Trojaner-Board
Seite 3 von 4 12 3 4
100 Beiträge dieses Themas auf einer Seite anzeigen

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   Bka Trojaner will nicht weichen (https://www.trojaner-board.de/112161-bka-trojaner-will-weichen.html)

petetheheat 04.04.2012 10:00
nach dem neustart öffnete sich folgendes log:

Code:
All processes killed
========== OTL ==========
Prefs.js: "Web Search" removed from browser.search.defaultengine
Prefs.js: "Web Search" removed from browser.search.defaultenginename
Prefs.js: "Web Search" removed from browser.search.order.1
Prefs.js: "hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.1.6&q=" removed from keyword.URL
C:\Dokumente und Einstellungen\Hoschie\Anwendungsdaten\Mozilla\Firefox\Profiles\cvljn78f.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}\defaults\preferences folder moved successfully.
C:\Dokumente und Einstellungen\Hoschie\Anwendungsdaten\Mozilla\Firefox\Profiles\cvljn78f.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}\defaults folder moved successfully.
C:\Dokumente und Einstellungen\Hoschie\Anwendungsdaten\Mozilla\Firefox\Profiles\cvljn78f.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}\chrome folder moved successfully.
C:\Dokumente und Einstellungen\Hoschie\Anwendungsdaten\Mozilla\Firefox\Profiles\cvljn78f.default\extensions\{20a82645-c095-46ed-80e3-08825760534b} folder moved successfully.
C:\Dokumente und Einstellungen\Hoschie\Anwendungsdaten\Mozilla\Firefox\Profiles\cvljn78f.default\searchplugins\icqplugin-1.xml moved successfully.
C:\Dokumente und Einstellungen\Hoschie\Anwendungsdaten\Mozilla\Firefox\Profiles\cvljn78f.default\searchplugins\icqplugin.xml moved successfully.
C:\Dokumente und Einstellungen\Hoschie\Anwendungsdaten\Mozilla\Firefox\Profiles\cvljn78f.default\searchplugins\startsear.xml moved successfully.
========== FILES ==========
C:\Programme\ICQ6Toolbar folder moved successfully.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: Administrator
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: Administrator.DACH
->Temp folder emptied: 1059 bytes
->Temporary Internet Files folder emptied: 66450 bytes
->FireFox cache emptied: 576920706 bytes
->Flash cache emptied: 2821 bytes
 
User: All Users
 
User: Default User
->Temporary Internet Files folder emptied: 0 bytes
 
User: Hoschie
->Temp folder emptied: 28434451 bytes
->Temporary Internet Files folder emptied: 566619 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 300957923 bytes
->Flash cache emptied: 3574 bytes
 
User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
 
User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 32768 bytes
RecycleBin emptied: 0 bytes
 
Total Files Cleaned = 865,00 mb
 
 
[EMPTYFLASH]
 
User: Administrator
 
User: Administrator.DACH
->Flash cache emptied: 0 bytes
 
User: All Users
 
User: Default User
 
User: Hoschie
->Flash cache emptied: 0 bytes
 
User: LocalService
 
User: NetworkService
 
Total Flash Files Cleaned = 0,00 mb
 
C:\WINDOWS\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully
 
OTL by OldTimer - Version 3.2.39.1 log created on 04042012_104821

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...

cosinus 04.04.2012 12:37
Bitte nun (im normalen Windows-Modus) dieses Tool von Kaspersky (TDSS-Killer) ausführen und das Log posten, Anleitung und Downloadlink hier => http://www.trojaner-board.de/82358-t...entfernen.html

Hinweis: Bitte den Virenscanner abstellen bevor du den TDSS-Killer ausführst, denn v.a. Avira meldet im TDSS-Tool oft einen Fehalalrm!

Das Tool so einstellen wie unten im Bild angegeben - klick auf change parameters und setze die Haken wie im folgenden Screenshot abgebildet,
Dann auf Start Scan klicken und wenn es durch ist auf den Button Report klicken um das Log anzuzeigen. Dieses bitte komplett posten.
Wenn du das Log nicht findest oder den Inhalt kopieren und in dein Posting übertragen kannst, dann schau bitte direkt auf deiner Windows-Systempartition (meistens Laufwerk C:) nach, da speichert der TDSS-Killer seine Logs.

Hinweis: Bitte nichts voreilig mit dem TDSS-Killer löschen! Falls Objekte vom TDSS-Killer bemängelt werden, alle mit der Aktion "skip" behandeln und hier nur das Log posten!

http://saved.im/mtkwmtcxexhp/setting...8_16-25-18.jpg

petetheheat 04.04.2012 20:09
ich kann avira leider momentan schlecht beenden. im taskmanager kann ich nur die aktuellen programme anwählen/beenden, wenn ich auf prozesse klicken will verschwindet die obere Zeile mit den Reitern.

edith: ok problemlösung gefunden, tdds killer läuft gleich durch.

hier das log:

Code:
21:27:30.0250 2316        TDSS rootkit removing tool 2.7.25.0 Apr  3 2012 13:42:32
21:27:30.0281 2316        ============================================================
21:27:30.0281 2316        Current date / time: 2012/04/04 21:27:30.0281
21:27:30.0281 2316        SystemInfo:
21:27:30.0281 2316       
21:27:30.0281 2316        OS Version: 5.1.2600 ServicePack: 3.0
21:27:30.0281 2316        Product type: Workstation
21:27:30.0281 2316        ComputerName: DACH
21:27:30.0281 2316        UserName: Hoschie
21:27:30.0281 2316        Windows directory: C:\WINDOWS
21:27:30.0281 2316        System windows directory: C:\WINDOWS
21:27:30.0281 2316        Processor architecture: Intel x86
21:27:30.0281 2316        Number of processors: 2
21:27:30.0281 2316        Page size: 0x1000
21:27:30.0281 2316        Boot type: Normal boot
21:27:30.0281 2316        ============================================================
21:27:31.0937 2316        Drive \Device\Harddisk0\DR0 - Size: 0x1BF2976000 (111.79 Gb), SectorSize: 0x200, Cylinders: 0x3901, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000054
21:27:31.0937 2316        Drive \Device\Harddisk1\DR3 - Size: 0x1F3800000 (7.80 Gb), SectorSize: 0x200, Cylinders: 0x3FA, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'W'
21:27:31.0953 2316        \Device\Harddisk0\DR0:
21:27:31.0953 2316        MBR used
21:27:31.0953 2316        \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x37E3E01
21:27:31.0968 2316        \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x37E3E7F, BlocksNum 0xA7AF942
21:27:31.0968 2316        \Device\Harddisk1\DR3:
21:27:31.0968 2316        MBR used
21:27:31.0968 2316        \Device\Harddisk1\DR3\Partition0: MBR, Type 0xB, StartLBA 0x180, BlocksNum 0xF9BE80
21:27:32.0093 2316        Initialize success
21:27:32.0093 2316        ============================================================
21:27:38.0843 4012        ============================================================
21:27:38.0843 4012        Scan started
21:27:38.0843 4012        Mode: Manual; SigCheck; TDLFS;
21:27:38.0843 4012        ============================================================
21:27:39.0156 4012        Abiosdsk - ok
21:27:39.0218 4012        abp480n5 - ok
21:27:39.0312 4012        ACPI            (ac407f1a62c3a300b4f2b5a9f1d55b2c) C:\WINDOWS\system32\DRIVERS\ACPI.sys
21:27:39.0656 4012        ACPI - ok
21:27:39.0750 4012        ACPIEC          (9e1ca3160dafb159ca14f83b1e317f75) C:\WINDOWS\system32\drivers\ACPIEC.sys
21:27:39.0921 4012        ACPIEC - ok
21:27:39.0984 4012        adpu160m - ok
21:27:40.0078 4012        aeaudio        (11c04b17ed2abbb4833694bcd644ac90) C:\WINDOWS\system32\drivers\aeaudio.sys
21:27:40.0109 4012        aeaudio - ok
21:27:40.0203 4012        aec            (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys
21:27:40.0375 4012        aec - ok
21:27:40.0468 4012        AFD            (1e44bc1e83d8fd2305f8d452db109cf9) C:\WINDOWS\System32\drivers\afd.sys
21:27:40.0515 4012        AFD - ok
21:27:40.0671 4012        AgereSoftModem  (58041495e6d3650c02b1aec525d24089) C:\WINDOWS\system32\DRIVERS\AGRSM.sys
21:27:40.0750 4012        AgereSoftModem - ok
21:27:40.0843 4012        agp440          (08fd04aa961bdc77fb983f328334e3d7) C:\WINDOWS\system32\DRIVERS\agp440.sys
21:27:41.0015 4012        agp440 - ok
21:27:41.0078 4012        Aha154x - ok
21:27:41.0140 4012        aic78u2 - ok
21:27:41.0203 4012        aic78xx - ok
21:27:41.0281 4012        Alerter        (738d80cc01d7bc7584be917b7f544394) C:\WINDOWS\system32\alrsvc.dll
21:27:41.0453 4012        Alerter - ok
21:27:41.0546 4012        ALG            (190cd73d4984f94d823f9444980513e5) C:\WINDOWS\System32\alg.exe
21:27:41.0718 4012        ALG - ok
21:27:41.0796 4012        AliIde - ok
21:27:41.0859 4012        amsint - ok
21:27:41.0937 4012        AntiVirSchedulerService (c27d46b06d340293670450fce9dfb166) C:\Programme\Avira\AntiVir Desktop\sched.exe
21:27:41.0953 4012        AntiVirSchedulerService - ok
21:27:42.0046 4012        AntiVirService  (72d90e56563165984224493069c69ed4) C:\Programme\Avira\AntiVir Desktop\avguard.exe
21:27:42.0062 4012        AntiVirService - ok
21:27:42.0125 4012        Apple Mobile Device (20f6f19fe9e753f2780dc2fa083ad597) C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe
21:27:42.0140 4012        Apple Mobile Device - ok
21:27:42.0203 4012        AppMgmt - ok
21:27:42.0281 4012        Arp1394        (b5b8a80875c1dededa8b02765642c32f) C:\WINDOWS\system32\DRIVERS\arp1394.sys
21:27:42.0453 4012        Arp1394 - ok
21:27:42.0515 4012        asc - ok
21:27:42.0578 4012        asc3350p - ok
21:27:42.0625 4012        asc3550 - ok
21:27:42.0750 4012        aspnet_state    (0e5e4957549056e2bf2c49f4f6b601ad) C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
21:27:42.0765 4012        aspnet_state - ok
21:27:42.0859 4012        AsyncMac        (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
21:27:43.0031 4012        AsyncMac - ok
21:27:43.0125 4012        atapi          (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys
21:27:43.0312 4012        atapi - ok
21:27:43.0359 4012        Atdisk - ok
21:27:43.0453 4012        Atmarpc        (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
21:27:43.0640 4012        Atmarpc - ok
21:27:43.0718 4012        AudioSrv        (58ed0d5452df7be732193e7999c6b9a4) C:\WINDOWS\System32\audiosrv.dll
21:27:43.0906 4012        AudioSrv - ok
21:27:44.0000 4012        audstub        (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
21:27:44.0171 4012        audstub - ok
21:27:44.0250 4012        avgio          (0b497c79824f8e1bf22fa6aacd3de3a0) C:\Programme\Avira\AntiVir Desktop\avgio.sys
21:27:44.0250 4012        avgio - ok
21:27:44.0359 4012        avgntflt        (1e4114685de1ffa9675e09c6a1fb3f4b) C:\WINDOWS\system32\DRIVERS\avgntflt.sys
21:27:44.0375 4012        avgntflt - ok
21:27:44.0468 4012        avipbb          (0f78d3dae6dedd99ae54c9491c62adf2) C:\WINDOWS\system32\DRIVERS\avipbb.sys
21:27:44.0484 4012        avipbb - ok
21:27:44.0578 4012        Beep            (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
21:27:44.0765 4012        Beep - ok
21:27:44.0859 4012        BITS            (d6f603772a789bb3228f310d650b8bd1) C:\WINDOWS\system32\qmgr.dll
21:27:45.0093 4012        BITS - ok
21:27:45.0171 4012        Bonjour Service (1c87705ccb2f60172b0fc86b5d82f00d) C:\Programme\Bonjour\mDNSResponder.exe
21:27:45.0203 4012        Bonjour Service - ok
21:27:45.0312 4012        Browser        (b42057f06bbb98b31876c0b3f2b54e33) C:\WINDOWS\System32\browser.dll
21:27:45.0468 4012        Browser - ok
21:27:45.0562 4012        cbidf2k        (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
21:27:45.0765 4012        cbidf2k - ok
21:27:45.0828 4012        cd20xrnt - ok
21:27:45.0906 4012        Cdaudio        (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
21:27:46.0109 4012        Cdaudio - ok
21:27:46.0203 4012        Cdfs            (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys
21:27:46.0375 4012        Cdfs - ok
21:27:46.0468 4012        Cdrom          (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys
21:27:46.0640 4012        Cdrom - ok
21:27:46.0687 4012        Changer - ok
21:27:46.0765 4012        CiSvc          (28e3040d1f1ca2008cd6b29dfebc9a5e) C:\WINDOWS\system32\cisvc.exe
21:27:46.0921 4012        CiSvc - ok
21:27:47.0031 4012        ClipSrv        (778a30ed3c134eb7e406afc407e9997d) C:\WINDOWS\system32\clipsrv.exe
21:27:47.0187 4012        ClipSrv - ok
21:27:47.0312 4012        clr_optimization_v2.0.50727_32 (d87acaed61e417bba546ced5e7e36d9c) C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
21:27:47.0328 4012        clr_optimization_v2.0.50727_32 - ok
21:27:47.0406 4012        CmdIde - ok
21:27:47.0453 4012        COMSysApp - ok
21:27:47.0531 4012        Cpqarray - ok
21:27:47.0625 4012        CryptSvc        (611f824e5c703a5a899f84c5f1699e4d) C:\WINDOWS\System32\cryptsvc.dll
21:27:47.0796 4012        CryptSvc - ok
21:27:47.0875 4012        dac2w2k - ok
21:27:47.0921 4012        dac960nt - ok
21:27:48.0015 4012        DcomLaunch      (3127afbf2c1ed0ab14a1bbb7aaecb85b) C:\WINDOWS\system32\rpcss.dll
21:27:48.0125 4012        DcomLaunch - ok
21:27:48.0234 4012        Dhcp            (c29a1c9b75ba38fa37f8c44405dec360) C:\WINDOWS\System32\dhcpcsvc.dll
21:27:48.0406 4012        Dhcp - ok
21:27:48.0515 4012        Disk            (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys
21:27:48.0671 4012        Disk - ok
21:27:48.0718 4012        dmadmin - ok
21:27:48.0875 4012        dmboot          (0dcfc8395a99fecbb1ef771cec7fe4ea) C:\WINDOWS\system32\drivers\dmboot.sys
21:27:49.0093 4012        dmboot - ok
21:27:49.0187 4012        DMICall        (526192bf7696f72e29777bf4a180513a) C:\WINDOWS\system32\DRIVERS\DMICall.sys
21:27:49.0375 4012        DMICall - ok
21:27:49.0500 4012        dmio            (53720ab12b48719d00e327da470a619a) C:\WINDOWS\system32\drivers\dmio.sys
21:27:49.0671 4012        dmio - ok
21:27:49.0765 4012        dmload          (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
21:27:49.0968 4012        dmload - ok
21:27:50.0046 4012        dmserver        (25c83ffbba13b554eb6d59a9b2e2ee78) C:\WINDOWS\System32\dmserver.dll
21:27:50.0187 4012        dmserver - ok
21:27:50.0296 4012        DMusic          (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys
21:27:50.0453 4012        DMusic - ok
21:27:50.0531 4012        Dnscache        (407f3227ac618fd1ca54b335b083de07) C:\WINDOWS\System32\dnsrslvr.dll
21:27:50.0609 4012        Dnscache - ok
21:27:50.0718 4012        Dot3svc        (676e36c4ff5bcea1900f44182b9723e6) C:\WINDOWS\System32\dot3svc.dll
21:27:50.0890 4012        Dot3svc - ok
21:27:50.0968 4012        dpti2o - ok
21:27:51.0046 4012        drmkaud        (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys
21:27:51.0218 4012        drmkaud - ok
21:27:51.0296 4012        E100B          (98b46b331404a951cabad8b4877e1276) C:\WINDOWS\system32\DRIVERS\e100b325.sys
21:27:51.0343 4012        E100B - ok
21:27:51.0437 4012        EapHost        (4e4f2fddab0a0736d7671134dcce91fb) C:\WINDOWS\System32\eapsvc.dll
21:27:51.0593 4012        EapHost - ok
21:27:51.0687 4012        ERSvc          (877c18558d70587aa7823a1a308ac96b) C:\WINDOWS\System32\ersvc.dll
21:27:51.0843 4012        ERSvc - ok
21:27:51.0937 4012        Eventlog        (a3edbe9053889fb24ab22492472b39dc) C:\WINDOWS\system32\services.exe
21:27:51.0968 4012        Eventlog - ok
21:27:52.0078 4012        EventSystem    (af4f6b5739d18ca7972ab53e091cbc74) C:\WINDOWS\System32\es.dll
21:27:52.0125 4012        EventSystem - ok
21:27:52.0234 4012        Fastfat        (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys
21:27:52.0406 4012        Fastfat - ok
21:27:52.0484 4012        FastUserSwitchingCompatibility (2db7d303c36ddd055215052f118e8e75) C:\WINDOWS\System32\shsvcs.dll
21:27:52.0562 4012        FastUserSwitchingCompatibility - ok
21:27:52.0656 4012        Fdc            (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\DRIVERS\fdc.sys
21:27:52.0812 4012        Fdc - ok
21:27:52.0906 4012        Fips            (b0678a548587c5f1967b0d70bacad6c1) C:\WINDOWS\system32\drivers\Fips.sys
21:27:53.0062 4012        Fips - ok
21:27:53.0156 4012        Flpydisk        (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\DRIVERS\flpydisk.sys
21:27:53.0312 4012        Flpydisk - ok
21:27:53.0406 4012        FltMgr          (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\drivers\fltmgr.sys
21:27:53.0562 4012        FltMgr - ok
21:27:53.0656 4012        FontCache3.0.0.0 (8ba7c024070f2b7fdd98ed8a4ba41789) C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
21:27:53.0671 4012        FontCache3.0.0.0 - ok
21:27:53.0750 4012        Fs_Rec          (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
21:27:53.0953 4012        Fs_Rec - ok
21:27:54.0046 4012        Ftdisk          (8f1955ce42e1484714b542f341647778) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
21:27:54.0234 4012        Ftdisk - ok
21:27:54.0312 4012        GEARAspiWDM    (8182ff89c65e4d38b2de4bb0fb18564e) C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys
21:27:54.0328 4012        GEARAspiWDM - ok
21:27:54.0421 4012        Gpc            (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys
21:27:54.0593 4012        Gpc - ok
21:27:54.0671 4012        gupdate        (8f0de4fef8201e306f9938b0905ac96a) C:\Programme\Google\Update\GoogleUpdate.exe
21:27:54.0687 4012        gupdate - ok
21:27:54.0687 4012        gupdatem        (8f0de4fef8201e306f9938b0905ac96a) C:\Programme\Google\Update\GoogleUpdate.exe
21:27:54.0703 4012        gupdatem - ok
21:27:54.0750 4012        gusvc          (cc839e8d766cc31a7710c9f38cf3e375) C:\Programme\Google\Common\Google Updater\GoogleUpdaterService.exe
21:27:54.0781 4012        gusvc - ok
21:27:54.0859 4012        helpsvc        (cb66bf85bf599befd6c6a57c2e20357f) C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll
21:27:55.0015 4012        helpsvc - ok
21:27:55.0109 4012        HidServ        (b35da85e60c0103f2e4104532da2f12b) C:\WINDOWS\System32\hidserv.dll
21:27:55.0265 4012        HidServ - ok
21:27:55.0390 4012        HidUsb          (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys
21:27:55.0546 4012        HidUsb - ok
21:27:55.0656 4012        hkmsvc          (ed29f14101523a6e0e808107405d452c) C:\WINDOWS\System32\kmsvc.dll
21:27:55.0812 4012        hkmsvc - ok
21:27:55.0890 4012        hpn - ok
21:27:55.0968 4012        HTTP            (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys
21:27:56.0000 4012        HTTP - ok
21:27:56.0078 4012        HTTPFilter      (9e4adb854cebcfb81a4b36718feecd16) C:\WINDOWS\System32\w3ssl.dll
21:27:56.0234 4012        HTTPFilter - ok
21:27:56.0312 4012        i2omgmt - ok
21:27:56.0390 4012        i2omp - ok
21:27:56.0468 4012        i8042prt        (e283b97cfbeb86c1d86baed5f7846a92) C:\WINDOWS\system32\DRIVERS\i8042prt.sys
21:27:56.0625 4012        i8042prt - ok
21:27:56.0656 4012        ICQ Service - ok
21:27:56.0812 4012        idsvc          (c01ac32dc5c03076cfb852cb5da5229c) C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
21:27:56.0875 4012        idsvc - ok
21:27:56.0984 4012        Imapi          (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys
21:27:57.0156 4012        Imapi - ok
21:27:57.0234 4012        ImapiService    (d4b413aa210c21e46aedd2ba5b68d38e) C:\WINDOWS\System32\imapi.exe
21:27:57.0406 4012        ImapiService - ok
21:27:57.0484 4012        ini910u - ok
21:27:57.0546 4012        IntelIde - ok
21:27:57.0640 4012        intelppm        (4c7d2750158ed6e7ad642d97bffae351) C:\WINDOWS\system32\DRIVERS\intelppm.sys
21:27:57.0796 4012        intelppm - ok
21:27:57.0890 4012        ip6fw          (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\drivers\ip6fw.sys
21:27:58.0046 4012        ip6fw - ok
21:27:58.0125 4012        IpFilterDriver  (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
21:27:58.0312 4012        IpFilterDriver - ok
21:27:58.0406 4012        IpInIp          (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys
21:27:58.0578 4012        IpInIp - ok
21:27:58.0671 4012        IpNat          (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys
21:27:58.0828 4012        IpNat - ok
21:27:58.0937 4012        iPod Service    (f62c69376a95795fe7cdb1c778edaca4) C:\Programme\iPod\bin\iPodService.exe
21:27:58.0984 4012        iPod Service - ok
21:27:59.0078 4012        IPSec          (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys
21:27:59.0250 4012        IPSec - ok
21:27:59.0328 4012        IRENUM          (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys
21:27:59.0500 4012        IRENUM - ok
21:27:59.0593 4012        isapnp          (6dfb88f64135c525433e87648bda30de) C:\WINDOWS\system32\DRIVERS\isapnp.sys
21:27:59.0750 4012        isapnp - ok
21:27:59.0828 4012        JavaQuickStarterService (381b25dc8e958d905b33130d500bbf29) C:\Programme\Java\jre6\bin\jqs.exe
21:27:59.0843 4012        JavaQuickStarterService - ok
21:27:59.0953 4012        Kbdclass        (1704d8c4c8807b889e43c649b478a452) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
21:28:00.0109 4012        Kbdclass - ok
21:28:00.0203 4012        kbdhid          (b6d6c117d771c98130497265f26d1882) C:\WINDOWS\system32\DRIVERS\kbdhid.sys
21:28:00.0359 4012        kbdhid - ok
21:28:00.0453 4012        kmixer          (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys
21:28:00.0625 4012        kmixer - ok
21:28:00.0703 4012        KSecDD          (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys
21:28:00.0781 4012        KSecDD - ok
21:28:00.0875 4012        L8042Kbd        (0f5ae6805ef05dbbe205e5b196cadf31) C:\WINDOWS\system32\Drivers\L8042Kbd.sys
21:28:00.0921 4012        L8042Kbd - ok
21:28:01.0015 4012        L8042mou        (ee1c6c057a83f93ad9ae7cdf12f0baa0) C:\WINDOWS\system32\DRIVERS\L8042mou.Sys
21:28:01.0062 4012        L8042mou - ok
21:28:01.0156 4012        lanmanserver    (2bbdcb79900990f0716dfcb714e72de7) C:\WINDOWS\System32\srvsvc.dll
21:28:01.0187 4012        lanmanserver - ok
21:28:01.0281 4012        lanmanworkstation (1869b14b06b44b44af70548e1ea3303f) C:\WINDOWS\System32\wkssvc.dll
21:28:01.0328 4012        lanmanworkstation - ok
21:28:01.0453 4012        LBeepKE        (17638894e150efee66d97bce8f037519) C:\WINDOWS\system32\Drivers\LBeepKE.sys
21:28:01.0468 4012        LBeepKE ( UnsignedFile.Multi.Generic ) - warning
21:28:01.0468 4012        LBeepKE - detected UnsignedFile.Multi.Generic (1)
21:28:01.0546 4012        lbrtfdc - ok
21:28:01.0640 4012        LHidKe          (eaed22460dad9ccd9c9a58c78e717497) C:\WINDOWS\system32\DRIVERS\LHidKE.Sys
21:28:01.0656 4012        LHidKe - ok
21:28:01.0734 4012        LHidUsbK        (f99fddb71da6a66ee2ebcc49f5bfadbb) C:\WINDOWS\system32\Drivers\LHidUsbK.Sys
21:28:01.0796 4012        LHidUsbK - ok
21:28:01.0890 4012        LmHosts        (636714b7d43c8d0c80449123fd266920) C:\WINDOWS\System32\lmhsvc.dll
21:28:02.0046 4012        LmHosts - ok
21:28:02.0156 4012        LMouKE          (d1fd76ea56cd653d7b55a0fac96ee416) C:\WINDOWS\system32\DRIVERS\LMouKE.Sys
21:28:02.0187 4012        LMouKE - ok
21:28:02.0234 4012        MACNDIS5        (e949d673842858d458f7e6bcd46a2a5d) C:\PROGRA~1\GEMEIN~1\MARMIK~1\MACNDIS5.SYS
21:28:02.0250 4012        MACNDIS5 ( UnsignedFile.Multi.Generic ) - warning
21:28:02.0250 4012        MACNDIS5 - detected UnsignedFile.Multi.Generic (1)
21:28:02.0359 4012        MagicTune      (7acae9601b3eb413f8bf5c90a77a6848) C:\WINDOWS\system32\drivers\MTiCtwl.sys
21:28:02.0375 4012        MagicTune ( UnsignedFile.Multi.Generic ) - warning
21:28:02.0375 4012        MagicTune - detected UnsignedFile.Multi.Generic (1)
21:28:02.0453 4012        MBAMProtector  (b7ca8cc3f978201856b6ab82f40953c3) C:\WINDOWS\system32\drivers\mbam.sys
21:28:02.0468 4012        MBAMProtector - ok
21:28:02.0562 4012        MBAMService    (056b19651bd7b7ce5f89a3ac46dbdc08) C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe
21:28:02.0609 4012        MBAMService - ok
21:28:02.0703 4012        Messenger      (b7550a7107281d170ce85524b1488c98) C:\WINDOWS\System32\msgsvc.dll
21:28:02.0875 4012        Messenger - ok
21:28:02.0953 4012        MIINPazX        (5e5024d9e2351db2563b30912b4c4146) C:\PROGRA~1\GEMEIN~1\MARMIK~1\MInfraIS\MIINPazX.SYS
21:28:02.0968 4012        MIINPazX ( UnsignedFile.Multi.Generic ) - warning
21:28:02.0968 4012        MIINPazX - detected UnsignedFile.Multi.Generic (1)
21:28:03.0062 4012        mnmdd          (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
21:28:03.0250 4012        mnmdd - ok
21:28:03.0328 4012        mnmsrvc        (c2f1d365fd96791b037ee504868065d3) C:\WINDOWS\System32\mnmsrvc.exe
21:28:03.0500 4012        mnmsrvc - ok
21:28:03.0609 4012        Modem          (6fb74ebd4ec57a6f1781de3852cc3362) C:\WINDOWS\system32\drivers\Modem.sys
21:28:03.0765 4012        Modem - ok
21:28:03.0859 4012        Mouclass        (b24ce8005deab254c0251e15cb71d802) C:\WINDOWS\system32\DRIVERS\mouclass.sys
21:28:04.0015 4012        Mouclass - ok
21:28:04.0109 4012        mouhid          (66a6f73c74e1791464160a7065ce711a) C:\WINDOWS\system32\DRIVERS\mouhid.sys
21:28:04.0281 4012        mouhid - ok
21:28:04.0375 4012        MountMgr        (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys
21:28:04.0531 4012        MountMgr - ok
21:28:04.0593 4012        mraid35x - ok
21:28:04.0687 4012        MRxDAV          (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
21:28:04.0828 4012        MRxDAV - ok
21:28:04.0937 4012        MRxSmb          (7d304a5eb4344ebeeab53a2fe3ffb9f0) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
21:28:05.0015 4012        MRxSmb - ok
21:28:05.0109 4012        MSDTC          (35a031af38c55f92d28aa03ee9f12cc9) C:\WINDOWS\System32\msdtc.exe
21:28:05.0250 4012        MSDTC - ok
21:28:05.0359 4012        Msfs            (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys
21:28:05.0515 4012        Msfs - ok
21:28:05.0562 4012        MSIServer - ok
21:28:05.0656 4012        MSKSSRV        (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys
21:28:05.0812 4012        MSKSSRV - ok
21:28:05.0890 4012        MSPCLOCK        (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
21:28:06.0046 4012        MSPCLOCK - ok
21:28:06.0125 4012        MSPQM          (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys
21:28:06.0281 4012        MSPQM - ok
21:28:06.0375 4012        mssmbios        (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
21:28:06.0515 4012        mssmbios - ok
21:28:06.0609 4012        Mup            (de6a75f5c270e756c5508d94b6cf68f5) C:\WINDOWS\system32\drivers\Mup.sys
21:28:06.0656 4012        Mup - ok
21:28:06.0718 4012        MZCCntrl        (5f9ba398f88fc8928ea6dbd5d144cfca) C:\Programme\Gemeinsame Dateien\Marmiko Shared\MZCCntrl.exe
21:28:06.0734 4012        MZCCntrl ( UnsignedFile.Multi.Generic ) - warning
21:28:06.0734 4012        MZCCntrl - detected UnsignedFile.Multi.Generic (1)
21:28:06.0843 4012        napagent        (46bb15ae2ac7d025d6d2567b876817bd) C:\WINDOWS\System32\qagentrt.dll
21:28:07.0015 4012        napagent - ok
21:28:07.0125 4012        NDIS            (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys
21:28:07.0281 4012        NDIS - ok
21:28:07.0375 4012        NdisTapi        (0109c4f3850dfbab279542515386ae22) C:\WINDOWS\system32\DRIVERS\ndistapi.sys
21:28:07.0406 4012        NdisTapi - ok
21:28:07.0515 4012        Ndisuio        (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys
21:28:07.0687 4012        Ndisuio - ok
21:28:07.0781 4012        NdisWan        (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys
21:28:07.0937 4012        NdisWan - ok
21:28:08.0015 4012        NDProxy        (9282bd12dfb069d3889eb3fcc1000a9b) C:\WINDOWS\system32\drivers\NDProxy.sys
21:28:08.0062 4012        NDProxy - ok
21:28:08.0156 4012        NetBIOS        (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys
21:28:08.0312 4012        NetBIOS - ok
21:28:08.0406 4012        NetBT          (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys
21:28:08.0562 4012        NetBT - ok
21:28:08.0656 4012        NetDDE          (8ace4251bffd09ce75679fe940e996cc) C:\WINDOWS\system32\netdde.exe
21:28:08.0828 4012        NetDDE - ok
21:28:08.0843 4012        NetDDEdsdm      (8ace4251bffd09ce75679fe940e996cc) C:\WINDOWS\system32\netdde.exe
21:28:09.0000 4012        NetDDEdsdm - ok
21:28:09.0078 4012        Netlogon        (afb8261b56cba0d86aeb6df682af9785) C:\WINDOWS\System32\lsass.exe
21:28:09.0234 4012        Netlogon - ok
21:28:09.0343 4012        Netman          (e6d88f1f6745bf00b57e7855a2ab696c) C:\WINDOWS\System32\netman.dll
21:28:09.0515 4012        Netman - ok
21:28:09.0625 4012        NetTcpPortSharing (d34612c5d02d026535b3095d620626ae) C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe
21:28:09.0640 4012        NetTcpPortSharing - ok
21:28:09.0765 4012        NIC1394        (e9e47cfb2d461fa0fc75b7a74c6383ea) C:\WINDOWS\system32\DRIVERS\nic1394.sys
21:28:09.0921 4012        NIC1394 - ok
21:28:10.0015 4012        Nla            (f1b67b6b0751ae0e6e964b02821206a3) C:\WINDOWS\System32\mswsock.dll
21:28:10.0046 4012        Nla - ok
21:28:10.0140 4012        nm              (1e421a6bcf2203cc61b821ada9de878b) C:\WINDOWS\system32\DRIVERS\NMnt.sys
21:28:10.0296 4012        nm - ok
21:28:10.0359 4012        NMSAccessU      (fd306fbcce7adb1077b709742e7148e9) C:\Programme\CDBurnerXP\NMSAccessU.exe
21:28:10.0375 4012        NMSAccessU - ok
21:28:10.0484 4012        Npfs            (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys
21:28:10.0625 4012        Npfs - ok
21:28:10.0687 4012        npggsvc - ok
21:28:10.0828 4012        Ntfs            (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys
21:28:11.0000 4012        Ntfs - ok
21:28:11.0093 4012        NtLmSsp        (afb8261b56cba0d86aeb6df682af9785) C:\WINDOWS\System32\lsass.exe
21:28:11.0250 4012        NtLmSsp - ok
21:28:11.0375 4012        NtmsSvc        (56af4064996fa5bac9c449b1514b4770) C:\WINDOWS\system32\ntmssvc.dll
21:28:11.0578 4012        NtmsSvc - ok
21:28:11.0671 4012        Null            (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
21:28:11.0859 4012        Null - ok
21:28:12.0171 4012        nv              (8e72e452b9cc1e455d19e3c9fa964d37) C:\WINDOWS\system32\DRIVERS\nv4_mini.sys
21:28:12.0468 4012        nv - ok
21:28:12.0562 4012        NVSvc          (934833b3cd462a6f8a96f64d024c8b20) C:\WINDOWS\system32\nvsvc32.exe
21:28:12.0593 4012        NVSvc - ok
21:28:12.0687 4012        NwlnkFlt        (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
21:28:12.0875 4012        NwlnkFlt - ok
21:28:12.0968 4012        NwlnkFwd        (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
21:28:13.0140 4012        NwlnkFwd - ok
21:28:13.0234 4012        ohci1394        (ca33832df41afb202ee7aeb05145922f) C:\WINDOWS\system32\DRIVERS\ohci1394.sys
21:28:13.0390 4012        ohci1394 - ok
21:28:13.0484 4012        Parport        (f84785660305b9b903fb3bca8ba29837) C:\WINDOWS\system32\DRIVERS\parport.sys
21:28:13.0640 4012        Parport - ok
21:28:13.0734 4012        PartMgr        (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys
21:28:13.0875 4012        PartMgr - ok
21:28:13.0968 4012        ParVdm          (c2bf987829099a3eaa2ca6a0a90ecb4f) C:\WINDOWS\system32\drivers\ParVdm.sys
21:28:14.0156 4012        ParVdm - ok
21:28:14.0234 4012        PCI            (387e8dedc343aa2d1efbc30580273acd) C:\WINDOWS\system32\DRIVERS\pci.sys
21:28:14.0406 4012        PCI - ok
21:28:14.0468 4012        PCIDump - ok
21:28:14.0546 4012        PCIIde          (59ba86d9a61cbcf4df8e598c331f5b82) C:\WINDOWS\system32\DRIVERS\pciide.sys
21:28:14.0718 4012        PCIIde - ok
21:28:14.0812 4012        Pcmcia          (a2a966b77d61847d61a3051df87c8c97) C:\WINDOWS\system32\drivers\Pcmcia.sys
21:28:14.0968 4012        Pcmcia - ok
21:28:15.0031 4012        PDCOMP - ok
21:28:15.0093 4012        PDFRAME - ok
21:28:15.0156 4012        PDRELI - ok
21:28:15.0218 4012        PDRFRAME - ok
21:28:15.0265 4012        perc2 - ok
21:28:15.0328 4012        perc2hib - ok
21:28:15.0437 4012        PlugPlay        (a3edbe9053889fb24ab22492472b39dc) C:\WINDOWS\system32\services.exe
21:28:15.0453 4012        PlugPlay - ok
21:28:15.0546 4012        PnkBstrA        (a1dd33d16f277ce34124ee52ab2c0f14) C:\WINDOWS\system32\PnkBstrA.exe
21:28:15.0562 4012        PnkBstrA - ok
21:28:15.0656 4012        PolicyAgent    (afb8261b56cba0d86aeb6df682af9785) C:\WINDOWS\System32\lsass.exe
21:28:15.0812 4012        PolicyAgent - ok
21:28:15.0906 4012        PptpMiniport    (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys
21:28:16.0062 4012        PptpMiniport - ok
21:28:16.0140 4012        Processor      (2cb55427c58679f49ad600fccba76360) C:\WINDOWS\system32\DRIVERS\processr.sys
21:28:16.0296 4012        Processor - ok
21:28:16.0390 4012        ProtectedStorage (afb8261b56cba0d86aeb6df682af9785) C:\WINDOWS\system32\lsass.exe
21:28:16.0531 4012        ProtectedStorage - ok
21:28:16.0640 4012        PSched          (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys
21:28:16.0812 4012        PSched - ok
21:28:16.0890 4012        Ptilink        (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
21:28:17.0078 4012        Ptilink - ok
21:28:17.0140 4012        ql1080 - ok
21:28:17.0203 4012        Ql10wnt - ok
21:28:17.0250 4012        ql12160 - ok
21:28:17.0312 4012        ql1240 - ok
21:28:17.0375 4012        ql1280 - ok
21:28:17.0453 4012        RasAcd          (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys
21:28:17.0625 4012        RasAcd - ok
21:28:17.0703 4012        RasAuto        (f5ba6caccdb66c8f048e867563203246) C:\WINDOWS\System32\rasauto.dll
21:28:17.0875 4012        RasAuto - ok
21:28:17.0984 4012        Rasl2tp        (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
21:28:18.0140 4012        Rasl2tp - ok
21:28:18.0234 4012        RasMan          (f9a7b66ea345726edb5862a46b1eccd5) C:\WINDOWS\System32\rasmans.dll
21:28:18.0406 4012        RasMan - ok
21:28:18.0515 4012        RasPppoe        (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys
21:28:18.0671 4012        RasPppoe - ok
21:28:18.0750 4012        Raspti          (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys
21:28:18.0953 4012        Raspti - ok
21:28:19.0031 4012        Rdbss          (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys
21:28:19.0187 4012        Rdbss - ok
21:28:19.0281 4012        RDPCDD          (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
21:28:19.0453 4012        RDPCDD - ok
21:28:19.0562 4012        RDPWD          (5b3055daa788bd688594d2f5981f2a83) C:\WINDOWS\system32\drivers\RDPWD.sys
21:28:19.0625 4012        RDPWD - ok
21:28:19.0718 4012        RDSessMgr      (263af18af0f3db99f574c95f284ccec9) C:\WINDOWS\system32\sessmgr.exe
21:28:19.0875 4012        RDSessMgr - ok
21:28:19.0968 4012        redbook        (ed761d453856f795a7fe056e42c36365) C:\WINDOWS\system32\DRIVERS\redbook.sys
21:28:20.0125 4012        redbook - ok
21:28:20.0218 4012        RemoteAccess    (0e97ec96d6942ceec2d188cc2eb69a01) C:\WINDOWS\System32\mprdim.dll
21:28:20.0375 4012        RemoteAccess - ok
21:28:20.0484 4012        RpcLocator      (2a02e21867497df20b8fc95631395169) C:\WINDOWS\System32\locator.exe
21:28:20.0640 4012        RpcLocator - ok
21:28:20.0734 4012        RpcSs          (3127afbf2c1ed0ab14a1bbb7aaecb85b) C:\WINDOWS\system32\rpcss.dll
21:28:20.0796 4012        RpcSs - ok
21:28:20.0890 4012        RSVP            (4bdd71b4b521521499dfd14735c4f398) C:\WINDOWS\System32\rsvp.exe
21:28:21.0078 4012        RSVP - ok
21:28:21.0171 4012        SamSs          (afb8261b56cba0d86aeb6df682af9785) C:\WINDOWS\system32\lsass.exe
21:28:21.0312 4012        SamSs - ok
21:28:21.0406 4012        SCardSvr        (dcec079fad95d36c8dd5cb6d779dfe32) C:\WINDOWS\System32\SCardSvr.exe
21:28:21.0562 4012        SCardSvr - ok
21:28:21.0656 4012        Schedule        (a050194a44d7fa8d7186ed2f4e8367ae) C:\WINDOWS\system32\schedsvc.dll
21:28:21.0812 4012        Schedule - ok
21:28:21.0921 4012        Secdrv          (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys
21:28:22.0062 4012        Secdrv - ok
21:28:22.0156 4012        seclogon        (bee4cfd1d48c23b44cf4b974b0b79b2b) C:\WINDOWS\System32\seclogon.dll
21:28:22.0296 4012        seclogon - ok
21:28:22.0406 4012        SENS            (2aac9b6ed9eddffb721d6452e34d67e3) C:\WINDOWS\system32\sens.dll
21:28:22.0578 4012        SENS - ok
21:28:22.0671 4012        Serial          (cf24eb4f0412c82bcd1f4f35a025e31d) C:\WINDOWS\system32\drivers\Serial.sys
21:28:22.0859 4012        Serial - ok
21:28:22.0953 4012        sfdrv01        (4c0d673281178cb496011a2e28571fc8) C:\WINDOWS\system32\drivers\sfdrv01.sys
21:28:22.0968 4012        sfdrv01 ( UnsignedFile.Multi.Generic ) - warning
21:28:22.0968 4012        sfdrv01 - detected UnsignedFile.Multi.Generic (1)
21:28:23.0046 4012        sfhlp02        (15be2b5e4dc5b8623cf167720682abc9) C:\WINDOWS\system32\drivers\sfhlp02.sys
21:28:23.0062 4012        sfhlp02 ( UnsignedFile.Multi.Generic ) - warning
21:28:23.0062 4012        sfhlp02 - detected UnsignedFile.Multi.Generic (1)
21:28:23.0140 4012        Sfloppy        (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys
21:28:23.0296 4012        Sfloppy - ok
21:28:23.0390 4012        sfvfs02        (d5a7e09d2c6a702809e49190d52adc9f) C:\WINDOWS\system32\drivers\sfvfs02.sys
21:28:23.0390 4012        sfvfs02 ( UnsignedFile.Multi.Generic ) - warning
21:28:23.0390 4012        sfvfs02 - detected UnsignedFile.Multi.Generic (1)
21:28:23.0515 4012        SharedAccess    (cad058d5f8b889a87ca3eb3cf624dcef) C:\WINDOWS\System32\ipnathlp.dll
21:28:23.0687 4012        SharedAccess - ok
21:28:23.0796 4012        ShellHWDetection (2db7d303c36ddd055215052f118e8e75) C:\WINDOWS\System32\shsvcs.dll
21:28:23.0812 4012        ShellHWDetection - ok
21:28:23.0906 4012        Simbad - ok
21:28:24.0031 4012        smwdm          (58dc61df8df8dbbed38ce511b5ea0eb9) C:\WINDOWS\system32\drivers\smwdm.sys
21:28:24.0078 4012        smwdm - ok
21:28:24.0156 4012        Sparrow - ok
21:28:24.0234 4012        splitter        (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys
21:28:24.0390 4012        splitter - ok
21:28:24.0468 4012        Spooler        (60784f891563fb1b767f70117fc2428f) C:\WINDOWS\system32\spoolsv.exe
21:28:24.0500 4012        Spooler - ok
21:28:24.0609 4012        sr              (50fa898f8c032796d3b1b9951bb5a90f) C:\WINDOWS\system32\DRIVERS\sr.sys
21:28:24.0765 4012        sr - ok
21:28:24.0843 4012        srservice      (fe77a85495065f3ad59c5c65b6c54182) C:\WINDOWS\System32\srsvc.dll
21:28:25.0000 4012        srservice - ok
21:28:25.0125 4012        Srv            (47ddfc2f003f7f9f0592c6874962a2e7) C:\WINDOWS\system32\DRIVERS\srv.sys
21:28:25.0203 4012        Srv - ok
21:28:25.0312 4012        sscdbus        (ffe42941e0326c322f40b0b79a46493c) C:\WINDOWS\system32\DRIVERS\sscdbus.sys
21:28:25.0328 4012        sscdbus - ok
21:28:25.0437 4012        sscdmdfl        (a68e7d87adfbb8c50d88cd58230c6819) C:\WINDOWS\system32\DRIVERS\sscdmdfl.sys
21:28:25.0453 4012        sscdmdfl - ok
21:28:25.0546 4012        sscdmdm        (b534b24151281856ec2f69ed3d6d60dd) C:\WINDOWS\system32\DRIVERS\sscdmdm.sys
21:28:25.0562 4012        sscdmdm - ok
21:28:25.0640 4012        SSDPSRV        (4df5b05dfaec29e13e1ed6f6ee12c500) C:\WINDOWS\System32\ssdpsrv.dll
21:28:25.0796 4012        SSDPSRV - ok
21:28:25.0890 4012        ssmdrv          (a36ee93698802cd899f98bfd553d8185) C:\WINDOWS\system32\DRIVERS\ssmdrv.sys
21:28:25.0906 4012        ssmdrv - ok
21:28:26.0000 4012        stisvc          (bc2c5985611c5356b24aeb370953ded9) C:\WINDOWS\system32\wiaservc.dll
21:28:26.0187 4012        stisvc - ok
21:28:26.0296 4012        swenum          (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys
21:28:26.0453 4012        swenum - ok
21:28:26.0531 4012        swmidi          (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys
21:28:26.0703 4012        swmidi - ok
21:28:26.0750 4012        SwPrv - ok
21:28:26.0812 4012        symc810 - ok
21:28:26.0875 4012        symc8xx - ok
21:28:26.0921 4012        sym_hi - ok
21:28:26.0984 4012        sym_u3 - ok
21:28:27.0062 4012        sysaudio        (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys
21:28:27.0234 4012        sysaudio - ok
21:28:27.0312 4012        SysmonLog      (2903fffa2523926d6219428040dce6b9) C:\WINDOWS\system32\smlogsvc.exe
21:28:27.0484 4012        SysmonLog - ok
21:28:27.0578 4012        TapiSrv        (05903cac4b98908d55ea5774775b382e) C:\WINDOWS\System32\tapisrv.dll
21:28:27.0734 4012        TapiSrv - ok
21:28:27.0859 4012        Tcpip          (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys
21:28:27.0921 4012        Tcpip - ok
21:28:28.0015 4012        TDPIPE          (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys
21:28:28.0171 4012        TDPIPE - ok
21:28:28.0250 4012        TDTCP          (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys
21:28:28.0406 4012        TDTCP - ok
21:28:28.0500 4012        TermDD          (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys
21:28:28.0656 4012        TermDD - ok
21:28:28.0750 4012        TermService    (b7de02c863d8f5a005a7bf375375a6a4) C:\WINDOWS\System32\termsrv.dll
21:28:28.0921 4012        TermService - ok
21:28:29.0015 4012        Themes          (2db7d303c36ddd055215052f118e8e75) C:\WINDOWS\System32\shsvcs.dll
21:28:29.0031 4012        Themes - ok
21:28:29.0109 4012        TosIde - ok
21:28:29.0187 4012        TrkWks          (626504572b175867f30f3215c04b3e2f) C:\WINDOWS\system32\trkwks.dll
21:28:29.0343 4012        TrkWks - ok
21:28:29.0453 4012        Udfs            (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys
21:28:29.0625 4012        Udfs - ok
21:28:29.0687 4012        ultra - ok
21:28:29.0781 4012        Update          (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys
21:28:29.0968 4012        Update - ok
21:28:30.0062 4012        upnphost        (1dfd8975d8c89214b98d9387c1125b49) C:\WINDOWS\System32\upnphost.dll
21:28:30.0234 4012        upnphost - ok
21:28:30.0328 4012        UPS            (9b11e6118958e63e1fef129466e2bda7) C:\WINDOWS\System32\ups.exe
21:28:30.0484 4012        UPS - ok
21:28:30.0593 4012        usbaudio        (e919708db44ed8543a7c017953148330) C:\WINDOWS\system32\drivers\usbaudio.sys
21:28:30.0750 4012        usbaudio - ok
21:28:30.0843 4012        usbccgp        (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys
21:28:31.0000 4012        usbccgp - ok
21:28:31.0078 4012        usbehci        (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys
21:28:31.0250 4012        usbehci - ok
21:28:31.0328 4012        usbhub          (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys
21:28:31.0500 4012        usbhub - ok
21:28:31.0593 4012        usbprint        (a717c8721046828520c9edf31288fc00) C:\WINDOWS\system32\DRIVERS\usbprint.sys
21:28:31.0750 4012        usbprint - ok
21:28:31.0828 4012        usbscan        (a0b8cf9deb1184fbdd20784a58fa75d4) C:\WINDOWS\system32\DRIVERS\usbscan.sys
21:28:31.0984 4012        usbscan - ok
21:28:32.0078 4012        USBSTOR        (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
21:28:32.0250 4012        USBSTOR - ok
21:28:32.0328 4012        usbuhci        (26496f9dee2d787fc3e61ad54821ffe6) C:\WINDOWS\system32\DRIVERS\usbuhci.sys
21:28:32.0484 4012        usbuhci - ok
21:28:32.0578 4012        VgaSave        (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys
21:28:32.0734 4012        VgaSave - ok
21:28:32.0796 4012        ViaIde - ok
21:28:32.0875 4012        VolSnap        (a5a712f4e880874a477af790b5186e1d) C:\WINDOWS\system32\drivers\VolSnap.sys
21:28:33.0031 4012        VolSnap - ok
21:28:33.0125 4012        VSS            (68f106273be29e7b7ef8266977268e78) C:\WINDOWS\System32\vssvc.exe
21:28:33.0296 4012        VSS - ok
21:28:33.0390 4012        W32Time        (7b353059e665f8b7ad2bbeaef597cf45) C:\WINDOWS\System32\w32time.dll
21:28:33.0546 4012        W32Time - ok
21:28:33.0640 4012        Wanarp          (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys
21:28:33.0812 4012        Wanarp - ok
21:28:33.0875 4012        WDICA - ok
21:28:33.0953 4012        wdmaud          (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys
21:28:34.0109 4012        wdmaud - ok
21:28:34.0203 4012        WebClient      (81727c9873e3905a2ffc1ebd07265002) C:\WINDOWS\System32\webclnt.dll
21:28:34.0359 4012        WebClient - ok
21:28:34.0468 4012        winmgmt        (6f3f3973d97714cc5f906a19fe883729) C:\WINDOWS\system32\wbem\WMIsvc.dll
21:28:34.0625 4012        winmgmt - ok
21:28:34.0734 4012        WmdmPmSN        (c51b4a5c05a5475708e3c81c7765b71d) C:\WINDOWS\system32\MsPMSNSv.dll
21:28:34.0812 4012        WmdmPmSN - ok
21:28:34.0921 4012        WmiApSrv        (93908111ba57a6e60ec2fa2de202105c) C:\WINDOWS\System32\wbem\wmiapsrv.exe
21:28:35.0078 4012        WmiApSrv - ok
21:28:35.0171 4012        WMPNetworkSvc  (bf05650bb7df5e9ebdd25974e22403bb) C:\Programme\Windows Media Player\WMPNetwk.exe
21:28:35.0250 4012        WMPNetworkSvc - ok
21:28:35.0359 4012        WpdUsb          (cf4def1bf66f06964dc0d91844239104) C:\WINDOWS\system32\Drivers\wpdusb.sys
21:28:35.0390 4012        WpdUsb - ok
21:28:35.0593 4012        wscsvc          (300b3e84faf1a5c1f791c159ba28035d) C:\WINDOWS\system32\wscsvc.dll
21:28:35.0765 4012        wscsvc - ok
21:28:35.0859 4012        wuauserv        (7b4fe05202aa6bf9f4dfd0e6a0d8a085) C:\WINDOWS\system32\wuauserv.dll
21:28:36.0031 4012        wuauserv - ok
21:28:36.0125 4012        WudfPf          (f15feafffbb3644ccc80c5da584e6311) C:\WINDOWS\system32\DRIVERS\WudfPf.sys
21:28:36.0171 4012        WudfPf - ok
21:28:36.0265 4012        WudfRd          (28b524262bce6de1f7ef9f510ba3985b) C:\WINDOWS\system32\DRIVERS\wudfrd.sys
21:28:36.0296 4012        WudfRd - ok
21:28:36.0375 4012        WudfSvc        (05231c04253c5bc30b26cbaae680ed89) C:\WINDOWS\System32\WUDFSvc.dll
21:28:36.0453 4012        WudfSvc - ok
21:28:36.0578 4012        WZCSVC          (c4f109c005f6725162d2d12ca751e4a7) C:\WINDOWS\System32\wzcsvc.dll
21:28:36.0765 4012        WZCSVC - ok
21:28:36.0875 4012        xmlprov        (0ada34871a2e1cd2caafed1237a47750) C:\WINDOWS\System32\xmlprov.dll
21:28:37.0046 4012        xmlprov - ok
21:28:37.0078 4012        MBR (0x1B8)    (8f558eb6672622401da993e1e865c861) \Device\Harddisk0\DR0
21:28:37.0328 4012        \Device\Harddisk0\DR0 - ok
21:28:37.0359 4012        MBR (0x1B8)    (ddae9d649db12f6aff24483f2c298989) \Device\Harddisk1\DR3
21:28:39.0125 4012        \Device\Harddisk1\DR3 - ok
21:28:39.0125 4012        Boot (0x1200)  (da2915e6e5895335e2f9cb68353f0d10) \Device\Harddisk0\DR0\Partition0
21:28:39.0125 4012        \Device\Harddisk0\DR0\Partition0 - ok
21:28:39.0140 4012        Boot (0x1200)  (279d44525f30c3018478a1c04ba05c76) \Device\Harddisk0\DR0\Partition1
21:28:39.0140 4012        \Device\Harddisk0\DR0\Partition1 - ok
21:28:39.0156 4012        Boot (0x1200)  (a8c58159f6f267b9c22b4b348a6b908f) \Device\Harddisk1\DR3\Partition0
21:28:39.0156 4012        \Device\Harddisk1\DR3\Partition0 - ok
21:28:39.0156 4012        ============================================================
21:28:39.0156 4012        Scan finished
21:28:39.0156 4012        ============================================================
21:28:39.0281 0508        Detected object count: 8
21:28:39.0281 0508        Actual detected object count: 8
21:28:52.0734 0508        LBeepKE ( UnsignedFile.Multi.Generic ) - skipped by user
21:28:52.0734 0508        LBeepKE ( UnsignedFile.Multi.Generic ) - User select action: Skip
21:28:52.0734 0508        MACNDIS5 ( UnsignedFile.Multi.Generic ) - skipped by user
21:28:52.0734 0508        MACNDIS5 ( UnsignedFile.Multi.Generic ) - User select action: Skip
21:28:52.0750 0508        MagicTune ( UnsignedFile.Multi.Generic ) - skipped by user
21:28:52.0750 0508        MagicTune ( UnsignedFile.Multi.Generic ) - User select action: Skip
21:28:52.0750 0508        MIINPazX ( UnsignedFile.Multi.Generic ) - skipped by user
21:28:52.0750 0508        MIINPazX ( UnsignedFile.Multi.Generic ) - User select action: Skip
21:28:52.0750 0508        MZCCntrl ( UnsignedFile.Multi.Generic ) - skipped by user
21:28:52.0750 0508        MZCCntrl ( UnsignedFile.Multi.Generic ) - User select action: Skip
21:28:52.0765 0508        sfdrv01 ( UnsignedFile.Multi.Generic ) - skipped by user
21:28:52.0765 0508        sfdrv01 ( UnsignedFile.Multi.Generic ) - User select action: Skip
21:28:52.0765 0508        sfhlp02 ( UnsignedFile.Multi.Generic ) - skipped by user
21:28:52.0765 0508        sfhlp02 ( UnsignedFile.Multi.Generic ) - User select action: Skip
21:28:52.0765 0508        sfvfs02 ( UnsignedFile.Multi.Generic ) - skipped by user
21:28:52.0765 0508        sfvfs02 ( UnsignedFile.Multi.Generic ) - User select action: Skip

cosinus 04.04.2012 22:35
Dann bitte jetzt CF ausführen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix
  • Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.
  • Starte combofix.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
    Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.
  • Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.
Wichtiger Hinweis:
Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!

Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

Solltest du nach der Ausführung von Combofix Probleme beim Starten von Anwendungen haben und Meldungen erhalten wie

Zitat:
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
startest du Windows dann manuell neu und die Fehlermeldungen sollten nicht mehr auftauchen.

petetheheat 05.04.2012 12:37
Combofix:

Code:
ComboFix 12-04-05.04 - Hoschie 05.04.2012  13:19:06.1.2 - x86
Microsoft Windows XP Home Edition  5.1.2600.3.1252.49.1031.18.2047.1361 [GMT 2:00]
ausgeführt von:: c:\dokumente und einstellungen\Hoschie\Desktop\ComboFix.exe
AV: AntiVir Desktop *Disabled/Updated* {AD166499-45F9-482A-A743-FDD3350758C7}
.
.
((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\CFLog
c:\dokumente und einstellungen\Administrator.DACH\WINDOWS
c:\dokumente und einstellungen\Administrator\WINDOWS
c:\dokumente und einstellungen\All Users\Anwendungsdaten\TEMP
c:\dokumente und einstellungen\Default User\WINDOWS
c:\dokumente und einstellungen\Hoschie\Eigene Dateien\~WRD0971.tmp
c:\dokumente und einstellungen\Hoschie\WINDOWS
c:\windows\IsUn0407.exe
c:\windows\system32\config\systemprofile\WINDOWS
c:\windows\unin0407.exe
.
.
(((((((((((((((((((((((  Dateien erstellt von 2012-03-05 bis 2012-04-05  ))))))))))))))))))))))))))))))
.
.
2012-04-02 13:51 . 2012-04-02 13:51        2322184        ----a-w-        C:\esetsmartinstaller_enu.exe
2012-04-02 11:58 . 2012-04-02 11:58        --------        d-----w-        c:\programme\GUM9.tmp
2012-04-02 11:58 . 2012-04-02 11:58        3993600        ----a-w-        c:\programme\GUTA.tmp
2012-03-27 13:48 . 2012-04-02 12:32        --------        d-----w-        C:\_OTL
2012-03-27 08:11 . 2012-03-27 08:11        --------        d-----w-        c:\dokumente und einstellungen\Hoschie\Anwendungsdaten\Malwarebytes
2012-03-25 11:29 . 2012-03-25 11:29        --------        d-----w-        c:\programme\ESETa
2012-03-23 10:37 . 2012-03-23 10:37        --------        d-----w-        c:\programme\7-Zip
2012-03-21 11:08 . 2012-03-21 11:08        2106216        ----a-w-        c:\programme\Mozilla Firefox\D3DCompiler_43.dll
2012-03-21 11:08 . 2012-03-21 11:08        592824        ----a-w-        c:\programme\Mozilla Firefox\gkmedias.dll
2012-03-21 11:08 . 2012-03-21 11:08        1998168        ----a-w-        c:\programme\Mozilla Firefox\d3dx9_43.dll
2012-03-21 11:08 . 2012-03-21 11:08        44472        ----a-w-        c:\programme\Mozilla Firefox\mozglue.dll
2012-03-21 11:08 . 2012-03-21 11:08        626688        ----a-w-        c:\programme\Mozilla Firefox\msvcr80.dll
2012-03-21 11:08 . 2012-03-21 11:08        548864        ----a-w-        c:\programme\Mozilla Firefox\msvcp80.dll
2012-03-21 11:08 . 2012-03-21 11:08        479232        ----a-w-        c:\programme\Mozilla Firefox\msvcm80.dll
2012-03-20 13:23 . 2012-03-20 13:23        --------        d-----w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\Malwarebytes
2012-03-20 13:23 . 2012-03-20 13:23        --------        d-----w-        c:\programme\Malwarebytes' Anti-Malware
2012-03-20 13:23 . 2011-12-10 14:24        20464        ----a-w-        c:\windows\system32\drivers\mbam.sys
2012-03-17 17:04 . 2012-03-19 10:48        --------        d---a-w-        C:\Kaspersky Rescue Disk 10.0
2012-03-17 15:02 . 2012-04-05 11:25        --------        d-----w-        c:\dokumente und einstellungen\Administrator.DACH
2012-03-13 09:03 . 2012-03-13 09:03        --------        d-----w-        c:\dokumente und einstellungen\Hoschie\Anwendungsdaten\LEGO Company
.
.
.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-02-29 16:39 . 2011-06-06 04:36        414368        ----a-w-        c:\windows\system32\FlashPlayerCPLApp.cpl
2012-02-29 09:08 . 2012-02-29 09:08        72304        ----a-w-        c:\windows\macromix.dll
2012-02-29 09:08 . 2012-02-29 09:08        30544        ----a-w-        c:\windows\dirdib.drv
2012-02-03 09:57 . 2003-06-07 07:28        1860224        ----a-w-        c:\windows\system32\win32k.sys
2012-01-11 19:06 . 2012-02-15 10:06        3072        ------w-        c:\windows\system32\iacenc.dll
2012-01-09 16:20 . 2003-06-07 07:39        139784        ----a-w-        c:\windows\system32\drivers\rdpwd.sys
2012-03-21 11:08 . 2011-06-18 16:34        97208        ----a-w-        c:\programme\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2011-12-05 19:17        94208        ----a-w-        c:\dokumente und einstellungen\Hoschie\Anwendungsdaten\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2011-12-05 19:17        94208        ----a-w-        c:\dokumente und einstellungen\Hoschie\Anwendungsdaten\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2011-12-05 19:17        94208        ----a-w-        c:\dokumente und einstellungen\Hoschie\Anwendungsdaten\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2011-12-05 19:17        94208        ----a-w-        c:\dokumente und einstellungen\Hoschie\Anwendungsdaten\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"T-Online_Software_6\WLAN-Access Finder"="c:\programme\T-Online\WLAN-Access Finder\ToWLaAcF.exe" [2008-04-08 671796]
"Steam"="d:\programme\steam\steam.exe" [2011-08-02 1242448]
"swg"="c:\programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-11-03 68856]
"Skype"="c:\programme\Skype\Phone\Skype.exe" [2010-03-09 26100520]
"Octoshape Streaming Services"="c:\dokumente und einstellungen\Hoschie\Anwendungsdaten\Octoshape\Octoshape Streaming Services\OctoshapeClient.exe" [2009-01-08 70936]
"OM2_Monitor"="c:\programme\OLYMPUS\OLYMPUS Master 2\MMonitor.exe" [2009-11-25 95632]
"RayV"="c:\programme\RayV\RayV\RayV.exe" [2010-10-21 2839848]
"AutoStartNPSAgent"="c:\programme\Samsung\Samsung New PC Studio\NPSAgent.exe" [2010-03-30 116056]
"GameXN (update)"="c:\dokumente und einstellungen\All Users\Anwendungsdaten\GameXN\GameXNGO.exe" [2011-09-01 347008]
"GameXN (news)"="c:\dokumente und einstellungen\All Users\Anwendungsdaten\GameXN\GameXNGO.exe" [2011-09-01 347008]
"GameXN"="c:\dokumente und einstellungen\All Users\Anwendungsdaten\GameXN\GameXNGO.exe" [2011-09-01 347008]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-05-03 13529088]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-05-03 86016]
"avgnt"="c:\programme\Avira\AntiVir Desktop\avgnt.exe" [2010-12-13 281768]
"Launch LgDeviceAgent"="c:\programme\Logitech\GamePanel Software\LgDevAgt.exe" [2009-12-10 357384]
"Launch LGDCore"="c:\programme\Logitech\GamePanel Software\G-series Software\LGDCore.exe" [2009-12-10 3203080]
"OM2_Monitor"="c:\programme\OLYMPUS\OLYMPUS Master 2\FirstStart.exe" [2009-11-25 54672]
"QuickTime Task"="c:\programme\QuickTime\QTTask.exe" [2011-07-05 421888]
"SunJavaUpdateSched"="c:\programme\Gemeinsame Dateien\Java\Java Update\jusched.exe" [2011-06-09 254696]
"Adobe Reader Speed Launcher"="c:\programme\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2012-01-03 37296]
"Malwarebytes' Anti-Malware"="c:\programme\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-01-13 460872]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360]
"T-Online_Software_6\WLAN-Access Finder"="c:\programme\T-Online\WLAN-Access Finder\ToWLaAcF.exe" [2008-04-08 671796]
.
c:\dokumente und einstellungen\Hoschie\Startmenü\Programme\Autostart\
CurseClientStartup.ccip [2010-1-26 0]
Dropbox.lnk - c:\dokumente und einstellungen\Hoschie\Anwendungsdaten\Dropbox\bin\Dropbox.exe [2012-2-15 24246216]
Microsoft-Indexerstellung.lnk - c:\programme\Microsoft Office\Office\FINDFAST.EXE [1997-1-17 111376]
Office-Start.lnk - c:\programme\Microsoft Office\Office\OSA.EXE [1997-1-17 51984]
.
c:\dokumente und einstellungen\All Users\Startmenü\Programme\Autostart\
Logitech SetPoint.lnk - c:\programme\Logitech\SetPoint\SetPoint.exe [2008-10-2 671744]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2012-01-02 09:07        843712        ----a-r-        c:\programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AGRSMMSG]
2003-02-14 09:59        88107        ----a-w-        c:\windows\AGRSMMSG.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2011-08-18 23:07        421736        ----a-w-        c:\programme\iTunes\iTunesHelper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Kernel and Hardware Abstraction Layer]
2006-07-19 10:03        94208        ----a-w-        c:\windows\KHALMNPR.Exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Logitech Hardware Abstraction Layer]
2006-07-19 10:03        94208        ----a-w-        c:\windows\KHALMNPR.Exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
2008-05-03 03:46        1630208        ----a-w-        c:\windows\system32\nwiz.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"npggsvc"=3 (0x3)
"iPod Service"=3 (0x3)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"d:\\Spiele\\World of Warcraft\\BackgroundDownloader.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"d:\\Programme\\Steam\\SteamApps\\hoschiebaer\\team fortress 2\\hl2.exe"=
"d:\\Programme\\SopCast\\SopCast.exe"=
"d:\\Programme\\SopCast\\adv\\SopAdver.exe"=
"d:\\Programme\\TVUPlayer\\TVUPlayer.exe"=
"c:\\Programme\\Mozilla Firefox\\firefox.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"c:\\Programme\\VentSrv\\ventrilo_srv.exe"=
"c:\\Programme\\Ventrilo\\Ventrilo.exe"=
"d:\\Spiele\\World of Warcraft\\Launcher.exe"=
"d:\\Spiele\\World of Warcraft\\WoW-3.1.3.9947-to-3.2.0.10192-deDE-downloader.exe"=
"d:\\Spiele\\World of Warcraft\\WoW-3.2.0.10192-to-3.2.0.10314-deDE-downloader.exe"=
"c:\\Dokumente und Einstellungen\\Hoschie\\Anwendungsdaten\\Octoshape\\Octoshape Streaming Services\\OctoshapeClient.exe"=
"d:\\Spiele\\World of Warcraft\\WoW-3.2.0.10314-to-3.2.2.10482-deDE-downloader.exe"=
"d:\\Spiele\\World of Warcraft\\WoW-3.2.2.10482-to-3.2.2.10505-deDE-downloader.exe"=
"c:\\Programme\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Programme\\Messenger\\msmsgs.exe"=
"c:\\Programme\\ICQ7.2\\ICQ.exe"=
"c:\\Programme\\ICQ7.2\\aolload.exe"=
"c:\\Programme\\RayV\\RayV\\RayV.exe"=
"c:\\Programme\\RayV\\RayV\\RayV.dll"=
"d:\\Programme\\Steam\\steam.exe"=
"c:\\Programme\\Samsung\\Samsung New PC Studio\\npsasvr.exe"=
"c:\\Programme\\Samsung\\Samsung New PC Studio\\npsvsvr.exe"=
"c:\\Programme\\Mozilla Firefox\\plugin-container.exe"=
"c:\\Programme\\Gemeinsame Dateien\\Apple\\Apple Application Support\\WebKit2WebProcess.exe"=
"c:\\Programme\\Bonjour\\mDNSResponder.exe"=
"c:\\Programme\\iTunes\\iTunes.exe"=
"c:\\Dokumente und Einstellungen\\Hoschie\\Anwendungsdaten\\Dropbox\\bin\\Dropbox.exe"=
"d:\\Spiele\\Warcraft III\\Warcraft III.exe"=
"c:\\Programme\\Pando Networks\\Media Booster\\PMB.exe"=
"d:\\Programme\\Steam\\SteamApps\\common\\killingfloor\\System\\KillingFloor.exe"=
"c:\\Dokumente und Einstellungen\\Hoschie\\Anwendungsdaten\\RayV\\Viewer\\RayV.dll"=
"d:\\Programme\\Steam\\SteamApps\\hoschiebaer\\day of defeat source\\hl2.exe"=
"c:\\Programme\\Skype\\Phone\\Skype.exe"=
"c:\\Dokumente und Einstellungen\\Hoschie\\Lokale Einstellungen\\Apps\\2.0\\JCTV778O.98G\\VK2G3LGH.RTV\\curs..tion_eee711038731a406_0004.0000_2bd39706d04e72c8\\CurseClient.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3724:TCP"= 3724:TCP:Blizzard Downloader: 3724
"56868:TCP"= 56868:TCP:Pando Media Booster
"56868:UDP"= 56868:UDP:Pando Media Booster
"56831:TCP"= 56831:TCP:Pando Media Booster
"56831:UDP"= 56831:UDP:Pando Media Booster
.
R2 AntiVirSchedulerService;Avira AntiVir Planer;c:\programme\Avira\AntiVir Desktop\sched.exe [19.08.2009 20:42 136360]
R2 LBeepKE;LBeepKE;c:\windows\system32\drivers\LBeepKE.sys [02.10.2008 10:59 3712]
R2 MBAMService;MBAMService;c:\programme\Malwarebytes' Anti-Malware\mbamservice.exe [20.03.2012 15:23 652360]
R2 MZCCntrl;T-Online WLAN Adapter Steuerungsdienst;c:\programme\Gemeinsame Dateien\Marmiko Shared\MZCCntrl.exe [07.07.2008 12:59 61440]
R3 MACNDIS5;MACNDIS5 NDIS Protocol Driver;c:\progra~1\GEMEIN~1\MARMIK~1\MACNDIS5.SYS [07.07.2008 12:59 17280]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [20.03.2012 15:23 20464]
S2 gupdate;Google Update Service (gupdate);c:\programme\Google\Update\GoogleUpdate.exe [04.03.2010 18:57 135664]
S2 ICQ Service;ICQ Service;c:\programme\ICQ6Toolbar\ICQ Service.exe --> c:\programme\ICQ6Toolbar\ICQ Service.exe [?]
S3 gupdatem;Google Update-Dienst (gupdatem);c:\programme\Google\Update\GoogleUpdate.exe [04.03.2010 18:57 135664]
S3 MIINPazX;MIINPazX NDIS Protocol Driver;c:\progra~1\GEMEIN~1\MARMIK~1\MInfraIS\MIINPazX.SYS [07.07.2008 12:59 17152]
S4 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des -service --> c:\windows\system32\GameMon.des -service [?]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
tapisrv        REG_MULTI_SZ          Tapisrv
.
Inhalt des "geplante Tasks" Ordners
.
2012-03-14 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\programme\Apple Software Update\SoftwareUpdate.exe [2011-06-01 15:57]
.
2012-04-05 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\programme\Google\Update\GoogleUpdate.exe [2010-03-04 16:57]
.
2012-04-05 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\programme\Google\Update\GoogleUpdate.exe [2010-03-04 16:57]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.google.com
mStart Page = hxxp://www.google.com
uInternet Connection Wizard,ShellNext = hxxp://www.t-online.de/service/redir/tosw6_sc_webtour.htm
uInternet Settings,ProxyOverride = *.local
IE: Google Sidewiki... - c:\programme\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_D183CA64F05FDD98.dll/cmsidewiki.html
Trusted Zone: sony-europe.com
Trusted Zone: sonystyle-europe.com
Trusted Zone: vaio-link.com
TCP: DhcpNameServer = 192.168.2.1
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\dokumente und einstellungen\Hoschie\Anwendungsdaten\Mozilla\Firefox\Profiles\cvljn78f.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - about:home
FF - prefs.js: keyword.URL - hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.1.6&q=
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
HKCU-Run-ICQ - c:\programme\ICQ6\ICQ.exe
AddRemove-Adobe Flash Player ActiveX - c:\windows\system32\Macromed\Flash\uninstall_activeX.exe
AddRemove-Adobe Photoshop Elements 2.0 - c:\windows\ISUN0407.EXE
AddRemove-Adobe Premiere 6 LE - c:\windows\UNIN0407.EXE
AddRemove-ICQToolbar - c:\programme\ICQ6Toolbar\ICQUnToolbar.exe
AddRemove-Microsoft Interactive Training - c:\windows\IsUn0407.exe
AddRemove-03_Swallowtail - c:\programme\SAMSUNG\USB Drivers\03_Swallowtail\Uninstall.exe
AddRemove-Octoshape add-in for Adobe Flash Player - c:\dokumente und einstellungen\Hoschie\Anwendungsdaten\Macromedia\Flash Player\www.macromedia.com\bin\octoshape\octoshape.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2012-04-05 13:25
Windows 5.1.2600 Service Pack 3 NTFS
.
Scanne versteckte Prozesse...
.
Scanne versteckte Autostarteinträge...
.
Scanne versteckte Dateien...
.
Scan erfolgreich abgeschlossen
versteckte Dateien: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\npggsvc]
"ImagePath"="c:\windows\system32\GameMon.des -service"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\S-1-5-21-3043918641-1562116810-1089896837-1005\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
Zeit der Fertigstellung: 2012-04-05  13:28:58
ComboFix-quarantined-files.txt  2012-04-05 11:28
.
Vor Suchlauf: 5.105.668.096 Bytes frei
Nach Suchlauf: 5.172.572.160 Bytes frei
.
WindowsXP-KB310994-SP2-Home-BootDisk-DEU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /fastdetect /NoExecute=OptIn
.
- - End Of File - - 9042D2B8DE051FA374977A7C8AA5FB25

cosinus 05.04.2012 14:06
Combofix - Scripten

1. Starte das Notepad (Start / Ausführen / notepad[Enter])

2. Jetzt füge mit copy/paste den ganzen Inhalt der untenstehenden Codebox in das Notepad Fenster ein.

Code:
Folder::
c:\programme\GUM9.tmp
c:\programme\ICQ6Toolbar

File::
c:\programme\GUTA.tmp

Driver::
ICQ Service

Registry::
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3724:TCP"=-
"56868:TCP"=-
"56868:UDP"=-
"56831:TCP"=-
"56831:UDP"=-
3. Speichere im Notepad als CFScript.txt auf dem Desktop.

4. Deaktivere den Guard Deines Antivirenprogramms und eine eventuell vorhandene Software Firewall.
(Auch Guards von Ad-, Spyware Programmen und den Tea Timer (wenn vorhanden) !)

5. Dann ziehe die CFScript.txt auf die cofi.exe, so wie es im unteren Bild zu sehen ist. Damit wird Combofix neu gestartet.

http://users.pandora.be/bluepatchy/m...s/CFScript.gif

6. Nach dem Neustart (es wird gefragt ob Du neustarten willst), poste bitte die folgenden Log Dateien:
Combofix.txt

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!

petetheheat 05.04.2012 19:45
combofix:

Code:
ComboFix 12-04-05.04 - Hoschie 05.04.2012  20:06:41.2.2 - x86
Microsoft Windows XP Home Edition  5.1.2600.3.1252.49.1031.18.2047.1341 [GMT 2:00]
ausgeführt von:: c:\dokumente und einstellungen\Hoschie\Desktop\ComboFix.exe
Benutzte Befehlsschalter :: c:\dokumente und einstellungen\Hoschie\Desktop\CFScript.txt
AV: AntiVir Desktop *Disabled/Updated* {AD166499-45F9-482A-A743-FDD3350758C7}
.
FILE ::
"c:\programme\GUTA.tmp"
.
.
((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programme\GUM9.tmp
c:\programme\GUM9.tmp\GoogleCrashHandler.exe
c:\programme\GUM9.tmp\GoogleCrashHandler64.exe
c:\programme\GUM9.tmp\GoogleUpdate.exe
c:\programme\GUM9.tmp\GoogleUpdateBroker.exe
c:\programme\GUM9.tmp\GoogleUpdateHelper.msi
c:\programme\GUM9.tmp\GoogleUpdateOnDemand.exe
c:\programme\GUM9.tmp\GoogleUpdateSetup.exe
c:\programme\GUM9.tmp\goopdate.dll
c:\programme\GUM9.tmp\goopdateres_am.dll
c:\programme\GUM9.tmp\goopdateres_ar.dll
c:\programme\GUM9.tmp\goopdateres_bg.dll
c:\programme\GUM9.tmp\goopdateres_bn.dll
c:\programme\GUM9.tmp\goopdateres_ca.dll
c:\programme\GUM9.tmp\goopdateres_cs.dll
c:\programme\GUM9.tmp\goopdateres_da.dll
c:\programme\GUM9.tmp\goopdateres_de.dll
c:\programme\GUM9.tmp\goopdateres_el.dll
c:\programme\GUM9.tmp\goopdateres_en-GB.dll
c:\programme\GUM9.tmp\goopdateres_en.dll
c:\programme\GUM9.tmp\goopdateres_es-419.dll
c:\programme\GUM9.tmp\goopdateres_es.dll
c:\programme\GUM9.tmp\goopdateres_et.dll
c:\programme\GUM9.tmp\goopdateres_fa.dll
c:\programme\GUM9.tmp\goopdateres_fi.dll
c:\programme\GUM9.tmp\goopdateres_fil.dll
c:\programme\GUM9.tmp\goopdateres_fr.dll
c:\programme\GUM9.tmp\goopdateres_gu.dll
c:\programme\GUM9.tmp\goopdateres_hi.dll
c:\programme\GUM9.tmp\goopdateres_hr.dll
c:\programme\GUM9.tmp\goopdateres_hu.dll
c:\programme\GUM9.tmp\goopdateres_id.dll
c:\programme\GUM9.tmp\goopdateres_is.dll
c:\programme\GUM9.tmp\goopdateres_it.dll
c:\programme\GUM9.tmp\goopdateres_iw.dll
c:\programme\GUM9.tmp\goopdateres_ja.dll
c:\programme\GUM9.tmp\goopdateres_kn.dll
c:\programme\GUM9.tmp\goopdateres_ko.dll
c:\programme\GUM9.tmp\goopdateres_lt.dll
c:\programme\GUM9.tmp\goopdateres_lv.dll
c:\programme\GUM9.tmp\goopdateres_ml.dll
c:\programme\GUM9.tmp\goopdateres_mr.dll
c:\programme\GUM9.tmp\goopdateres_ms.dll
c:\programme\GUM9.tmp\goopdateres_nl.dll
c:\programme\GUM9.tmp\goopdateres_no.dll
c:\programme\GUM9.tmp\goopdateres_pl.dll
c:\programme\GUM9.tmp\goopdateres_pt-BR.dll
c:\programme\GUM9.tmp\goopdateres_pt-PT.dll
c:\programme\GUM9.tmp\goopdateres_ro.dll
c:\programme\GUM9.tmp\goopdateres_ru.dll
c:\programme\GUM9.tmp\goopdateres_sk.dll
c:\programme\GUM9.tmp\goopdateres_sl.dll
c:\programme\GUM9.tmp\goopdateres_sr.dll
c:\programme\GUM9.tmp\goopdateres_sv.dll
c:\programme\GUM9.tmp\goopdateres_sw.dll
c:\programme\GUM9.tmp\goopdateres_ta.dll
c:\programme\GUM9.tmp\goopdateres_te.dll
c:\programme\GUM9.tmp\goopdateres_th.dll
c:\programme\GUM9.tmp\goopdateres_tr.dll
c:\programme\GUM9.tmp\goopdateres_uk.dll
c:\programme\GUM9.tmp\goopdateres_ur.dll
c:\programme\GUM9.tmp\goopdateres_vi.dll
c:\programme\GUM9.tmp\goopdateres_zh-CN.dll
c:\programme\GUM9.tmp\goopdateres_zh-TW.dll
c:\programme\GUM9.tmp\npGoogleUpdate3.dll
c:\programme\GUM9.tmp\psmachine.dll
c:\programme\GUM9.tmp\psuser.dll
.
.
(((((((((((((((((((((((((((((((((((((((  Treiber/Dienste  )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_ICQ_SERVICE
-------\Service_ICQ Service
.
.
(((((((((((((((((((((((  Dateien erstellt von 2012-03-05 bis 2012-04-05  ))))))))))))))))))))))))))))))
.
.
2012-04-02 13:51 . 2012-04-02 13:51        2322184        ----a-w-        C:\esetsmartinstaller_enu.exe
2012-04-02 11:58 . 2012-04-02 11:58        3993600        ----a-w-        c:\programme\GUTA.tmp
2012-03-27 13:48 . 2012-04-02 12:32        --------        d-----w-        C:\_OTL
2012-03-27 08:11 . 2012-03-27 08:11        --------        d-----w-        c:\dokumente und einstellungen\Hoschie\Anwendungsdaten\Malwarebytes
2012-03-25 11:29 . 2012-03-25 11:29        --------        d-----w-        c:\programme\ESET
2012-03-23 10:37 . 2012-03-23 10:37        --------        d-----w-        c:\programme\7-Zip
2012-03-21 11:08 . 2012-03-21 11:08        2106216        ----a-w-        c:\programme\Mozilla Firefox\D3DCompiler_43.dll
2012-03-21 11:08 . 2012-03-21 11:08        592824        ----a-w-        c:\programme\Mozilla Firefox\gkmedias.dll
2012-03-21 11:08 . 2012-03-21 11:08        1998168        ----a-w-        c:\programme\Mozilla Firefox\d3dx9_43.dll
2012-03-21 11:08 . 2012-03-21 11:08        44472        ----a-w-        c:\programme\Mozilla Firefox\mozglue.dll
2012-03-21 11:08 . 2012-03-21 11:08        626688        ----a-w-        c:\programme\Mozilla Firefox\msvcr80.dll
2012-03-21 11:08 . 2012-03-21 11:08        548864        ----a-w-        c:\programme\Mozilla Firefox\msvcp80.dll
2012-03-21 11:08 . 2012-03-21 11:08        479232        ----a-w-        c:\programme\Mozilla Firefox\msvcm80.dll
2012-03-20 13:23 . 2012-03-20 13:23        --------        d-----w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\Malwarebytes
2012-03-20 13:23 . 2012-03-20 13:23        --------        d-----w-        c:\programme\Malwarebytes' Anti-Malware
2012-03-20 13:23 . 2011-12-10 14:24        20464        ----a-w-        c:\windows\system32\drivers\mbam.sys
2012-03-17 17:04 . 2012-03-19 10:48        --------        d---a-w-        C:\Kaspersky Rescue Disk 10.0
2012-03-17 15:02 . 2012-04-05 11:25        --------        d-----w-        c:\dokumente und einstellungen\Administrator.DACH
2012-03-13 09:03 . 2012-03-13 09:03        --------        d-----w-        c:\dokumente und einstellungen\Hoschie\Anwendungsdaten\LEGO Company
.
.
.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-02-29 16:39 . 2011-06-06 04:36        414368        ----a-w-        c:\windows\system32\FlashPlayerCPLApp.cpl
2012-02-29 09:08 . 2012-02-29 09:08        72304        ----a-w-        c:\windows\macromix.dll
2012-02-29 09:08 . 2012-02-29 09:08        30544        ----a-w-        c:\windows\dirdib.drv
2012-02-03 09:57 . 2003-06-07 07:28        1860224        ----a-w-        c:\windows\system32\win32k.sys
2012-01-11 19:06 . 2012-02-15 10:06        3072        ------w-        c:\windows\system32\iacenc.dll
2012-01-09 16:20 . 2003-06-07 07:39        139784        ----a-w-        c:\windows\system32\drivers\rdpwd.sys
2012-03-21 11:08 . 2011-06-18 16:34        97208        ----a-w-        c:\programme\mozilla firefox\components\browsercomps.dll
.
.
(((((((((((((((((((((((((((((  SnapShot@2012-04-05_11.26.03  )))))))))))))))))))))))))))))))))))))))))
.
+ 2012-04-05 18:27 . 2012-04-05 18:27        16384              c:\windows\Temp\Perflib_Perfdata_6a0.dat
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2011-12-05 19:17        94208        ----a-w-        c:\dokumente und einstellungen\Hoschie\Anwendungsdaten\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2011-12-05 19:17        94208        ----a-w-        c:\dokumente und einstellungen\Hoschie\Anwendungsdaten\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2011-12-05 19:17        94208        ----a-w-        c:\dokumente und einstellungen\Hoschie\Anwendungsdaten\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2011-12-05 19:17        94208        ----a-w-        c:\dokumente und einstellungen\Hoschie\Anwendungsdaten\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"T-Online_Software_6\WLAN-Access Finder"="c:\programme\T-Online\WLAN-Access Finder\ToWLaAcF.exe" [2008-04-08 671796]
"Steam"="d:\programme\steam\steam.exe" [2011-08-02 1242448]
"swg"="c:\programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-11-03 68856]
"Skype"="c:\programme\Skype\Phone\Skype.exe" [2010-03-09 26100520]
"Octoshape Streaming Services"="c:\dokumente und einstellungen\Hoschie\Anwendungsdaten\Octoshape\Octoshape Streaming Services\OctoshapeClient.exe" [2009-01-08 70936]
"OM2_Monitor"="c:\programme\OLYMPUS\OLYMPUS Master 2\MMonitor.exe" [2009-11-25 95632]
"RayV"="c:\programme\RayV\RayV\RayV.exe" [2010-10-21 2839848]
"AutoStartNPSAgent"="c:\programme\Samsung\Samsung New PC Studio\NPSAgent.exe" [2010-03-30 116056]
"GameXN (update)"="c:\dokumente und einstellungen\All Users\Anwendungsdaten\GameXN\GameXNGO.exe" [2011-09-01 347008]
"GameXN (news)"="c:\dokumente und einstellungen\All Users\Anwendungsdaten\GameXN\GameXNGO.exe" [2011-09-01 347008]
"GameXN"="c:\dokumente und einstellungen\All Users\Anwendungsdaten\GameXN\GameXNGO.exe" [2011-09-01 347008]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-05-03 13529088]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-05-03 86016]
"avgnt"="c:\programme\Avira\AntiVir Desktop\avgnt.exe" [2010-12-13 281768]
"Launch LgDeviceAgent"="c:\programme\Logitech\GamePanel Software\LgDevAgt.exe" [2009-12-10 357384]
"Launch LGDCore"="c:\programme\Logitech\GamePanel Software\G-series Software\LGDCore.exe" [2009-12-10 3203080]
"OM2_Monitor"="c:\programme\OLYMPUS\OLYMPUS Master 2\FirstStart.exe" [2009-11-25 54672]
"QuickTime Task"="c:\programme\QuickTime\QTTask.exe" [2011-07-05 421888]
"SunJavaUpdateSched"="c:\programme\Gemeinsame Dateien\Java\Java Update\jusched.exe" [2011-06-09 254696]
"Adobe Reader Speed Launcher"="c:\programme\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2012-01-03 37296]
"Malwarebytes' Anti-Malware"="c:\programme\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-01-13 460872]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360]
"T-Online_Software_6\WLAN-Access Finder"="c:\programme\T-Online\WLAN-Access Finder\ToWLaAcF.exe" [2008-04-08 671796]
.
c:\dokumente und einstellungen\Hoschie\Startmenü\Programme\Autostart\
CurseClientStartup.ccip [2010-1-26 0]
Dropbox.lnk - c:\dokumente und einstellungen\Hoschie\Anwendungsdaten\Dropbox\bin\Dropbox.exe [2012-2-15 24246216]
Microsoft-Indexerstellung.lnk - c:\programme\Microsoft Office\Office\FINDFAST.EXE [1997-1-17 111376]
Office-Start.lnk - c:\programme\Microsoft Office\Office\OSA.EXE [1997-1-17 51984]
.
c:\dokumente und einstellungen\All Users\Startmenü\Programme\Autostart\
Logitech SetPoint.lnk - c:\programme\Logitech\SetPoint\SetPoint.exe [2008-10-2 671744]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2012-01-02 09:07        843712        ----a-r-        c:\programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AGRSMMSG]
2003-02-14 09:59        88107        ----a-w-        c:\windows\AGRSMMSG.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2011-08-18 23:07        421736        ----a-w-        c:\programme\iTunes\iTunesHelper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Kernel and Hardware Abstraction Layer]
2006-07-19 10:03        94208        ----a-w-        c:\windows\KHALMNPR.Exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Logitech Hardware Abstraction Layer]
2006-07-19 10:03        94208        ----a-w-        c:\windows\KHALMNPR.Exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
2008-05-03 03:46        1630208        ----a-w-        c:\windows\system32\nwiz.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"npggsvc"=3 (0x3)
"iPod Service"=3 (0x3)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"d:\\Spiele\\World of Warcraft\\BackgroundDownloader.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"d:\\Programme\\Steam\\SteamApps\\hoschiebaer\\team fortress 2\\hl2.exe"=
"d:\\Programme\\SopCast\\SopCast.exe"=
"d:\\Programme\\SopCast\\adv\\SopAdver.exe"=
"d:\\Programme\\TVUPlayer\\TVUPlayer.exe"=
"c:\\Programme\\Mozilla Firefox\\firefox.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"c:\\Programme\\VentSrv\\ventrilo_srv.exe"=
"c:\\Programme\\Ventrilo\\Ventrilo.exe"=
"d:\\Spiele\\World of Warcraft\\Launcher.exe"=
"d:\\Spiele\\World of Warcraft\\WoW-3.1.3.9947-to-3.2.0.10192-deDE-downloader.exe"=
"d:\\Spiele\\World of Warcraft\\WoW-3.2.0.10192-to-3.2.0.10314-deDE-downloader.exe"=
"c:\\Dokumente und Einstellungen\\Hoschie\\Anwendungsdaten\\Octoshape\\Octoshape Streaming Services\\OctoshapeClient.exe"=
"d:\\Spiele\\World of Warcraft\\WoW-3.2.0.10314-to-3.2.2.10482-deDE-downloader.exe"=
"d:\\Spiele\\World of Warcraft\\WoW-3.2.2.10482-to-3.2.2.10505-deDE-downloader.exe"=
"c:\\Programme\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Programme\\Messenger\\msmsgs.exe"=
"c:\\Programme\\ICQ7.2\\ICQ.exe"=
"c:\\Programme\\ICQ7.2\\aolload.exe"=
"c:\\Programme\\RayV\\RayV\\RayV.exe"=
"c:\\Programme\\RayV\\RayV\\RayV.dll"=
"d:\\Programme\\Steam\\steam.exe"=
"c:\\Programme\\Samsung\\Samsung New PC Studio\\npsasvr.exe"=
"c:\\Programme\\Samsung\\Samsung New PC Studio\\npsvsvr.exe"=
"c:\\Programme\\Mozilla Firefox\\plugin-container.exe"=
"c:\\Programme\\Gemeinsame Dateien\\Apple\\Apple Application Support\\WebKit2WebProcess.exe"=
"c:\\Programme\\Bonjour\\mDNSResponder.exe"=
"c:\\Programme\\iTunes\\iTunes.exe"=
"c:\\Dokumente und Einstellungen\\Hoschie\\Anwendungsdaten\\Dropbox\\bin\\Dropbox.exe"=
"d:\\Spiele\\Warcraft III\\Warcraft III.exe"=
"c:\\Programme\\Pando Networks\\Media Booster\\PMB.exe"=
"d:\\Programme\\Steam\\SteamApps\\common\\killingfloor\\System\\KillingFloor.exe"=
"c:\\Dokumente und Einstellungen\\Hoschie\\Anwendungsdaten\\RayV\\Viewer\\RayV.dll"=
"d:\\Programme\\Steam\\SteamApps\\hoschiebaer\\day of defeat source\\hl2.exe"=
"c:\\Dokumente und Einstellungen\\Hoschie\\Lokale Einstellungen\\Apps\\2.0\\JCTV778O.98G\\VK2G3LGH.RTV\\curs..tion_eee711038731a406_0004.0000_2bd39706d04e72c8\\CurseClient.exe"=
"c:\\Programme\\Skype\\Phone\\Skype.exe"=
.
R2 AntiVirSchedulerService;Avira AntiVir Planer;c:\programme\Avira\AntiVir Desktop\sched.exe [19.08.2009 20:42 136360]
R2 LBeepKE;LBeepKE;c:\windows\system32\drivers\LBeepKE.sys [02.10.2008 10:59 3712]
R2 MBAMService;MBAMService;c:\programme\Malwarebytes' Anti-Malware\mbamservice.exe [20.03.2012 15:23 652360]
R2 MZCCntrl;T-Online WLAN Adapter Steuerungsdienst;c:\programme\Gemeinsame Dateien\Marmiko Shared\MZCCntrl.exe [07.07.2008 12:59 61440]
R3 MACNDIS5;MACNDIS5 NDIS Protocol Driver;c:\progra~1\GEMEIN~1\MARMIK~1\MACNDIS5.SYS [07.07.2008 12:59 17280]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [20.03.2012 15:23 20464]
S2 gupdate;Google Update Service (gupdate);c:\programme\Google\Update\GoogleUpdate.exe [04.03.2010 18:57 135664]
S3 gupdatem;Google Update-Dienst (gupdatem);c:\programme\Google\Update\GoogleUpdate.exe [04.03.2010 18:57 135664]
S3 MIINPazX;MIINPazX NDIS Protocol Driver;c:\progra~1\GEMEIN~1\MARMIK~1\MInfraIS\MIINPazX.SYS [07.07.2008 12:59 17152]
S4 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des -service --> c:\windows\system32\GameMon.des -service [?]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
tapisrv        REG_MULTI_SZ          Tapisrv
.
Inhalt des "geplante Tasks" Ordners
.
2012-03-14 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\programme\Apple Software Update\SoftwareUpdate.exe [2011-06-01 15:57]
.
2012-04-05 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\programme\Google\Update\GoogleUpdate.exe [2010-03-04 16:57]
.
2012-04-05 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\programme\Google\Update\GoogleUpdate.exe [2010-03-04 16:57]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.google.com
mStart Page = hxxp://www.google.com
uInternet Connection Wizard,ShellNext = hxxp://www.t-online.de/service/redir/tosw6_sc_webtour.htm
uInternet Settings,ProxyOverride = *.local
IE: Google Sidewiki... - c:\programme\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_D183CA64F05FDD98.dll/cmsidewiki.html
Trusted Zone: sony-europe.com
Trusted Zone: sonystyle-europe.com
Trusted Zone: vaio-link.com
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\dokumente und einstellungen\Hoschie\Anwendungsdaten\Mozilla\Firefox\Profiles\cvljn78f.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - about:home
FF - prefs.js: keyword.URL - hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.1.6&q=
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2012-04-05 20:29
Windows 5.1.2600 Service Pack 3 NTFS
.
Scanne versteckte Prozesse...
.
Scanne versteckte Autostarteinträge...
.
Scanne versteckte Dateien...
.
Scan erfolgreich abgeschlossen
versteckte Dateien: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\npggsvc]
"ImagePath"="c:\windows\system32\GameMon.des -service"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\S-1-5-21-3043918641-1562116810-1089896837-1005\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------
.
- - - - - - - > 'explorer.exe'(3336)
c:\programme\Logitech\SetPoint\GameHook.dll
c:\programme\Logitech\SetPoint\lgscroll.dll
c:\dokumente und einstellungen\Hoschie\Anwendungsdaten\Dropbox\bin\DropboxExt.14.dll
c:\progra~1\WINDOW~2\wmpband.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\programme\Avira\AntiVir Desktop\avguard.exe
c:\programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\programme\Bonjour\mDNSResponder.exe
c:\programme\Java\jre6\bin\jqs.exe
c:\programme\Avira\AntiVir Desktop\avshadow.exe
c:\programme\CDBurnerXP\NMSAccessU.exe
c:\windows\system32\nvsvc32.exe
c:\windows\system32\PnkBstrA.exe
c:\windows\system32\RUNDLL32.EXE
c:\programme\Gemeinsame Dateien\Marmiko Shared\MWLaMaS.exe
c:\windows\Microsoft.NET\Framework\v2.0.50727\dfsvc.exe
c:\programme\Gemeinsame Dateien\Logitech\khalshared\KHALMNPR.EXE
c:\programme\Skype\Plugin Manager\skypePM.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2012-04-05  20:36:53 - PC wurde neu gestartet
ComboFix-quarantined-files.txt  2012-04-05 18:36
ComboFix2.txt  2012-04-05 11:28
.
Vor Suchlauf: 5.187.276.800 Bytes frei
Nach Suchlauf: 5.076.221.952 Bytes frei
.
- - End Of File - - A5EA10E5FDA8F5D4986670789195EED8

cosinus 05.04.2012 20:29
Bitte nun Logs mit GMER und OSAM erstellen und posten.
GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus - die Online-Abfrage durch OSAM bitte überspringen.
Bei OSAM bitte darauf auch achten, dass Du das Log auch als *.log und nicht *.html oder so abspeicherst.

Hinweis: Zum Entpacken von OSAM bitte WinRAR oder 7zip verwenden! Stell auch unbedingt den Virenscanner ab, besonders der Scanner von McAfee meldet oft einen Fehalarm in OSAM!

Downloade dir bitte aswMBR.exe und speichere die Datei auf deinem Desktop.
  • Starte die aswMBR.exe - (aswMBR.exe Anleitung)
    Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten".
  • Das Tool wird dich fragen, ob Du mit der aktuellen Virendefinition von AVAST! dein System scannen willst. Beantworte diese Frage bitte mit Ja. (Sollte deine Firewall fragen, bitte den Zugriff auf das Internet zulassen )
    Der Download der Definitionen kann je nach Verbindung eine Weile dauern.
  • Klicke auf Scan.
  • Warte bitte bis Scan finished successfully im DOS-Fenster steht.
  • Drücke auf Save Log und speichere diese auf dem Desktop.
Poste mir die aswMBR.txt in deiner nächsten Antwort.

Wichtig: Drücke keinesfalls einen der Fix Buttons ohne Anweisung

Hinweis: Sollte der Scan Button ausgeblendet sein, schließe das Tool und starte es erneut. Sollte der Scan abbrechen und das Programm abstürzen, dann teile mir das mit und wähle unter AV Scan die Einstellung (none).



Noch ein Hinweis: Sollte aswMBR abstürzen und es kommt eine Meldung wie "aswMBR.exe funktioniert nicht mehr, dann mach Folgendes:
Starte aswMBR neu, wähle unten links im Drop-Down-Menü (unten links im Fenster von aswMBR) bei "AV scan" (none) aus und klick nochmal auf den Scan-Button.

petetheheat 06.04.2012 12:45
Gmer hat bei mir nicht wirklich funktioniert.

Osam

Code:
Report of OSAM: Autorun Manager v5.0.11926.0
hxxp://www.online-solutions.ru/en/
Saved at 13:13:20 on 06.04.2012

OS: Windows XP Home Edition Service Pack 3 (Build 2600)
Default Browser: Mozilla Corporation Firefox 11.0

Scanner Settings
[x] Rootkits detection (hidden registry)
[x] Rootkits detection (hidden files)
[x] Retrieve files information
[x] Check Microsoft signatures

Filters
[ ] Trusted entries
[ ] Empty entries
[x] Hidden registry entries (rootkit activity)
[x] Exclusively opened files
[x] Not found files
[x] Files without detailed information
[x] Existing files
[ ] Non-startable services
[ ] Non-startable drivers
[x] Active entries
[x] Disabled entries


[Control Panel Objects]
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )-----
"Pando" - "Pando Networks" - C:\Programme\Pando Networks\Media Booster\PMB.cpl
"QuickTime" - "Apple Inc." - C:\Programme\QuickTime\QTSystem\QuickTime.cpl

[Drivers]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"avgio" (avgio) - "Avira GmbH" - C:\Programme\Avira\AntiVir Desktop\avgio.sys
"avgntflt" (avgntflt) - "Avira GmbH" - C:\WINDOWS\System32\DRIVERS\avgntflt.sys
"avipbb" (avipbb) - "Avira GmbH" - C:\WINDOWS\System32\DRIVERS\avipbb.sys
"catchme" (catchme) - ? - C:\ComboFix\catchme.sys  (File not found)
"Changer" (Changer) - ? - C:\WINDOWS\system32\drivers\Changer.sys  (File not found)
"i2omgmt" (i2omgmt) - ? - C:\WINDOWS\system32\drivers\i2omgmt.sys  (File not found)
"LBeepKE" (LBeepKE) - "Logitech Inc." - C:\WINDOWS\System32\Drivers\LBeepKE.sys
"lbrtfdc" (lbrtfdc) - ? - C:\WINDOWS\system32\drivers\lbrtfdc.sys  (File not found)
"MACNDIS5 NDIS Protocol Driver" (MACNDIS5) - "Marmiko IT-Solutions GmbH" - C:\PROGRA~1\GEMEIN~1\MARMIK~1\MACNDIS5.SYS
"MagicTune" (MagicTune) - ? - C:\WINDOWS\System32\drivers\MTiCtwl.sys  (File found, but it contains no detailed information)
"MBAMProtector" (MBAMProtector) - "Malwarebytes Corporation" - C:\WINDOWS\system32\drivers\mbam.sys
"MIINPazX NDIS Protocol Driver" (MIINPazX) - "Deutsche Telekom AG, Marmiko IT-Solutions GmbH" - C:\PROGRA~1\GEMEIN~1\MARMIK~1\MInfraIS\MIINPazX.SYS
"PCIDump" (PCIDump) - ? - C:\WINDOWS\system32\drivers\PCIDump.sys  (File not found)
"PDCOMP" (PDCOMP) - ? - C:\WINDOWS\system32\drivers\PDCOMP.sys  (File not found)
"PDFRAME" (PDFRAME) - ? - C:\WINDOWS\system32\drivers\PDFRAME.sys  (File not found)
"PDRELI" (PDRELI) - ? - C:\WINDOWS\system32\drivers\PDRELI.sys  (File not found)
"PDRFRAME" (PDRFRAME) - ? - C:\WINDOWS\system32\drivers\PDRFRAME.sys  (File not found)
"ssmdrv" (ssmdrv) - "Avira GmbH" - C:\WINDOWS\System32\DRIVERS\ssmdrv.sys
"StarForce Protection Environment Driver (version 1.x)" (sfdrv01) - "Protection Technology" - C:\WINDOWS\System32\drivers\sfdrv01.sys
"StarForce Protection Helper Driver (version 2.x)" (sfhlp02) - "Protection Technology" - C:\WINDOWS\System32\drivers\sfhlp02.sys
"StarForce Protection VFS Driver (version 2.x)" (sfvfs02) - "Protection Technology" - C:\WINDOWS\System32\drivers\sfvfs02.sys
"WDICA" (WDICA) - ? - C:\WINDOWS\system32\drivers\WDICA.sys  (File not found)

[Explorer]
-----( HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----
{FB314ED9-A251-47B7-93E1-CDD82E34AF8B} "DropboxExt" - ? -  (File not found | COM-object registry key not found)
{FB314EDA-A251-47B7-93E1-CDD82E34AF8B} "DropboxExt" - ? -  (File not found | COM-object registry key not found)
{FB314EDB-A251-47B7-93E1-CDD82E34AF8B} "DropboxExt" - ? -  (File not found | COM-object registry key not found)
{FB314EDC-A251-47B7-93E1-CDD82E34AF8B} "DropboxExt" - ? -  (File not found | COM-object registry key not found)
-----( HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components )-----
{89B4C1CD-B018-4511-B0A1-5476DBF70820} "StubPath" - "Microsoft Corporation" - C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install
-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----
{C9E60ED7-FEAE-477b-B6A6-7D62103A0C6B} "NeroDigitalColumnHandler Class" - ? - C:\Programme\Gemeinsame Dateien\Nero\SMC\NeroDigitalExt.dll  (File not found)
{F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\PDFShell.dll
-----( HKLM\Software\Classes\Protocols\Filter )-----
{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll
{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll
{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll
-----( HKLM\Software\Classes\Protocols\Handler )-----
{FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} "IEProtocolHandler Class" - "Skype Technologies" - C:\PROGRA~1\GEMEIN~1\Skype\SKYPE4~1.DLL
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----
{23170F69-40C1-278A-1000-000100020000} "7-Zip Shell Extension" - "Igor Pavlov" - C:\Programme\7-Zip\7-zip.dll
{42071714-76d4-11d1-8b24-00a0c9068ff3} "CPL-Erweiterung für Anzeigeverschiebung" - ? -  (File not found | COM-object registry key not found)
{1CDB2949-8F65-4355-8456-263E7C208A5D} "Desktop Explorer" - "NVIDIA Corporation" - C:\WINDOWS\system32\nvshell.dll
{1E9B04FB-F9E5-4718-997B-B8DA88302A47} "Desktop Explorer Menu" - "NVIDIA Corporation" - C:\WINDOWS\system32\nvshell.dll
{1D2680C9-0E2A-469d-B787-065558BC7D43} "Fusion Cache" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll
{B9E1D2CB-CCFF-4AA6-9579-D7A4754030EF} "iTunes" - "Apple Inc." - C:\Programme\iTunes\iTunesMiniPlayer.dll
{DC70C4A5-2044-4c59-B806-DEFB9AE0DF7C} "KbLogiExt Class" - "Logitech Inc." - C:\Programme\Logitech\SetPoint\kbcplext.dll
{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA} "Kontextmenü für die Verschlüsselung" - ? -  (File not found | COM-object registry key not found)
{B9B9F083-2B04-452A-8691-83694AC1037B} "LogiExt Class" - "Logitech Inc." - C:\Programme\Logitech\SetPoint\mcplext.dll
{32683183-48a0-441b-a342-7c2a440a9478} "Media Band" - ? -  (File not found | COM-object registry key not found)
{97F68CE3-7146-45FF-BE24-D9A7DD7CB8A2} "NeroCoverEdLiveIcons Class" - "Nero AG" - C:\Programme\Nero\Nero 9\Nero CoverDesigner\CoverEdExtension.dll
{C9E60ED7-FEAE-477b-B6A6-7D62103A0C6B} "NeroDigitalColumnHandler Class" - ? - C:\Programme\Gemeinsame Dateien\Nero\SMC\NeroDigitalExt.dll  (File not found)
{1CA6BBC9-E9FA-4021-822B-075DF1837B63} "NeroDigitalIconHandler Class" - ? - C:\Programme\Gemeinsame Dateien\Nero\SMC\NeroDigitalExt.dll  (File not found)
{4FBFFA8D-F390-471a-AE46-FEB93623AD63} "NeroDigitalInfoHandler Class" - ? - C:\Programme\Gemeinsame Dateien\Nero\SMC\NeroDigitalExt.dll  (File not found)
{846083A4-BFC6-4447-985C-6578B466A7D7} "NeroDigitalPropSheetHandler Class" - ? - C:\Programme\Gemeinsame Dateien\Nero\SMC\NeroDigitalExt.dll  (File not found)
{EDCC595A-F0EE-4d81-B554-D5D01C7AFB87} "NeroDigitalThumbnailHandler Class" - ? - C:\Programme\Gemeinsame Dateien\Nero\SMC\NeroDigitalExt.dll  (File not found)
{1E9B04FB-F9E5-4718-997B-B8DA88302A48} "nView Desktop Context Menu" - "NVIDIA Corporation" - C:\WINDOWS\system32\nvshell.dll
{45AC2688-0253-4ED8-97DE-B5370FA7D48A} "Shell Extension for Malware scanning" - "Avira GmbH" - C:\Programme\Avira\AntiVir Desktop\shlext.dll
{E37E2028-CE1A-4f42-AF05-6CEABC4E5D75} "Shell Icon Handler for Application References" - "Microsoft Corporation" - C:\WINDOWS\system32\dfshim.dll
{764BF0E1-F219-11ce-972D-00AA00A14F56} "Shellerweiterungen für die Dateikomprimierung" - ? -  (File not found | COM-object registry key not found)
{e82a2d71-5b2f-43a0-97b8-81be15854de8} "ShellLink for Application References" - "Microsoft Corporation" - C:\WINDOWS\system32\dfshim.dll
{B41DB860-8EE4-11D2-9906-E49FADC173CA} "WinRAR" - ? - C:\Programme\WinRAR\rarext.dll  (File found, but it contains no detailed information)

[Internet Explorer]
-----( HKCU\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars )-----
{32683183-48a0-441b-a342-7c2a440a9478} "{32683183-48a0-441b-a342-7c2a440a9478}" - ? -  (File not found | COM-object registry key not found)
-----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )-----
<binary data> "Google Toolbar" - "Google Inc." - C:\Programme\Google\Google Toolbar\GoogleToolbar_32.dll
<binary data> "ITBar7Layout" - ? -  (File not found | COM-object registry key not found)
<binary data> "ITBarLayout" - ? -  (File not found | COM-object registry key not found)
<binary data> "{EE5D279F-081B-4404-994D-C6B60AAEBA6D}" - ? -  (File not found | COM-object registry key not found)
-----( HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks )-----
 "{855F3B16-6D32-4fe6-8A56-BBB695989046}" - ? -  (File not found | COM-object registry key not found)
{855F3B16-6D32-4fe6-8A56-BBB695989046} "{855F3B16-6D32-4fe6-8A56-BBB695989046}" - ? -  (File not found | COM-object registry key not found)
-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----
DirectAnimation Java Classes "DirectAnimation Java Classes" - ? -  (File not found | COM-object registry key not found) / file://C:\WINDOWS\Java\classes\dajava.cab
{8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.6.0_29" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\npjpi160_29.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab
{CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} "Java Plug-in 1.6.0_29" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\npjpi160_29.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab
{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_29" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\npjpi160_29.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab
Microsoft XML Parser for Java "Microsoft XML Parser for Java" - ? -  (File not found | COM-object registry key not found) / file://C:\WINDOWS\Java\classes\xmldso.cab
{D27CDB6E-AE6D-11CF-96B8-444553540000} "Shockwave Flash Object" - "Adobe Systems, Inc." - C:\WINDOWS\system32\Macromed\Flash\Flash10b.ocx / hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----
{53707962-6F74-2D53-2644-206D7942484F} "ClsidExtension" - ? -  (File not found | COM-object registry key not found)
"ICQ7.2" - "ICQ, LLC." - C:\Programme\ICQ7.2\ICQ.exe
-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar )-----
<binary data> "Google Toolbar" - "Google Inc." - C:\Programme\Google\Google Toolbar\GoogleToolbar_32.dll
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----
{AA58ED58-01DD-4d91-8333-CF10577473F7} "Google Toolbar Helper" - "Google Inc." - C:\Programme\Google\Google Toolbar\GoogleToolbar_32.dll
{AF69DE43-7D58-4638-B6FA-CE66B5AD205D} "Google Toolbar Notifier BHO" - "Google Inc." - C:\Programme\Google\GoogleToolbarNotifier\5.7.7227.1100\swg.dll
{DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\jp2ssv.dll
{E7E6F031-17CE-4C07-BC86-EABFE594F69C} "JQSIEStartDetectorImpl Class" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
{18DF081C-E8AD-4283-A596-FA578C2EBDC3} "{18DF081C-E8AD-4283-A596-FA578C2EBDC3}" - ? -  (File not found | COM-object registry key not found)
{53707962-6F74-2D53-2644-206D7942484F} "{53707962-6F74-2D53-2644-206D7942484F}" - ? -  (File not found | COM-object registry key not found)
{E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} "{E99421FB-68DD-40F0-B4AC-B7027CAE2F1A}" - ? -  (File not found | COM-object registry key not found)

[Logon]
-----( HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run )-----
"AutoStartNPSAgent" - "Samsung Electronics Co., Ltd." - C:\Programme\Samsung\Samsung New PC Studio\NPSAgent.exe
"GameXN" - "EasyBits Software AS" - "C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\GameXN\GameXNGO.exe" /silent
"GameXN (news)" - "EasyBits Software AS" - "C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\GameXN\GameXNGO.exe" /n
"GameXN (update)" - "EasyBits Software AS" - "C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\GameXN\GameXNGO.exe" /u
"Octoshape Streaming Services" - "Octoshape ApS" - "C:\Dokumente und Einstellungen\Hoschie\Anwendungsdaten\Octoshape\Octoshape Streaming Services\OctoshapeClient.exe" -inv:bootrun
"OM2_Monitor" - "OLYMPUS IMAGING CORP." - "C:\Programme\OLYMPUS\OLYMPUS Master 2\MMonitor.exe" -NoStart
"RayV" - "RayV" - C:\Programme\RayV\RayV\RayV.exe /background
"Skype" - "Skype Technologies S.A." - "C:\Programme\Skype\Phone\Skype.exe" /nosplash /minimized
"Steam" - "Valve Corporation" - "d:\programme\steam\steam.exe" -silent
"swg" - "Google Inc." - "C:\Programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
"T-Online_Software_6\WLAN-Access Finder" - "Deutsche Telekom AG, Marmiko IT-Solutions GmbH" - C:\Programme\T-Online\WLAN-Access Finder\ToWLaAcF.exe /StartMinimized
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----
"Adobe Reader Speed Launcher" - "Adobe Systems Incorporated" - "C:\Programme\Adobe\Reader 9.0\Reader\Reader_sl.exe"
"avgnt" - "Avira GmbH" - "C:\Programme\Avira\AntiVir Desktop\avgnt.exe" /min
"Launch LGDCore" - "Logitech Inc." - "C:\Programme\Logitech\GamePanel Software\G-series Software\LGDCore.exe" /SHOWHIDE
"Launch LgDeviceAgent" - "Logitech Inc." - "C:\Programme\Logitech\GamePanel Software\LgDevAgt.exe"
"Malwarebytes' Anti-Malware" - "Malwarebytes Corporation" - "C:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
"OM2_Monitor" - "OLYMPUS IMAGING CORP." - "C:\Programme\OLYMPUS\OLYMPUS Master 2\FirstStart.exe" /OM
"QuickTime Task" - "Apple Inc." - "C:\Programme\QuickTime\QTTask.exe" -atboottime
"SunJavaUpdateSched" - "Sun Microsystems, Inc." - "C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe"

[Services]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
".NET Runtime Optimization Service v2.0.50727_X86" (clr_optimization_v2.0.50727_32) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
"Anwendungsverwaltung" (AppMgmt) - ? - C:\WINDOWS\System32\appmgmts.dll  (File not found)
"Apple Mobile Device" (Apple Mobile Device) - "Apple Inc." - C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe
"ASP.NET-Zustandsdienst" (aspnet_state) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
"Avira AntiVir Guard" (AntiVirService) - "Avira GmbH" - C:\Programme\Avira\AntiVir Desktop\avguard.exe
"Avira AntiVir Planer" (AntiVirSchedulerService) - "Avira GmbH" - C:\Programme\Avira\AntiVir Desktop\sched.exe
"Dienst "Bonjour"" (Bonjour Service) - "Apple Inc." - C:\Programme\Bonjour\mDNSResponder.exe
"Google Software Updater" (gusvc) - "Google" - C:\Programme\Google\Common\Google Updater\GoogleUpdaterService.exe
"Google Update Service (gupdate)" (gupdate) - "Google Inc." - C:\Programme\Google\Update\GoogleUpdate.exe
"Google Update-Dienst (gupdatem)" (gupdatem) - "Google Inc." - C:\Programme\Google\Update\GoogleUpdate.exe
"Java Quick Starter" (JavaQuickStarterService) - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\jqs.exe
"MBAMService" (MBAMService) - "Malwarebytes Corporation" - C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe
"NMSAccessU" (NMSAccessU) - ? - C:\Programme\CDBurnerXP\NMSAccessU.exe  (File found, but it contains no detailed information)
"PnkBstrA" (PnkBstrA) - ? - C:\WINDOWS\system32\PnkBstrA.exe  (File found, but it contains no detailed information)
"T-Online WLAN Adapter Steuerungsdienst" (MZCCntrl) - "Deutsche Telekom AG, Marmiko IT-Solutions GmbH" - C:\Programme\Gemeinsame Dateien\Marmiko Shared\MZCCntrl.exe
"Windows CardSpace" (idsvc) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
"Windows Presentation Foundation Font Cache 3.0.0.0" (FontCache3.0.0.0) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe

[Winlogon]
-----( HKCU\Control Panel\IOProcs )-----
"MVB" - ? - mvfs32.dll  (File not found)
-----( HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions )-----
{c6dc5466-785a-11d2-84d0-00c04fb169f7} "Softwareinstallation" - ? - appmgmts.dll  (File not found)

[Winsock Providers]
-----( HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries )-----
"mdnsNSP" - "Apple Inc." - C:\Programme\Bonjour\mdnsNSP.dll

===[ Logfile end ]=========================================[ Logfile end ]===

If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru
Aswmbr

Code:
aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software
Run date: 2012-04-06 13:14:15
-----------------------------
13:14:15.875    OS Version: Windows 5.1.2600 Service Pack 3
13:14:15.875    Number of processors: 2 586 0x209
13:14:15.890    ComputerName: DACH  UserName:
13:14:16.296    Initialize success
13:16:55.703    AVAST engine defs: 12040600
13:16:59.828    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3
13:16:59.828    Disk 0 Vendor: WDC_WD1200BB-22DAA0 65.13G65 Size: 114473MB BusType: 3
13:16:59.843    Disk 0 MBR read successfully
13:16:59.843    Disk 0 MBR scan
13:16:59.875    Disk 0 Windows XP default MBR code
13:16:59.875    Disk 0 Partition 1 80 (A) 07    HPFS/NTFS NTFS        28615 MB offset 63
13:16:59.875    Disk 0 Partition - 00    0F Extended LBA            85855 MB offset 58605120
13:16:59.875    Disk 0 Partition 2 00    07    HPFS/NTFS NTFS        85855 MB offset 58605183
13:16:59.890    Disk 0 scanning sectors +234436545
13:16:59.953    Disk 0 scanning C:\WINDOWS\system32\drivers
13:17:10.937    Service scanning
13:17:19.953    Service npggsvc C:\WINDOWS\system32\GameMon.des **INFECTED** Win32:Malware-gen
13:17:27.328    Modules scanning
13:17:33.750    Disk 0 trace - called modules:
13:17:33.765    ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys pciide.sys PCIIDEX.SYS
13:17:33.765    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x8a68eab8]
13:17:33.765    3 CLASSPNP.SYS[f7657fd7] -> nt!IofCallDriver -> \Device\00000060[0x8a693510]
13:17:33.765    5 ACPI.sys[f75ad620] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-3[0x8a62c940]
13:17:34.125    AVAST engine scan C:\WINDOWS
13:17:55.593    AVAST engine scan C:\WINDOWS\system32
13:18:35.921    File: C:\WINDOWS\system32\GameMon.des  **INFECTED** Win32:Malware-gen
13:21:21.578    AVAST engine scan C:\WINDOWS\system32\drivers
13:21:39.437    AVAST engine scan C:\Dokumente und Einstellungen\Hoschie
13:28:40.234    AVAST engine scan C:\Dokumente und Einstellungen\All Users
13:30:04.156    Scan finished successfully
13:42:21.250    Disk 0 MBR has been saved successfully to "C:\Dokumente und Einstellungen\Hoschie\Desktop\MBR.dat"
13:42:21.250    The log file has been saved successfully to "C:\Dokumente und Einstellungen\Hoschie\Desktop\aswMBR.txt"

cosinus 06.04.2012 14:53
Scheint ok zu sein alles

Zitat:
Service npggsvc C:\WINDOWS\system32\GameMon.des **INFECTED** Win32:Malware-gen
Das sieht mir eher nach einem Fehlalarm aus, werte die bemängelt Datei C:\WINDOWS\system32\GameMon.des bitte mal bei Virustotal aus und poste den Ergebnislink

petetheheat 06.04.2012 19:55
https://www.virustotal.com/file/a282fdbbdf22b2b66f72d25ba212732507d32ffc326e5ca049397f927e90be52/analysis/

cosinus 06.04.2012 20:38
Zitat:
Analysis date: 2010-11-02 15:24:11 UTC ( 1 Jahr, 5 Monate ago )
Du musst die Datei neu scannen lassen!!!

petetheheat 06.04.2012 21:09
hoppla, dann eben so:

https://www.virustotal.com/file/a282fdbbdf22b2b66f72d25ba212732507d32ffc326e5ca049397f927e90be52/analysis/1333742877/

cosinus 06.04.2012 21:16
Das ist das hier => nProtect GameGuard
Warum das so viele als Malware einstufen weiß ich nicht.
Du kannst die Datei mal umbenennen zB in GameMon.des.VIR nd beobachten ob irgendwelche Spiele nicht mehr richtig laufen. Aber ich glaub nicht, dass diese Datei bösartig ist.


Sieht ok aus. Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SASW und poste die Logs.
Denk dran beide Tools zu updaten vor dem Scan!!

petetheheat 07.04.2012 13:21
Malwarebytes:

Code:
Malwarebytes Anti-Malware 1.60.1.1000
www.malwarebytes.org

Database version: v2012.04.07.02

Windows XP Service Pack 3 x86 NTFS
Internet Explorer 7.0.5730.13
Hoschie :: DACH [administrator]

Protection: Enabled

07.04.2012 11:16:26
mbam-log-2012-04-07 (11-16-26).txt

Scan type: Full scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 366032
Time elapsed: 2 hour(s), 26 minute(s), 59 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)
malwarebytes hat aber zwischendurch die meldung über eine datei im moved-files unterordner von otl gepiepst - log find ich aber darüber keines.

Superantispyware lasse ich jetzt anschließend durchlaufen - log folgt.


Alle Zeitangaben in WEZ +1. Es ist jetzt 06:59 Uhr.
Seite 3 von 4 12 3 4
100 Beiträge dieses Themas auf einer Seite anzeigen

Copyright ©2000-2024, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129