Trojaner-Board
Seite 2 von 5 1 2 34 Letzte »
100 Beiträge dieses Themas auf einer Seite anzeigen

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   TR/ATRAPS.Gen gefunden (https://www.trojaner-board.de/107249-tr-atraps-gen-gefunden.html)

snowly1 06.01.2012 19:21
Wie bring ich das Softonic Downloader denn auf den Laptop ohne Internet? habs auf den Stick gespeichert. Mit dem Stick geht es nicht. Meldung: Keine Verbindung mit Internet.

snowly1 06.01.2012 19:41
Es hat geklappt: TDSS Killer
Code:
2012/01/06 19:37:46.0436 3332        TDSS rootkit removing tool 2.5.5.0 Jun 16 2011 15:25:15
2012/01/06 19:37:46.0452 3332        ================================================================================
2012/01/06 19:37:46.0452 3332        SystemInfo:
2012/01/06 19:37:46.0452 3332       
2012/01/06 19:37:46.0452 3332        OS Version: 6.1.7601 ServicePack: 1.0
2012/01/06 19:37:46.0452 3332        Product type: Workstation
2012/01/06 19:37:46.0452 3332        ComputerName: ACER-PC
2012/01/06 19:37:46.0452 3332        UserName: Acer
2012/01/06 19:37:46.0452 3332        Windows directory: C:\Windows
2012/01/06 19:37:46.0452 3332        System windows directory: C:\Windows
2012/01/06 19:37:46.0452 3332        Processor architecture: Intel x86
2012/01/06 19:37:46.0452 3332        Number of processors: 2
2012/01/06 19:37:46.0452 3332        Page size: 0x1000
2012/01/06 19:37:46.0452 3332        Boot type: Normal boot
2012/01/06 19:37:46.0452 3332        ================================================================================
2012/01/06 19:37:46.0982 3332        Initialize success
2012/01/06 19:37:52.0115 0856        ================================================================================
2012/01/06 19:37:52.0115 0856        Scan started
2012/01/06 19:37:52.0115 0856        Mode: Manual;
2012/01/06 19:37:52.0115 0856        ================================================================================
2012/01/06 19:37:52.0645 0856        1394ohci        (1b133875b8aa8ac48969bd3458afe9f5) C:\Windows\system32\drivers\1394ohci.sys
2012/01/06 19:37:52.0786 0856        ACPI            (cea80c80bed809aa0da6febc04733349) C:\Windows\system32\drivers\ACPI.sys
2012/01/06 19:37:52.0864 0856        AcpiPmi        (1efbc664abff416d1d07db115dcb264f) C:\Windows\system32\drivers\acpipmi.sys
2012/01/06 19:37:53.0004 0856        adp94xx        (21e785ebd7dc90a06391141aac7892fb) C:\Windows\system32\DRIVERS\adp94xx.sys
2012/01/06 19:37:53.0051 0856        adpahci        (0c676bc278d5b59ff5abd57bbe9123f2) C:\Windows\system32\DRIVERS\adpahci.sys
2012/01/06 19:37:53.0129 0856        adpu320        (7c7b5ee4b7b822ec85321fe23a27db33) C:\Windows\system32\DRIVERS\adpu320.sys
2012/01/06 19:37:53.0285 0856        AFD            (9ebbba55060f786f0fcaa3893bfa2806) C:\Windows\system32\drivers\afd.sys
2012/01/06 19:37:53.0363 0856        agp440          (507812c3054c21cef746b6ee3d04dd6e) C:\Windows\system32\drivers\agp440.sys
2012/01/06 19:37:53.0456 0856        aic78xx        (8b30250d573a8f6b4bd23195160d8707) C:\Windows\system32\DRIVERS\djsvs.sys
2012/01/06 19:37:53.0519 0856        aliide          (0d40bcf52ea90fc7df2aeab6503dea44) C:\Windows\system32\drivers\aliide.sys
2012/01/06 19:37:53.0597 0856        amdagp          (3c6600a0696e90a463771c7422e23ab5) C:\Windows\system32\drivers\amdagp.sys
2012/01/06 19:37:53.0644 0856        amdide          (cd5914170297126b6266860198d1d4f0) C:\Windows\system32\drivers\amdide.sys
2012/01/06 19:37:53.0737 0856        AmdK8          (00dda200d71bac534bf56a9db5dfd666) C:\Windows\system32\DRIVERS\amdk8.sys
2012/01/06 19:37:53.0784 0856        AmdPPM          (3cbf30f5370fda40dd3e87df38ea53b6) C:\Windows\system32\DRIVERS\amdppm.sys
2012/01/06 19:37:53.0878 0856        amdsata        (d320bf87125326f996d4904fe24300fc) C:\Windows\system32\drivers\amdsata.sys
2012/01/06 19:37:53.0940 0856        amdsbs          (ea43af0c423ff267355f74e7a53bdaba) C:\Windows\system32\DRIVERS\amdsbs.sys
2012/01/06 19:37:53.0987 0856        amdxata        (46387fb17b086d16dea267d5be23a2f2) C:\Windows\system32\drivers\amdxata.sys
2012/01/06 19:37:54.0127 0856        AppID          (aea177f783e20150ace5383ee368da19) C:\Windows\system32\drivers\appid.sys
2012/01/06 19:37:54.0252 0856        arc            (2932004f49677bd84dbc72edb754ffb3) C:\Windows\system32\DRIVERS\arc.sys
2012/01/06 19:37:54.0314 0856        arcsas          (5d6f36c46fd283ae1b57bd2e9feb0bc7) C:\Windows\system32\DRIVERS\arcsas.sys
2012/01/06 19:37:54.0346 0856        AsyncMac        (add2ade1c2b285ab8378d2daaf991481) C:\Windows\system32\DRIVERS\asyncmac.sys
2012/01/06 19:37:54.0439 0856        atapi          (338c86357871c167a96ab976519bf59e) C:\Windows\system32\drivers\atapi.sys
2012/01/06 19:37:54.0548 0856        athr            (2eb96571fe865f07ed1fd6017575026f) C:\Windows\system32\DRIVERS\athr.sys
2012/01/06 19:37:54.0658 0856        avgntflt        (1e4114685de1ffa9675e09c6a1fb3f4b) C:\Windows\system32\DRIVERS\avgntflt.sys
2012/01/06 19:37:54.0704 0856        avipbb          (0f78d3dae6dedd99ae54c9491c62adf2) C:\Windows\system32\DRIVERS\avipbb.sys
2012/01/06 19:37:54.0814 0856        b06bdrv        (1a231abec60fd316ec54c66715543cec) C:\Windows\system32\DRIVERS\bxvbdx.sys
2012/01/06 19:37:54.0876 0856        b57nd60x        (bd8869eb9cde6bbe4508d869929869ee) C:\Windows\system32\DRIVERS\b57nd60x.sys
2012/01/06 19:37:55.0048 0856        BCM43XX        (f9ce9b5e049efc66b8e6c73c18ee8438) C:\Windows\system32\DRIVERS\bcmwl6.sys
2012/01/06 19:37:55.0141 0856        Beep            (505506526a9d467307b3c393dedaf858) C:\Windows\system32\drivers\Beep.sys
2012/01/06 19:37:55.0219 0856        blbdrive        (2287078ed48fcfc477b05b20cf38f36f) C:\Windows\system32\DRIVERS\blbdrive.sys
2012/01/06 19:37:55.0328 0856        bowser          (8f2da3028d5fcbd1a060a3de64cd6506) C:\Windows\system32\DRIVERS\bowser.sys
2012/01/06 19:37:55.0375 0856        BrFiltLo        (9f9acc7f7ccde8a15c282d3f88b43309) C:\Windows\system32\DRIVERS\BrFiltLo.sys
2012/01/06 19:37:55.0422 0856        BrFiltUp        (56801ad62213a41f6497f96dee83755a) C:\Windows\system32\DRIVERS\BrFiltUp.sys
2012/01/06 19:37:55.0500 0856        Brserid        (845b8ce732e67f3b4133164868c666ea) C:\Windows\System32\Drivers\Brserid.sys
2012/01/06 19:37:55.0547 0856        BrSerWdm        (203f0b1e73adadbbb7b7b1fabd901f6b) C:\Windows\System32\Drivers\BrSerWdm.sys
2012/01/06 19:37:55.0578 0856        BrUsbMdm        (bd456606156ba17e60a04e18016ae54b) C:\Windows\System32\Drivers\BrUsbMdm.sys
2012/01/06 19:37:55.0640 0856        BrUsbSer        (af72ed54503f717a43268b3cc5faec2e) C:\Windows\System32\Drivers\BrUsbSer.sys
2012/01/06 19:37:55.0687 0856        BTHMODEM        (ed3df7c56ce0084eb2034432fc56565a) C:\Windows\system32\DRIVERS\bthmodem.sys
2012/01/06 19:37:55.0781 0856        cdfs            (77ea11b065e0a8ab902d78145ca51e10) C:\Windows\system32\DRIVERS\cdfs.sys
2012/01/06 19:37:55.0874 0856        cdrom          (be167ed0fdb9c1fa1133953c18d5a6c9) C:\Windows\system32\drivers\cdrom.sys
2012/01/06 19:37:55.0937 0856        circlass        (3fe3fe94a34df6fb06e6418d0f6a0060) C:\Windows\system32\DRIVERS\circlass.sys
2012/01/06 19:37:55.0999 0856        CLFS            (635181e0e9bbf16871bf5380d71db02d) C:\Windows\system32\CLFS.sys
2012/01/06 19:37:56.0108 0856        CmBatt          (dea805815e587dad1dd2c502220b5616) C:\Windows\system32\DRIVERS\CmBatt.sys
2012/01/06 19:37:56.0171 0856        cmdide          (c537b1db64d495b9b4717b4d6d9edbf2) C:\Windows\system32\drivers\cmdide.sys
2012/01/06 19:37:56.0233 0856        CNG            (1b675691ed940766149c93e8f4488d68) C:\Windows\system32\Drivers\cng.sys
2012/01/06 19:37:56.0296 0856        Compbatt        (a6023d3823c37043986713f118a89bee) C:\Windows\system32\DRIVERS\compbatt.sys
2012/01/06 19:37:56.0374 0856        CompositeBus    (cbe8c58a8579cfe5fccf809e6f114e89) C:\Windows\system32\drivers\CompositeBus.sys
2012/01/06 19:37:56.0436 0856        crcdisk        (2c4ebcfc84a9b44f209dff6c6e6c61d1) C:\Windows\system32\DRIVERS\crcdisk.sys
2012/01/06 19:37:56.0592 0856        DfsC            (f024449c97ec1e464aaffda18593db88) C:\Windows\system32\Drivers\dfsc.sys
2012/01/06 19:37:56.0639 0856        discache        (1a050b0274bfb3890703d490f330c0da) C:\Windows\system32\drivers\discache.sys
2012/01/06 19:37:56.0717 0856        Disk            (565003f326f99802e68ca78f2a68e9ff) C:\Windows\system32\DRIVERS\disk.sys
2012/01/06 19:37:56.0810 0856        DKbFltr        (c701324c9e0c25dd9d60311bd87fbc84) C:\Windows\system32\DRIVERS\DKbFltr.sys
2012/01/06 19:37:56.0920 0856        drmkaud        (b918e7c5f9bf77202f89e1a9539f2eb4) C:\Windows\system32\drivers\drmkaud.sys
2012/01/06 19:37:56.0998 0856        DXGKrnl        (23f5d28378a160352ba8f817bd8c71cb) C:\Windows\System32\drivers\dxgkrnl.sys
2012/01/06 19:37:57.0185 0856        ebdrv          (024e1b5cac09731e4d868e64dbfb4ab0) C:\Windows\system32\DRIVERS\evbdx.sys
2012/01/06 19:37:57.0294 0856        elxstor        (0ed67910c8c326796faa00b2bf6d9d3c) C:\Windows\system32\DRIVERS\elxstor.sys
2012/01/06 19:37:57.0388 0856        ErrDev          (8fc3208352dd3912c94367a206ab3f11) C:\Windows\system32\drivers\errdev.sys
2012/01/06 19:37:57.0481 0856        exfat          (2dc9108d74081149cc8b651d3a26207f) C:\Windows\system32\drivers\exfat.sys
2012/01/06 19:37:57.0544 0856        fastfat        (7e0ab74553476622fb6ae36f73d97d35) C:\Windows\system32\drivers\fastfat.sys
2012/01/06 19:37:57.0606 0856        fdc            (e817a017f82df2a1f8cfdbda29388b29) C:\Windows\system32\DRIVERS\fdc.sys
2012/01/06 19:37:57.0684 0856        FileInfo        (6cf00369c97f3cf563be99be983d13d8) C:\Windows\system32\drivers\fileinfo.sys
2012/01/06 19:37:57.0731 0856        Filetrace      (42c51dc94c91da21cb9196eb64c45db9) C:\Windows\system32\drivers\filetrace.sys
2012/01/06 19:37:57.0778 0856        flpydisk        (87907aa70cb3c56600f1c2fb8841579b) C:\Windows\system32\DRIVERS\flpydisk.sys
2012/01/06 19:37:57.0840 0856        FltMgr          (7520ec808e0c35e0ee6f841294316653) C:\Windows\system32\drivers\fltmgr.sys
2012/01/06 19:37:57.0934 0856        FsDepends      (1a16b57943853e598cff37fe2b8cbf1d) C:\Windows\system32\drivers\FsDepends.sys
2012/01/06 19:37:57.0980 0856        Fs_Rec          (a574b4360e438977038aae4bf60d79a2) C:\Windows\system32\drivers\Fs_Rec.sys
2012/01/06 19:37:58.0074 0856        fvevol          (8a73e79089b282100b9393b644cb853b) C:\Windows\system32\DRIVERS\fvevol.sys
2012/01/06 19:37:58.0136 0856        gagp30kx        (65ee0c7a58b65e74ae05637418153938) C:\Windows\system32\DRIVERS\gagp30kx.sys
2012/01/06 19:37:58.0214 0856        GEARAspiWDM    (8182ff89c65e4d38b2de4bb0fb18564e) C:\Windows\system32\DRIVERS\GEARAspiWDM.sys
2012/01/06 19:37:58.0370 0856        hcw85cir        (c44e3c2bab6837db337ddee7544736db) C:\Windows\system32\drivers\hcw85cir.sys
2012/01/06 19:37:58.0464 0856        HdAudAddService (a5ef29d5315111c80a5c1abad14c8972) C:\Windows\system32\drivers\HdAudio.sys
2012/01/06 19:37:58.0542 0856        HDAudBus        (9036377b8a6c15dc2eec53e489d159b5) C:\Windows\system32\drivers\HDAudBus.sys
2012/01/06 19:37:58.0589 0856        HidBatt        (1d58a7f3e11a9731d0eaaaa8405acc36) C:\Windows\system32\DRIVERS\HidBatt.sys
2012/01/06 19:37:58.0651 0856        HidBth          (89448f40e6df260c206a193a4683ba78) C:\Windows\system32\DRIVERS\hidbth.sys
2012/01/06 19:37:58.0698 0856        HidIr          (cf50b4cf4a4f229b9f3c08351f99ca5e) C:\Windows\system32\DRIVERS\hidir.sys
2012/01/06 19:37:58.0776 0856        HidUsb          (10c19f8290891af023eaec0832e1eb4d) C:\Windows\system32\drivers\hidusb.sys
2012/01/06 19:37:58.0885 0856        HpSAMD          (295fdc419039090eb8b49ffdbb374549) C:\Windows\system32\drivers\HpSAMD.sys
2012/01/06 19:37:58.0994 0856        HTTP            (871917b07a141bff43d76d8844d48106) C:\Windows\system32\drivers\HTTP.sys
2012/01/06 19:37:59.0057 0856        hwpolicy        (0c4e035c7f105f1299258c90886c64c5) C:\Windows\system32\drivers\hwpolicy.sys
2012/01/06 19:37:59.0135 0856        i8042prt        (f151f0bdc47f4a28b1b20a0818ea36d6) C:\Windows\system32\drivers\i8042prt.sys
2012/01/06 19:37:59.0228 0856        iaStor          (d483687eace0c065ee772481a96e05f5) C:\Windows\system32\DRIVERS\iaStor.sys
2012/01/06 19:37:59.0322 0856        iaStorV        (5cd5f9a5444e6cdcb0ac89bd62d8b76e) C:\Windows\system32\drivers\iaStorV.sys
2012/01/06 19:37:59.0572 0856        igfx            (9467514ea189475a6e7fdc5d7bde9d3f) C:\Windows\system32\DRIVERS\igdkmd32.sys
2012/01/06 19:37:59.0821 0856        iirsp          (4173ff5708f3236cf25195fecd742915) C:\Windows\system32\DRIVERS\iirsp.sys
2012/01/06 19:38:00.0024 0856        IntcAzAudAddService (f2baa4ff548f7f0317f7638951c1cd9c) C:\Windows\system32\drivers\RTKVHDA.sys
2012/01/06 19:38:00.0180 0856        intelide        (a0f12f2c9ba6c72f3987ce780e77c130) C:\Windows\system32\drivers\intelide.sys
2012/01/06 19:38:00.0258 0856        intelppm        (3b514d27bfc4accb4037bc6685f766e0) C:\Windows\system32\DRIVERS\intelppm.sys
2012/01/06 19:38:00.0320 0856        IpFilterDriver  (709d1761d3b19a932ff0238ea6d50200) C:\Windows\system32\DRIVERS\ipfltdrv.sys
2012/01/06 19:38:00.0414 0856        IPMIDRV        (4bd7134618c1d2a27466a099062547bf) C:\Windows\system32\drivers\IPMIDrv.sys
2012/01/06 19:38:00.0461 0856        IPNAT          (a5fa468d67abcdaa36264e463a7bb0cd) C:\Windows\system32\drivers\ipnat.sys
2012/01/06 19:38:00.0554 0856        IRENUM          (42996cff20a3084a56017b7902307e9f) C:\Windows\system32\drivers\irenum.sys
2012/01/06 19:38:00.0617 0856        isapnp          (1f32bb6b38f62f7df1a7ab7292638a35) C:\Windows\system32\drivers\isapnp.sys
2012/01/06 19:38:00.0695 0856        iScsiPrt        (cb7a9abb12b8415bce5d74994c7ba3ae) C:\Windows\system32\drivers\msiscsi.sys
2012/01/06 19:38:00.0773 0856        kbdclass        (adef52ca1aeae82b50df86b56413107e) C:\Windows\system32\drivers\kbdclass.sys
2012/01/06 19:38:00.0851 0856        kbdhid          (9e3ced91863e6ee98c24794d05e27a71) C:\Windows\system32\drivers\kbdhid.sys
2012/01/06 19:38:00.0944 0856        KSecDD          (412cea1aa78cc02a447f5c9e62b32ff1) C:\Windows\system32\Drivers\ksecdd.sys
2012/01/06 19:38:01.0007 0856        KSecPkg        (26c046977e85b95036453d7b88ba1820) C:\Windows\system32\Drivers\ksecpkg.sys
2012/01/06 19:38:01.0100 0856        L1C            (a158cea8644b8a5c1ec0e9a81b70f65a) C:\Windows\system32\DRIVERS\L1C62x86.sys
2012/01/06 19:38:01.0225 0856        lltdio          (f7611ec07349979da9b0ae1f18ccc7a6) C:\Windows\system32\DRIVERS\lltdio.sys
2012/01/06 19:38:01.0334 0856        LSI_FC          (eb119a53ccf2acc000ac71b065b78fef) C:\Windows\system32\DRIVERS\lsi_fc.sys
2012/01/06 19:38:01.0397 0856        LSI_SAS        (8ade1c877256a22e49b75d1cc9161f9c) C:\Windows\system32\DRIVERS\lsi_sas.sys
2012/01/06 19:38:01.0444 0856        LSI_SAS2        (dc9dc3d3daa0e276fd2ec262e38b11e9) C:\Windows\system32\DRIVERS\lsi_sas2.sys
2012/01/06 19:38:01.0490 0856        LSI_SCSI        (0a036c7d7cab643a7f07135ac47e0524) C:\Windows\system32\DRIVERS\lsi_scsi.sys
2012/01/06 19:38:01.0568 0856        luafv          (6703e366cc18d3b6e534f5cf7df39cee) C:\Windows\system32\drivers\luafv.sys
2012/01/06 19:38:01.0631 0856        MBAMProtector  (b7ca8cc3f978201856b6ab82f40953c3) C:\Windows\system32\drivers\mbam.sys
2012/01/06 19:38:01.0709 0856        megasas        (0fff5b045293002ab38eb1fd1fc2fb74) C:\Windows\system32\DRIVERS\megasas.sys
2012/01/06 19:38:01.0771 0856        MegaSR          (dcbab2920c75f390caf1d29f675d03d6) C:\Windows\system32\DRIVERS\MegaSR.sys
2012/01/06 19:38:01.0834 0856        Modem          (f001861e5700ee84e2d4e52c712f4964) C:\Windows\system32\drivers\modem.sys
2012/01/06 19:38:01.0880 0856        monitor        (79d10964de86b292320e9dfe02282a23) C:\Windows\system32\DRIVERS\monitor.sys
2012/01/06 19:38:01.0974 0856        mouclass        (fb18cc1d4c2e716b6b903b0ac0cc0609) C:\Windows\system32\drivers\mouclass.sys
2012/01/06 19:38:02.0021 0856        mouhid          (2c388d2cd01c9042596cf3c8f3c7b24d) C:\Windows\system32\DRIVERS\mouhid.sys
2012/01/06 19:38:02.0099 0856        mountmgr        (fc8771f45ecccfd89684e38842539b9b) C:\Windows\system32\drivers\mountmgr.sys
2012/01/06 19:38:02.0177 0856        mpio            (2d699fb6e89ce0d8da14ecc03b3edfe0) C:\Windows\system32\drivers\mpio.sys
2012/01/06 19:38:02.0239 0856        mpsdrv          (ad2723a7b53dd1aacae6ad8c0bfbf4d0) C:\Windows\system32\drivers\mpsdrv.sys
2012/01/06 19:38:02.0333 0856        MRxDAV          (ceb46ab7c01c9f825f8cc6babc18166a) C:\Windows\system32\drivers\mrxdav.sys
2012/01/06 19:38:02.0411 0856        mrxsmb          (5d16c921e3671636c0eba3bbaac5fd25) C:\Windows\system32\DRIVERS\mrxsmb.sys
2012/01/06 19:38:02.0473 0856        mrxsmb10        (6d17a4791aca19328c685d256349fefc) C:\Windows\system32\DRIVERS\mrxsmb10.sys
2012/01/06 19:38:02.0551 0856        mrxsmb20        (b81f204d146000be76651a50670a5e9e) C:\Windows\system32\DRIVERS\mrxsmb20.sys
2012/01/06 19:38:02.0629 0856        msahci          (012c5f4e9349e711e11e0f19a8589f0a) C:\Windows\system32\drivers\msahci.sys
2012/01/06 19:38:02.0692 0856        msdsm          (55055f8ad8be27a64c831322a780a228) C:\Windows\system32\drivers\msdsm.sys
2012/01/06 19:38:02.0785 0856        Msfs            (daefb28e3af5a76abcc2c3078c07327f) C:\Windows\system32\drivers\Msfs.sys
2012/01/06 19:38:02.0848 0856        mshidkmdf      (3e1e5767043c5af9367f0056295e9f84) C:\Windows\System32\drivers\mshidkmdf.sys
2012/01/06 19:38:02.0926 0856        msisadrv        (0a4e5757ae09fa9622e3158cc1aef114) C:\Windows\system32\drivers\msisadrv.sys
2012/01/06 19:38:03.0004 0856        MSKSSRV        (8c0860d6366aaffb6c5bb9df9448e631) C:\Windows\system32\drivers\MSKSSRV.sys
2012/01/06 19:38:03.0066 0856        MSPCLOCK        (3ea8b949f963562cedbb549eac0c11ce) C:\Windows\system32\drivers\MSPCLOCK.sys
2012/01/06 19:38:03.0113 0856        MSPQM          (f456e973590d663b1073e9c463b40932) C:\Windows\system32\drivers\MSPQM.sys
2012/01/06 19:38:03.0175 0856        MsRPC          (0e008fc4819d238c51d7c93e7b41e560) C:\Windows\system32\drivers\MsRPC.sys
2012/01/06 19:38:03.0222 0856        mssmbios        (fc6b9ff600cc585ea38b12589bd4e246) C:\Windows\system32\drivers\mssmbios.sys
2012/01/06 19:38:03.0269 0856        MSTEE          (b42c6b921f61a6e55159b8be6cd54a36) C:\Windows\system32\drivers\MSTEE.sys
2012/01/06 19:38:03.0331 0856        MTConfig        (33599130f44e1f34631cea241de8ac84) C:\Windows\system32\DRIVERS\MTConfig.sys
2012/01/06 19:38:03.0378 0856        Mup            (159fad02f64e6381758c990f753bcc80) C:\Windows\system32\Drivers\mup.sys
2012/01/06 19:38:03.0456 0856        mwlPSDFilter    (cb47c414e083ca6e50e634b148f28f64) C:\Windows\system32\DRIVERS\mwlPSDFilter.sys
2012/01/06 19:38:03.0487 0856        mwlPSDNServ    (647b953019559bff07536f5c6121f333) C:\Windows\system32\DRIVERS\mwlPSDNServ.sys
2012/01/06 19:38:03.0534 0856        mwlPSDVDisk    (5a236a36db8687d1e64dc81c03eaabe1) C:\Windows\system32\DRIVERS\mwlPSDVDisk.sys
2012/01/06 19:38:03.0643 0856        NativeWifiP    (26384429fcd85d83746f63e798ab1480) C:\Windows\system32\DRIVERS\nwifi.sys
2012/01/06 19:38:03.0737 0856        NDIS            (e7c54812a2aaf43316eb6930c1ffa108) C:\Windows\system32\drivers\ndis.sys
2012/01/06 19:38:03.0830 0856        NdisCap        (0e1787aa6c9191d3d319e8bafe86f80c) C:\Windows\system32\DRIVERS\ndiscap.sys
2012/01/06 19:38:03.0877 0856        NdisTapi        (e4a8aec125a2e43a9e32afeea7c9c888) C:\Windows\system32\DRIVERS\ndistapi.sys
2012/01/06 19:38:03.0955 0856        Ndisuio        (d8a65dafb3eb41cbb622745676fcd072) C:\Windows\system32\DRIVERS\ndisuio.sys
2012/01/06 19:38:04.0064 0856        NdisWan        (38fbe267e7e6983311179230facb1017) C:\Windows\system32\DRIVERS\ndiswan.sys
2012/01/06 19:38:04.0174 0856        NDProxy        (a4bdc541e69674fbff1a8ff00be913f2) C:\Windows\system32\drivers\NDProxy.sys
2012/01/06 19:38:04.0233 0856        NetBIOS        (80b275b1ce3b0e79909db7b39af74d51) C:\Windows\system32\DRIVERS\netbios.sys
2012/01/06 19:38:04.0313 0856        NetBT          (280122ddcf04b378edd1ad54d71c1e54) C:\Windows\system32\DRIVERS\netbt.sys
2012/01/06 19:38:04.0463 0856        nfrd960        (1d85c4b390b0ee09c7a46b91efb2c097) C:\Windows\system32\DRIVERS\nfrd960.sys
2012/01/06 19:38:04.0533 0856        Npfs            (1db262a9f8c087e8153d89bef3d2235f) C:\Windows\system32\drivers\Npfs.sys
2012/01/06 19:38:04.0603 0856        nsiproxy        (e9a0a4d07e53d8fea2bb8387a3293c58) C:\Windows\system32\drivers\nsiproxy.sys
2012/01/06 19:38:04.0733 0856        Ntfs            (81189c3d7763838e55c397759d49007a) C:\Windows\system32\drivers\Ntfs.sys
2012/01/06 19:38:04.0823 0856        Null            (f9756a98d69098dca8945d62858a812c) C:\Windows\system32\drivers\Null.sys
2012/01/06 19:38:04.0916 0856        nvraid          (b3e25ee28883877076e0e1ff877d02e0) C:\Windows\system32\drivers\nvraid.sys
2012/01/06 19:38:04.0979 0856        nvstor          (4380e59a170d88c4f1022eff6719a8a4) C:\Windows\system32\drivers\nvstor.sys
2012/01/06 19:38:05.0041 0856        nv_agp          (5a0983915f02bae73267cc2a041f717d) C:\Windows\system32\drivers\nv_agp.sys
2012/01/06 19:38:05.0119 0856        ohci1394        (08a70a1f2cdde9bb49b885cb817a66eb) C:\Windows\system32\drivers\ohci1394.sys
2012/01/06 19:38:05.0260 0856        Parport        (2ea877ed5dd9713c5ac74e8ea7348d14) C:\Windows\system32\DRIVERS\parport.sys
2012/01/06 19:38:05.0369 0856        partmgr        (bf8f6af06da75b336f07e23aef97d93b) C:\Windows\system32\drivers\partmgr.sys
2012/01/06 19:38:05.0447 0856        Parvdm          (eb0a59f29c19b86479d36b35983daadc) C:\Windows\system32\DRIVERS\parvdm.sys
2012/01/06 19:38:05.0556 0856        pci            (673e55c3498eb970088e812ea820aa8f) C:\Windows\system32\drivers\pci.sys
2012/01/06 19:38:05.0618 0856        pciide          (afe86f419014db4e5593f69ffe26ce0a) C:\Windows\system32\drivers\pciide.sys
2012/01/06 19:38:05.0712 0856        pcmcia          (f396431b31693e71e8a80687ef523506) C:\Windows\system32\DRIVERS\pcmcia.sys
2012/01/06 19:38:05.0774 0856        pcw            (250f6b43d2b613172035c6747aeeb19f) C:\Windows\system32\drivers\pcw.sys
2012/01/06 19:38:05.0852 0856        PEAUTH          (9e0104ba49f4e6973749a02bf41344ed) C:\Windows\system32\drivers\peauth.sys
2012/01/06 19:38:06.0211 0856        PptpMiniport    (631e3e205ad6d86f2aed6a4a8e69f2db) C:\Windows\system32\DRIVERS\raspptp.sys
2012/01/06 19:38:06.0274 0856        Processor      (85b1e3a0c7585bc4aae6899ec6fcf011) C:\Windows\system32\DRIVERS\processr.sys
2012/01/06 19:38:06.0414 0856        Psched          (6270ccae2a86de6d146529fe55b3246a) C:\Windows\system32\DRIVERS\pacer.sys
2012/01/06 19:38:06.0523 0856        ql2300          (ab95ecf1f6659a60ddc166d8315b0751) C:\Windows\system32\DRIVERS\ql2300.sys
2012/01/06 19:38:06.0632 0856        ql40xx          (b4dd51dd25182244b86737dc51af2270) C:\Windows\system32\DRIVERS\ql40xx.sys
2012/01/06 19:38:06.0726 0856        QWAVEdrv        (584078ca1b95ca72df2a27c336f9719d) C:\Windows\system32\drivers\qwavedrv.sys
2012/01/06 19:38:06.0788 0856        RasAcd          (30a81b53c766d0133bb86d234e5556ab) C:\Windows\system32\DRIVERS\rasacd.sys
2012/01/06 19:38:06.0882 0856        RasAgileVpn    (57ec4aef73660166074d8f7f31c0d4fd) C:\Windows\system32\DRIVERS\AgileVpn.sys
2012/01/06 19:38:06.0976 0856        Rasl2tp        (d9f91eafec2815365cbe6d167e4e332a) C:\Windows\system32\DRIVERS\rasl2tp.sys
2012/01/06 19:38:07.0038 0856        RasPppoe        (0fe8b15916307a6ac12bfb6a63e45507) C:\Windows\system32\DRIVERS\raspppoe.sys
2012/01/06 19:38:07.0132 0856        RasSstp        (44101f495a83ea6401d886e7fd70096b) C:\Windows\system32\DRIVERS\rassstp.sys
2012/01/06 19:38:07.0225 0856        rdbss          (d528bc58a489409ba40334ebf96a311b) C:\Windows\system32\DRIVERS\rdbss.sys
2012/01/06 19:38:07.0303 0856        rdpbus          (0d8f05481cb76e70e1da06ee9f0da9df) C:\Windows\system32\DRIVERS\rdpbus.sys
2012/01/06 19:38:07.0381 0856        RDPCDD          (23dae03f29d253ae74c44f99e515f9a1) C:\Windows\system32\DRIVERS\RDPCDD.sys
2012/01/06 19:38:07.0475 0856        RDPENCDD        (5a53ca1598dd4156d44196d200c94b8a) C:\Windows\system32\drivers\rdpencdd.sys
2012/01/06 19:38:07.0615 0856        RDPREFMP        (44b0a53cd4f27d50ed461dae0c0b4e1f) C:\Windows\system32\drivers\rdprefmp.sys
2012/01/06 19:38:07.0709 0856        RDPWD          (288b06960d78428ff89e811632684e20) C:\Windows\system32\drivers\RDPWD.sys
2012/01/06 19:38:07.0802 0856        rdyboost        (518395321dc96fe2c9f0e96ac743b656) C:\Windows\system32\drivers\rdyboost.sys
2012/01/06 19:38:07.0974 0856        rspndr          (032b0d36ad92b582d869879f5af5b928) C:\Windows\system32\DRIVERS\rspndr.sys
2012/01/06 19:38:08.0083 0856        RSUSBSTOR      (96f8dd546677aa5102150acc140377b3) C:\Windows\system32\Drivers\RtsUStor.sys
2012/01/06 19:38:08.0286 0856        sbp2port        (05d860da1040f111503ac416ccef2bca) C:\Windows\system32\drivers\sbp2port.sys
2012/01/06 19:38:08.0380 0856        scfilter        (0693b5ec673e34dc147e195779a4dcf6) C:\Windows\system32\DRIVERS\scfilter.sys
2012/01/06 19:38:08.0489 0856        secdrv          (90a3935d05b494a5a39d37e71f09a677) C:\Windows\system32\drivers\secdrv.sys
2012/01/06 19:38:08.0582 0856        Serenum        (9ad8b8b515e3df6acd4212ef465de2d1) C:\Windows\system32\DRIVERS\serenum.sys
2012/01/06 19:38:08.0629 0856        Serial          (5fb7fcea0490d821f26f39cc5ea3d1e2) C:\Windows\system32\DRIVERS\serial.sys
2012/01/06 19:38:08.0723 0856        sermouse        (79bffb520327ff916a582dfea17aa813) C:\Windows\system32\DRIVERS\sermouse.sys
2012/01/06 19:38:08.0863 0856        sffdisk        (9f976e1eb233df46fce808d9dea3eb9c) C:\Windows\system32\drivers\sffdisk.sys
2012/01/06 19:38:08.0910 0856        sffp_mmc        (932a68ee27833cfd57c1639d375f2731) C:\Windows\system32\drivers\sffp_mmc.sys
2012/01/06 19:38:09.0019 0856        sffp_sd        (6d4ccaedc018f1cf52866bbbaa235982) C:\Windows\system32\drivers\sffp_sd.sys
2012/01/06 19:38:09.0082 0856        sfloppy        (db96666cc8312ebc45032f30b007a547) C:\Windows\system32\DRIVERS\sfloppy.sys
2012/01/06 19:38:09.0191 0856        sisagp          (2565cac0dc9fe0371bdce60832582b2e) C:\Windows\system32\drivers\sisagp.sys
2012/01/06 19:38:09.0253 0856        SiSRaid2        (a9f0486851becb6dda1d89d381e71055) C:\Windows\system32\DRIVERS\SiSRaid2.sys
2012/01/06 19:38:09.0316 0856        SiSRaid4        (3727097b55738e2f554972c3be5bc1aa) C:\Windows\system32\DRIVERS\sisraid4.sys
2012/01/06 19:38:09.0378 0856        Smb            (3e21c083b8a01cb70ba1f09303010fce) C:\Windows\system32\DRIVERS\smb.sys
2012/01/06 19:38:09.0487 0856        spldr          (95cf1ae7527fb70f7816563cbc09d942) C:\Windows\system32\drivers\spldr.sys
2012/01/06 19:38:09.0612 0856        srv            (e4c2764065d66ea1d2d3ebc28fe99c46) C:\Windows\system32\DRIVERS\srv.sys
2012/01/06 19:38:09.0674 0856        srv2            (03f0545bd8d4c77fa0ae1ceedfcc71ab) C:\Windows\system32\DRIVERS\srv2.sys
2012/01/06 19:38:09.0737 0856        srvnet          (be6bd660caa6f291ae06a718a4fa8abc) C:\Windows\system32\DRIVERS\srvnet.sys
2012/01/06 19:38:09.0815 0856        ssmdrv          (a36ee93698802cd899f98bfd553d8185) C:\Windows\system32\DRIVERS\ssmdrv.sys
2012/01/06 19:38:09.0908 0856        stexstor        (db32d325c192b801df274bfd12a7e72b) C:\Windows\system32\DRIVERS\stexstor.sys
2012/01/06 19:38:10.0002 0856        swenum          (e58c78a848add9610a4db6d214af5224) C:\Windows\system32\drivers\swenum.sys
2012/01/06 19:38:10.0096 0856        SynTP          (47183e3520c88fadd5b0c87d57040da5) C:\Windows\system32\DRIVERS\SynTP.sys
2012/01/06 19:38:10.0298 0856        Tcpip          (65d10b191c59c5501a1263fc33f6894b) C:\Windows\system32\drivers\tcpip.sys
2012/01/06 19:38:10.0454 0856        TCPIP6          (65d10b191c59c5501a1263fc33f6894b) C:\Windows\system32\DRIVERS\tcpip.sys
2012/01/06 19:38:10.0548 0856        tcpipreg        (cca24162e055c3714ce5a88b100c64ed) C:\Windows\system32\drivers\tcpipreg.sys
2012/01/06 19:38:10.0642 0856        TDPIPE          (1cb91b2bd8f6dd367dfc2ef26fd751b2) C:\Windows\system32\drivers\tdpipe.sys
2012/01/06 19:38:10.0688 0856        TDTCP          (2c10395baa4847f83042813c515cc289) C:\Windows\system32\drivers\tdtcp.sys
2012/01/06 19:38:10.0782 0856        tdx            (b459575348c20e8121d6039da063c704) C:\Windows\system32\DRIVERS\tdx.sys
2012/01/06 19:38:10.0860 0856        TermDD          (04dbf4b01ea4bf25a9a3e84affac9b20) C:\Windows\system32\drivers\termdd.sys
2012/01/06 19:38:11.0016 0856        tssecsrv        (254bb140eee3c59d6114c1a86b636877) C:\Windows\system32\DRIVERS\tssecsrv.sys
2012/01/06 19:38:11.0110 0856        TsUsbFlt        (fd1d6c73e6333be727cbcc6054247654) C:\Windows\system32\drivers\tsusbflt.sys
2012/01/06 19:38:11.0219 0856        tunnel          (b2fa25d9b17a68bb93d58b0556e8c90d) C:\Windows\system32\DRIVERS\tunnel.sys
2012/01/06 19:38:11.0266 0856        uagp35          (750fbcb269f4d7dd2e420c56b795db6d) C:\Windows\system32\DRIVERS\uagp35.sys
2012/01/06 19:38:11.0344 0856        udfs            (ee43346c7e4b5e63e54f927babbb32ff) C:\Windows\system32\DRIVERS\udfs.sys
2012/01/06 19:38:11.0468 0856        uliagpkx        (44e8048ace47befbfdc2e9be4cbc8880) C:\Windows\system32\drivers\uliagpkx.sys
2012/01/06 19:38:11.0546 0856        umbus          (d295bed4b898f0fd999fcfa9b32b071b) C:\Windows\system32\drivers\umbus.sys
2012/01/06 19:38:11.0609 0856        UmPass          (7550ad0c6998ba1cb4843e920ee0feac) C:\Windows\system32\DRIVERS\umpass.sys
2012/01/06 19:38:11.0718 0856        USBAAPL        (83cafcb53201bbac04d822f32438e244) C:\Windows\system32\Drivers\usbaapl.sys
2012/01/06 19:38:11.0765 0856        usbccgp        (bd9c55d7023c5de374507acc7a14e2ac) C:\Windows\system32\DRIVERS\usbccgp.sys
2012/01/06 19:38:11.0905 0856        usbcir          (04ec7cec62ec3b6d9354eee93327fc82) C:\Windows\system32\drivers\usbcir.sys
2012/01/06 19:38:11.0968 0856        usbehci        (f92de757e4b7ce9c07c5e65423f3ae3b) C:\Windows\system32\DRIVERS\usbehci.sys
2012/01/06 19:38:12.0030 0856        usbhub          (8dc94aec6a7e644a06135ae7506dc2e9) C:\Windows\system32\DRIVERS\usbhub.sys
2012/01/06 19:38:12.0077 0856        usbohci        (e185d44fac515a18d9deddc23c2cdf44) C:\Windows\system32\drivers\usbohci.sys
2012/01/06 19:38:12.0170 0856        usbprint        (797d862fe0875e75c7cc4c1ad7b30252) C:\Windows\system32\DRIVERS\usbprint.sys
2012/01/06 19:38:12.0217 0856        USBSTOR        (f991ab9cc6b908db552166768176896a) C:\Windows\system32\DRIVERS\USBSTOR.SYS
2012/01/06 19:38:12.0264 0856        usbuhci        (68df884cf41cdada664beb01daf67e3d) C:\Windows\system32\DRIVERS\usbuhci.sys
2012/01/06 19:38:12.0373 0856        usbvideo        (45f4e7bf43db40a6c6b4d92c76cbc3f2) C:\Windows\System32\Drivers\usbvideo.sys
2012/01/06 19:38:12.0498 0856        vdrvroot        (a059c4c3edb09e07d21a8e5c0aabd3cb) C:\Windows\system32\drivers\vdrvroot.sys
2012/01/06 19:38:12.0560 0856        vga            (17c408214ea61696cec9c66e388b14f3) C:\Windows\system32\DRIVERS\vgapnp.sys
2012/01/06 19:38:12.0623 0856        VgaSave        (8e38096ad5c8570a6f1570a61e251561) C:\Windows\System32\drivers\vga.sys
2012/01/06 19:38:12.0685 0856        vhdmp          (5461686cca2fda57b024547733ab42e3) C:\Windows\system32\drivers\vhdmp.sys
2012/01/06 19:38:12.0732 0856        viaagp          (c829317a37b4bea8f39735d4b076e923) C:\Windows\system32\drivers\viaagp.sys
2012/01/06 19:38:12.0794 0856        ViaC7          (e02f079a6aa107f06b16549c6e5c7b74) C:\Windows\system32\DRIVERS\viac7.sys
2012/01/06 19:38:12.0841 0856        viaide          (e43574f6a56a0ee11809b48c09e4fd3c) C:\Windows\system32\drivers\viaide.sys
2012/01/06 19:38:12.0919 0856        volmgr          (4c63e00f2f4b5f86ab48a58cd990f212) C:\Windows\system32\drivers\volmgr.sys
2012/01/06 19:38:12.0966 0856        volmgrx        (b5bb72067ddddbbfb04b2f89ff8c3c87) C:\Windows\system32\drivers\volmgrx.sys
2012/01/06 19:38:13.0028 0856        volsnap        (f497f67932c6fa693d7de2780631cfe7) C:\Windows\system32\drivers\volsnap.sys
2012/01/06 19:38:13.0091 0856        vsmraid        (9dfa0cc2f8855a04816729651175b631) C:\Windows\system32\DRIVERS\vsmraid.sys
2012/01/06 19:38:13.0169 0856        vwifibus        (90567b1e658001e79d7c8bbd3dde5aa6) C:\Windows\system32\DRIVERS\vwifibus.sys
2012/01/06 19:38:13.0231 0856        vwififlt        (7090d3436eeb4e7da3373090a23448f7) C:\Windows\system32\DRIVERS\vwififlt.sys
2012/01/06 19:38:13.0325 0856        WacomPen        (de3721e89c653aa281428c8a69745d90) C:\Windows\system32\DRIVERS\wacompen.sys
2012/01/06 19:38:13.0403 0856        WANARP          (3c3c78515f5ab448b022bdf5b8ffdd2e) C:\Windows\system32\DRIVERS\wanarp.sys
2012/01/06 19:38:13.0465 0856        Wanarpv6        (3c3c78515f5ab448b022bdf5b8ffdd2e) C:\Windows\system32\DRIVERS\wanarp.sys
2012/01/06 19:38:13.0574 0856        Wd              (1112a9badacb47b7c0bb0392e3158dff) C:\Windows\system32\DRIVERS\wd.sys
2012/01/06 19:38:13.0652 0856        Wdf01000        (9950e3d0f08141c7e89e64456ae7dc73) C:\Windows\system32\drivers\Wdf01000.sys
2012/01/06 19:38:13.0824 0856        WfpLwf          (8b9a943f3b53861f2bfaf6c186168f79) C:\Windows\system32\DRIVERS\wfplwf.sys
2012/01/06 19:38:13.0871 0856        WIMMount        (5cf95b35e59e2a38023836fff31be64c) C:\Windows\system32\drivers\wimmount.sys
2012/01/06 19:38:14.0136 0856        WinUsb          (a67e5f9a400f3bd1be3d80613b45f708) C:\Windows\system32\DRIVERS\WinUsb.sys
2012/01/06 19:38:14.0276 0856        WmiAcpi        (0217679b8fca58714c3bf2726d2ca84e) C:\Windows\system32\drivers\wmiacpi.sys
2012/01/06 19:38:14.0417 0856        ws2ifsl        (6db3276587b853bf886b69528fdb048c) C:\Windows\system32\drivers\ws2ifsl.sys
2012/01/06 19:38:14.0573 0856        WudfPf          (e714a1c0354636837e20ccbf00888ee7) C:\Windows\system32\drivers\WudfPf.sys
2012/01/06 19:38:14.0635 0856        WUDFRd          (1023ee888c9b47178c5293ed5336ab69) C:\Windows\system32\DRIVERS\WUDFRd.sys
2012/01/06 19:38:14.0791 0856        MBR (0x1B8)    (a36c5e4f47e84449ff07ed3517b43a31) \Device\Harddisk0\DR0
2012/01/06 19:38:14.0822 0856        ================================================================================
2012/01/06 19:38:14.0822 0856        Scan finished
2012/01/06 19:38:14.0822 0856        ================================================================================
2012/01/06 19:38:14.0869 2252        Detected object count: 0
2012/01/06 19:38:14.0869 2252        Actual detected object count: 0
Und nun?

cosinus 06.01.2012 19:49
Dann bitte jetzt CF ausführen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix
  • Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.
  • Starte cofi.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
    Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.
  • Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.
Wichtiger Hinweis:
Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!

Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

Solltest du nach der Ausführung von Combofix Probleme beim Starten von Anwendungen haben und Meldungen erhalten wie

Zitat:
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
startest du Windows dann manuell neu und die Fehlermeldungen sollten nicht mehr auftauchen.

snowly1 06.01.2012 20:27
Combofix: Combofix Logfile:
Code:
ComboFix 12-01-06.01 - Acer 06.01.2012  20:03:43.1.2 - x86
Microsoft Windows 7 Starter  6.1.7601.1.1252.41.1031.18.1014.324 [GMT 1:00]
ausgeführt von:: c:\users\Acer\Desktop\ComboFix.exe
AV: AntiVir Desktop *Disabled/Updated* {090F9C29-64CE-6C6F-379C-5901B49A85B7}
SP: AntiVir Desktop *Disabled/Updated* {B26E7DCD-42F4-63E1-0D2C-6273CF1DCF0A}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\Tarma Installer
c:\programdata\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\_Setup.dll
c:\programdata\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\_Setupx.dll
c:\programdata\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\Setup.dat
c:\programdata\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\Setup.exe
c:\programdata\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\Setup.ico
c:\windows\system32\1.cmd
.
.
(((((((((((((((((((((((  Dateien erstellt von 2011-12-06 bis 2012-01-06  ))))))))))))))))))))))))))))))
.
.
2012-01-06 19:16 . 2012-01-06 19:17        --------        d-----w-        c:\users\Acer\AppData\Local\temp
2012-01-06 19:16 . 2012-01-06 19:16        --------        d-----w-        c:\users\Gast\AppData\Local\temp
2012-01-06 19:16 . 2012-01-06 19:16        --------        d-----w-        c:\users\Default\AppData\Local\temp
2012-01-06 13:39 . 2012-01-06 13:39        --------        d-----w-        C:\_OTL
2012-01-05 13:21 . 2012-01-05 13:21        --------        d-----w-        c:\program files\ESET
2011-12-30 12:19 . 2011-12-30 12:19        --------        d-----w-        c:\users\Acer\AppData\Roaming\Avira
2011-12-30 10:47 . 2011-12-30 10:47        --------        d-----w-        c:\users\Acer\AppData\Roaming\Malwarebytes
2011-12-30 10:46 . 2011-12-30 10:46        --------        d-----w-        c:\programdata\Malwarebytes
2011-12-30 10:46 . 2011-12-10 14:24        20464        ----a-w-        c:\windows\system32\drivers\mbam.sys
2011-12-30 10:46 . 2011-12-30 10:46        --------        d-----w-        c:\program files\Malwarebytes' Anti-Malware
2011-12-21 16:32 . 2011-12-21 16:32        --------        d-----w-        c:\users\Gastbenutzer
2011-12-21 16:15 . 2011-12-21 16:15        --------        d-----w-        c:\users\Gast\AppData\Local\FILSH_Media_GmbH
2011-12-21 15:52 . 2011-12-21 16:00        --------        d-----w-        c:\program files\Sony Media Go Install
2011-12-17 12:14 . 2011-11-24 04:25        2342912        ----a-w-        c:\windows\system32\win32k.sys
2011-12-17 12:14 . 2011-10-15 05:38        534528        ----a-w-        c:\windows\system32\EncDec.dll
2011-12-17 12:14 . 2011-11-05 04:26        2048        ----a-w-        c:\windows\system32\tzres.dll
2011-12-17 12:13 . 2011-10-26 04:28        38912        ----a-w-        c:\windows\system32\csrsrv.dll
2011-12-17 12:13 . 2011-10-26 04:47        3912560        ----a-w-        c:\windows\system32\ntoskrnl.exe
2011-12-17 12:13 . 2011-10-26 04:47        3967856        ----a-w-        c:\windows\system32\ntkrnlpa.exe
2011-12-15 19:21 . 2005-05-26 14:34        2297552        ----a-w-        c:\windows\system32\d3dx9_26.dll
2011-12-15 19:15 . 2011-12-15 19:15        --------        d-----w-        c:\program files\Firefly Studios
2011-12-15 19:14 . 2004-10-22 01:17        69715        ----a-w-        c:\program files\Common Files\InstallShield\Professional\RunTime\10\50\Intel32\ctor.dll
2011-12-15 19:14 . 2004-10-22 01:17        274432        ----a-w-        c:\program files\Common Files\InstallShield\Professional\RunTime\10\50\Intel32\iscript.dll
2011-12-15 19:14 . 2004-10-22 01:16        180224        ----a-w-        c:\program files\Common Files\InstallShield\Professional\RunTime\10\50\Intel32\iuser.dll
2011-12-15 19:14 . 2004-10-22 01:16        5632        ----a-w-        c:\program files\Common Files\InstallShield\Professional\RunTime\10\50\Intel32\DotNetInstaller.exe
2011-12-15 19:14 . 2004-10-22 01:18        749568        ----a-w-        c:\program files\Common Files\InstallShield\Professional\RunTime\10\50\Intel32\iKernel.dll
2011-12-15 19:14 . 2011-12-15 19:14        192644        ----a-w-        c:\program files\Common Files\InstallShield\Professional\RunTime\10\50\Intel32\iGdi.dll
2011-12-15 19:14 . 2011-12-15 19:14        323716        ----a-w-        c:\program files\Common Files\InstallShield\Professional\RunTime\10\50\Intel32\setup.dll
2011-12-14 18:21 . 2011-12-14 18:21        --------        d-----w-        c:\users\Acer\AppData\Local\FILSH_Media_GmbH
2011-12-14 18:21 . 2011-12-14 18:43        --------        d-----w-        c:\program files\FILSHtray
.
.
.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-12-21 16:39 . 2011-08-27 14:12        98304        ----a-w-        c:\windows\system32\CmdLineExt.dll
2011-12-07 15:39 . 2011-12-07 15:39        472808        ----a-w-        c:\windows\system32\deployJava1.dll
2011-11-11 17:59 . 2011-11-11 17:59        114000        ----a-w-        c:\windows\system32\UpdSvc.dll
2011-10-15 10:01 . 2011-03-28 16:36        18328        ----a-w-        c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
2011-10-11 17:25 . 2011-10-11 17:25        74752        ----a-w-        c:\windows\system32\RegisterIEPKEYs.exe
2011-10-11 17:25 . 2011-10-11 17:25        161792        ----a-w-        c:\windows\system32\msls31.dll
2011-10-11 17:24 . 2011-10-11 17:24        86528        ----a-w-        c:\windows\system32\iesysprep.dll
2011-10-11 17:24 . 2011-10-11 17:24        76800        ----a-w-        c:\windows\system32\SetIEInstalledDate.exe
2011-10-11 17:24 . 2011-10-11 17:24        48640        ----a-w-        c:\windows\system32\mshtmler.dll
2011-10-11 17:24 . 2011-10-11 17:24        110592        ----a-w-        c:\windows\system32\IEAdvpack.dll
2011-10-11 17:24 . 2011-10-11 17:24        74752        ----a-w-        c:\windows\system32\iesetup.dll
2011-10-11 17:24 . 2011-10-11 17:24        63488        ----a-w-        c:\windows\system32\tdc.ocx
2011-10-11 17:24 . 2011-10-11 17:24        367104        ----a-w-        c:\windows\system32\html.iec
2011-10-11 17:24 . 2011-10-11 17:24        420864        ----a-w-        c:\windows\system32\vbscript.dll
2011-10-11 17:24 . 2011-10-11 17:24        35840        ----a-w-        c:\windows\system32\imgutil.dll
2011-10-11 17:24 . 2011-10-11 17:24        23552        ----a-w-        c:\windows\system32\licmgr10.dll
2011-10-11 17:24 . 2011-10-11 17:24        152064        ----a-w-        c:\windows\system32\wextract.exe
2011-10-11 17:24 . 2011-10-11 17:24        150528        ----a-w-        c:\windows\system32\iexpress.exe
2011-10-11 17:24 . 2011-10-11 17:24        142848        ----a-w-        c:\windows\system32\ieUnatt.exe
2011-10-11 17:24 . 2011-10-11 17:24        11776        ----a-w-        c:\windows\system32\mshta.exe
2011-10-11 17:24 . 2011-10-11 17:24        101888        ----a-w-        c:\windows\system32\admparse.dll
2011-10-11 14:37 . 2009-07-14 02:05        152576        ----a-w-        c:\windows\system32\msclmd.dll
.
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP]
@="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}"
[HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}]
2009-08-06 17:18        120104        ----a-w-        c:\program files\EgisTec\MyWinLocker 3\x86\PSDProtect.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"FreeCT"="c:\program files\FreeCountdownTimer\FreeCountdownTimer.exe" [2011-05-24 2033488]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-08-14 39408]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2009-06-05 186904]
"LManager"="c:\program files\Launch Manager\LManager.exe" [2009-06-02 1130504]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2009-07-06 7600672]
"Acer ePower Management"="c:\program files\Acer\Acer ePower Management\ePowerTray.exe" [2009-08-06 707104]
"EgisTecLiveUpdate"="c:\program files\EgisTec Egis Software Update\EgisUpdate.exe" [2009-08-04 199464]
"mwlDaemon"="c:\program files\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe" [2009-08-06 349480]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-28 35696]
"NortonOnlineBackupReminder"="c:\program files\Symantec\Norton Online Backup\Activation\NobuActivation.exe" [2009-07-24 588648]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2009-06-18 1537320]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-09-24 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-09-24 173592]
"Persistence"="c:\windows\system32\igfxpers.exe" [2009-09-24 150552]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2011-03-29 281768]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2011-07-05 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2011-08-18 421736]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696]
"FILSHtray"="c:\program files\FILSHtray\FILSHtray.exe" [2011-12-13 591872]
"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2011-12-24 460872]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Acer VCM.lnk - c:\program files\Acer\Acer VCM\AcerVCM.exe [2009-8-14 708608]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages        REG_MULTI_SZ          kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 Greg_Service;GRegService;c:\program files\Acer\Registration\GregHSRW.exe [2009-06-04 1150496]
R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2011-02-27 135664]
R2 Update-Service;Update-Service;c:\windows\System32\svchost.exe [2009-07-14 20992]
R3 gupdatem;Google Update-Dienst (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2011-02-27 135664]
R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys [2009-06-24 167424]
R3 RtsUIR;Realtek IR Driver;c:\windows\system32\DRIVERS\Rts516xIR.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224]
S1 mwlPSDFilter;mwlPSDFilter;c:\windows\system32\DRIVERS\mwlPSDFilter.sys [2009-06-02 18992]
S1 mwlPSDNServ;mwlPSDNServ;c:\windows\system32\DRIVERS\mwlPSDNServ.sys [2009-06-02 16432]
S1 mwlPSDVDisk;mwlPSDVDisk;c:\windows\system32\DRIVERS\mwlPSDVDisk.sys [2009-06-02 60976]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-13 48128]
S2 AntiVirSchedulerService;Avira AntiVir Planer;c:\program files\Avira\AntiVir Desktop\sched.exe [2011-05-01 136360]
S2 ePowerSvc;Acer ePower Service;c:\program files\Acer\Acer ePower Management\ePowerSvc.exe [2009-08-06 727584]
S2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [2011-12-24 652872]
S2 MWLService;MyWinLocker Service;c:\program files\EgisTec\MyWinLocker 3\x86\\MWLService.exe [2009-08-06 311592]
S2 RS_Service;Raw Socket Service;c:\program files\Acer\Acer VCM\RS_Service.exe [2009-07-10 253952]
S2 Updater Service;Updater Service;c:\program files\Acer\Acer Updater\UpdaterService.exe [2009-07-04 240160]
S3 L1C;NDIS Miniport Driver for Atheros AR8131/AR8132 PCI-E Ethernet Controller (NDIS 6.20);c:\windows\system32\DRIVERS\L1C62x86.sys [2009-07-27 51712]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2011-12-10 20464]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - 62472621
*NewlyCreated* - 70529300
*Deregistered* - 62472621
*Deregistered* - 70529300
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation        REG_MULTI_SZ          SSDPSRV upnphost SCardSvr TBS FontCache fdrespub AppIDSvc QWAVE wcncsvc
Update-Service-Installer-Service        REG_MULTI_SZ          Update-Service-Installer-Service
Update-Service        REG_MULTI_SZ          Update-Service
.
Inhalt des "geplante Tasks" Ordners
.
2012-01-06 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-02-27 05:21]
.
2012-01-06 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-02-27 05:21]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page =
mStart Page =
uInternet Settings,ProxyOverride = *.local
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 62.2.17.61 62.2.24.158 62.2.17.60 62.2.24.162
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
URLSearchHooks-{37483b40-c254-4a72-bda4-22ee90182c1e} - (no file)
AddRemove-{889DF117-14D1-44EE-9F31-C5FB5D47F68B} - c:\progra~2\TARMAI~1\{889DF~1\Setup.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2012-01-06  20:22:47
ComboFix-quarantined-files.txt  2012-01-06 19:22
.
Vor Suchlauf: 12 Verzeichnis(se), 72'776'421'376 Bytes frei
Nach Suchlauf: 17 Verzeichnis(se), 72'800'243'712 Bytes frei
.
- - End Of File - - 836D0CB4C7E1D805E771185A2EB1722E
--- --- ---


Danke. Und wie weiter?

cosinus 06.01.2012 20:58
Ok. Bitte nun Logs mit GMER und OSAM erstellen und posten.
GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus - die Online-Abfrage durch OSAM bitte überspringen.
Bei OSAM bitte darauf auch achten, dass Du das Log auch als *.log und nicht *.html oder so abspeicherst.

Hinweis: Zum Entpacken von OSAM bitte WinRAR oder 7zip verwenden! Stell auch unbedingt den Virenscanner ab, besonders der Scanner von McAfee meldet oft einen Fehalarm in OSAM!

Downloade dir bitte aswMBR.exe und speichere die Datei auf deinem Desktop.
  • Starte die aswMBR.exe - (aswMBR.exe Anleitung)
    Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten".
  • Das Tool wird dich fragen, ob Du mit der aktuellen Virendefinition von AVAST! dein System scannen willst. Beantworte diese Frage bitte mit Ja. (Sollte deine Firewall fragen, bitte den Zugriff auf das Internet zulassen )
    Der Download der Definitionen kann je nach Verbindung eine Weile dauern.
  • Klicke auf Scan.
  • Warte bitte bis Scan finished successfully im DOS-Fenster steht.
  • Drücke auf Save Log und speichere diese auf dem Desktop.
Poste mir die aswMBR.txt in deiner nächsten Antwort.

Wichtig: Drücke keinesfalls einen der Fix Buttons ohne Anweisung

Hinweis: Sollte der Scan Button ausgeblendet sein, schließe das Tool und starte es erneut. Sollte der Scan abbrechen und das Programm abstürzen, dann teile mir das mit und wähle unter AV Scan die Einstellung (none).

snowly1 06.01.2012 22:27
Also hier Gmer (musste es in einer Word datei abspeichern): GMER Logfile:
Code:
GMER 1.0.15.15641 - hxxp://www.gmer.net
Rootkit scan 2012-01-06 21:57:23
Windows 6.1.7601 Service Pack 1 Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-0 WDC_WD16 rev.11.0
Running: 54vekgg7.exe; Driver: C:\Users\Acer\AppData\Local\Temp\kwldrpob.sys


---- System - GMER 1.0.15 ----

SSDT            8062ABBE                                                                                                ZwCreateSection
SSDT            8062ABC3                                                                                                ZwSetContextThread
SSDT            8062AB5F                                                                                                ZwTerminateProcess

---- Kernel code sections - GMER 1.0.15 ----

.text          ntoskrnl.exe!ZwSaveKey + 13CD                                                                            820519A9 1 Byte  [06]
.text          ntoskrnl.exe!KiDispatchInterrupt + 5A2                                                                  820714E2 19 Bytes  [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3}
.text          ntoskrnl.exe!KeRemoveQueueEx + 14BF                                                                      8207887C 4 Bytes  [BE, AB, 62, 80]
.text          ntoskrnl.exe!KeRemoveQueueEx + 185F                                                                      82078C1C 4 Bytes  [C3, AB, 62, 80]
.text          ntoskrnl.exe!KeRemoveQueueEx + 1937                                                                      82078CF4 4 Bytes  [5F, AB, 62, 80]

---- User code sections - GMER 1.0.15 ----

.text          C:\Windows\Explorer.EXE[1292] SHELL32.dll!SHCreateDefaultExtractIcon + 7333                              769A3434 4 Bytes  [80, 1B, 00, 10]

---- User IAT/EAT - GMER 1.0.15 ----

IAT            C:\Windows\Explorer.EXE[1292] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!FreeLibraryAndExitThread]  [10001ED0] C:\Program Files\EgisTec\MyWinLocker 3\x86\psdprotect.dll (PSD DragDrop Protection/Egis Technology Inc.)
IAT            C:\Windows\Explorer.EXE[1292] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!CreateThread]              [10002A90] C:\Program Files\EgisTec\MyWinLocker 3\x86\psdprotect.dll (PSD DragDrop Protection/Egis Technology Inc.)
IAT            C:\Windows\Explorer.EXE[1292] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryA]              [100011D0] C:\Program Files\EgisTec\MyWinLocker 3\x86\psdprotect.dll (PSD DragDrop Protection/Egis Technology Inc.)

---- Devices - GMER 1.0.15 ----

AttachedDevice  \Driver\kbdclass \Device\KeyboardClass0                                                                  Wdf01000.sys (Kernelmodustreiber-Frameworklaufzeit/Microsoft Corporation)
AttachedDevice  \Driver\kbdclass \Device\KeyboardClass1                                                                  Wdf01000.sys (Kernelmodustreiber-Frameworklaufzeit/Microsoft Corporation)
AttachedDevice  \Driver\volmgr \Device\HarddiskVolume1                                                                  fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice  \Driver\volmgr \Device\HarddiskVolume2                                                                  fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice  \Driver\volmgr \Device\HarddiskVolume3                                                                  fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)

Device          \Driver\ACPI_HAL \Device\0000004d                                                                        halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation)

AttachedDevice  \FileSystem\fastfat \Fat                                                                                fltmgr.sys (Microsoft Dateisystem-Filter-Manager/Microsoft Corporation)
AttachedDevice  \FileSystem\fastfat \Fat                                                                                mwlPSDFilter.sys (PSD Filter Driver/Egis Technology Inc.)

---- EOF - GMER 1.0.15 ----
--- --- ---


[/code]

Osam (online scan hat nicht funktioniert, musste dann abbrechen, habs aber doch gespeichert):
Code:
OSAM Logfile:

       
Code:

       
Report of OSAM: Autorun Manager v5.0.11926.0
hxxp://www.online-solutions.ru/en/
Saved at 22:13:12 on 06.01.2012

OS: Windows 7 Starter Edition Service Pack 1 (Build 7601), 32-bit
Default Browser: Apple Inc. Safari 5.1 (7534.50)

Scanner Settings
[x] Rootkits detection (hidden registry)
[x] Rootkits detection (hidden files)
[x] Retrieve files information
[x] Check Microsoft signatures

Filters
[ ] Trusted entries
[ ] Empty entries
[x] Hidden registry entries (rootkit activity)
[x] Exclusively opened files
[x] Not found files
[x] Files without detailed information
[x] Existing files
[ ] Non-startable services
[ ] Non-startable drivers
[x] Active entries
[x] Disabled entries


[Common]
-----( %SystemRoot%\Tasks )-----
"GoogleUpdateTaskMachineCore.job" - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe
"GoogleUpdateTaskMachineUA.job" - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe

[Control Panel Objects]
-----( %SystemRoot%\system32 )-----
"FlashPlayerCPLApp.cpl" - "Adobe Systems Incorporated" - C:\Windows\system32\FlashPlayerCPLApp.cpl
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )-----
"QuickTime" - "Apple Inc." - C:\Program Files\QuickTime\QTSystem\QuickTime.cpl

[Drivers]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"avgntflt" (avgntflt) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avgntflt.sys
"avipbb" (avipbb) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avipbb.sys
"catchme" (catchme) - ? - C:\Users\Acer\AppData\Local\Temp\catchme.sys  (File not found)
"MBAMProtector" (MBAMProtector) - "Malwarebytes Corporation" - C:\Windows\system32\drivers\mbam.sys
"Realtek IR Driver" (RtsUIR) - ? - C:\Windows\System32\DRIVERS\Rts516xIR.sys  (File not found)
"Realtek Smartcard Reader Driver" (USBCCID) - ? - C:\Windows\System32\DRIVERS\RtsUCcid.sys  (File not found)
"ssmdrv" (ssmdrv) - "Avira GmbH" - C:\Windows\System32\DRIVERS\ssmdrv.sys

[Explorer]
-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----
{F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll
-----( HKLM\Software\Classes\Protocols\Filter )-----
{807563E5-5146-11D5-A672-00B0D022E945} "Microsoft Office InfoPath XML Mime Filter" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
-----( HKLM\Software\Classes\Protocols\Handler )-----
{E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} "Album Download IE Asynchronous Pluggable Protocol Interface" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
{314111c7-a502-11d2-bbca-00c04f8ec294} "HxProtocol Class" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
{FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} "IEProtocolHandler Class" - "Skype Technologies" - C:\Program Files\Acer\Acer VCM\Skype4COM.dll
{5513F07E-936B-4E52-9B00-067394E91CC5} "sacore" - ? -   (File not found | COM-object registry key not found)
{91774881-D725-4E58-B298-07617B9B86A8} "Skype IE add-on Pluggable Protocol" - ? - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll  (File not found)
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----
{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA} "DragDropProtect Class" - "Egis Technology Inc." - C:\Program Files\EgisTec\MyWinLocker 3\x86\psdprotect.dll
{B9E1D2CB-CCFF-4AA6-9579-D7A4754030EF} "iTunes" - "Apple Inc." - C:\Program Files\iTunes\iTunesMiniPlayer.dll
{42042206-2D85-11D3-8CFF-005004838597} "Microsoft Office HTML Icon Handler" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\msohevi.dll
{993BE281-6695-4BA5-8A2A-7AACBFAAB69E} "Microsoft Office Metadata Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll
{5858A72C-C2B4-4dd7-B2BF-B76DB1BD9F6C} "Microsoft Office OneNote Namespace Extension for Windows Desktop Search" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\ONFILTER.DLL
{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97} "Microsoft Office Thumbnail Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll
{45AC2688-0253-4ED8-97DE-B5370FA7D48A} "Shell Extension for Malware scanning" - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\shlext.dll
{2BE99FD4-A181-4996-BFA9-58C5FFD11F6C} "Windows Live Photo Gallery Autoplay Drop Target" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\WLXPhotoGallery.exe
{00F30F64-AC33-42F5-8FD1-5DC2D3FDE06C} "Windows Live Photo Gallery Editor Drop Target" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\WLXPhotoGallery.exe
{00F3712A-CA79-45B4-9E4D-D7891E7F8B9D} "Windows Live Photo Gallery Editor Shim" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\PhotoViewerShim.dll
{00F30F90-3E96-453B-AFCD-D71989ECC2C7} "Windows Live Photo Gallery Viewer Autoplay Shim" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\PhotoViewerShim.dll
{00F33137-EE26-412F-8D71-F84E4C2C6625} "Windows Live Photo Gallery Viewer Autoplay Shim" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\PhotoViewerShim.dll
{00F374B7-B390-4884-B372-2FC349F2172B} "Windows Live Photo Gallery Viewer Drop Target" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\WLXPhotoGallery.exe
{00F346CB-35A4-465B-8B8F-65A29DBAB1F6} "Windows Live Photo Gallery Viewer Shim" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\PhotoViewerShim.dll
{06A2568A-CED6-4187-BB20-400B8C02BE5A} "{06A2568A-CED6-4187-BB20-400B8C02BE5A}" - "Microsoft Corporation" - C:\Program Files\Windows Live\Photo Gallery\WLXPhotoAcquireWizard.exe

[Internet Explorer]
-----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )-----
<binary data> "Google Toolbar" - "Google Inc." - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
ITBar7Height "ITBar7Height" - ? -   (File not found | COM-object registry key not found)
<binary data> "ITBar7Layout" - ? -   (File not found | COM-object registry key not found)
-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----
{8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.6.0_29" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab
{CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} "Java Plug-in 1.6.0_29" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab
{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_29" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\npjpi160_29.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab
{7530BFB8-7293-4D34-9923-61A11451AFC5} "OnlineScanner Control" - "ESET" - C:\PROGRA~1\ESET\ESETON~1\ONLINE~1.OCX / hxxp://download.eset.com/special/eos/OnlineScanner.cab
-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----
{898EA8C8-E7FF-479B-8935-AEC46303B9E5} "Click to call with Skype" - ? - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll  (File not found)
{FF059E31-CC5A-4E2E-BF3B-96E929D65503} "Research" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
{48E73304-E1D6-4330-914C-F5F514E3486C} "Send to OneNote" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar )-----
<binary data> "Google Toolbar" - "Google Inc." - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----
{18DF081C-E8AD-4283-A596-FA578C2EBDC3} "Adobe PDF Link Helper" - "Adobe Systems Incorporated" - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
{AA58ED58-01DD-4d91-8333-CF10577473F7} "Google Toolbar Helper" - "Google Inc." - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
{DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2ssv.dll

[LSA Providers]
-----( HKLM\SYSTEM\CurrentControlSet\Control\Lsa )-----
"Security Packages" - "Microsoft Corp." - C:\Windows\system32\livessp.dll

[Logon]
-----( %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup )-----
"desktop.ini" - ? - C:\Users\Acer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
-----( %AllUsersProfile%\Microsoft\Windows\Start Menu\Programs\Startup )-----
"Acer VCM.lnk" - "Acer Incorporated" - C:\Program Files\Acer\Acer VCM\AcerVCM.exe  (Shortcut exists | File exists)
"desktop.ini" - ? - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
-----( HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run )-----
"FreeCT" - "Comfort Software Group" - C:\Program Files\FreeCountdownTimer\FreeCountdownTimer.exe -autorun
"swg" - "Google Inc." - "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
-----( HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\Wds\rdpwd )-----
"StartupPrograms" - ? - rdpclip  (File not found)
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----
"Acer ePower Management" - "Acer Incorporated" - C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe
"Adobe Reader Speed Launcher" - "Adobe Systems Incorporated" - "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
"avgnt" - "Avira GmbH" - "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
"EgisTecLiveUpdate" - "Egis Technology Inc." - "C:\Program Files\EgisTec Egis Software Update\EgisUpdate.exe"
"FILSHtray" - "FILSH Media GmbH" - "C:\Program Files\FILSHtray\FILSHtray.exe"
"IAAnotif" - "Intel Corporation" - C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
"iTunesHelper" - "Apple Inc." - "C:\Program Files\iTunes\iTunesHelper.exe"
"LManager" - "Dritek System Inc." - C:\Program Files\Launch Manager\LManager.exe
"Malwarebytes' Anti-Malware" - "Malwarebytes Corporation" - "C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
"mwlDaemon" - "Egis Technology Inc." - C:\Program Files\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe
"NortonOnlineBackupReminder" - "Symantec Corporation" - "C:\Program Files\Symantec\Norton Online Backup\Activation\NobuActivation.exe" UNATTENDED
"QuickTime Task" - "Apple Inc." - "C:\Program Files\QuickTime\QTTask.exe" -atboottime
"SunJavaUpdateSched" - "Sun Microsystems, Inc." - "C:\Program Files\Common Files\Java\Java Update\jusched.exe"

[Network Providers]
-----( HKLM\SYSTEM\CurrentControlSet\Control\NetworkProvider\Order )-----
"LanmanWorkstation" - ? - RDPNP,LanmanWorkstation,webclient  (File not found)

[Print Monitors]
-----( HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors )-----
"Send To Microsoft OneNote Monitor" - "Microsoft Corporation" - C:\Windows\system32\msonpmon.dll

[Services]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"Acer ePower Service" (ePowerSvc) - "Acer Incorporated" - C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe
"Apple Mobile Device" (Apple Mobile Device) - "Apple Inc." - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
"Avira AntiVir Guard" (AntiVirService) - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
"Avira AntiVir Planer" (AntiVirSchedulerService) - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\sched.exe
"Dienst "Bonjour"" (Bonjour Service) - "Apple Inc." - C:\Program Files\Bonjour\mDNSResponder.exe
"Google Software Updater" (gusvc) - "Google" - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
"Google Update Service (gupdate)" (gupdate) - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe
"Google Update-Dienst (gupdatem)" (gupdatem) - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe
"GRegService" (Greg_Service) - "Acer Incorporated" - C:\Program Files\Acer\Registration\GregHSRW.exe
"Intel(R) Matrix Storage Event Monitor" (IAANTMON) - "Intel Corporation" - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
"iPod-Dienst" (iPod Service) - "Apple Inc." - C:\Program Files\iPod\bin\iPodService.exe
"MBAMService" (MBAMService) - "Malwarebytes Corporation" - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
"Microsoft .NET Framework NGEN v4.0.30319_X86" (clr_optimization_v4.0.30319_32) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
"Microsoft Office Diagnostics Service" (odserv) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE
"MyWinLocker Service" (MWLService) - "Egis Technology Inc." - C:\Program Files\EgisTec\MyWinLocker 3\x86\MWLService.exe
"Office Source Engine" (ose) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"Raw Socket Service" (RS_Service) - "Acer Incorporated" - C:\Program Files\Acer\Acer VCM\RS_Service.exe
"Update-Service" (Update-Service) - "Joosoft.com GmbH" - C:\Windows\System32\UpdSvc.dll
"Updater Service" (Updater Service) - "Acer" - C:\Program Files\Acer\Acer Updater\UpdaterService.exe
"Windows Live ID Sign-in Assistant" (wlidsvc) - "Microsoft Corp." - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

[Winlogon]
-----( HKCU\Control Panel\Desktop )-----
"SCRNSAVE.EXE" - "Acer" - C:\Windows\System32\Acer.scr

[Winsock Providers]
-----( HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries )-----
"mdnsNSP" - "Apple Inc." - C:\Program Files\Bonjour\mdnsNSP.dll
"WindowsLive Local NSP" - "Microsoft Corp." - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL
"WindowsLive NSP" - "Microsoft Corp." - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL

===[ Logfile end ]=========================================[ Logfile end ]===

--- --- ---

If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru
aswmbr:
Code:
aswMBR version 0.9.9.1297 Copyright(c) 2011 AVAST Software
Run date: 2012-01-06 22:15:42
-----------------------------
22:15:42.831    OS Version: Windows 6.1.7601 Service Pack 1
22:15:42.831    Number of processors: 2 586 0x1C02
22:15:42.831    ComputerName: ACER-PC  UserName: Acer
22:15:45.436    Initialize success
22:15:51.957    AVAST engine download error: 0
22:15:51.957    AVAST engine error: 11003
22:16:02.596    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-0
22:16:02.612    Disk 0 Vendor: WDC_WD16 11.0 Size: 152627MB BusType: 3
22:16:02.627    Disk 0 MBR read successfully
22:16:02.643    Disk 0 MBR scan
22:16:02.643    Disk 0 Windows 7 default MBR code
22:16:02.658    Disk 0 Partition 1 00    27 Hidden NTFS WinRE NTFS        12291 MB offset 63
22:16:02.674    Disk 0 Partition 2 80 (A) 07    HPFS/NTFS NTFS        2039 MB offset 25173855
22:16:02.690    Disk 0 Partition 3 00    07    HPFS/NTFS NTFS      138293 MB offset 29350755
22:16:02.705    Disk 0 scanning sectors +312576705
22:16:02.799    Disk 0 scanning C:\Windows\system32\drivers
22:16:12.330    Service scanning
22:16:14.374    Modules scanning
22:16:27.790    Disk 0 trace - called modules:
22:16:27.837    ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys halmacpi.dll iaStor.sys
22:16:27.852    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x851553b0]
22:16:27.868    3 CLASSPNP.SYS[87b7659e] -> nt!IofCallDriver -> [0x847568b8]
22:16:27.899    5 ACPI.sys[872293d4] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-0[0x84711028]
22:16:27.915    Scan finished successfully
22:17:07.322    Disk 0 MBR has been saved successfully to "D:\MBR.dat"
22:17:07.369    The log file has been saved successfully to "D:\aswMBR.txt"
Wie weiter?

cosinus 06.01.2012 22:33
Sieht ok aus. Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SASW und poste die Logs.
Denk dran beide Tools zu updaten vor dem Scan!!


Anschließend über den OnlineScanner von ESET eine zusätzliche Meinung zu holen ist auch nicht verkehrt:


ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset


snowly1 07.01.2012 01:49
So, hier mbamlog (es kam mal eine Fehlermeldung: von Microsoft .Net Framework. Unbehandelte Ausnahme in der Anwendung: Klicken Sie auf weiter um den Fehler zu ignorieren und die Anwendung fortzusetzen. Wenn Sie auf beenden klicken, wird die Anwendung sofort beendet. Der Vorgang wurde erfolgreich beendet. Ich habe dann auf weiter geklickt.) Hier nun das mbamlog:
Code:
Malwarebytes Anti-Malware (Test) 1.60.0.1800
www.malwarebytes.org

Datenbank Version: v2012.01.06.02

Windows 7 Service Pack 1 x86 NTFS
Internet Explorer 9.0.8112.16421
Acer :: ACER-PC [Administrator]

Schutz: Aktiviert

06.01.2012 22:51:57
mbam-log-2012-01-06 (22-51-57).txt

Art des Suchlaufs: Vollständiger Suchlauf
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 316431
Laufzeit: 58 Minute(n), 21 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)
Super antispyware (es hat Trojaner drauf, ist der jetzt vom heute heruntergeladenen Softonic Downloader?):
Code:
  SUPERAntiSpyware Scan Log
hxxp://www.superantispyware.com

Generated 01/07/2012 at 01:44 AM

Application Version : 5.0.1142

Core Rules Database Version : 8057
Trace Rules Database Version: 5869

Scan type      : Complete Scan
Total Scan Time : 01:33:20

Operating System Information
Windows 7 Starter 32-bit, Service Pack 1 (Build 6.01.7601)
UAC On - Administrator

Memory items scanned      : 611
Memory threats detected  : 0
Registry items scanned    : 37177
Registry threats detected : 0
File items scanned        : 119826
File threats detected    : 37

Adware.Tracking Cookie
        C:\Users\Acer\AppData\Roaming\Microsoft\Windows\Cookies\acer@adx.chip[1].txt [ /adx.chip ]
        C:\Users\Acer\AppData\Roaming\Microsoft\Windows\Cookies\acer@smartadserver[2].txt [ /smartadserver ]
        C:\Users\Acer\AppData\Roaming\Microsoft\Windows\Cookies\3KKL5MLA.txt [ /free-countdown-timer.softonic.de ]
        C:\Users\Acer\AppData\Roaming\Microsoft\Windows\Cookies\TPUXTLX8.txt [ /ad.yieldmanager.com ]
        C:\Users\Acer\AppData\Roaming\Microsoft\Windows\Cookies\6SV9N4OE.txt [ /invitemedia.com ]
        C:\Users\Acer\AppData\Roaming\Microsoft\Windows\Cookies\GZJVRMW9.txt [ /revsci.net ]
        C:\Users\Acer\AppData\Roaming\Microsoft\Windows\Cookies\GM223ZR1.txt [ /c.atdmt.com ]
        C:\Users\Acer\AppData\Roaming\Microsoft\Windows\Cookies\TZ986BUH.txt [ /doubleclick.net ]
        C:\Users\Acer\AppData\Roaming\Microsoft\Windows\Cookies\WMRTV4PN.txt [ /atdmt.com ]
        C:\Users\Acer\AppData\Roaming\Microsoft\Windows\Cookies\11GFCMTC.txt [ /tracking.gameforge.de ]
        C:\Users\Acer\AppData\Roaming\Microsoft\Windows\Cookies\AVG9I23D.txt [ /content.yieldmanager.com ]
        C:\Users\Acer\AppData\Roaming\Microsoft\Windows\Cookies\MMYNHC1C.txt [ /serving-sys.com ]
        C:\USERS\ACER\AppData\Roaming\Microsoft\Windows\Cookies\Low\acer@www.google[1].txt [ Cookie:acer@www.google.ch/accounts ]
        C:\USERS\ACER\AppData\Roaming\Microsoft\Windows\Cookies\Low\QDYM8IRU.txt [ Cookie:acer@www.etracker.de/ ]
        C:\USERS\ACER\AppData\Roaming\Microsoft\Windows\Cookies\Low\PD2BAXEQ.txt [ Cookie:acer@ad.yieldmanager.com/ ]
        C:\USERS\ACER\AppData\Roaming\Microsoft\Windows\Cookies\Low\R681HDD1.txt [ Cookie:acer@invitemedia.com/ ]
        C:\USERS\ACER\AppData\Roaming\Microsoft\Windows\Cookies\Low\acer@www.google[2].txt [ Cookie:acer@www.google.com/accounts ]
        C:\USERS\ACER\AppData\Roaming\Microsoft\Windows\Cookies\Low\KE3C2E1H.txt [ Cookie:acer@tribalfusion.com/ ]
        C:\USERS\ACER\AppData\Roaming\Microsoft\Windows\Cookies\Low\acer@accounts.youtube[1].txt [ Cookie:acer@accounts.youtube.com/accounts ]
        C:\USERS\ACER\AppData\Roaming\Microsoft\Windows\Cookies\Low\YGGPKL0L.txt [ Cookie:acer@trafficmp.com/ ]
        C:\USERS\ACER\AppData\Roaming\Microsoft\Windows\Cookies\Low\IWO8Y9LF.txt [ Cookie:acer@free-countdown-timer.com/ ]
        C:\USERS\ACER\AppData\Roaming\Microsoft\Windows\Cookies\Low\acer@autoscout24.112.2o7[1].txt [ Cookie:acer@autoscout24.112.2o7.net/ ]
        C:\USERS\ACER\AppData\Roaming\Microsoft\Windows\Cookies\Low\UVZKEIU8.txt [ Cookie:acer@doubleclick.net/ ]
        C:\USERS\ACER\AppData\Roaming\Microsoft\Windows\Cookies\Low\0QADNPLI.txt [ Cookie:acer@casalemedia.com/ ]
        C:\USERS\ACER\AppData\Roaming\Microsoft\Windows\Cookies\Low\HPUY8YRL.txt [ Cookie:acer@atdmt.com/ ]
        C:\USERS\ACER\AppData\Roaming\Microsoft\Windows\Cookies\Low\FNRHKFYC.txt [ Cookie:acer@sonymediasoftware.112.2o7.net/ ]
        C:\USERS\ACER\AppData\Roaming\Microsoft\Windows\Cookies\Low\Z6DYWIJX.txt [ Cookie:acer@2o7.net/ ]
        C:\USERS\ACER\AppData\Roaming\Microsoft\Windows\Cookies\Low\354X9W3T.txt [ Cookie:acer@accounts.google.com/ ]
        C:\USERS\ACER\Cookies\TPUXTLX8.txt [ Cookie:acer@ad.yieldmanager.com/ ]
        C:\USERS\ACER\Cookies\6SV9N4OE.txt [ Cookie:acer@invitemedia.com/ ]
        C:\USERS\ACER\Cookies\TZ986BUH.txt [ Cookie:acer@doubleclick.net/ ]
        C:\USERS\ACER\Cookies\acer@smartadserver[2].txt [ Cookie:acer@smartadserver.com/ ]
        C:\USERS\ACER\Cookies\WMRTV4PN.txt [ Cookie:acer@atdmt.com/ ]
        C:\USERS\ACER\Cookies\AVG9I23D.txt [ Cookie:acer@content.yieldmanager.com/ak/ ]

Trojan.Dropper/SVCHost-Fake
        C:\PROGRAM FILES\MALWAREBYTES' ANTI-MALWARE\CHAMELEON\SVCHOST.EXE

Trojan.Agent/Gen-SoftonicDownloader
        C:\USERS\ACER\DOCUMENTS\MINIANWENDUNG COUNTDOWN.EXE
        C:\USERS\ACER\DOCUMENTS\MINIANWENDUNG SPRACHE ü..EXE
Wie gehts weiter? Danke für die Hilfe!

snowly1 07.01.2012 02:01
Frage: Habe das Prog. noch nicht beendet. Ich habe die grünen Haken rausgenommen bei den gefundenen Dateien. Muss ich die nun ankreuzen und "remove Threats" drücken? Ich glaube sie sind noch nicht in Quarantäne. Es steht oben, wenn nicht angekreuzt werden sie nicht entfernt und nur in Quarantäne gehen wenn sie entfernt werden. Da ist noch eine Taste mit Managed allowed items. Was ist das?

cosinus 07.01.2012 02:09
Nein das sind Fehlalarme. Die Cookies aber können weg...
Mach mit ESET weiter

snowly1 07.01.2012 02:12
Danke. Also wie, Du meinst die 34 adware.tracking kann ich entfernen und die zwei trojaner auch? es steht these items should be immediately removed from your computer. Eset ist doch ein online scanner, geht doch nicht ohne I-Net, oder? Was mache ich nun?

snowly1 07.01.2012 02:33
Kann Eset nicht ausführen, kein Internet seit dem fix. Meldung: die Proxyeinstellungen des Netzwerks konnten nicht automatisch ermittelt werden. Was tun? Wie bekomme ich eine Verbindung?

cosinus 07.01.2012 03:33
  • Verknüpfung zu cmd.exe auf Desktop rechtsklicken => Als Administrator ausführen => Sicherheitsabfrage der Benutzerkontensteuerung ggf. bestätigen => schwarze Eingabeaufforderung öffnet sich
  • Tipp dort ein:
    Code:
    netsh int ip reset c:\resetlog.txt
    und bestätige mit enter.
  • zweiten Befehl eintippen und ausführen:

    Code:
    netsh branchcache reset
  • dritten Befehl eintippen und ausführen:

    Code:
    netsh winsock reset
  • Öffne die Datei c:\resetlog.txt und poste den Inhalt hier mit CODE-Tags umschlossen

snowly1 07.01.2012 13:32
Hat nicht geklappt. Fehlermeldungen:1:

Code:
Die Initialisierungsfunktion InitHelperDll in NSHHTTP.DLL konnte nicht gestartet werden. Fehlercode 11003. Schnittstelle wird zurückgesetzt, OK! Starten Sie den Computer neu, um die Aktion abzuschliessen.
2:
Code:
Die Initialisierungsfunktion InitHelperDll in NSHHTTP.DLL konnte nicht gestartet werden. Fehlercode 11003. Der folgende Befehl wurde nicht gefunden: branchcache reset.
3:
Code:
Die Initialisierungsfunktion InitHelperDll in NSHHTTP.DLL konnte nicht gestartet werden. Fehlercode 11003.  Der Winsock Katalog wurde zurückgesetzt.
Die Datei resetlog.txt kann ich nicht finden. In welchem Unterordner sollte sie sein?

Was muss ich nun tun? Kann noch keine Neztwerkverbindung herstellen und keine Verbindung mit Windows Dienst hergestellen. Danke.

cosinus 07.01.2012 15:57
Erstmal Windows neu starten und prüfen.

Wenn Internetverbindung immer noch nicht da ist auch mal das prüfen => http://www.trojaner-board.de/94344-p...n-pruefen.html


Alle Zeitangaben in WEZ +1. Es ist jetzt 13:16 Uhr.
Seite 2 von 5 1 2 34 Letzte »
100 Beiträge dieses Themas auf einer Seite anzeigen

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19