Ich glaub ich hab nen Virus!

cosinus · 10.05.2011, 09:47

Dann bitte jetzt CF ausführen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix

Lade dir ComboFix hier herunter auf deinen Desktop. Benenne es beim Runterladen um in cofi.exe.

Dann folgende Anleitung durchlesen und abarbeiten -> CCleaner Systembereinigung

Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.

Starte cofi.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.

Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.

Wichtiger Hinweis:

Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

Kangoo96 · 10.05.2011, 12:47

Hier das cofi-Log:

Code:

ATTFilter

ComboFix 11-05-09.02 - Alex 10.05.2011  13:33:39.1.2 - x86
Microsoft Windows 7 Home Premium   6.1.7600.0.1252.49.1031.18.3071.2020 [GMT 2:00]
ausgeführt von:: c:\users\Alex\Desktop\cofi.exe
AV: Kaspersky Internet Security *Disabled/Updated* {56547CC9-C9B2-849D-8FEF-A496150D6A06}
FW: Kaspersky Internet Security *Disabled* {6E6FFDEC-83DD-85C5-A4B0-0DA3EBDE2D7D}
SP: Kaspersky Internet Security *Disabled/Updated* {ED359D2D-EF88-8B13-B55F-9FE46E8A20BB}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Alex\AppData\Roaming\inst.exe
c:\windows\system32\jusched.exe
.
.
(((((((((((((((((((((((   Dateien erstellt von 2011-04-10 bis 2011-05-10  ))))))))))))))))))))))))))))))
.
.
2011-05-10 11:43 . 2011-05-10 11:43	--------	d-----w-	c:\users\Alex\AppData\Local\temp
2011-05-10 11:26 . 2011-05-10 11:26	--------	d-----w-	c:\program files\CCleaner
2011-05-09 13:48 . 2011-05-09 13:48	--------	d-----w-	C:\_OTL
2011-05-08 14:12 . 2011-05-08 14:12	--------	d-----w-	c:\users\Alex\AppData\Roaming\Malwarebytes
2011-05-08 14:12 . 2010-12-20 16:09	38224	----a-w-	c:\windows\system32\drivers\mbamswissarmy.sys
2011-05-08 14:12 . 2011-05-08 14:12	--------	d-----w-	c:\programdata\Malwarebytes
2011-05-08 14:12 . 2011-05-08 14:12	--------	d-----w-	c:\program files\Malwarebytes' Anti-Malware
2011-05-08 14:12 . 2010-12-20 16:08	20952	----a-w-	c:\windows\system32\drivers\mbam.sys
2011-05-08 12:34 . 2011-05-08 12:34	--------	d-----w-	c:\program files\18 WoS Voll aufs Gas
2011-05-06 11:32 . 2011-04-11 07:04	7071056	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{F6B93263-E3AB-426A-ADD7-AB33A66AD44E}\mpengine.dll
2011-05-04 14:07 . 2011-05-04 14:08	--------	d-----w-	c:\users\Alex\AppData\Local\Microsoft Games
2011-04-28 16:51 . 2011-05-08 10:30	--------	d-----w-	c:\programdata\TrackMania
2011-04-28 14:59 . 2011-04-28 14:59	--------	d-sh--w-	c:\programdata\SecuROM
2011-04-28 14:56 . 2009-03-16 12:18	69448	----a-w-	c:\windows\system32\XAPOFX1_3.dll
2011-04-28 14:56 . 2009-03-16 12:18	517448	----a-w-	c:\windows\system32\XAudio2_4.dll
2011-04-28 14:56 . 2009-03-16 12:18	235352	----a-w-	c:\windows\system32\xactengine3_4.dll
2011-04-28 14:56 . 2009-03-09 13:27	4178264	----a-w-	c:\windows\system32\D3DX9_41.dll
2011-04-28 14:56 . 2009-03-16 12:18	22360	----a-w-	c:\windows\system32\X3DAudio1_6.dll
2011-04-28 14:46 . 2011-04-28 14:46	--------	d--h--r-	c:\users\Alex\AppData\Roaming\SecuROM
2011-04-27 05:11 . 2011-02-18 05:33	31232	----a-w-	c:\windows\system32\prevhost.exe
2011-04-27 05:10 . 2011-03-11 05:44	146304	----a-w-	c:\windows\system32\drivers\storport.sys
2011-04-27 05:10 . 2011-03-11 05:44	143744	----a-w-	c:\windows\system32\drivers\nvstor.sys
2011-04-27 05:10 . 2011-03-11 05:44	1210240	----a-w-	c:\windows\system32\drivers\ntfs.sys
2011-04-27 05:10 . 2011-03-11 05:44	117120	----a-w-	c:\windows\system32\drivers\nvraid.sys
2011-04-27 05:10 . 2011-03-11 05:43	80256	----a-w-	c:\windows\system32\drivers\amdsata.sys
2011-04-27 05:10 . 2011-03-11 05:39	1686016	----a-w-	c:\windows\system32\esent.dll
2011-04-27 05:10 . 2011-03-11 05:43	332160	----a-w-	c:\windows\system32\drivers\iaStorV.sys
2011-04-27 05:10 . 2011-03-11 05:43	22400	----a-w-	c:\windows\system32\drivers\amdxata.sys
2011-04-27 05:10 . 2011-03-11 05:37	74240	----a-w-	c:\windows\system32\fsutil.exe
2011-04-27 05:10 . 2011-03-12 11:31	442880	----a-w-	c:\windows\system32\XpsPrint.dll
2011-04-27 05:10 . 2011-02-26 05:33	2614784	----a-w-	c:\windows\explorer.exe
2011-04-18 15:15 . 2011-04-18 17:02	--------	d-----w-	c:\users\Alex\AppData\Roaming\DVDVideoSoft
2011-04-18 10:41 . 2011-04-18 12:23	--------	d-----w-	C:\Referat
2011-04-17 09:36 . 2011-04-29 19:22	--------	d-----w-	c:\users\Alex\AppData\Roaming\dvdcss
2011-04-15 21:01 . 2011-04-18 15:16	--------	d-----w-	c:\program files\Common Files\DVDVideoSoft
2011-04-15 21:01 . 2011-04-18 15:15	--------	d-----w-	c:\program files\DVDVideoSoft
2011-04-15 20:51 . 2011-04-15 20:51	--------	d-----w-	c:\program files\eRightSoft
2011-04-14 11:24 . 2011-02-23 05:05	309760	----a-w-	c:\windows\system32\drivers\srv2.sys
2011-04-14 11:24 . 2011-02-23 05:06	311296	----a-w-	c:\windows\system32\drivers\srv.sys
2011-04-14 11:24 . 2011-02-23 05:05	113664	----a-w-	c:\windows\system32\drivers\srvnet.sys
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-04-28 15:00 . 2009-08-18 10:30	564632	----a-w-	c:\programdata\Microsoft\IdentityCRL\production\wlidui.dll
2011-04-28 15:00 . 2009-08-18 10:24	18328	----a-w-	c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
2011-04-15 04:17 . 2011-02-04 20:07	2300696	----a-w-	c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup\markup.dll
2011-04-15 04:17 . 2011-02-10 13:25	42776	----a-w-	c:\programdata\Microsoft\eHome\Packages\MCEClientUX\dSM-2\StartResources.dll
2011-04-11 04:11 . 2011-04-04 03:38	2300696	----a-w-	c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup-2\markup.dll
2011-04-11 04:11 . 2011-02-04 20:06	42776	----a-w-	c:\programdata\Microsoft\eHome\Packages\MCEClientUX\dSM\StartResources.dll
2011-04-11 04:11 . 2011-02-10 13:25	1220416	----a-w-	c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight-2\SpotlightResources.dll
2011-04-09 16:55 . 2011-04-09 16:55	15453336	----a-w-	c:\windows\system32\xlive.dll
2011-04-09 16:55 . 2011-04-09 16:55	13642904	----a-w-	c:\windows\system32\xlivefnt.dll
2011-04-08 04:43 . 2011-02-04 20:06	1220416	----a-w-	c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll
2011-02-19 05:33 . 2011-03-09 15:36	802304	----a-w-	c:\windows\system32\FntCache.dll
2011-02-19 05:32 . 2011-03-09 15:36	1074176	----a-w-	c:\windows\system32\DWrite.dll
2011-02-19 05:32 . 2011-03-09 15:36	739840	----a-w-	c:\windows\system32\d2d1.dll
2011-02-18 15:36 . 2011-02-18 15:36	41984	----a-w-	c:\windows\system32\drivers\usbaapl.sys
2011-02-18 15:36 . 2011-02-18 15:36	4184352	----a-w-	c:\windows\system32\usbaaplrc.dll
2011-02-11 20:47 . 2011-02-11 20:47	2300696	----a-w-	c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup-5\markup.dll
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2011-01-26 15026056]
"LightScribe Control Panel"="c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe" [2009-06-17 2363392]
"EADM"="c:\program files\Electronic Arts\EADM\EADMUI.exe" [2011-03-03 11509760]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="RtHDVCpl.exe" [2007-07-06 4669440]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 40048]
"HP Health Check Scheduler"="c:\program files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe" [2007-05-24 71176]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2005-02-16 49152]
"hpsysdrv"="c:\hp\support\hpsysdrv.exe" [2007-04-18 65536]
"KBD"="c:\hp\KBD\KbdStub.EXE" [2006-12-08 65536]
"OsdMaestro"="c:\program files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe" [2007-02-15 118784]
"SunJavaUpdateReg"="c:\windows\system32\jureg.exe" [2007-04-07 54936]
"AVP"="c:\program files\Kaspersky Lab\Kaspersky Internet Security 2011\avp.exe" [2010-11-02 365336]
"LogitechQuickCamRibbon"="c:\program files\Logitech\Logitech WebCam Software\LWS.exe" [2009-10-14 2793304]
"LXCGCATS"="c:\windows\system32\spool\DRIVERS\W32X86\3\LXCGtime.dll" [2007-02-22 73728]
"lxcgmon.exe"="c:\program files\Lexmark 2300 Series\lxcgmon.exe" [2007-04-29 205744]
"EzPrint"="c:\program files\Lexmark 2300 Series\ezprint.exe" [2007-04-29 103344]
"HPUsageTracking"="c:\program files\HP\HP UT\bin\hppusg.exe" [2009-05-11 24576]
"BCSSync"="c:\program files\Microsoft Office\Office14\BCSSync.exe" [2010-03-13 91520]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
"Nero MediaHome 4"="c:\program files\Nero\Nero MediaHome 4\NeroMediaHome.exe" [2010-03-08 5174568]
"TkBellExe"="c:\program files\Real\RealPlayer\Update\realsched.exe" [2011-02-23 273544]
"VirtualCloneDrive"="c:\program files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" [2006-04-29 94208]
"CloneCDTray"="c:\program files\SlySoft\CloneCD\CloneCDTray.exe" [2006-09-28 57344]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-11-29 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2011-03-07 421160]
"Malwarebytes' Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2010-12-20 963976]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Acrobat Assistant.lnk - c:\program files\Adobe\Acrobat 6.0\Distillr\acrotray.exe [2003-5-15 217193]
Adobe Gamma Loader.exe.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2011-1-23 110592]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]
WDDMStatus.lnk - c:\program files\Western Digital\WD SmartWare\WD Drive Manager\WDDMStatus.exe [2009-11-13 2057536]
WDSmartWare.lnk - c:\program files\Western Digital\WD SmartWare\Front Parlor\WDSmartWare.exe [2009-11-13 9117504]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\progra~1\KASPER~1\KASPER~1\kloehk.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux2"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages	REG_MULTI_SZ   	kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2011-03-27 136176]
R3 EagleXNt;EagleXNt;c:\windows\system32\drivers\EagleXNt.sys [x]
R3 gupdatem;Google Update-Dienst (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2011-03-27 136176]
R3 HCW85BDA;Hauppauge WinTV 885 Video Capture;c:\windows\system32\drivers\HCW85BDA.sys [2007-06-11 968064]
R3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des [2010-06-07 3549224]
R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4640000]
R3 Ph3xIB32;Philips 713x Inbox PCI TV Card;c:\windows\system32\DRIVERS\Ph3xIB32.sys [2009-07-13 1311232]
S1 kl2;kl2;c:\windows\system32\DRIVERS\kl2.sys [2010-06-09 11352]
S1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter;c:\windows\system32\DRIVERS\klim6.sys [2010-04-22 22104]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-13 48128]
S2 Akamai;Akamai NetSession Interface;c:\windows\System32\svchost.exe [2009-07-14 20992]
S2 HPBtnSrv;HP Chasis Button Service;c:\hp\HPEZBTN\HPBtnSrv.exe [2007-05-29 198240]
S2 NAUpdate;Nero Update;c:\program files\Nero\Update\NASvc.exe [2010-05-04 503080]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2011-01-07 378984]
S2 WDDMService;WD SmartWare Drive Manager;c:\program files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe [2009-11-13 110592]
S2 WDSmartWareBackgroundService;WD SmartWare Background Service;c:\program files\Western Digital\WD SmartWare\Front Parlor\WDSmartWareBackgroundService.exe [2009-06-16 20480]
S3 3xHybrid;CTX SAA713x PCI Card;c:\windows\system32\DRIVERS\3xHybrid.sys [2009-09-24 1006816]
S3 klmouflt;Kaspersky Lab KLMOUFLT;c:\windows\system32\DRIVERS\klmouflt.sys [2009-11-02 19984]
S3 netr73;USB-Drahtlos-802.11 b/g-Adaptertreiber für Vista;c:\windows\system32\DRIVERS\netr73.sys [2009-07-13 545792]
S3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\DRIVERS\wdcsam.sys [2009-02-13 11520]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
Akamai	REG_MULTI_SZ   	Akamai
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2009-06-17 11:11	451872	----a-w-	c:\program files\Common Files\LightScribe\LSRunOnce.exe
.
Inhalt des "geplante Tasks" Ordners
.
2011-05-10 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-03-27 08:48]
.
2011-05-10 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-03-27 08:48]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.google.de/
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=DE_DE&c=74&bd=Pavilion&pf=desktop
uInternet Settings,ProxyOverride = *.local
IE: add to &BOM - c:\\PROGRA~1\\BIET-O~1\\\\AddToBOM.hta
IE: An OneNote s&enden - c:\progra~1\MICROS~2\Office14\ONBttnIE.dll/105
IE: Free YouTube Download - c:\users\Alex\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm
IE: Free YouTube to MP3 Converter - c:\users\Alex\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm
IE: Nach Microsoft &Excel exportieren - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Nach Microsoft E&xcel exportieren - c:\progra~1\MICROS~2\Office14\EXCEL.EXE/3000
IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\users\Alex\AppData\Roaming\Mozilla\Firefox\Profiles\t7fkiur8.default\
FF - prefs.js: browser.search.selectedEngine - iload.to
FF - prefs.js: browser.startup.homepage - hxxp://www.google.de/
FF - prefs.js: network.proxy.type - 0
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Anti-Banner: KavAntiBanner@Kaspersky.ru - c:\program files\Mozilla Firefox\extensions\KavAntiBanner@Kaspersky.ru
FF - Ext: Modul zur Link-Untersuchung: linkfilter@kaspersky.ru - c:\program files\Mozilla Firefox\extensions\linkfilter@kaspersky.ru
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
FF - Ext: DVDVideoSoft Menu: {ACAA314B-EEBA-48e4-AD47-84E31C44796C} - %profile%\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
MSConfigStartUp-EA Core - c:\program files\Electronic Arts\EADM\Core.exe
MSConfigStartUp-RGSC - c:\program files\Spiele\Rockstar Games\Rockstar Games Social Club\RGSCLauncher.exe
.
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\npggsvc]
"ImagePath"="c:\windows\system32\GameMon.des -service"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\S-1-5-21-4146598908-1969735870-1766285717-1000\Software\SecuROM\License information*]
"datasecu"=hex:b1,a3,0a,37,f4,69,89,17,f0,fe,c6,50,46,f3,d9,07,f7,10,16,d4,6b,
   7c,63,61,55,60,45,40,95,b4,fc,20,8b,87,c2,5c,8e,ca,5b,11,52,5b,e3,81,dc,93,\
"rkeysecu"=hex:2f,0f,d5,3e,02,2b,06,63,b1,0b,dd,b6,71,e2,54,98
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2011-05-10  13:44:49
ComboFix-quarantined-files.txt  2011-05-10 11:44
.
Vor Suchlauf: 11 Verzeichnis(se), 201.278.644.224 Bytes frei
Nach Suchlauf: 19 Verzeichnis(se), 201.201.664.000 Bytes frei
.
- - End Of File - - 6802386696D4201F4EA9B2E737086261

cosinus · 10.05.2011, 13:07

Combofix - Scripten

1. Starte das Notepad (Start / Ausführen / notepad[Enter])

2. Jetzt füge mit copy/paste den ganzen Inhalt der untenstehenden Codebox in das Notepad Fenster ein.

Code:

ATTFilter

File::
c:\windows\system32\drivers\EagleXNt.sys

Driver::
EagleXNt

3. Speichere im Notepad als CFScript.txt auf dem Desktop.

4. Deaktivere den Guard Deines Antivirenprogramms und eine eventuell vorhandene Software Firewall.
(Auch Guards von Ad-, Spyware Programmen und den Tea Timer (wenn vorhanden) !)

5. Dann ziehe die CFScript.txt auf die cofi.exe, so wie es im unteren Bild zu sehen ist. Damit wird Combofix neu gestartet.

6. Nach dem Neustart (es wird gefragt ob Du neustarten willst), poste bitte die folgenden Log Dateien:
Combofix.txt

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!

Kangoo96 · 10.05.2011, 13:41

Hier das neue Log-File:

Code:

ATTFilter

ComboFix 11-05-09.02 - Alex 10.05.2011  14:12:38.2.2 - x86
Microsoft Windows 7 Home Premium   6.1.7600.0.1252.49.1031.18.3071.1879 [GMT 2:00]
ausgeführt von:: c:\users\Alex\Desktop\cofi.exe
Benutzte Befehlsschalter :: c:\users\Alex\Desktop\CFScript.txt
AV: Kaspersky Internet Security *Disabled/Updated* {56547CC9-C9B2-849D-8FEF-A496150D6A06}
FW: Kaspersky Internet Security *Disabled* {6E6FFDEC-83DD-85C5-A4B0-0DA3EBDE2D7D}
SP: Kaspersky Internet Security *Disabled/Updated* {ED359D2D-EF88-8B13-B55F-9FE46E8A20BB}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
FILE ::
"c:\windows\system32\drivers\EagleXNt.sys"
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
.
(((((((((((((((((((((((((((((((((((((((   Treiber/Dienste   )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_EAGLEXNT
-------\Service_EagleXNt
.
.
(((((((((((((((((((((((   Dateien erstellt von 2011-04-10 bis 2011-05-10  ))))))))))))))))))))))))))))))
.
.
2011-05-10 12:25 . 2011-05-10 12:27	--------	d-----w-	c:\users\NeroMediaHomeUser.4\AppData\Local\temp
2011-05-10 12:25 . 2011-05-10 12:25	--------	d-----w-	c:\users\Default\AppData\Local\temp
2011-05-10 11:31 . 2011-05-10 11:44	--------	d-----w-	C:\cofi
2011-05-10 11:26 . 2011-05-10 11:26	--------	d-----w-	c:\program files\CCleaner
2011-05-09 13:48 . 2011-05-09 13:48	--------	d-----w-	C:\_OTL
2011-05-08 14:12 . 2011-05-08 14:12	--------	d-----w-	c:\users\Alex\AppData\Roaming\Malwarebytes
2011-05-08 14:12 . 2010-12-20 16:09	38224	----a-w-	c:\windows\system32\drivers\mbamswissarmy.sys
2011-05-08 14:12 . 2011-05-08 14:12	--------	d-----w-	c:\programdata\Malwarebytes
2011-05-08 14:12 . 2011-05-08 14:12	--------	d-----w-	c:\program files\Malwarebytes' Anti-Malware
2011-05-08 14:12 . 2010-12-20 16:08	20952	----a-w-	c:\windows\system32\drivers\mbam.sys
2011-05-08 12:34 . 2011-05-08 12:34	--------	d-----w-	c:\program files\18 WoS Voll aufs Gas
2011-05-06 11:32 . 2011-04-11 07:04	7071056	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{F6B93263-E3AB-426A-ADD7-AB33A66AD44E}\mpengine.dll
2011-05-04 14:07 . 2011-05-04 14:08	--------	d-----w-	c:\users\Alex\AppData\Local\Microsoft Games
2011-04-28 16:51 . 2011-05-08 10:30	--------	d-----w-	c:\programdata\TrackMania
2011-04-28 14:59 . 2011-04-28 14:59	--------	d-sh--w-	c:\programdata\SecuROM
2011-04-28 14:56 . 2009-03-16 12:18	69448	----a-w-	c:\windows\system32\XAPOFX1_3.dll
2011-04-28 14:56 . 2009-03-16 12:18	517448	----a-w-	c:\windows\system32\XAudio2_4.dll
2011-04-28 14:56 . 2009-03-16 12:18	235352	----a-w-	c:\windows\system32\xactengine3_4.dll
2011-04-28 14:56 . 2009-03-09 13:27	4178264	----a-w-	c:\windows\system32\D3DX9_41.dll
2011-04-28 14:56 . 2009-03-16 12:18	22360	----a-w-	c:\windows\system32\X3DAudio1_6.dll
2011-04-28 14:46 . 2011-04-28 14:46	--------	d--h--r-	c:\users\Alex\AppData\Roaming\SecuROM
2011-04-27 05:11 . 2011-02-18 05:33	31232	----a-w-	c:\windows\system32\prevhost.exe
2011-04-27 05:10 . 2011-03-11 05:44	146304	----a-w-	c:\windows\system32\drivers\storport.sys
2011-04-27 05:10 . 2011-03-11 05:44	143744	----a-w-	c:\windows\system32\drivers\nvstor.sys
2011-04-27 05:10 . 2011-03-11 05:44	1210240	----a-w-	c:\windows\system32\drivers\ntfs.sys
2011-04-27 05:10 . 2011-03-11 05:44	117120	----a-w-	c:\windows\system32\drivers\nvraid.sys
2011-04-27 05:10 . 2011-03-11 05:43	80256	----a-w-	c:\windows\system32\drivers\amdsata.sys
2011-04-27 05:10 . 2011-03-11 05:39	1686016	----a-w-	c:\windows\system32\esent.dll
2011-04-27 05:10 . 2011-03-11 05:43	332160	----a-w-	c:\windows\system32\drivers\iaStorV.sys
2011-04-27 05:10 . 2011-03-11 05:43	22400	----a-w-	c:\windows\system32\drivers\amdxata.sys
2011-04-27 05:10 . 2011-03-11 05:37	74240	----a-w-	c:\windows\system32\fsutil.exe
2011-04-27 05:10 . 2011-03-12 11:31	442880	----a-w-	c:\windows\system32\XpsPrint.dll
2011-04-27 05:10 . 2011-02-26 05:33	2614784	----a-w-	c:\windows\explorer.exe
2011-04-18 15:15 . 2011-04-18 17:02	--------	d-----w-	c:\users\Alex\AppData\Roaming\DVDVideoSoft
2011-04-18 10:41 . 2011-04-18 12:23	--------	d-----w-	C:\Referat
2011-04-17 09:36 . 2011-04-29 19:22	--------	d-----w-	c:\users\Alex\AppData\Roaming\dvdcss
2011-04-15 21:01 . 2011-04-18 15:16	--------	d-----w-	c:\program files\Common Files\DVDVideoSoft
2011-04-15 21:01 . 2011-04-18 15:15	--------	d-----w-	c:\program files\DVDVideoSoft
2011-04-15 20:51 . 2011-04-15 20:51	--------	d-----w-	c:\program files\eRightSoft
2011-04-14 11:24 . 2011-02-23 05:05	309760	----a-w-	c:\windows\system32\drivers\srv2.sys
2011-04-14 11:24 . 2011-02-23 05:06	311296	----a-w-	c:\windows\system32\drivers\srv.sys
2011-04-14 11:24 . 2011-02-23 05:05	113664	----a-w-	c:\windows\system32\drivers\srvnet.sys
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-04-28 15:00 . 2009-08-18 10:30	564632	----a-w-	c:\programdata\Microsoft\IdentityCRL\production\wlidui.dll
2011-04-28 15:00 . 2009-08-18 10:24	18328	----a-w-	c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
2011-04-15 04:17 . 2011-02-04 20:07	2300696	----a-w-	c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup\markup.dll
2011-04-15 04:17 . 2011-02-10 13:25	42776	----a-w-	c:\programdata\Microsoft\eHome\Packages\MCEClientUX\dSM-2\StartResources.dll
2011-04-11 04:11 . 2011-04-04 03:38	2300696	----a-w-	c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup-2\markup.dll
2011-04-11 04:11 . 2011-02-04 20:06	42776	----a-w-	c:\programdata\Microsoft\eHome\Packages\MCEClientUX\dSM\StartResources.dll
2011-04-11 04:11 . 2011-02-10 13:25	1220416	----a-w-	c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight-2\SpotlightResources.dll
2011-04-09 16:55 . 2011-04-09 16:55	15453336	----a-w-	c:\windows\system32\xlive.dll
2011-04-09 16:55 . 2011-04-09 16:55	13642904	----a-w-	c:\windows\system32\xlivefnt.dll
2011-04-08 04:43 . 2011-02-04 20:06	1220416	----a-w-	c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll
2011-02-19 05:33 . 2011-03-09 15:36	802304	----a-w-	c:\windows\system32\FntCache.dll
2011-02-19 05:32 . 2011-03-09 15:36	1074176	----a-w-	c:\windows\system32\DWrite.dll
2011-02-19 05:32 . 2011-03-09 15:36	739840	----a-w-	c:\windows\system32\d2d1.dll
2011-02-18 15:36 . 2011-02-18 15:36	41984	----a-w-	c:\windows\system32\drivers\usbaapl.sys
2011-02-18 15:36 . 2011-02-18 15:36	4184352	----a-w-	c:\windows\system32\usbaaplrc.dll
2011-02-11 20:47 . 2011-02-11 20:47	2300696	----a-w-	c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup-5\markup.dll
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2011-01-26 15026056]
"LightScribe Control Panel"="c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe" [2009-06-17 2363392]
"EADM"="c:\program files\Electronic Arts\EADM\EADMUI.exe" [2011-03-03 11509760]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="RtHDVCpl.exe" [2007-07-06 4669440]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 40048]
"HP Health Check Scheduler"="c:\program files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe" [2007-05-24 71176]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2005-02-16 49152]
"hpsysdrv"="c:\hp\support\hpsysdrv.exe" [2007-04-18 65536]
"KBD"="c:\hp\KBD\KbdStub.EXE" [2006-12-08 65536]
"OsdMaestro"="c:\program files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe" [2007-02-15 118784]
"SunJavaUpdateReg"="c:\windows\system32\jureg.exe" [2007-04-07 54936]
"AVP"="c:\program files\Kaspersky Lab\Kaspersky Internet Security 2011\avp.exe" [2010-11-02 365336]
"LogitechQuickCamRibbon"="c:\program files\Logitech\Logitech WebCam Software\LWS.exe" [2009-10-14 2793304]
"LXCGCATS"="c:\windows\system32\spool\DRIVERS\W32X86\3\LXCGtime.dll" [2007-02-22 73728]
"lxcgmon.exe"="c:\program files\Lexmark 2300 Series\lxcgmon.exe" [2007-04-29 205744]
"EzPrint"="c:\program files\Lexmark 2300 Series\ezprint.exe" [2007-04-29 103344]
"HPUsageTracking"="c:\program files\HP\HP UT\bin\hppusg.exe" [2009-05-11 24576]
"BCSSync"="c:\program files\Microsoft Office\Office14\BCSSync.exe" [2010-03-13 91520]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
"Nero MediaHome 4"="c:\program files\Nero\Nero MediaHome 4\NeroMediaHome.exe" [2010-03-08 5174568]
"TkBellExe"="c:\program files\Real\RealPlayer\Update\realsched.exe" [2011-02-23 273544]
"VirtualCloneDrive"="c:\program files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" [2006-04-29 94208]
"CloneCDTray"="c:\program files\SlySoft\CloneCD\CloneCDTray.exe" [2006-09-28 57344]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-11-29 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2011-03-07 421160]
"Malwarebytes' Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2010-12-20 963976]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Acrobat Assistant.lnk - c:\program files\Adobe\Acrobat 6.0\Distillr\acrotray.exe [2003-5-15 217193]
Adobe Gamma Loader.exe.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2011-1-23 110592]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]
WDDMStatus.lnk - c:\program files\Western Digital\WD SmartWare\WD Drive Manager\WDDMStatus.exe [2009-11-13 2057536]
WDSmartWare.lnk - c:\program files\Western Digital\WD SmartWare\Front Parlor\WDSmartWare.exe [2009-11-13 9117504]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\progra~1\KASPER~1\KASPER~1\kloehk.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux2"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages	REG_MULTI_SZ   	kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2011-03-27 136176]
R3 gupdatem;Google Update-Dienst (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2011-03-27 136176]
R3 HCW85BDA;Hauppauge WinTV 885 Video Capture;c:\windows\system32\drivers\HCW85BDA.sys [2007-06-11 968064]
R3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des [2010-06-07 3549224]
R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4640000]
R3 Ph3xIB32;Philips 713x Inbox PCI TV Card;c:\windows\system32\DRIVERS\Ph3xIB32.sys [2009-07-13 1311232]
S1 kl2;kl2;c:\windows\system32\DRIVERS\kl2.sys [2010-06-09 11352]
S1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter;c:\windows\system32\DRIVERS\klim6.sys [2010-04-22 22104]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-13 48128]
S2 Akamai;Akamai NetSession Interface;c:\windows\System32\svchost.exe [2009-07-14 20992]
S2 HPBtnSrv;HP Chasis Button Service;c:\hp\HPEZBTN\HPBtnSrv.exe [2007-05-29 198240]
S2 NAUpdate;Nero Update;c:\program files\Nero\Update\NASvc.exe [2010-05-04 503080]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2011-01-07 378984]
S2 WDDMService;WD SmartWare Drive Manager;c:\program files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe [2009-11-13 110592]
S2 WDSmartWareBackgroundService;WD SmartWare Background Service;c:\program files\Western Digital\WD SmartWare\Front Parlor\WDSmartWareBackgroundService.exe [2009-06-16 20480]
S3 3xHybrid;CTX SAA713x PCI Card;c:\windows\system32\DRIVERS\3xHybrid.sys [2009-09-24 1006816]
S3 klmouflt;Kaspersky Lab KLMOUFLT;c:\windows\system32\DRIVERS\klmouflt.sys [2009-11-02 19984]
S3 netr73;USB-Drahtlos-802.11 b/g-Adaptertreiber für Vista;c:\windows\system32\DRIVERS\netr73.sys [2009-07-13 545792]
S3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\DRIVERS\wdcsam.sys [2009-02-13 11520]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
Akamai	REG_MULTI_SZ   	Akamai
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2009-06-17 11:11	451872	----a-w-	c:\program files\Common Files\LightScribe\LSRunOnce.exe
.
Inhalt des "geplante Tasks" Ordners
.
2011-05-10 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-03-27 08:48]
.
2011-05-10 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-03-27 08:48]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.google.de/
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=DE_DE&c=74&bd=Pavilion&pf=desktop
uInternet Settings,ProxyOverride = *.local
IE: add to &BOM - c:\\PROGRA~1\\BIET-O~1\\\\AddToBOM.hta
IE: An OneNote s&enden - c:\progra~1\MICROS~2\Office14\ONBttnIE.dll/105
IE: Free YouTube Download - c:\users\Alex\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm
IE: Free YouTube to MP3 Converter - c:\users\Alex\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm
IE: Nach Microsoft &Excel exportieren - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Nach Microsoft E&xcel exportieren - c:\progra~1\MICROS~2\Office14\EXCEL.EXE/3000
IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\users\Alex\AppData\Roaming\Mozilla\Firefox\Profiles\t7fkiur8.default\
FF - prefs.js: browser.search.selectedEngine - iload.to
FF - prefs.js: browser.startup.homepage - hxxp://www.google.de/
FF - prefs.js: network.proxy.type - 0
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Anti-Banner: KavAntiBanner@Kaspersky.ru - c:\program files\Mozilla Firefox\extensions\KavAntiBanner@Kaspersky.ru
FF - Ext: Modul zur Link-Untersuchung: linkfilter@kaspersky.ru - c:\program files\Mozilla Firefox\extensions\linkfilter@kaspersky.ru
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
FF - Ext: DVDVideoSoft Menu: {ACAA314B-EEBA-48e4-AD47-84E31C44796C} - %profile%\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\npggsvc]
"ImagePath"="c:\windows\system32\GameMon.des -service"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\S-1-5-21-4146598908-1969735870-1766285717-1000\Software\SecuROM\License information*]
"datasecu"=hex:b1,a3,0a,37,f4,69,89,17,f0,fe,c6,50,46,f3,d9,07,f7,10,16,d4,6b,
   7c,63,61,55,60,45,40,95,b4,fc,20,8b,87,c2,5c,8e,ca,5b,11,52,5b,e3,81,dc,93,\
"rkeysecu"=hex:2f,0f,d5,3e,02,2b,06,63,b1,0b,dd,b6,71,e2,54,98
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\windows\system32\nvvsvc.exe
c:\program files\NVIDIA Corporation\Display\NvXDSync.exe
c:\windows\system32\nvvsvc.exe
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\windows\system32\lxcgcoms.exe
c:\program files\Nero\Nero MediaHome 4\NMMediaServerService.exe
c:\windows\system32\taskhost.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
c:\windows\system32\spool\DRIVERS\W32X86\3\HP1006MC.EXE
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
c:\windows\system32\taskhost.exe
c:\windows\system32\conhost.exe
c:\windows\system32\WUDFHost.exe
c:\windows\RtHDVCpl.exe
c:\windows\system32\schtasks.exe
c:\windows\system32\conhost.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\program files\iPod\bin\iPodService.exe
c:\program files\Hewlett-Packard\HP Health Check\hphc_service.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2011-05-10  14:40:18 - PC wurde neu gestartet
ComboFix-quarantined-files.txt  2011-05-10 12:40
ComboFix2.txt  2011-05-10 11:44
.
Vor Suchlauf: 19 Verzeichnis(se), 201.242.181.632 Bytes frei
Nach Suchlauf: 20 Verzeichnis(se), 200.741.298.176 Bytes frei
.
- - End Of File - - DF390F949202FDE660D4A9021D21D94D

cosinus · 10.05.2011, 14:09

Ok. Bitte nun Logs mit GMER und OSAM erstellen und posten.
GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus - die Online-Abfrage durch OSAM bitte überspringen.
Bei OSAM bitte darauf auch achten, dass Du das Log auch als *.log und nicht *.html oder so abspeicherst.

Downloade Dir danach bitte MBRCheck (by a_d_13) und speichere die Datei auf dem Desktop.

Doppelklick auf die MBRCheck.exe.
Vista und Win7 User mit Rechtsklick "als Administrator starten"
Das Tool braucht nur wenige Sekunden.
Danach solltest du eine MBRCheck_<Datum>_<Uhrzeit>.txt auf dem Desktop finden.

Poste mir bitte den Inhalt des .txt Dokumentes

Kangoo96 · 10.05.2011, 14:27

GMER hat sich aufgehangen!

Osam Log:

Code:

ATTFilter

Report of OSAM: Autorun Manager v5.0.11926.0
hxxp://www.online-solutions.ru/en/
Saved at 15:25:31 on 10.05.2011

OS: Windows 7 Home Premium Edition (Build 7600), 32-bit
Default Browser: Mozilla Corporation Firefox 3.6.17

Scanner Settings
[x] Rootkits detection (hidden registry)
[x] Rootkits detection (hidden files)
[x] Retrieve files information
[x] Check Microsoft signatures

Filters
[ ] Trusted entries
[ ] Empty entries
[x] Hidden registry entries (rootkit activity)
[x] Exclusively opened files
[x] Not found files
[x] Files without detailed information
[x] Existing files
[ ] Non-startable services
[ ] Non-startable drivers
[x] Active entries
[x] Disabled entries


[AppInit DLLs]
-----( HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows )-----
"AppInit_DLLs" - "Kaspersky Lab ZAO" - C:\PROGRA~1\KASPER~1\KASPER~1\kloehk.dll

[Common]
-----( %SystemRoot%\Tasks )-----
"GoogleUpdateTaskMachineCore.job" - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe
"GoogleUpdateTaskMachineUA.job" - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe

[Control Panel Objects]
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )-----
"mlcfg32.cpl" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office14\MLCFG32.CPL
"Nero BurnRights 10" - "Nero AG" - C:\Program Files\Nero\Nero 10\Nero BurnRights\NeroBurnRights_10.cpl
"QuickTime" - "Apple Inc." - C:\Program Files\QuickTime\QTSystem\QuickTime.cpl

[Drivers]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"AnyDVD" (AnyDVD) - "SlySoft, Inc." - C:\Windows\System32\Drivers\AnyDVD.sys
"catchme" (catchme) - ? - C:\Users\Alex\AppData\Local\Temp\catchme.sys  (File not found)
"ElbyCDFL" (ElbyCDFL) - "SlySoft, Inc." - C:\Windows\System32\Drivers\ElbyCDFL.sys
"ElbyCDIO Driver" (ElbyCDIO) - "Elaborate Bytes AG" - C:\Windows\System32\Drivers\ElbyCDIO.sys
"Hamachi Network Interface" (hamachi) - "LogMeIn, Inc." - C:\Windows\System32\DRIVERS\hamachi.sys
"PxHelp20" (PxHelp20) - "Sonic Solutions" - C:\Windows\System32\Drivers\PxHelp20.sys
"StarForce Protection Environment Driver (version 1.x)" (sfdrv01) - "Protection Technology" - C:\Windows\System32\drivers\sfdrv01.sys
"StarForce Protection Helper Driver (version 2.x)" (sfhlp02) - "Protection Technology" - C:\Windows\System32\drivers\sfhlp02.sys
"StarForce Protection Synchronization Driver (version 2.x)" (sfsync02) - "Protection Technology" - C:\Windows\System32\drivers\sfsync02.sys
"StarForce Protection VFS Driver (version 2.x)" (sfvfs02) - "Protection Technology" - C:\Windows\System32\drivers\sfvfs02.sys
"VClone" (VClone) - "Elaborate Bytes AG" - C:\Windows\System32\DRIVERS\VClone.sys

[Explorer]
-----( HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components )-----
{10880D85-AAD9-4558-ABDC-2AB1552D831F} "LightScribe Control Panel" - "Hewlett-Packard Company" - "C:\Program Files\Common Files\LightScribe\LSRunOnce.exe"
{44BBA840-CC51-11CF-AAFA-00AA00B6015C} "Microsoft Windows" - "Microsoft Corporation" - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----
{F9DB5320-233E-11D1-9F84-707F02C10627} "{F9DB5320-233E-11D1-9F84-707F02C10627}" - ? -   (File not found | COM-object registry key not found)
-----( HKLM\Software\Classes\Protocols\Filter )-----
{807553E5-5146-11D5-A672-00B0D022E945} "text/xml" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL
-----( HKLM\Software\Classes\Protocols\Handler )-----
{32505114-5902-49B2-880A-1F7738E5A384} "Data Page Plugable Protocal mso-offdap11 Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\WEBCOM~1\11\OWC11.DLL
{3D9F03FA-7A94-11D3-BE81-0050048385D1} "Data Page Pluggable Protocol mso-offdap Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\WEBCOM~1\10\OWC10.DLL
{314111c7-a502-11d2-bbca-00c04f8ec294} "HxProtocol Class" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
{FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} "IEProtocolHandler Class" - "Skype Technologies" - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
{0A9007C0-4076-11D3-8789-0000F8105754} "Microsoft Infotech Storage Protocol for IE 4.0" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll
{CD00020A-8B95-11D1-82DB-00C04FB1625D} "Microsoft PKM KnowledgePluggable Class" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Web Folders\PKMCDO.DLL
{91774881-D725-4E58-B298-07617B9B86A8} "Skype IE add-on Pluggable Protocol" - "Skype Technologies S.A." - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----
{911051fa-c21c-4246-b470-070cd8df6dc4} ".cab or .zip files" - ? -   (File not found | COM-object registry key not found)
{D25B2CAB-8A9A-4517-A9B2-CB5F68A5A802} "Acrobat Elements Context Menu" - "Adobe Systems Inc." - C:\Program Files\Adobe\Acrobat 6.0\Acrobat Elements\ContextMenu.dll
{1b24a030-9b20-49bc-97ac-1be4426f9e59} "ActiveDirectory Folder" - ? -   (File not found | COM-object registry key not found)
{34449847-FD14-4fc8-A75A-7432F5181EFB} "ActiveDirectory Folder" - ? -   (File not found | COM-object registry key not found)
{D66DC78C-4F61-447F-942B-3FB6980118CF} "CInfoTipShellExt Class" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office14\VISSHE.DLL
{0F8604A5-4ECE-4DE1-BA7D-CF10F8AA4F48} "Contacts folder" - ? -   (File not found | COM-object registry key not found)
{A70C977A-BF00-412C-90B7-034C51DA2439} "DesktopContext Class" - "NVIDIA Corporation" - C:\Program Files\NVIDIA Corporation\Display\nvui.dll
{2C2577C2-63A7-40e3-9B7F-586602617ECB} "Explorer Query Band" - ? -   (File not found | COM-object registry key not found)
{506F4668-F13E-4AA1-BB04-B43203AB3CC0} "ImageExtractorShellExt Class" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office14\VISSHE.DLL
{B9E1D2CB-CCFF-4AA6-9579-D7A4754030EF} "iTunes" - "Apple Inc." - C:\Program Files\iTunes\iTunesMiniPlayer.dll
{42042206-2D85-11D3-8CFF-005004838597} "Microsoft Office HTML Icon Handler" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office14\msohevi.dll
{993BE281-6695-4BA5-8A2A-7AACBFAAB69E} "Microsoft Office Metadata Handler" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\OFFICE14\msoshext.dll
{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97} "Microsoft Office Thumbnail Handler" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\OFFICE14\msoshext.dll
{00020D75-0000-0000-C000-000000000046} "Microsoft Outlook" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office14\MLSHEXT.DLL
{F764812A-132C-4013-9960-5CBBEB408A0E} "NeroShellExt Class" - "Nero AG" - C:\Program Files\Common Files\Nero\NeroShellExt\NeroShellExt.dll
{3D1975AF-48C6-4f8e-A182-BE0E08FA86A9} "NVIDIA CPL Context Menu Extension" - "NVIDIA Corporation" - C:\Windows\system32\nvshext.dll
{0006F045-0000-0000-C000-000000000046} "Outlook File Icon Extension" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office14\OLKFSTUB.DLL
{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4} "RealOne Player Context Menu Class" - "RealNetworks, Inc." - C:\Program Files\Real\RealPlayer\rpshell.dll
{C8494E42-ACDD-4739-B0FB-217361E4894F} "Sam Account Folder" - ? -   (File not found | COM-object registry key not found)
{E29F9716-5C08-4FCD-955A-119FDB5A522D} "Sam Account Folder" - ? -   (File not found | COM-object registry key not found)
{7F67036B-66F1-411A-AD85-759FB9C5B0DB} "ShellViewRTF" - "XSS" - C:\Windows\System32\ShellvRTF.dll
{B7056B8E-4F99-44f8-8CBD-282390FE5428} "VirtualCloneDrive Shell Extension" - "Elaborate Bytes AG" - C:\Program Files\Elaborate Bytes\VirtualCloneDrive\ElbyVCDShell.dll
{BDEADF00-C265-11D0-BCED-00A0C90AB50F} "Webordner" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\WEBFOL~1\MSONSEXT.DLL
{da67b8ad-e81b-4c70-9b91b417b5e33527} "Windows Search Shell Service" - ? -   (File not found | COM-object registry key not found)
{B41DB860-8EE4-11D2-9906-E49FADC173CA} "WinRAR" - "Alexander Roshal" - C:\Program Files\WinRAR\rarext.dll

[Internet Explorer]
-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----
{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} "Java Plug-in 1.6.0_01" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab
{8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.6.0_22" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} "Java Plug-in 1.6.0_22" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_22" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\npjpi160_22.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----
{4248FE82-7FCB-46AC-B270-339F08212110} "&Virtuelle Tastatur" - "Kaspersky Lab ZAO" - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\klwtbbho.dll
{CCF151D8-D089-449F-A5A4-D9909053F20F} "Li&nks untersuchen" - "Kaspersky Lab ZAO" - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\klwtbbho.dll
{FF059E31-CC5A-4E2E-BF3B-96E929D65503} "Recherchieren" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
{898EA8C8-E7FF-479B-8935-AEC46303B9E5} "Skype Plug-In" - "Skype Technologies S.A." - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} "AcroIEHlprObj Class" - "Adobe Systems Incorporated" - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
{E33CF602-D945-461A-83F0-819F76A199F8} "FilterBHO Class" - "Kaspersky Lab ZAO" - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\klwtbbho.dll
{59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} "IEVkbdBHO Class" - "Kaspersky Lab ZAO" - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\ievkbd.dll
{DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2ssv.dll
{B4F3A835-0E21-4959-BA22-42B3008E02FF} "Office Document Cache Handler" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office14\URLREDIR.DLL
{AE805869-2E5C-4ED4-8F7B-F1F7851A4497} "Skype Plug-In" - "Skype Technologies S.A." - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
{9030D464-4C02-4ABF-8ECC-5164760863C6} "Windows Live ID Sign-in Helper" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

[LSA Providers]
-----( HKLM\SYSTEM\CurrentControlSet\Control\Lsa )-----
"Security Packages" - "Microsoft Corporation" - C:\Windows\system32\livessp.dll

[Logon]
-----( %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup )-----
"desktop.ini" - ? - C:\Users\Alex\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
-----( %AllUsersProfile%\Microsoft\Windows\Start Menu\Programs\Startup )-----
"Acrobat Assistant.lnk" - "Adobe Systems Inc." - C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe  (Shortcut exists | File exists)
"Adobe Gamma Loader.exe.lnk" - "Adobe Systems, Inc." - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe  (Shortcut exists | File exists)
"desktop.ini" - ? - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
"Microsoft Office.lnk" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office10\OSA.EXE  (Shortcut exists | File exists)
"WDDMStatus.lnk" - "WDC" - C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMStatus.exe  (Shortcut exists | File exists)
"WDSmartWare.lnk" - "Western Digital" - C:\Program Files\Western Digital\WD SmartWare\Front Parlor\WDSmartWare.exe  (Shortcut exists | File exists)
-----( HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run )-----
"EADM" - "Electronic Arts" - "C:\Program Files\Electronic Arts\EADM\EADMUI.exe"
"LightScribe Control Panel" - "Hewlett-Packard Company" - C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden
"Skype" - "Skype Technologies S.A." - "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
-----( HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\Wds\rdpwd )-----
"StartupPrograms" - ? - rdpclip  (File not found)
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----
"Adobe Reader Speed Launcher" - "Adobe Systems Incorporated" - "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
"AVP" - "Kaspersky Lab ZAO" - "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\avp.exe"
"BCSSync" - "Microsoft Corporation" - "C:\Program Files\Microsoft Office\Office14\BCSSync.exe" /DelayServices
"CloneCDTray" - "SlySoft, Inc." - "C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" /s
"EzPrint" - "Lexmark International Inc." - "C:\Program Files\Lexmark 2300 Series\ezprint.exe"
"HP Health Check Scheduler" - "Hewlett-Packard" - c:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
"HP Software Update" - "Hewlett-Packard Co." - c:\Program Files\HP\HP Software Update\HPWuSchd2.exe
"hpsysdrv" - "Hewlett-Packard Company" - c:\hp\support\hpsysdrv.exe
"HPUsageTracking" - "Hewlett-Packard Company" - C:\Program Files\HP\HP UT\bin\hppusg.exe "C:\Program Files\HP\HP UT\"
"iTunesHelper" - "Apple Inc." - "C:\Program Files\iTunes\iTunesHelper.exe"
"KBD" - ? - C:\HP\KBD\KbdStub.EXE  (File found, but it contains no detailed information)
"LogitechQuickCamRibbon" - "Logitech Inc." - "C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe" /hide
"lxcgmon.exe" - "Lexmark International, Inc." - "C:\Program Files\Lexmark 2300 Series\lxcgmon.exe"
"Malwarebytes' Anti-Malware (reboot)" - "Malwarebytes Corporation" - "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
"Nero MediaHome 4" - "Nero AG" - "C:\Program Files\Nero\Nero MediaHome 4\NeroMediaHome.exe" /AUTORUN
"OsdMaestro" - "OsdMaestro" - "C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe"
"QuickTime Task" - "Apple Inc." - "C:\Program Files\QuickTime\QTTask.exe" -atboottime
"SunJavaUpdateReg" - "Sun Microsystems, Inc." - "C:\Windows\system32\jureg.exe"
"SunJavaUpdateSched" - "Sun Microsystems, Inc." - "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
"TkBellExe" - "RealNetworks, Inc." - "C:\Program Files\Real\RealPlayer\Update\realsched.exe" -osboot
"VirtualCloneDrive" - "Elaborate Bytes AG" - "C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" /s

[Print Monitors]
-----( HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors )-----
"Adobe PDF Port" - "Adobe Systems Incorporated." - C:\Windows\system32\AdobePDF.dll
"Microsoft Document Imaging Writer Monitor" - "Microsoft Corporation" - C:\Windows\system32\mdimon.dll

[Services]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"@C:\Program Files\Nero\Update\NASvc.exe,-200" (NAUpdate) - "Nero AG" - C:\Program Files\Nero\Update\NASvc.exe
"Akamai NetSession Interface" (Akamai) - ? - c:\program files\common files\akamai\netsession_win_3f211bc.dll  (File found, but it contains no detailed information)
"Apple Mobile Device" (Apple Mobile Device) - "Apple Inc." - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
"ASP.NET-Zustandsdienst" (aspnet_state) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe
"Dienst "Bonjour"" (Bonjour Service) - "Apple Inc." - C:\Program Files\Bonjour\mDNSResponder.exe
"Google Update Service (gupdate)" (gupdate) - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe
"Google Update-Dienst (gupdatem)" (gupdatem) - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe
"HP Chasis Button Service" (HPBtnSrv) - ? - c:\hp\HPEZBTN\HPBtnSrv.exe  (File found, but it contains no detailed information)
"HP Health Check Service" (HP Health Check Service) - "Hewlett-Packard" - c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
"InstallDriver Table Manager" (IDriverT) - "Macrovision Corporation" - c:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
"iPod-Dienst" (iPod Service) - "Apple Inc." - C:\Program Files\iPod\bin\iPodService.exe
"Kaspersky Anti-Virus Service" (AVP) - "Kaspersky Lab ZAO" - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\avp.exe
"LightScribeService Direct Disc Labeling Service" (LightScribeService) - "Hewlett-Packard Company" - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
"Microsoft .NET Framework NGEN v4.0.30319_X86" (clr_optimization_v4.0.30319_32) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
"Microsoft Office Diagnostics Service" (odserv) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE
"Nero MediaHome 4 Service" (NeroMediaHomeService.4) - "Nero AG" - C:\Program Files\Nero\Nero MediaHome 4\NMMediaServerService.exe
"nProtect GameGuard Service" (npggsvc) - "INCA Internet Co., Ltd." - C:\Windows\system32\GameMon.des
"NVIDIA Driver Helper Service" (NVSvc) - "NVIDIA Corporation" - C:\Windows\system32\nvvsvc.exe
"NVIDIA Stereoscopic 3D Driver Service" (Stereo Service) - "NVIDIA Corporation" - C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
"Office  Source Engine" (ose) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"Office Software Protection Platform" (osppsvc) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
"Process Monitor" (LVPrcSrv) - "Logitech Inc." - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
"RoxMediaDB9" (RoxMediaDB9) - "Sonic Solutions" - c:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
"stllssvr" (stllssvr) - "MicroVision Development, Inc." - c:\Program Files\Common Files\SureThing Shared\stllssvr.exe
"WD SmartWare Background Service" (WDSmartWareBackgroundService) - "Memeo" - C:\Program Files\Western Digital\WD SmartWare\Front Parlor\WDSmartWareBackgroundService.exe
"WD SmartWare Drive Manager" (WDDMService) - "WDC" - C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe
"Windows Live ID Sign-in Assistant" (wlidsvc) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

[Winlogon]
-----( HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify )-----
"klogon" - "Kaspersky Lab ZAO" - C:\Windows\system32\klogon.dll

[Winsock Providers]
-----( HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries )-----
"mdnsNSP" - "Apple Inc." - C:\Program Files\Bonjour\mdnsNSP.dll
"WindowsLive Local NSP" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL
"WindowsLive NSP" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL

===[ Logfile end ]=========================================[ Logfile end ]===

If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru

-----------------------------------------------------------------

MBR-Check-Log:

Code:

ATTFilter

MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:			
Windows Version:		Windows 7 Home Premium Edition
Windows Information:		 (build 7600), 32-bit
Base Board Manufacturer:	ASUSTek Computer INC.
BIOS Manufacturer:		Phoenix Technologies, LTD
System Manufacturer:		HP-Pavilion
System Product Name:		GU557AA-ABD m9070.de
Logical Drives Mask:		0x00003ffc

Kernel Drivers (total 216):
  0x82E42000 \SystemRoot\system32\ntkrnlpa.exe
  0x82E0B000 \SystemRoot\system32\halmacpi.dll
  0x80B98000 \SystemRoot\system32\kdcom.dll
  0x83831000 \SystemRoot\system32\mcupdate_AuthenticAMD.dll
  0x8383C000 \SystemRoot\system32\PSHED.dll
  0x8384D000 \SystemRoot\system32\BOOTVID.dll
  0x83855000 \SystemRoot\system32\CLFS.SYS
  0x83897000 \SystemRoot\system32\CI.dll
  0x83942000 \SystemRoot\system32\drivers\Wdf01000.sys
  0x839B3000 \SystemRoot\system32\drivers\WDFLDR.SYS
  0x83A16000 \SystemRoot\system32\DRIVERS\ACPI.sys
  0x83A5E000 \SystemRoot\system32\DRIVERS\WMILIB.SYS
  0x83A67000 \SystemRoot\system32\DRIVERS\msisadrv.sys
  0x83A6F000 \SystemRoot\system32\DRIVERS\pci.sys
  0x83A99000 \SystemRoot\system32\DRIVERS\vdrvroot.sys
  0x83AA4000 \SystemRoot\System32\drivers\partmgr.sys
  0x83AB5000 \SystemRoot\system32\DRIVERS\volmgr.sys
  0x83AC5000 \SystemRoot\System32\drivers\volmgrx.sys
  0x83B10000 \SystemRoot\system32\DRIVERS\pciide.sys
  0x83B17000 \SystemRoot\system32\DRIVERS\PCIIDEX.SYS
  0x83B25000 \SystemRoot\System32\drivers\mountmgr.sys
  0x83B44000 \SystemRoot\system32\DRIVERS\atapi.sys
  0x83B4D000 \SystemRoot\system32\DRIVERS\ataport.SYS
  0x83B70000 \SystemRoot\system32\drivers\nvstor.sys
  0x83B95000 \SystemRoot\system32\drivers\storport.sys
  0x83BDC000 \SystemRoot\system32\DRIVERS\nvstor32.sys
  0x83A00000 \SystemRoot\system32\drivers\amdxata.sys
  0x839C1000 \SystemRoot\system32\drivers\fltmgr.sys
  0x83800000 \SystemRoot\system32\drivers\fileinfo.sys
  0x83A09000 \SystemRoot\System32\Drivers\PxHelp20.sys
  0x8B804000 \SystemRoot\System32\Drivers\Ntfs.sys
  0x8B933000 \SystemRoot\System32\Drivers\msrpc.sys
  0x8B95E000 \SystemRoot\System32\Drivers\ksecdd.sys
  0x8B971000 \SystemRoot\System32\Drivers\cng.sys
  0x8B9CE000 \SystemRoot\System32\drivers\pcw.sys
  0x8B9DC000 \SystemRoot\System32\Drivers\Fs_Rec.sys
  0x8BA0D000 \SystemRoot\system32\drivers\ndis.sys
  0x8BAC4000 \SystemRoot\system32\drivers\NETIO.SYS
  0x8BB02000 \SystemRoot\System32\Drivers\ksecpkg.sys
  0x8BC0E000 \SystemRoot\System32\drivers\tcpip.sys
  0x8BD57000 \SystemRoot\System32\drivers\fwpkclnt.sys
  0x8BD88000 \SystemRoot\system32\DRIVERS\volsnap.sys
  0x8BDC7000 \SystemRoot\System32\Drivers\spldr.sys
  0x8BDE3000 \SystemRoot\System32\drivers\sfhlp02.sys
  0x8BB27000 \SystemRoot\System32\drivers\rdyboost.sys
  0x8BB54000 \SystemRoot\System32\Drivers\mup.sys
  0x8BE1C000 \SystemRoot\system32\DRIVERS\kl1.sys
  0x8C33E000 \SystemRoot\System32\drivers\hwpolicy.sys
  0x8C346000 \SystemRoot\System32\DRIVERS\fvevol.sys
  0x8C378000 \SystemRoot\system32\DRIVERS\disk.sys
  0x8C389000 \SystemRoot\system32\DRIVERS\CLASSPNP.SYS
  0x8C3F3000 \SystemRoot\system32\DRIVERS\VClone.sys
  0x8BB64000 \SystemRoot\system32\DRIVERS\SCSIPORT.SYS
  0x8BB8A000 \SystemRoot\system32\DRIVERS\cdrom.sys
  0x91837000 \SystemRoot\system32\DRIVERS\klif.sys
  0x918BA000 \SystemRoot\System32\Drivers\Null.SYS
  0x918C1000 \SystemRoot\System32\Drivers\Beep.SYS
  0x918C8000 \SystemRoot\System32\drivers\vga.sys
  0x918D4000 \SystemRoot\System32\drivers\VIDEOPRT.SYS
  0x918F5000 \SystemRoot\System32\drivers\watchdog.sys
  0x91902000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
  0x9190A000 \SystemRoot\system32\drivers\rdpencdd.sys
  0x91912000 \SystemRoot\system32\drivers\rdprefmp.sys
  0x9191A000 \SystemRoot\System32\Drivers\Msfs.SYS
  0x91925000 \SystemRoot\System32\Drivers\Npfs.SYS
  0x91933000 \SystemRoot\system32\DRIVERS\tdx.sys
  0x9194A000 \SystemRoot\system32\DRIVERS\TDI.SYS
  0x91955000 \SystemRoot\system32\DRIVERS\kl2.sys
  0x9195B000 \SystemRoot\system32\drivers\afd.sys
  0x919B5000 \SystemRoot\System32\DRIVERS\netbt.sys
  0x919E7000 \SystemRoot\system32\DRIVERS\wfplwf.sys
  0x91800000 \SystemRoot\system32\DRIVERS\pacer.sys
  0x9181F000 \SystemRoot\system32\DRIVERS\klim6.sys
  0x919EE000 \SystemRoot\system32\DRIVERS\vwififlt.sys
  0x91827000 \SystemRoot\system32\DRIVERS\netbios.sys
  0x8BE00000 \SystemRoot\system32\DRIVERS\wanarp.sys
  0x8BDCF000 \SystemRoot\system32\DRIVERS\termdd.sys
  0x8BBA9000 \SystemRoot\system32\DRIVERS\rdbss.sys
  0x8BDEB000 \SystemRoot\system32\drivers\nsiproxy.sys
  0x8BDF5000 \SystemRoot\system32\DRIVERS\mssmbios.sys
  0x8BC00000 \SystemRoot\System32\Drivers\ElbyCDIO.sys
  0x8BBEA000 \SystemRoot\System32\drivers\discache.sys
  0x8B9E5000 \SystemRoot\System32\Drivers\dfsc.sys
  0x83811000 \SystemRoot\system32\DRIVERS\blbdrive.sys
  0x92438000 \SystemRoot\system32\DRIVERS\tunnel.sys
  0x92459000 \SystemRoot\system32\DRIVERS\amdk8.sys
  0x9246B000 \SystemRoot\system32\DRIVERS\i8042prt.sys
  0x92483000 \SystemRoot\system32\DRIVERS\PS2.sys
  0x92488000 \SystemRoot\system32\DRIVERS\kbdclass.sys
  0x92495000 \SystemRoot\system32\DRIVERS\usbohci.sys
  0x9249F000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
  0x924EA000 \SystemRoot\system32\DRIVERS\usbehci.sys
  0x924F9000 \SystemRoot\system32\DRIVERS\1394ohci.sys
  0x92C2E000 \SystemRoot\system32\DRIVERS\3xHybrid.sys
  0x92D23000 \SystemRoot\system32\DRIVERS\ks.sys
  0x92D57000 \SystemRoot\system32\DRIVERS\BdaSup.SYS
  0x92D5A000 \SystemRoot\system32\DRIVERS\HDAudBus.sys
  0x92D79000 \SystemRoot\System32\Drivers\ElbyCDFL.sys
  0x92D80000 \SystemRoot\System32\Drivers\AnyDVD.sys
  0x92D99000 \SystemRoot\system32\DRIVERS\GEARAspiWDM.sys
  0x92D9F000 \SystemRoot\system32\DRIVERS\nvmf6232.sys
  0x94C00000 \SystemRoot\system32\DRIVERS\nvlddmkm.sys
  0x955FA000 \SystemRoot\System32\Drivers\nvBridge.kmd
  0x92530000 \SystemRoot\System32\drivers\dxgkrnl.sys
  0x94422000 \SystemRoot\System32\drivers\dxgmms1.sys
  0x9445B000 \SystemRoot\system32\DRIVERS\CompositeBus.sys
  0x94468000 \SystemRoot\system32\DRIVERS\AgileVpn.sys
  0x9447A000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
  0x94492000 \SystemRoot\system32\DRIVERS\ndistapi.sys
  0x9449D000 \SystemRoot\system32\DRIVERS\ndiswan.sys
  0x944BF000 \SystemRoot\system32\DRIVERS\raspppoe.sys
  0x944D7000 \SystemRoot\system32\DRIVERS\raspptp.sys
  0x944EE000 \SystemRoot\system32\DRIVERS\rassstp.sys
  0x94505000 \SystemRoot\System32\Drivers\pcouffin.sys
  0x94511000 \SystemRoot\system32\DRIVERS\mouclass.sys
  0x9451E000 \SystemRoot\system32\DRIVERS\swenum.sys
  0x94520000 \SystemRoot\system32\DRIVERS\circlass.sys
  0x9452E000 \SystemRoot\system32\DRIVERS\umbus.sys
  0x9453C000 \SystemRoot\system32\DRIVERS\usbhub.sys
  0x94580000 \SystemRoot\System32\Drivers\NDProxy.SYS
  0x82629000 \SystemRoot\system32\drivers\RTKVHDA.sys
  0x828C6000 \SystemRoot\system32\drivers\portcls.sys
  0x828F5000 \SystemRoot\system32\drivers\drmk.sys
  0x9B750000 \SystemRoot\System32\win32k.sys
  0x8290E000 \SystemRoot\System32\drivers\Dxapi.sys
  0x82918000 \SystemRoot\System32\Drivers\crashdmp.sys
  0x82925000 \SystemRoot\System32\Drivers\dump_diskdump.sys
  0x8292F000 \SystemRoot\System32\Drivers\dump_nvstor32.sys
  0x8294C000 \SystemRoot\System32\Drivers\dump_dumpfve.sys
  0x8295D000 \SystemRoot\system32\DRIVERS\monitor.sys
  0x9B9B0000 \SystemRoot\System32\TSDDD.dll
  0x82968000 \SystemRoot\system32\drivers\USBSTOR.SYS
  0x8297F000 \SystemRoot\system32\drivers\USBD.SYS
  0x9B9E0000 \SystemRoot\System32\cdd.dll
  0x82981000 \SystemRoot\system32\DRIVERS\usbccgp.sys
  0x82998000 \SystemRoot\system32\drivers\LVUSBSta.sys
  0x9DC0D000 \SystemRoot\system32\DRIVERS\LV302V32.SYS
  0x9DE7F000 \SystemRoot\system32\DRIVERS\lv302af.sys
  0x9DE81000 \SystemRoot\system32\drivers\usbaudio.sys
  0x9DE95000 \SystemRoot\system32\DRIVERS\lvrs.sys
  0x9DF2D000 \SystemRoot\system32\drivers\luafv.sys
  0x9DF48000 \SystemRoot\system32\drivers\WudfPf.sys
  0x9DF62000 \SystemRoot\system32\DRIVERS\netr73.sys
  0x9DFF0000 \SystemRoot\system32\DRIVERS\lltdio.sys
  0x9DC00000 \SystemRoot\system32\DRIVERS\vwifibus.sys
  0x829A1000 \SystemRoot\system32\DRIVERS\nwifi.sys
  0x829E7000 \SystemRoot\system32\DRIVERS\ndisuio.sys
  0x82600000 \SystemRoot\system32\DRIVERS\rspndr.sys
  0x9DC0A000 \SystemRoot\system32\DRIVERS\wdcsam.sys
  0x9FE2C000 \SystemRoot\system32\drivers\HTTP.sys
  0x9FEB1000 \SystemRoot\system32\DRIVERS\usbcir.sys
  0x9FECC000 \SystemRoot\system32\DRIVERS\usbscan.sys
  0x9FEDA000 \SystemRoot\system32\DRIVERS\usbprint.sys
  0x9FEE5000 \SystemRoot\system32\DRIVERS\hidusb.sys
  0x9FEF0000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
  0x9FF03000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
  0x9FF0A000 \SystemRoot\system32\DRIVERS\kbdhid.sys
  0x9FF16000 \SystemRoot\system32\DRIVERS\mouhid.sys
  0x9FF21000 \SystemRoot\system32\DRIVERS\klmouflt.sys
  0x9FF2A000 \SystemRoot\system32\DRIVERS\hidir.sys
  0x9FF39000 \SystemRoot\system32\DRIVERS\bowser.sys
  0x9FF52000 \SystemRoot\System32\drivers\mpsdrv.sys
  0x9FF64000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
  0x9FF87000 \SystemRoot\system32\DRIVERS\mrxsmb10.sys
  0x9FFC2000 \SystemRoot\system32\DRIVERS\mrxsmb20.sys
  0x9FE00000 \SystemRoot\System32\Drivers\usbaapl.sys
  0xA9819000 \SystemRoot\system32\drivers\peauth.sys
  0xA98B0000 \SystemRoot\System32\Drivers\secdrv.SYS
  0xA98BA000 \SystemRoot\System32\DRIVERS\srvnet.sys
  0xA98DB000 \SystemRoot\System32\drivers\tcpipreg.sys
  0xA98E8000 \SystemRoot\System32\DRIVERS\srv2.sys
  0xA9937000 \SystemRoot\System32\DRIVERS\srv.sys
  0xA9989000 \SystemRoot\system32\DRIVERS\LVPr2Mon.sys
  0x9B600000 \SystemRoot\System32\ATMFD.DLL
  0xA998E000 \SystemRoot\system32\DRIVERS\WUDFRd.sys
  0x94591000 \SystemRoot\system32\drivers\spsys.sys
  0xA99AF000 \SystemRoot\system32\DRIVERS\asyncmac.sys
  0x77100000 \Windows\System32\ntdll.dll
  0x481F0000 \Windows\System32\smss.exe
  0x77340000 \Windows\System32\apisetschema.dll
  0x00DD0000 \Windows\System32\autochk.exe
  0x77260000 \Windows\System32\msctf.dll
  0x770B0000 \Windows\System32\Wldap32.dll
  0x76FE0000 \Windows\System32\user32.dll
  0x76F80000 \Windows\System32\difxapi.dll
  0x76F00000 \Windows\System32\comdlg32.dll
  0x76E20000 \Windows\System32\kernel32.dll
  0x76DF0000 \Windows\System32\imagehlp.dll
  0x76D60000 \Windows\System32\oleaut32.dll
  0x77250000 \Windows\System32\nsi.dll
  0x77240000 \Windows\System32\psapi.dll
  0x76CB0000 \Windows\System32\msvcrt.dll
  0x76B50000 \Windows\System32\ole32.dll
  0x76B30000 \Windows\System32\sechost.dll
  0x76AF0000 \Windows\System32\ws2_32.dll
  0x769B0000 \Windows\System32\urlmon.dll
  0x75D60000 \Windows\System32\shell32.dll
  0x75D40000 \Windows\System32\imm32.dll
  0x75CE0000 \Windows\System32\shlwapi.dll
  0x75C40000 \Windows\System32\advapi32.dll
  0x75BB0000 \Windows\System32\clbcatq.dll
  0x75AB0000 \Windows\System32\wininet.dll
  0x75910000 \Windows\System32\setupapi.dll
  0x75870000 \Windows\System32\usp10.dll
  0x75820000 \Windows\System32\gdi32.dll
  0x75770000 \Windows\System32\rpcrt4.dll
  0x75760000 \Windows\System32\normaliz.dll
  0x75560000 \Windows\System32\iertutil.dll
  0x75550000 \Windows\System32\lpk.dll
  0x75500000 \Windows\System32\KernelBase.dll
  0x753E0000 \Windows\System32\crypt32.dll
  0x75350000 \Windows\System32\comctl32.dll
  0x75320000 \Windows\System32\cfgmgr32.dll
  0x75300000 \Windows\System32\devobj.dll
  0x752D0000 \Windows\System32\wintrust.dll
  0x752C0000 \Windows\System32\msasn1.dll

Processes (total 87):
       0 System Idle Process
       4 System
     320 C:\Windows\System32\smss.exe
     484 csrss.exe
     544 C:\Windows\System32\wininit.exe
     552 csrss.exe
     604 C:\Windows\System32\services.exe
     628 C:\Windows\System32\winlogon.exe
     668 C:\Windows\System32\lsass.exe
     676 C:\Windows\System32\lsm.exe
     796 C:\Windows\System32\svchost.exe
     860 C:\Windows\System32\nvvsvc.exe
     900 C:\Windows\System32\svchost.exe
     960 C:\Windows\System32\svchost.exe
    1044 C:\Windows\System32\svchost.exe
    1072 C:\Windows\System32\svchost.exe
    1188 C:\Windows\System32\audiodg.exe
    1232 C:\Windows\System32\svchost.exe
    1332 C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe
    1344 C:\Windows\System32\nvvsvc.exe
    1432 C:\Windows\System32\svchost.exe
    1644 C:\Windows\System32\spoolsv.exe
    1680 C:\Windows\System32\svchost.exe
    1804 C:\Windows\System32\svchost.exe
    1824 C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    1892 C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\avp.exe
    1976 C:\Program Files\Bonjour\mDNSResponder.exe
    2024 C:\hp\HPEZBTN\HPBtnSrv.exe
     356 C:\Program Files\Common Files\LightScribe\LSSrvc.exe
     492 C:\Program Files\Common Files\logishrd\LVMVFM\LVPrcSrv.exe
     556 C:\Windows\System32\lxcgcoms.exe
    1780 C:\Program Files\Nero\Nero MediaHome 4\NMMediaServerService.exe
    1732 C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
    2052 C:\Windows\System32\svchost.exe
    2096 C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe
    2124 C:\Program Files\Western Digital\WD SmartWare\Front Parlor\WDSmartWareBackgroundService.exe
    2212 C:\Windows\System32\taskhost.exe
    2320 C:\Windows\explorer.exe
    2388 C:\Windows\System32\dwm.exe
    2456 C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
    2660 HP1006MC.EXE
    3052 C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
    3392 C:\Windows\System32\SearchIndexer.exe
    3584 C:\Windows\System32\svchost.exe
    3676 C:\Windows\System32\taskhost.exe
    3824 C:\Windows\System32\svchost.exe
    2468 C:\Windows\RtHDVCpl.exe
    3000 C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
    3100 C:\hp\support\hpsysdrv.exe
    2916 C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe
    2300 C:\Windows\System32\schtasks.exe
    2104 C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\avp.exe
    1560 C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe
    1040 C:\Windows\System32\conhost.exe
    1092 C:\Program Files\Lexmark 2300 Series\lxcgmon.exe
    3988 C:\Program Files\Lexmark 2300 Series\ezprint.exe
    4220 C:\Program Files\HP\HP UT\bin\hppusg.exe
    4304 C:\Program Files\Common Files\Java\Java Update\jusched.exe
    4436 C:\Program Files\Real\RealPlayer\Update\realsched.exe
    4536 C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe
    4724 C:\Program Files\iTunes\iTunesHelper.exe
    4824 C:\Program Files\Skype\Phone\Skype.exe
    4860 C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
    4956 C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
    5052 C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMStatus.exe
    5064 C:\Program Files\Western Digital\WD SmartWare\Front Parlor\WDSmartWare.exe
    5576 C:\Program Files\iPod\bin\iPodService.exe
    4488 C:\Program Files\Windows Media Player\wmpnetwk.exe
    5536 WUDFHost.exe
    6040 C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2011\klwtblfs.exe
    5264 C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Service.exe
    5704 C:\Program Files\Nero\Update\NASvc.exe
    5000 C:\Windows\System32\sppsvc.exe
    1256 C:\Windows\System32\svchost.exe
    1952 C:\hp\KBD\kbd.exe
    6056 C:\Windows\System32\wuauclt.exe
    5336 WmiPrvSE.exe
    4992 C:\Program Files\Mozilla Firefox\plugin-container.exe
    2616 C:\Windows\System32\SearchProtocolHost.exe
    5984 C:\Windows\System32\SearchFilterHost.exe
    5904 C:\Windows\System32\msdt.exe
    2900 dllhost.exe
    5804 dllhost.exe
     640 C:\Windows\System32\sdiagnhost.exe
    4988 C:\Users\Alex\Desktop\MBRCheck.exe
    2568 C:\Windows\System32\conhost.exe
    3232 C:\Windows\System32\conhost.exe

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`00007e00  (NTFS)
\\.\D: --> \\.\PhysicalDrive0 at offset 0x00000072`9cae6000  (NTFS)
\\.\K: --> \\.\PhysicalDrive1 at offset 0x00000000`00100000  (NTFS)
\\.\M: --> \\.\PhysicalDrive2 at offset 0x00000000`00100000  (NTFS)
\\.\N: --> \\.\PhysicalDrive2 at offset 0x0000017a`17100000  (NTFS)

PhysicalDrive0 Model Number: ST3500630AS, Rev: 3.CH
PhysicalDrive1 Model Number: Ext HardDisk, Rev: 
PhysicalDrive2 Model Number: WDMy Book 1111, Rev: 1032

      Size  Device Name          MBR Status
  --------------------------------------------
    465 GB  \\.\PhysicalDrive0   Windows 7 MBR code detected
            SHA1: 4379A3D43019B46FA357F7DD6A53B45A3CA8FB79
    465 GB  \\.\PhysicalDrive1   RE: Windows XP MBR code detected
            SHA1: DA38B874B7713D1B51CBC449F4EF809B0DEC644A
   1862 GB  \\.\PhysicalDrive2   RE: Windows XP MBR code detected
            SHA1: DA38B874B7713D1B51CBC449F4EF809B0DEC644A


Done!

cosinus · 10.05.2011, 15:07

Sieht ok aus. Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SUPERAntiSpyware und poste die Logs.
Denk dran beide Tools zu updaten vor dem Scan!!

Kangoo96 · 10.05.2011, 18:36

Malwarebytes Log:

Code:

ATTFilter

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Datenbank Version: 6546

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

10.05.2011 19:34:46
mbam-log-2011-05-10 (19-34-39).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|K:\|M:\|N:\|)
Durchsuchte Objekte: 669003
Laufzeit: 2 Stunde(n), 32 Minute(n), 19 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)

10.05.2011, 15:07	#7
cosinus /// Winkelfunktion /// TB-Süch-Tiger™	Ich glaub ich hab nen Virus! Sieht ok aus. Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SUPERAntiSpyware und poste die Logs. Denk dran beide Tools zu updaten vor dem Scan!! __________________ Logfiles bitte immer in CODE-Tags posten

Ich glaub ich hab nen Virus!

Plagegeister aller Art und deren Bekämpfung: Ich glaub ich hab nen Virus!