Avira\AntiVir Desktop\avguard.exe
1964 C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe
2008 C:\Windows\System32\svchost.exe
112 C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe
416 C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
644 C:\Windows\RtHDVCpl.exe
1204 C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
1792 C:\Program Files\Lexmark X1100 Series\LXBKbmgr.exe
2068 C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe
2088 C:\Program Files\Google\Update\1.2.183.39\GoogleCrashHandler.exe
2116 C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
2136 C:\Program Files\Lexmark X1100 Series\LXBKbmon.exe
2356 C:\Program Files\Common Files\LightScribe\LSSrvc.exe
2364 C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
2372 C:\Windows\System32\conhost.exe
2408 C:\Acer\Mobility Center\MobilityService.exe
2556 C:\Users\***\AppData\Local\Temp\RtkBtMnt.exe
2680 C:\Program Files\CyberLink\Shared Files\RichVideo.exe
2716 C:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
2812 C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
2868 C:\Windows\System32\svchost.exe
2928 C:\Windows\System32\drivers\XAudio.exe
3012 C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
3096 C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
3468 WmiPrvSE.exe
3624 C:\Windows\System32\SearchIndexer.exe
3880 C:\Windows\System32\svchost.exe
4056 C:\Program Files\Windows Media Player\wmpnetwk.exe
1888 C:\Program Files\Launch Manager\LManager.exe
2160 C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
2060 C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
952 C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
2452 C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
1580 C:\Windows\System32\svchost.exe
968 C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
5396 C:\Windows\System32\svchost.exe
2028 C:\Windows\System32\svchost.exe
1780 C:\Program Files\Mozilla Firefox\firefox.exe
4224 C:\Users\***\Desktop\MBRCheck.exe
196 C:\Windows\System32\conhost.exe
1584 C:\Windows\System32\dllhost.exe

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000002`71100000 (NTFS)
\\.\D: --> \\.\PhysicalDrive0 at offset 0x00000013`da600000 (NTFS)

PhysicalDrive0 Model Number: HitachiHTS541616J9SA00, Rev: SB4OC70P

Size Device Name MBR Status
--------------------------------------------
149 GB \\.\PhysicalDrive0 Windows 7 MBR code detected
SHA1: 4379A3D43019B46FA357F7DD6A53B45A3CA8FB79


Done!

Sieht ok aus. Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SUPERAntiSpyware und poste die Logs.
Denk dran beide Tools zu updaten vor dem Scan!!

hier die mbam.log

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Datenbank Version: 5929

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

02.03.2011 15:50:46
mbam-log-2011-03-02 (15-50-46).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|)
Durchsuchte Objekte: 251017
Laufzeit: 1 Stunde(n), 7 Minute(n), 15 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)


und hier die SUPERAntiSpyware Scan Log:


SUPERAntiSpyware Scan Log
hxxp://www.superantispyware.com

Generated 03/02/2011 at 05:24 PM

Application Version : 4.49.1000

Core Rules Database Version : 6512
Trace Rules Database Version: 4324

Scan type : Complete Scan
Total Scan Time : 01:22:37

Memory items scanned : 741
Memory threats detected : 0
Registry items scanned : 10449
Registry threats detected : 0
File items scanned : 111504
File threats detected : 14

Adware.Tracking Cookie
C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\***@overture[1].txt
C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\***@partypoker[1].txt
C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\***@www.mynortonaccount[1].txt
C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\***@www.googleadservices[2].txt
C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\***@ads.heias[1].txt
C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\***@tribalfusion[1].txt
C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\***@content.yieldmanager[1].txt
C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\***@hmt.connexpromotions[2].txt
C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\***@www.windowsmedia[2].txt
C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\***@realmedia[1].txt
C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\***@youporn[1].txt
C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\***@indexstats[2].txt
C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\***@atdmt[2].txt
C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\***@clickbooth[2].txt


hoffe das nun alles wieder gut ist ;-)

Sieht ok aus, da wurden nur Cookies gefunden.
Noch Probleme oder weitere Funde in der Zwischenzeit?

nö, nix weiter bemerkt...

ich danke dir!

Dann wären wir durch!

Bitte abschließend die Updates prüfen, unten mein Leitfaden dazu.
Für noch mehr Sicherheit solltest Du nach der beseitigten Infektion auch möglichst alle Passwörter ändern.


Microsoftupdate

Windows XP: Besuch mit dem IE die MS-Updateseite und lass Dir alle wichtigen Updates installieren.

Windows Vista/7: Anleitung Windows-Update



PDF-Reader aktualisieren
Dein Adobe Reader ist nicht aktuell, was ein großes Sicherheitsrisiko darstellt. Du solltest daher besser die alte Version über Systemsteuerung => Software deinstallieren, indem Du dort auf "Adobe Reader x.0" klickst und das Programm entfernst.

Ich empfehle einen alternativen PDF-Reader wie SumatraPDF oder Foxit PDF Reader, beide sind sehr viel schlanker und flotter als der AdobeReader.

Bitte überprüf bei der Gelegenheit auch die Aktualität des Flashplayers, hier der direkte Downloadlink:

Mozilla und andere Browser => http://filepony.de/?q=Flash+Player
Internet Explorer => http://fpdownload.adobe.com/get/flas..._player_ax.exe


Java-Update
Veraltete Java-Installationen sind ein Sicherheitsrisiko, daher solltest Du die alten Versionen löschen (falls vorhanden, am besten mit JavaRa) und auf die neuste aktualisieren. Beende dazu alle Programme (v.a. die Browser), klick danach auf Start, Systemsteuerung, Software und deinstalliere darüber alle aufgelisteten Java-Versionen. Lad Dir danach von hier das aktuelle Java SE Runtime Environment (JRE) herunter und installiere es.

ich danke dir für deine unglaublich gute hilfe!!!

bin echt begeistert, dass alles noch so glimpflich abgegangen ist...