Trojaner-Board - TR/Sirefef.BP.1 und andere

Guten Morgen,

ich bins nochmal. Habe eben gesehen, dass man noch eine DDS.txt und eine Attach.txt beifügen sollte. (siehe unten)

Noch eine weitere Frage: wenn ich meine Daten via Linux Live CD gesichert habe (auf externe HDD), wie kann ich dann sicher gehen, dass ich keinen Virus/... mit auf diese HDD gepackt habe. In Linux kann ich ja schlecht nach Viren suchen, oder?

DDS:

Code:

.

DDS (Ver_2011-08-26.01) - NTFSx86 

Internet Explorer: 9.0.8112.16421  BrowserJavaVersion: 1.6.0_25

Run by Andreas at 8:42:07 on 2012-03-01

Microsoft Windows 7 Professional   6.1.7601.1.1252.49.1031.18.3055.2071 [GMT 1:00]

.

AV: AntiVir Desktop *Enabled/Updated* {090F9C29-64CE-6C6F-379C-5901B49A85B7}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

SP: AntiVir Desktop *Enabled/Updated* {B26E7DCD-42F4-63E1-0D2C-6273CF1DCF0A}

.

============== Running Processes ===============

.

C:\Windows\system32\wininit.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Program Files\Fingerprint Sensor\AtService.exe

C:\Windows\system32\nvvsvc.exe

C:\Windows\system32\svchost.exe -k RPCSS

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe -k GPSvcGroup

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\nvvsvc.exe

C:\Windows\system32\svchost.exe -k NetworkService

C:\Program Files\ASUS\ASUS Data Security Manager\ADSMSrv.exe

C:\Program Files\ATK Hotkey\ASLDRSrv.exe

C:\Windows\System32\spoolsv.exe

C:\Windows\system32\svchost.exe -k WbioSvcGroup

C:\Program Files\Avira\AntiVir Desktop\sched.exe

C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe

C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe

C:\Program Files\Avira\AntiVir Desktop\avguard.exe

C:\Program Files\Prey\platform\windows\cronsvc.exe

C:\Program Files\Avira\AntiVir Desktop\avshadow.exe

C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe

C:\Windows\system32\conhost.exe

C:\Windows\System32\svchost.exe -k LocalServiceNoNetwork

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\Program Files\Common Files\LightScribe\LSSrvc.exe

C:\Program Files\CDBurnerXP\NMSAccessU.exe

C:\Windows\system32\PnkBstrA.exe

D:\Solidworks\SolidWorks Flow Simulation\binCFW\StandAloneSlv.exe

C:\Program Files\CyberLink\Shared Files\RichVideo.exe

C:\Program Files\Sandboxie\SbieSvc.exe

C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe

C:\Windows\system32\svchost.exe -k imgsvc

C:\Windows\System32\StkCSrv.exe

C:\Program Files\TeamViewer\Version6\TeamViewer_Service.exe

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

C:\Windows\system32\wbem\wmiprvse.exe

C:\Program Files\Wyse\PocketCloud Windows Companion\PocketCloudService.exe

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe

C:\Windows\system32\SearchIndexer.exe

C:\Windows\system32\SearchProtocolHost.exe

C:\Windows\system32\SearchFilterHost.exe

C:\Windows\system32\taskeng.exe

C:\Windows\system32\Dwm.exe

C:\Windows\system32\taskhost.exe

C:\Windows\explorer.exe

C:\Program Files\ATK Hotkey\Hcontrol.exe

C:\Program Files\ATKOSD2\ATKOSD2.exe

C:\Program Files\P4G\BatteryLife.exe

C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe

C:\Program Files\ASUS\Splendid\ACMON.exe

C:\Program Files\ASUS\ATK Media\DMedia.exe

C:\Windows\System32\ACEngSvr.exe

C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe

C:\Windows\WindowsMobile\wmdc.exe

C:\Program Files\ATK Hotkey\ATKOSD.exe

C:\Windows\system32\svchost.exe -k WindowsMobile

C:\Program Files\Avira\AntiVir Desktop\avgnt.exe

C:\Windows\System32\StikyNot.exe

C:\Program Files\ATK Hotkey\KBFiltr.exe

C:\Users\Andreas\AppData\Roaming\Dropbox\bin\Dropbox.exe

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe

C:\Windows\system32\conhost.exe

C:\Windows\system32\wbem\wmiprvse.exe

.

============== Pseudo HJT Report ===============

.

uStart Page = about:blank

uWinlogon: Shell=c:\users\andreas\appdata\local\75422588\X

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll

BHO: {31FF080D-12A3-439A-A2EF-4BA95A3148E8} - No File

BHO: DivX Plus Web Player HTML5 <video>: {326e768d-4182-46fd-9c16-1449a49795f4} - c:\program files\divx\divx plus web player\ie\divxhtml5\DivXHTML5.dll

BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\progra~1\micros~1\office14\GROOVEEX.DLL

BHO: Windows Live ID-Anmelde-Hilfsprogramm: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll

BHO: Office Document Cache Handler: {b4f3a835-0e21-4959-ba22-42b3008e02ff} - c:\progra~1\micros~1\office14\URLREDIR.DLL

BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll

TB: TerraTec Home Cinema: {ad6e6555-fb2c-47d4-8339-3e2965509877} - c:\progra~1\terratec\terrat~1\THCDES~1.DLL

TB: {D4027C7F-154A-4066-A1AD-4243D8127440} - No File

uRun: [RESTART_STICKY_NOTES] c:\windows\system32\StikyNot.exe

mRun: [SMSERIAL] c:\program files\motorola\smserial\sm56hlpr.exe

mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup

mRun: [JMB36X IDE Setup] c:\windows\raidtool\xInsIDE.exe

mRun: [ATKMEDIA] c:\program files\asus\atk media\DMEDIA.EXE

mRun: [RtHDVCpl] c:\program files\realtek\audio\hda\RtHDVCpl.exe -s

mRun: [Windows Mobile Device Center] %windir%\WindowsMobile\wmdc.exe

mRun: [<NO NAME>] 

mRun: [avgnt] "c:\program files\avira\antivir desktop\avgnt.exe" /min

mRun: [BCSSync] "c:\program files\microsoft office\office14\BCSSync.exe" /DelayServices

mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"

StartupFolder: c:\users\andreas\appdata\roaming\micros~1\windows\startm~1\programs\startup\dropbox.lnk - c:\users\andreas\appdata\roaming\dropbox\bin\Dropbox.exe

mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)

mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)

mPolicies-system: EnableUIADesktopToggle = 0 (0x0)

mPolicies-system: PromptOnSecureDesktop = 0 (0x0)

IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200

IE: An OneNote s&enden - c:\progra~1\micros~1\office14\ONBttnIE.dll/105

IE: Free YouTube Download - c:\users\andreas\appdata\roaming\dvdvideosoftiehelpers\freeyoutubedownload.htm

IE: Free YouTube to MP3 Converter - c:\users\andreas\appdata\roaming\dvdvideosoftiehelpers\freeyoutubetomp3converter.htm

IE: Nach Microsoft &Excel exportieren - c:\progra~1\mi3dfc~1\office11\EXCEL.EXE/3000

IE: Nach Microsoft E&xcel exportieren - c:\progra~1\micros~1\office14\EXCEL.EXE/3000

IE: Nach Microsoft E&xel exportieren - c:\progra~1\micros~1\office12\EXCEL.EXE/3000

IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\program files\microsoft office\office14\ONBttnIE.dll

IE: {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:\windows\windowsmobile\INetRepl.dll

IE: {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:\windows\windowsmobile\INetRepl.dll

IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - c:\program files\microsoft office\office14\ONBttnIELinkedNotes.dll

LSP: mswsock.dll

DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} - hxxp://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab

DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} - hxxp://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab

DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

TCP: DhcpNameServer = 192.168.1.1

TCP: Interfaces\{E6700137-9ECC-410F-BF8A-53E7790BEB0C} : DhcpNameServer = 192.168.1.1

TCP: Interfaces\{E6700137-9ECC-410F-BF8A-53E7790BEB0C}\465667F6C6F6D2030303243324441323132364 : DhcpNameServer = 192.168.2.1

TCP: Interfaces\{E6700137-9ECC-410F-BF8A-53E7790BEB0C}\642716E6A7F5745756E6475627374716C6 : DhcpNameServer = 192.168.0.1

TCP: Interfaces\{E6700137-9ECC-410F-BF8A-53E7790BEB0C}\6457371627F6 : DhcpNameServer = 192.168.1.1

TCP: Interfaces\{E6700137-9ECC-410F-BF8A-53E7790BEB0C}\757402B4F6D647572737472716373756 : DhcpNameServer = 192.168.178.1

TCP: Interfaces\{E6700137-9ECC-410F-BF8A-53E7790BEB0C}\75C414E4D23536861647A7 : DhcpNameServer = 192.168.2.1

Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - c:\program files\common files\microsoft shared\office14\MSOXMLMF.DLL

Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL

SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\progra~1\micros~1\office14\GROOVEEX.DLL

mASetup: {10880D85-AAD9-4558-ABDC-2AB1552D831F} - "c:\program files\common files\lightscribe\LSRunOnce.exe"

.

================= FIREFOX ===================

.

FF - ProfilePath - c:\users\andreas\appdata\roaming\mozilla\firefox\profiles\jgcaeez0.default\

FF - prefs.js: browser.startup.homepage - hxxp://www.google.de/ig?hl=de&source=iglk

FF - plugin: c:\progra~1\micros~1\office14\NPAUTHZ.DLL

FF - plugin: c:\progra~1\micros~1\office14\NPSPWRAP.DLL

FF - plugin: c:\program files\adobe\reader 10.0\reader\air\nppdf32.dll

FF - plugin: c:\program files\common files\wolfram research\browser\8.0.1.2063897\npmathplugin.dll

FF - plugin: c:\program files\divx\divx ovs helper\npovshelper.dll

FF - plugin: c:\program files\divx\divx plus web player\npdivx32.dll

FF - plugin: c:\program files\google\google earth\plugin\npgeplugin.dll

FF - plugin: c:\program files\google\picasa3\npPicasa3.dll

FF - plugin: c:\program files\google\update\1.3.21.99\npGoogleUpdate3.dll

FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll

FF - plugin: c:\program files\microsoft silverlight\4.1.10111.0\npctrlui.dll

FF - plugin: c:\program files\mozilla firefox\plugins\npdeployJava1.dll

FF - plugin: c:\program files\mozilla firefox\plugins\npEModelPlugin.dll

FF - plugin: c:\program files\windows live\photo gallery\NPWLPG.dll

FF - plugin: c:\programdata\id software\quakelive\npquakezero.dll

FF - plugin: c:\users\andreas\appdata\roaming\mozilla\firefox\profiles\jgcaeez0.default\extensions\battlefieldplay4free@ea.com\plugins\npBP4FUpdater.dll

.

---- FIREFOX POLICIES ----

FF - user.js: network.cookie.cookieBehavior - 0

FF - user.js: privacy.clearOnShutdown.cookies - false

FF - user.js: security.warn_viewing_mixed - false

FF - user.js: security.warn_viewing_mixed.show_once - false

FF - user.js: security.warn_submit_insecure - false

FF - user.js: security.warn_submit_insecure.show_once - false

.

============= SERVICES / DRIVERS ===============

.

R2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\common files\adobe\arm\1.0\armsvc.exe [2011-6-6 64952]

R2 AntiVirSchedulerService;Avira AntiVir Planer;c:\program files\avira\antivir desktop\sched.exe [2010-11-12 136360]

R2 AntiVirService;Avira AntiVir Guard;c:\program files\avira\antivir desktop\avguard.exe [2010-11-12 269480]

R2 ATService;AuthenTec Fingerprint Service;c:\program files\fingerprint sensor\AtService.exe [2009-3-16 1787128]

R2 avgntflt;avgntflt;c:\windows\system32\drivers\avgntflt.sys [2010-11-12 66616]

R2 CronService;Cron Service for Prey;c:\program files\prey\platform\windows\cronsvc.exe [2010-9-29 18432]

R2 Remote Solver for Flow Simulation 2010;Remote Solver for Flow Simulation 2010;d:\solidworks\solidworks flow simulation\bincfw\StandAloneSlv.exe [2010-4-19 71432]

R2 StkSSrv;Syntek AVStream USB2.0 WebCam Service;c:\windows\system32\StkCSrv.exe [2007-4-19 24576]

R2 sxuptp;SXUPTP Driver;c:\windows\system32\drivers\sxuptp.sys [2011-5-16 62464]

R2 TeamViewer6;TeamViewer 6;c:\program files\teamviewer\version6\TeamViewer_Service.exe [2011-6-1 2337144]

R2 WysePocketCloud;Wyse PocketCloud;c:\program files\wyse\pocketcloud windows companion\PocketCloudService.exe [2012-2-3 170400]

R3 ATSwpWDF;AuthenTec TruePrint USB WBF WDF Driver;c:\windows\system32\drivers\ATSwpWDF.sys [2009-9-1 625152]

R3 NETwLv32;    Intel(R) Wireless WiFi Link der Serie 5000 Adaptertreiber für Windows Vista 32-Bit;c:\windows\system32\drivers\NETwLv32.sys [2011-1-27 6639616]

R3 SbieDrv;SbieDrv;c:\program files\sandboxie\SbieDrv.sys [2010-2-3 115432]

R3 seehcri;Sony Ericsson seehcri Device Driver;c:\windows\system32\drivers\seehcri.sys [2010-4-9 27632]

R3 SMSCIRDA;SMSC Infrared Device Driver;c:\windows\system32\drivers\smscirda.sys [2007-4-25 31232]

R3 StkCMini;Syntek AVStream USB2.0 1.3M WebCam;c:\windows\system32\drivers\StkCMini.sys [2007-6-6 1260672]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]

S2 DivisCTS;Webrootcommagentservice;c:\windows\system32\svchost.exe -k netsvcs [2009-7-14 20992]

S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2011-2-16 136176]

S2 mcupdmgr.exe;Qfcoresvc;c:\windows\system32\svchost.exe -k netsvcs [2009-7-14 20992]

S2 SkypeUpdate;Skype Updater;c:\program files\skype\updater\Updater.exe [2012-2-15 158856]

S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2009-7-13 229888]

S3 BthAvrcp;Bluetooth-AVRCP-Profil;c:\windows\system32\drivers\BthAvrcp.sys [2009-8-13 22528]

S3 CoordinatorServiceHost;SW Distributed TS Coordinator Service;d:\solidworks\solidworks\swscheduler\DTSCoordinatorService.exe [2010-6-15 87336]

S3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);c:\windows\system32\drivers\ssudbus.sys [2011-12-30 80184]

S3 gupdatem;Google Update-Dienst (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2011-2-16 136176]

S3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files\microsoft office\office14\GROOVE.EXE [2011-6-12 31125880]

S3 MODRC;Cinergy HT USB XE IR Service;c:\windows\system32\drivers\modrc.sys [2007-7-11 13824]

S3 netw5v32;Intel(R) Wireless WiFi Link 5000-Serie - Adaptertreiber für Windows Vista 32 Bit;c:\windows\system32\drivers\netw5v32.sys [2009-6-10 4231168]

S3 osppsvc;Office Software Protection Platform;c:\program files\common files\microsoft shared\officesoftwareprotectionplatform\OSPPSVC.EXE [2010-1-9 4640000]

S3 ssudmdm;SAMSUNG  Mobile USB Modem Drivers (DEVGURU Ver.);c:\windows\system32\drivers\ssudmdm.sys [2011-12-30 181432]

S3 StorSvc;Speicherdienst;c:\windows\system32\svchost.exe -k LocalSystemNetworkRestricted [2009-7-14 20992]

S3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\TsUsbFlt.sys [2011-3-18 52224]

S3 vpcuxd;USB-Virtualisierungsstubdienst;c:\windows\system32\drivers\vpcuxd.sys [2011-3-18 12800]

S3 WatAdminSvc;Windows-Aktivierungstechnologieservice;c:\windows\system32\wat\WatAdminSvc.exe [2011-4-9 1343400]

S3 WSDPrintDevice;WSD-Druckunterstützung durch UMB;c:\windows\system32\drivers\WSDPrint.sys [2009-7-14 17920]

S4 msvsmon80;Visual Studio 2005 Remote Debugger;c:\program files\microsoft visual studio 8\common7\ide\remote debugger\x86\msvsmon.exe [2005-9-23 2799808]

.

=============== Created Last 30 ================

.

2012-02-29 17:01:41        --------        d-----w-        c:\users\andreas\appdata\roaming\Malwarebytes

2012-02-29 17:01:31        --------        d-----w-        c:\programdata\Malwarebytes

2012-02-29 17:01:30        20464        ----a-w-        c:\windows\system32\drivers\mbam.sys

2012-02-29 17:01:30        --------        d-----w-        c:\program files\Malwarebytes' Anti-Malware

2012-02-29 16:59:30        89088        ----a-w-        c:\windows\system32\mbr.exe

2012-02-29 13:12:39        --------        d-sh--w-        c:\windows\system32\%APPDATA%

2012-02-29 13:09:32        0        --sha-w-        c:\windows\system32\dds_log_trash.cmd

2012-02-29 13:07:10        --------        d-sh--w-        c:\users\andreas\appdata\local\75422588

2012-02-28 14:21:40        30940        ----a-w-        C:\cc_20120228_152138.reg

2012-02-17 20:36:15        552960        ----a-w-        c:\windows\Notepad2.exe

2012-02-15 13:41:39        478720        ----a-w-        c:\windows\system32\timedate.cpl

2012-02-15 13:41:32        690688        ----a-w-        c:\windows\system32\msvcrt.dll

2012-02-15 13:41:21        442880        ----a-w-        c:\windows\system32\ntshrui.dll

2012-02-15 13:41:18        2343424        ----a-w-        c:\windows\system32\win32k.sys

2012-02-12 18:41:01        --------        d-----w-        c:\program files\Wyse

2012-02-10 16:43:59        --------        d-----w-        c:\users\andreas\appdata\local\DDMSettings

2012-02-07 22:25:19        26408        ----a-w-        c:\windows\system32\nitrolocalmon2.dll

2012-02-07 22:25:19        17704        ----a-w-        c:\windows\system32\nitrolocalui2.dll

2012-02-07 22:04:34        --------        d-----w-        c:\program files\pdfsam

2012-02-01 20:20:14        --------        d-----w-        c:\users\andreas\appdata\roaming\e-academy Inc

2012-02-01 20:20:14        --------        d-----w-        c:\program files\SecureDownloadManagerUniversity

.

==================== Find3M  ====================

.

2012-03-01 07:39:44        29        ----a-w-        c:\windows\system32\TempWmicBatchFile.bat

2012-02-29 16:29:28        45056        ----a-w-        c:\windows\system32\acovcnt.exe

2012-02-29 13:08:17        414368        ----a-w-        c:\windows\system32\FlashPlayerCPLApp.cpl

2012-02-28 09:21:38        138160        ----a-w-        c:\windows\system32\drivers\PnkBstrK.sys

2012-02-28 09:21:28        271200        ----a-w-        c:\windows\system32\PnkBstrB.xtr

2012-02-28 09:21:28        271200        ----a-w-        c:\windows\system32\PnkBstrB.exe

2012-02-24 17:21:52        271200        ----a-w-        c:\windows\system32\PnkBstrB.ex0

2012-01-14 21:14:41        75136        ----a-w-        c:\windows\system32\PnkBstrA.exe

2012-01-04 00:48:42        354176        ----a-w-        c:\windows\system32\DivXControlPanelApplet.cpl

2011-12-27 12:55:31        109408        ----a-w-        C:\cc_20111227_135525.reg

2011-12-14 03:04:54        1798656        ----a-w-        c:\windows\system32\jscript9.dll

2011-12-14 02:57:18        1127424        ----a-w-        c:\windows\system32\wininet.dll

2011-12-14 02:56:58        1427456        ----a-w-        c:\windows\system32\inetcpl.cpl

2011-12-14 02:50:04        2382848        ----a-w-        c:\windows\system32\mshtml.tlb

2011-12-13 18:27:11        138056        ----a-w-        c:\users\andreas\appdata\roaming\PnkBstrK.sys

2011-12-08 04:22:38        80184        ----a-w-        c:\windows\system32\drivers\ssudbus.sys

2011-12-08 04:22:38        181432        ----a-w-        c:\windows\system32\drivers\ssudmdm.sys

.

=================== ROOTKIT  ====================

.

Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, hxxp://www.gmer.net

Windows 6.1.7601 Disk: ST9160821AS rev.3.ALC -> Harddisk0\DR0 -> \Device\Ide\IdeDeviceP3T0L0-6 

.

device: opened successfully

user: MBR read successfully

.

Disk trace:

called modules: >>UNKNOWN [0x83404000]<< >>UNKNOWN [0x8BD93000]<< >>UNKNOWN [0x8BE00000]<< >>UNKNOWN [0x872C0BC0]<< 

_asm { DEC EBP; POP EDX; NOP ; ADD [EBX], AL; ADD [EAX], AL; ADD [EAX+EAX], AL; ADD [EAX], AL;  }

1 ntkrnlpa!IofCallDriver[0x8343B52A] -> \Device\Harddisk0\DR0[0x8700C768]

\Driver\Disk[0x8700BD40] -> IRP_MJ_CREATE -> 0x8BD9739F

3 [0x8BD9759E] -> ntkrnlpa!IofCallDriver[0x8343B52A] -> [0x87299C40]

\Driver\00000649[0x872994C0] -> IRP_MJ_CREATE -> 0x872C0BC0

kernel: MBR read successfully

_asm { XOR AX, AX; MOV SS, AX; MOV SP, 0x7c00; MOV ES, AX; MOV DS, AX; MOV SI, 0x7c00; MOV DI, 0x600; MOV CX, 0x200; CLD ; REP MOVSB ; PUSH AX; PUSH 0x61c; RETF ; STI ; MOV CX, 0x4; MOV BP, 0x7be; CMP BYTE [BP+0x0], 0x0;  }

user & kernel MBR OK 

Warning: possible TDL3 rootkit infection !

.

============= FINISH:  8:46:12,32 ===============

Attach.txt:

Code:

.

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.

IF REQUESTED, ZIP IT UP & ATTACH IT

.

DDS (Ver_2011-08-26.01)

.

Microsoft Windows 7 Professional 

Boot Device: \Device\HarddiskVolume2

Install Date: 05.10.2009 12:36:20

System Uptime: 01.03.2012 08:38:55 (0 hours ago)

.

Motherboard: ASUSTeK Computer Inc.         |  | V1S       

Processor: Intel(R) Core(TM)2 Duo CPU     T7300  @ 2.00GHz | Socket 478 | 1580/200mhz

.

==== Disk Partitions =========================

.

C: is FIXED (NTFS) - 78 GiB total, 7,166 GiB free.

D: is FIXED (NTFS) - 71 GiB total, 8,934 GiB free.

E: is CDROM ()

.

==== Disabled Device Manager Items =============

.

Class GUID: {4d36e972-e325-11ce-bfc1-08002be10318}

Description: Cisco Systems VPN Adapter

Device ID: ROOT\NET\0000

Manufacturer: Cisco Systems

Name: Cisco Systems VPN Adapter

PNP Device ID: ROOT\NET\0000

Service: CVirtA

.

Class GUID: 

Description: 

Device ID: ROOT\VIRTUALUSB\0000

Manufacturer: 

Name: 

PNP Device ID: ROOT\VIRTUALUSB\0000

Service: 

.

Class GUID: {eec5ad98-8080-425f-922a-dabf3de3f69a}

Description: Microsoft WPD erweiterter Speicherkennworttreiber

Device ID: ROOT\WPD\0000

Manufacturer: (Erweitertes Speichergerät)

Name: Microsoft WPD erweiterter Speicherkennworttreiber

PNP Device ID: ROOT\WPD\0000

Service: WUDFRd

.

==== System Restore Points ===================

.

RP383: 23.02.2012 13:25:31 - Geplanter Prüfpunkt

.

==== Installed Programs ======================

.

.

7-PDF Split & Merge Version 2.0.0 (Build 178)

Acronis*True*Image*Home

Adobe Digital Editions

Adobe Flash Player 10 Plugin

Adobe Flash Player 11 ActiveX

Adobe Reader X (10.1.0) - Deutsch

Adobe Shockwave Player 11.6

AnyDVD

ASUS Data Security Manager

ASUS Splendid Video Enhancement Technology

ATK Hotkey

ATK Media

ATKOSD2

AuthenTec Fingerprint Sensor Minimum Install

AuthenTec Fingerprint Software

AuthenTec TrueSuite

Avira AntiVir Personal - Free Antivirus

Battlefield Play4Free

Bombzone

Cadence SPB 16.2 (12-13-2011)

Call of Duty(R) 4 - Modern Warfare(TM)

Call of Duty(R) 4 - Modern Warfare(TM) 1.6 Patch

Call of Duty(R) 4 - Modern Warfare(TM) 1.7 Patch

CCleaner

CDBurnerXP

CIB pdf brewer 2.5.29

Cisco Systems VPN Client 5.0.05.0290

COMSOL 4.2

ConvertXtoDVD 4.0.10.324

Counter-Strike: Source

Crazy Machines - Neues aus dem Labor

Crystal XI

Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition

DivX-Setup

DivX Converter

DivX Plus DirectShow Filters

DivX Version Checker

dm-Fotowelt

Dr Kawashima

Dropbox

DVD Shrink 3.2

DVD Suite

DVDFab 6.0.2.0 (June 24, 2009)

EVEREST Ultimate Edition v4.60

Foxit Reader

Free eXPert PDF Reader

Free Studio version 5.0.9

Free YouTube to MP3 Converter version 3.10.15.1228

G-Force

GanttProject

GIMP 2.6.11

Google Earth

Google Update Helper

Hotfix for Microsoft .NET Framework 4 Client Profile (KB2461678)

Inkscape 0.48.0

IrfanView (remove only)

Java Auto Updater

Java(TM) 6 Update 25

JMB36X Raid Configurer

Lasers

LECTURNITY Player

LifeFrame2

LightScribe System Software

LightScribe Template Labeler

Little Fighter 2 version 2.0a

Lupas Rename 2000 v5.0 Release

MagicDisc 2.7.106

Malwarebytes Anti-Malware Version 1.60.1.1000

Mathematica Extras 8.0 (2063897)

MediaMonkey 4.0

MediaShow 3.0

Mein CEWE FOTOBUCH

Microsoft .NET Framework 4 Client Profile

Microsoft .NET Framework 4 Client Profile DEU Language Pack

Microsoft Application Error Reporting

Microsoft Choice Guard

Microsoft Mathematics-Add-In (32 Bit)

Microsoft Office 2003 Web Components

Microsoft Office 2010 Service Pack 1 (SP1)

Microsoft Office Access MUI (German) 2010

Microsoft Office Excel MUI (German) 2010

Microsoft Office Groove MUI (German) 2010

Microsoft Office InfoPath MUI (German) 2010

Microsoft Office OneNote MUI (German) 2010

Microsoft Office Outlook MUI (German) 2010

Microsoft Office PowerPoint MUI (German) 2010

Microsoft Office Professional Plus 2010

Microsoft Office Project MUI (German) 2010

Microsoft Office Project Professional 2010

Microsoft Office Proof (English) 2010

Microsoft Office Proof (French) 2010

Microsoft Office Proof (German) 2010

Microsoft Office Proof (Italian) 2010

Microsoft Office Proofing (German) 2010

Microsoft Office Publisher MUI (German) 2010

Microsoft Office Shared MUI (German) 2010

Microsoft Office Word MUI (German) 2010

Microsoft Project 2010 Service Pack 1 (SP1)

Microsoft Project Professional 2010

Microsoft Silverlight

Microsoft SQL Server 2005 Compact Edition [ENU]

Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053

Microsoft Visual C++ 2005 Redistributable

Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161

Microsoft Visual C++ 2010  x86 Redistributable - 10.0.30319

Microsoft Visual Studio 2005 Tools for Applications - ENU

Microsoft Visual Studio 2010-Tools für Office-Laufzeit (x86) Language Pack - DEU

Microsoft Visual Studio 2010 Tools for Office Runtime (x86)

Microsoft Visual Studio 2010 Tools for Office Runtime (x86) Language Pack - DEU

MiKTeX 2.9

Motorola SM56 Speakerphone Modem

MozBackup 1.4.9

Mozilla Firefox (3.5.3)

Mozilla Firefox 10.0.2 (x86 de)

Mozilla Thunderbird (3.0)

Mozilla Thunderbird 10.0.2 (x86 de)

MSVCRT

MSXML 4.0 SP2 (KB954430)

MSXML 4.0 SP2 (KB973688)

MyDefrag v4.3.1

MyFreeCodec

MyPhoneExplorer

National Instruments - Software

NB Probe

Nero 7 Essentials

Nero Installer

neroxml

NHL® 09

NI EULA Depot

NI MDF Support

NI TDM Excel Add-In 3.2.2

NI Uninstaller

NI VC2008MSMs x86

NVIDIA Drivers

OGA Notifier 2.0.0048.0

Orban/Coding Technologies AAC/aacPlus Player Plugin™ 1.0

Orcad Family Release 9.2 Lite Edition

Origin81

OriginPro 8.1G

pdfsam

PhotoView 360

Picasa 3

PlayReady PC Runtime x86

PocketCloud Windows Companion

Power4Gear eXtreme

PowerDVD

PPT Remote

PunkBuster Services

Quake Live Mozilla Plugin

QuickTime

Realtek High Definition Audio Driver

Reference Manager 11

Samsung Kies

SAMSUNG USB Driver for Mobile Phones

Sandboxie 3.44

Sansa Updater

Secure Download Manager

Security Update for CAPICOM (KB931906)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)

Security Update for Microsoft .NET Framework 4 Client Profile DEU Language Pack (KB2478663)

Security Update for Microsoft .NET Framework 4 Client Profile DEU Language Pack (KB2518870)

Security Update for Microsoft Office 2010 (KB2553091)

Security Update for Microsoft Office 2010 (KB2553096)

Security Update for Microsoft Office 2010 (KB2589320) 32-Bit Edition

Security Update for Microsoft PowerPoint 2010 (KB2553185) 32-Bit Edition

Security Update for Microsoft SharePoint Workspace 2010 (KB2566445)

Security Update for Microsoft Visio Viewer 2010 (KB2597170) 32-Bit Edition

Shutdown4U

Skype™ 5.8

SolidWorks 2010 SP04

SolidWorks eDrawings 2010

SolidWorks Flow Simulation 2010 SP04

Steam

swMSM

System Requirements Lab for Intel

Team Fortress 2

TeamViewer 6

TerraTec Home Cinema

TeXnicCenter Version 1.0 Stable RC1

Total Commander (Remove or Repair)

Trillian

Uninstall 1.0.0.1

Update for Microsoft .NET Framework 4 Client Profile (KB2468871)

Update for Microsoft .NET Framework 4 Client Profile (KB2533523)

Update for Microsoft .NET Framework 4 Client Profile (KB2600217)

Update for Microsoft Excel 2010 (KB2553439) 32-Bit Edition

Update for Microsoft Office 2010 (KB2494150)

Update for Microsoft Office 2010 (KB2553065)

Update for Microsoft Office 2010 (KB2553092)

Update for Microsoft Office 2010 (KB2553181) 32-Bit Edition

Update for Microsoft Office 2010 (KB2553270) 32-Bit Edition

Update for Microsoft Office 2010 (KB2553310) 32-Bit Edition

Update for Microsoft Office 2010 (KB2553385) 32-Bit Edition

Update for Microsoft Office 2010 (KB2566458)

Update for Microsoft Office 2010 (KB2596964) 32-Bit Edition

Update for Microsoft Office 2010 (KB2597091) 32-Bit Edition

Update for Microsoft OneNote 2010 (KB2553290) 32-Bit Edition

Update for Microsoft Outlook 2010 (KB2553323) 32-Bit Edition

Update for Microsoft Outlook Social Connector (KB2583935)

Update Service

USB2.0 1.3M WebCam

VC80CRTRedist - 8.0.50727.6195

VLC media player 1.1.11

War Inc. Battlezone

WhiteCap

WIN7TS

Windows Live-Uploadtool

Windows Live Communications Platform

Windows Live Essentials

Windows Live Fotogalerie

Windows Live ID-Anmelde-Assistent

Windows Live Movie Maker

Windows Live Sync

Windows Mobile-Gerätecenter

Windows XP Mode

WinFlash

WinRAR archiver

WinSCP 4.2.3 beta

Wolfram Mathematica 8 (M-WIN-L 8.0.1 2063990)

.

==== End Of File ===========================

Nochmal Danke schonmal für die Hilfe!