Trojaner-Board - smart fortress 2012, wie entfernen?

Trojaner-Board (https://www.trojaner-board.de/)

- Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)

- - smart fortress 2012, wie entfernen? (https://www.trojaner-board.de/113643-smart-fortress-2012-entfernen.html)

Dann bitte jetzt CF ausführen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix

Lade dir ComboFix hier herunter auf deinen Desktop.

Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.

Starte combofix.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.

Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.

Wichtiger Hinweis:

Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!

Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

Solltest du nach der Ausführung von Combofix Probleme beim Starten von Anwendungen haben und Meldungen erhalten wie

Zitat:

Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.

startest du Windows dann manuell neu und die Fehlermeldungen sollten nicht mehr auftauchen.

ComboFix habe ich ausgeführt. Jetzt habe ich auf dem Desktop dort wo das Symbol von Combofix war das Symbol vom IE. Kann ich das einfach löschen und warum wurde das dort erstellt?

Hier das Log

Combofix Logfile:

Code:

ComboFix 12-04-19.01 - Janet 19.04.2012  19:09:20.1.2 - x86

Microsoft® Windows Vista™ Home Premium   6.0.6002.2.1252.49.1031.18.2047.1132 [GMT 2:00]

ausgeführt von:: c:\users\Janet\Desktop\ComboFix.exe

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

C:\Install.exe

c:\windows\security\Database\tmp.edb

c:\windows\unin0407.exe

.

.

(((((((((((((((((((((((   Dateien erstellt von 2012-03-19 bis 2012-04-19  ))))))))))))))))))))))))))))))

.

.

2012-04-19 19:11 . 2012-04-19 19:11        --------        d-----w-        c:\users\Janet\AppData\Local\temp

2012-04-19 19:11 . 2012-04-19 19:11        --------        d-----w-        c:\users\Default\AppData\Local\temp

2012-04-17 18:21 . 2012-04-17 18:21        --------        d-----w-        C:\_OTL

2012-04-16 16:23 . 2012-02-28 01:58        141112        ----a-w-        c:\program files\Internet Explorer\sqmapi.dll

2012-04-16 16:23 . 2012-02-28 01:08        194048        ----a-w-        c:\program files\Internet Explorer\IEShims.dll

2012-04-16 16:23 . 2012-02-28 01:13        678912        ----a-w-        c:\program files\Internet Explorer\iedvtool.dll

2012-04-15 23:30 . 2012-02-13 13:44        1068544        ----a-w-        c:\windows\system32\DWrite.dll

2012-04-15 23:30 . 2012-02-14 15:45        219648        ----a-w-        c:\windows\system32\d3d10_1core.dll

2012-04-15 23:30 . 2012-02-13 14:12        1172480        ----a-w-        c:\windows\system32\d3d10warp.dll

2012-04-15 23:30 . 2012-02-14 15:45        160768        ----a-w-        c:\windows\system32\d3d10_1.dll

2012-04-15 23:30 . 2012-02-13 13:47        683008        ----a-w-        c:\windows\system32\d2d1.dll

2012-04-15 20:41 . 2012-04-15 20:41        --------        d-----w-        c:\program files\ESET

2012-04-15 17:58 . 2012-04-15 17:58        --------        d-----w-        c:\program files\Windows Portable Devices

2012-04-15 16:24 . 2009-10-01 01:02        31232        ----a-w-        c:\windows\system32\BthMtpContextHandler.dll

2012-04-15 16:24 . 2009-10-01 01:01        40448        ----a-w-        c:\windows\system32\drivers\WpdUsb.sys

2012-04-15 16:24 . 2009-10-01 01:01        839168        ----a-w-        c:\windows\system32\drivers\UMDF\WpdMtpDr.dll

2012-04-15 16:12 . 2012-02-29 13:32        12800        ----a-w-        c:\windows\system32\drivers\fs_rec.sys

2012-04-15 15:32 . 2012-04-15 15:32        486400        ----a-w-        c:\windows\system32\d3d10level9.dll

2012-04-15 15:32 . 2012-04-15 15:32        638336        ----a-w-        c:\windows\system32\drivers\dxgkrnl.sys

2012-04-15 15:32 . 2012-04-15 15:32        478720        ----a-w-        c:\windows\system32\dxgi.dll

2012-04-15 15:32 . 2012-04-15 15:32        37376        ----a-w-        c:\windows\system32\cdd.dll

2012-04-15 15:32 . 2012-04-15 15:32        189952        ----a-w-        c:\windows\system32\d3d10core.dll

2012-04-15 15:32 . 2012-04-15 15:32        1029120        ----a-w-        c:\windows\system32\d3d10.dll

2012-04-15 15:30 . 2012-04-15 15:30        519680        ----a-w-        c:\windows\system32\d3d11.dll

2012-04-15 15:30 . 2012-04-15 15:30        252928        ----a-w-        c:\windows\system32\dxdiag.exe

2012-04-15 15:30 . 2012-04-15 15:30        195584        ----a-w-        c:\windows\system32\dxdiagn.dll

2012-04-15 13:31 . 2011-11-17 06:48        440192        ----a-w-        c:\windows\system32\drivers\ksecdd.sys

2012-04-15 13:30 . 2011-02-22 13:33        797696        ----a-w-        c:\windows\system32\FntCache.dll

2012-04-15 13:28 . 2011-10-25 15:56        49152        ----a-w-        c:\windows\system32\csrsrv.dll

2012-04-15 13:28 . 2011-09-20 21:02        905088        ----a-w-        c:\windows\system32\drivers\tcpip.sys

2012-04-15 13:28 . 2011-10-14 16:02        429056        ----a-w-        c:\windows\system32\EncDec.dll

2012-04-15 13:28 . 2011-08-13 04:43        6144        ----a-w-        c:\program files\Internet Explorer\iecompat.dll

2012-04-15 13:13 . 2012-03-01 11:01        2409784        ----a-w-        c:\program files\Windows Mail\OESpamFilter.dat

2012-04-15 13:11 . 2011-09-30 15:57        707584        ----a-w-        c:\program files\Common Files\System\wab32.dll

2012-04-15 13:08 . 2012-01-09 13:58        180736        ----a-w-        c:\windows\system32\drivers\rdpwd.sys

2012-04-14 22:08 . 2012-04-14 22:09        --------        d-----w-        c:\windows\system32\ca-ES

2012-04-14 22:08 . 2012-04-14 22:09        --------        d-----w-        c:\windows\system32\eu-ES

2012-04-14 21:13 . 2009-04-10 21:27        57856        ----a-w-        c:\windows\system32\compcln.exe

2012-04-14 21:09 . 2009-04-10 21:28        941056        ----a-w-        c:\program files\Common Files\Microsoft Shared\ink\ShapeCollector.exe

2012-04-14 21:08 . 2009-04-10 21:28        75264        ----a-w-        c:\windows\system32\dot3msm.dll

2012-04-14 21:07 . 2009-04-10 21:27        513000        ----a-w-        c:\program files\Windows Defender\MpSoftEx.dll

2012-04-14 21:06 . 2009-04-10 19:38        17408        ----a-w-        c:\windows\system32\drivers\kbdhid.sys

2012-04-14 21:05 . 2009-04-10 21:28        735232        ----a-w-        c:\program files\Microsoft Games\SpiderSolitaire\SpiderSolitaire.exe

2012-04-14 20:57 . 2012-04-14 20:57        --------        d-----w-        c:\windows\system32\EventProviders

2012-04-14 20:08 . 2012-04-14 20:08        --------        d-----w-        c:\users\Janet\AppData\Roaming\InstallShield

2012-04-14 19:18 . 2012-04-14 19:18        --------        d-----w-        c:\program files\7-Zip

2012-04-14 10:25 . 2012-04-14 10:25        --------        d-----w-        c:\users\Janet\AppData\Roaming\Malwarebytes

2012-04-14 10:24 . 2012-04-14 10:24        --------        d-----w-        c:\programdata\Malwarebytes

2012-04-14 10:24 . 2012-04-04 13:56        22344        ----a-w-        c:\windows\system32\drivers\mbam.sys

2012-04-14 10:24 . 2012-04-14 10:24        --------        d-----w-        c:\program files\Malwarebytes' Anti-Malware

2012-04-12 18:10 . 2012-04-12 18:10        418464        ----a-w-        c:\windows\system32\FlashPlayerApp.exe

2012-04-04 05:53 . 2012-04-04 05:53        182160        ----a-w-        c:\program files\Mozilla Firefox\plugins\nppdf32.dll

2012-04-04 05:53 . 2012-04-04 05:53        182160        ----a-w-        c:\program files\Internet Explorer\Plugins\nppdf32.dll

2012-04-02 18:04 . 2012-04-10 18:25        --------        d-----w-        c:\programdata\F4D55F2C00016056000AD65EEEC1FB6E

.

.

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2012-04-17 19:58 . 2011-12-10 21:01        472808        ----a-w-        c:\windows\system32\deployJava1.dll

2012-04-15 15:34 . 2012-04-15 15:34        161792        ----a-w-        c:\windows\system32\msls31.dll

2012-04-15 15:34 . 2012-04-15 15:34        86528        ----a-w-        c:\windows\system32\iesysprep.dll

2012-04-15 15:34 . 2012-04-15 15:34        76800        ----a-w-        c:\windows\system32\SetIEInstalledDate.exe

2012-04-15 15:34 . 2012-04-15 15:34        74752        ----a-w-        c:\windows\system32\RegisterIEPKEYs.exe

2012-04-15 15:34 . 2012-04-15 15:34        48640        ----a-w-        c:\windows\system32\mshtmler.dll

2012-04-15 15:34 . 2012-04-15 15:34        63488        ----a-w-        c:\windows\system32\tdc.ocx

2012-04-15 15:34 . 2012-04-15 15:34        367104        ----a-w-        c:\windows\system32\html.iec

2012-04-15 15:34 . 2012-04-15 15:34        74752        ----a-w-        c:\windows\system32\iesetup.dll

2012-04-15 15:34 . 2012-04-15 15:34        23552        ----a-w-        c:\windows\system32\licmgr10.dll

2012-04-15 15:34 . 2012-04-15 15:34        420864        ----a-w-        c:\windows\system32\vbscript.dll

2012-04-15 15:34 . 2012-04-15 15:34        152064        ----a-w-        c:\windows\system32\wextract.exe

2012-04-15 15:34 . 2012-04-15 15:34        150528        ----a-w-        c:\windows\system32\iexpress.exe

2012-04-15 15:34 . 2012-04-15 15:34        142848        ----a-w-        c:\windows\system32\ieUnatt.exe

2012-04-15 15:34 . 2012-04-15 15:34        35840        ----a-w-        c:\windows\system32\imgutil.dll

2012-04-15 15:34 . 2012-04-15 15:34        11776        ----a-w-        c:\windows\system32\mshta.exe

2012-04-15 15:34 . 2012-04-15 15:34        110592        ----a-w-        c:\windows\system32\IEAdvpack.dll

2012-04-15 15:32 . 2012-04-15 15:32        979456        ----a-w-        c:\windows\system32\MFH264Dec.dll

2012-04-15 15:32 . 2012-04-15 15:32        357376        ----a-w-        c:\windows\system32\MFHEAACdec.dll

2012-04-15 15:32 . 2012-04-15 15:32        98816        ----a-w-        c:\windows\system32\mfps.dll

2012-04-15 15:32 . 2012-04-15 15:32        302592        ----a-w-        c:\windows\system32\mfmp4src.dll

2012-04-15 15:32 . 2012-04-15 15:32        2873344        ----a-w-        c:\windows\system32\mf.dll

2012-04-15 15:32 . 2012-04-15 15:32        261632        ----a-w-        c:\windows\system32\mfreadwrite.dll

2012-04-15 15:32 . 2012-04-15 15:32        209920        ----a-w-        c:\windows\system32\mfplat.dll

2012-04-15 15:32 . 2012-04-15 15:32        586240        ----a-w-        c:\windows\system32\stobject.dll

2012-04-15 15:32 . 2012-04-15 15:32        135680        ----a-w-        c:\windows\system32\XpsRasterService.dll

2012-04-15 15:32 . 2012-04-15 15:32        258048        ----a-w-        c:\windows\system32\winspool.drv

2012-04-15 15:32 . 2012-04-15 15:32        847360        ----a-w-        c:\windows\system32\OpcServices.dll

2012-04-15 15:32 . 2012-04-15 15:32        667648        ----a-w-        c:\windows\system32\printfilterpipelinesvc.exe

2012-04-15 15:32 . 2012-04-15 15:32        26112        ----a-w-        c:\windows\system32\printfilterpipelineprxy.dll

2012-04-15 15:32 . 2012-04-15 15:32        1554432        ----a-w-        c:\windows\system32\xpsservices.dll

2012-04-15 15:30 . 2012-04-15 15:30        4096        ----a-w-        c:\windows\system32\drivers\de-DE\dxgkrnl.sys.mui

2012-04-15 15:30 . 2012-04-15 15:30        369664        ----a-w-        c:\windows\system32\WMPhoto.dll

2012-04-15 15:30 . 2012-04-15 15:30        321024        ----a-w-        c:\windows\system32\PhotoMetadataHandler.dll

2012-04-15 15:30 . 2012-04-15 15:30        189440        ----a-w-        c:\windows\system32\WindowsCodecsExt.dll

2012-04-15 15:30 . 2012-04-15 15:30        974848        ----a-w-        c:\windows\system32\WindowsCodecs.dll

2012-04-12 18:10 . 2012-01-04 19:39        70304        ----a-w-        c:\windows\system32\FlashPlayerCPLApp.cpl

2012-03-06 06:39 . 2012-04-15 15:58        3602816        ----a-w-        c:\windows\system32\ntkrnlpa.exe

2012-03-06 06:39 . 2012-04-15 15:58        3550080        ----a-w-        c:\windows\system32\ntoskrnl.exe

2012-02-29 15:11 . 2012-04-15 16:12        5120        ----a-w-        c:\windows\system32\wmi.dll

2012-02-29 15:11 . 2012-04-15 16:12        172032        ----a-w-        c:\windows\system32\wintrust.dll

2012-02-29 15:09 . 2012-04-15 16:12        157696        ----a-w-        c:\windows\system32\imagehlp.dll

2012-02-28 01:18 . 2012-04-16 16:23        1799168        ----a-w-        c:\windows\system32\jscript9.dll

2012-02-28 01:11 . 2012-04-16 16:23        1427456        ----a-w-        c:\windows\system32\inetcpl.cpl

2012-02-28 01:11 . 2012-04-16 16:23        1127424        ----a-w-        c:\windows\system32\wininet.dll

2012-02-28 01:03 . 2012-04-16 16:23        2382848        ----a-w-        c:\windows\system32\mshtml.tlb

2012-02-23 08:18 . 2010-01-14 21:10        237072        ------w-        c:\windows\system32\MpSigStub.exe

2012-02-07 09:02 . 2012-02-07 09:02        1070352        ----a-w-        c:\windows\system32\MSCOMCTL.OCX

2012-02-02 15:16 . 2012-04-15 13:29        2044416        ----a-w-        c:\windows\system32\win32k.sys

.

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-10 1233920]

"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-18 125952]

"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-01-19 39408]

"BullGuard"="c:\program files\BullGuard Software\BullGuard\BullGuard.exe" [2008-04-13 308552]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"BullGuard"="c:\program files\BullGuard Software\BullGuard\bullguard.exe" [2008-04-13 308552]

"RtHDVCpl"="RtHDVCpl.exe" [2007-11-14 4706304]

"Skytel"="Skytel.exe" [2007-10-11 1826816]

"Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2008-02-07 220160]

"toolbar_eula_launcher"="c:\program files\GoogleEULA\EULALauncher.exe" [2007-02-09 16896]

"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2011-11-01 59240]

"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2011-10-24 421888]

"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2011-12-08 421736]

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-04-04 843712]

"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-01-18 254696]

.

c:\users\Janet\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2009-2-26 97680]

.

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

WISO Mein Steuer-Sparbuch heute.lnk - c:\program files\WISO\Steuersoftware 2012\mshaktuell.exe [2012-2-5 1370224]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]

"AppInit_DLLs"=c:\progra~1\Google\GOOGLE~1\GoogleDesktopNetwork3.dll

.

R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-12 253600]

S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-04-04 63928]

S3 3xHybrid;Philips SAA713x PCI Card;c:\windows\system32\DRIVERS\3xHybrid.sys [2008-01-08 1302368]

.

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

BullGuard        REG_MULTI_SZ           BgMainSvc BsFileScan BsMailProxy

LocalServiceAndNoImpersonation        REG_MULTI_SZ           FontCache

.

Inhalt des "geplante Tasks" Ordners

.

2012-04-19 c:\windows\Tasks\Adobe Flash Player Updater.job

- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-12 18:10]

.

2012-04-19 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files\Google\Update\GoogleUpdate.exe [2009-02-21 12:55]

.

2012-04-19 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files\Google\Update\GoogleUpdate.exe [2009-02-21 12:55]

.

.

------- Zusätzlicher Suchlauf -------

.

uStart Page = hxxp://www.google.de/

mStart Page = about:blank

mSearch Bar = hxxp://www.google.com/ie

IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200

IE: Felder mit Bestellhelfer ausfüllen - file://c:\program files\DHL\DHL Bestellhelfer\fillFormContext.html

IE: Felder mit Bestellhelfer merken - file://c:\program files\DHL\DHL Bestellhelfer\assignContext.html

IE: Nach Microsoft &Excel exportieren - c:\progra~1\MICROS~3\Office10\EXCEL.EXE/3000

IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000

IE: {{0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - hxxp://rover.ebay.com/rover/1/707-37276-17534-25/4

Trusted Zone: fernuni-hagen.de\ca

Trusted Zone: fernuni-hagen.de\pos

TCP: Interfaces\{0A534F7E-8C94-48C5-ADAD-357149947882}: NameServer = 213.191.74.19 62.109.123.197

DPF: {445F47D7-E043-4BD6-82EB-7A1BD0EBA773} - hxxp://www.psapoll.com/CopyGuardIE.cab

DPF: {E9B39AC7-B9FB-48CA-84A0-1659A05C0008} - hxxp://www.wohnmoebel.de/priess/install/KPSA-home%20Priess.cab

FF - ProfilePath - c:\users\Janet\AppData\Roaming\Mozilla\Firefox\Profiles\jnqba3oc.default\

FF - prefs.js: browser.startup.homepage - hxxp://alice.aol.de/

FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA}

FF - Ext: RealPlayer Browser Record Plugin: {ABDE892B-13A8-4d1b-88E6-365A6E755758} - c:\program files\real\realplayer\browserrecord\firefox\ext

FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension

FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}

.

- - - - Entfernte verwaiste Registrierungseinträge - - - -

.

AddRemove-EADM - c:\program files\Electronic Arts\EADM\EADMUI\EADMUninstall.exe

.

.

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net

Rootkit scan 2012-04-19 21:11

Windows 6.0.6002 Service Pack 2 NTFS

.

Scanne versteckte Prozesse... 

.

Scanne versteckte Autostarteinträge... 

.

Scanne versteckte Dateien... 

.

.

c:\users\Janet\AppData\Local\Temp\catchme.dll 53248 bytes executable

.

Scan erfolgreich abgeschlossen

versteckte Dateien: 1

.

**************************************************************************

.

Zeit der Fertigstellung: 2012-04-19  21:26:21

ComboFix-quarantined-files.txt  2012-04-19 19:26

.

Vor Suchlauf: 13 Verzeichnis(se), 265.264.746.496 Bytes frei

Nach Suchlauf: 19 Verzeichnis(se), 265.086.435.328 Bytes frei

.

- - End Of File - - 83B289E7881AE19CA35B838E1E96BE97

Combofix - Scripten

1. Starte das Notepad (Start / Ausführen / notepad[Enter])

2. Jetzt füge mit copy/paste den ganzen Inhalt der untenstehenden Codebox in das Notepad Fenster ein.

Code:

Folder::

c:\programdata\F4D55F2C00016056000AD65EEEC1FB6E

3. Speichere im Notepad als CFScript.txt auf dem Desktop.

4. Deaktivere den Guard Deines Antivirenprogramms und eine eventuell vorhandene Software Firewall.
(Auch Guards von Ad-, Spyware Programmen und den Tea Timer (wenn vorhanden) !)

5. Dann ziehe die CFScript.txt auf die cofi.exe, so wie es im unteren Bild zu sehen ist. Damit wird Combofix neu gestartet.

http://users.pandora.be/bluepatchy/m...s/CFScript.gif

6. Nach dem Neustart (es wird gefragt ob Du neustarten willst), poste bitte die folgenden Log Dateien:
Combofix.txt

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!

Hier das CF Log

Code:

ComboFix 12-04-19.01 - Janet 20.04.2012  18:38:28.2.2 - x86

Microsoft® Windows Vista™ Home Premium   6.0.6002.2.1252.49.1031.18.2047.1006 [GMT 2:00]

ausgeführt von:: c:\users\Janet\Desktop\ComboFix.exe

Benutzte Befehlsschalter :: c:\users\Janet\Desktop\CFScript.txt

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

c:\programdata\F4D55F2C00016056000AD65EEEC1FB6E

c:\programdata\F4D55F2C00016056000AD65EEEC1FB6E\F4D55F2C00016056000AD65EEEC1FB6E

.

.

(((((((((((((((((((((((   Dateien erstellt von 2012-03-20 bis 2012-04-20  ))))))))))))))))))))))))))))))

.

.

2012-04-20 18:37 . 2012-04-20 18:38        --------        d-----w-        c:\users\Janet\AppData\Local\temp

2012-04-20 18:37 . 2012-04-20 18:37        --------        d-----w-        c:\users\Default\AppData\Local\temp

2012-04-17 18:21 . 2012-04-17 18:21        --------        d-----w-        C:\_OTL

2012-04-16 16:23 . 2012-02-28 01:58        141112        ----a-w-        c:\program files\Internet Explorer\sqmapi.dll

2012-04-16 16:23 . 2012-02-28 01:08        194048        ----a-w-        c:\program files\Internet Explorer\IEShims.dll

2012-04-16 16:23 . 2012-02-28 01:13        678912        ----a-w-        c:\program files\Internet Explorer\iedvtool.dll

2012-04-16 16:23 . 2012-02-28 01:11        1427456        ----a-w-        c:\windows\system32\inetcpl.cpl

2012-04-15 23:30 . 2012-02-13 13:44        1068544        ----a-w-        c:\windows\system32\DWrite.dll

2012-04-15 23:30 . 2012-02-14 15:45        219648        ----a-w-        c:\windows\system32\d3d10_1core.dll

2012-04-15 23:30 . 2012-02-13 14:12        1172480        ----a-w-        c:\windows\system32\d3d10warp.dll

2012-04-15 23:30 . 2012-02-14 15:45        160768        ----a-w-        c:\windows\system32\d3d10_1.dll

2012-04-15 23:30 . 2012-02-13 13:47        683008        ----a-w-        c:\windows\system32\d2d1.dll

2012-04-15 20:41 . 2012-04-15 20:41        --------        d-----w-        c:\program files\ESET

2012-04-15 17:58 . 2012-04-15 17:58        --------        d-----w-        c:\program files\Windows Portable Devices

2012-04-15 16:24 . 2009-10-01 01:02        31232        ----a-w-        c:\windows\system32\BthMtpContextHandler.dll

2012-04-15 16:24 . 2009-10-01 01:01        40448        ----a-w-        c:\windows\system32\drivers\WpdUsb.sys

2012-04-15 16:24 . 2009-10-01 01:01        839168        ----a-w-        c:\windows\system32\drivers\UMDF\WpdMtpDr.dll

2012-04-15 16:12 . 2012-02-29 15:09        157696        ----a-w-        c:\windows\system32\imagehlp.dll

2012-04-15 16:12 . 2012-02-29 13:32        12800        ----a-w-        c:\windows\system32\drivers\fs_rec.sys

2012-04-15 15:32 . 2012-04-15 15:32        486400        ----a-w-        c:\windows\system32\d3d10level9.dll

2012-04-15 15:32 . 2012-04-15 15:32        638336        ----a-w-        c:\windows\system32\drivers\dxgkrnl.sys

2012-04-15 15:32 . 2012-04-15 15:32        478720        ----a-w-        c:\windows\system32\dxgi.dll

2012-04-15 15:32 . 2012-04-15 15:32        37376        ----a-w-        c:\windows\system32\cdd.dll

2012-04-15 15:32 . 2012-04-15 15:32        189952        ----a-w-        c:\windows\system32\d3d10core.dll

2012-04-15 15:32 . 2012-04-15 15:32        1029120        ----a-w-        c:\windows\system32\d3d10.dll

2012-04-15 15:30 . 2012-04-15 15:30        519680        ----a-w-        c:\windows\system32\d3d11.dll

2012-04-15 15:30 . 2012-04-15 15:30        252928        ----a-w-        c:\windows\system32\dxdiag.exe

2012-04-15 15:30 . 2012-04-15 15:30        195584        ----a-w-        c:\windows\system32\dxdiagn.dll

2012-04-15 13:31 . 2011-11-17 06:48        440192        ----a-w-        c:\windows\system32\drivers\ksecdd.sys

2012-04-15 13:30 . 2011-02-22 13:33        797696        ----a-w-        c:\windows\system32\FntCache.dll

2012-04-15 13:28 . 2011-10-25 15:56        49152        ----a-w-        c:\windows\system32\csrsrv.dll

2012-04-15 13:28 . 2011-09-20 21:02        905088        ----a-w-        c:\windows\system32\drivers\tcpip.sys

2012-04-15 13:28 . 2011-10-14 16:02        429056        ----a-w-        c:\windows\system32\EncDec.dll

2012-04-15 13:28 . 2011-08-13 04:43        6144        ----a-w-        c:\program files\Internet Explorer\iecompat.dll

2012-04-15 13:13 . 2012-03-01 11:01        2409784        ----a-w-        c:\program files\Windows Mail\OESpamFilter.dat

2012-04-15 13:11 . 2011-09-30 15:57        707584        ----a-w-        c:\program files\Common Files\System\wab32.dll

2012-04-15 13:08 . 2012-01-09 13:58        180736        ----a-w-        c:\windows\system32\drivers\rdpwd.sys

2012-04-14 22:08 . 2012-04-14 22:09        --------        d-----w-        c:\windows\system32\ca-ES

2012-04-14 22:08 . 2012-04-14 22:09        --------        d-----w-        c:\windows\system32\eu-ES

2012-04-14 21:13 . 2009-04-10 21:27        57856        ----a-w-        c:\windows\system32\compcln.exe

2012-04-14 21:09 . 2009-04-10 21:28        941056        ----a-w-        c:\program files\Common Files\Microsoft Shared\ink\ShapeCollector.exe

2012-04-14 21:08 . 2009-04-10 21:28        75264        ----a-w-        c:\windows\system32\dot3msm.dll

2012-04-14 21:07 . 2009-04-10 21:27        513000        ----a-w-        c:\program files\Windows Defender\MpSoftEx.dll

2012-04-14 21:06 . 2009-04-10 19:38        17408        ----a-w-        c:\windows\system32\drivers\kbdhid.sys

2012-04-14 21:05 . 2009-04-10 21:28        735232        ----a-w-        c:\program files\Microsoft Games\SpiderSolitaire\SpiderSolitaire.exe

2012-04-14 20:57 . 2012-04-14 20:57        --------        d-----w-        c:\windows\system32\EventProviders

2012-04-14 20:08 . 2012-04-14 20:08        --------        d-----w-        c:\users\Janet\AppData\Roaming\InstallShield

2012-04-14 19:18 . 2012-04-14 19:18        --------        d-----w-        c:\program files\7-Zip

2012-04-14 10:25 . 2012-04-14 10:25        --------        d-----w-        c:\users\Janet\AppData\Roaming\Malwarebytes

2012-04-14 10:24 . 2012-04-14 10:24        --------        d-----w-        c:\programdata\Malwarebytes

2012-04-14 10:24 . 2012-04-04 13:56        22344        ----a-w-        c:\windows\system32\drivers\mbam.sys

2012-04-14 10:24 . 2012-04-14 10:24        --------        d-----w-        c:\program files\Malwarebytes' Anti-Malware

2012-04-12 18:10 . 2012-04-12 18:10        418464        ----a-w-        c:\windows\system32\FlashPlayerApp.exe

2012-04-04 05:53 . 2012-04-04 05:53        182160        ----a-w-        c:\program files\Mozilla Firefox\plugins\nppdf32.dll

2012-04-04 05:53 . 2012-04-04 05:53        182160        ----a-w-        c:\program files\Internet Explorer\Plugins\nppdf32.dll

.

.

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2012-04-17 19:58 . 2011-12-10 21:01        472808        ----a-w-        c:\windows\system32\deployJava1.dll

2012-04-15 15:34 . 2012-04-15 15:34        161792        ----a-w-        c:\windows\system32\msls31.dll

2012-04-15 15:34 . 2012-04-15 15:34        76800        ----a-w-        c:\windows\system32\SetIEInstalledDate.exe

2012-04-15 15:34 . 2012-04-15 15:34        74752        ----a-w-        c:\windows\system32\RegisterIEPKEYs.exe

2012-04-15 15:34 . 2012-04-15 15:34        48640        ----a-w-        c:\windows\system32\mshtmler.dll

2012-04-15 15:34 . 2012-04-15 15:34        63488        ----a-w-        c:\windows\system32\tdc.ocx

2012-04-15 15:34 . 2012-04-15 15:34        23552        ----a-w-        c:\windows\system32\licmgr10.dll

2012-04-15 15:34 . 2012-04-15 15:34        420864        ----a-w-        c:\windows\system32\vbscript.dll

2012-04-15 15:34 . 2012-04-15 15:34        152064        ----a-w-        c:\windows\system32\wextract.exe

2012-04-15 15:34 . 2012-04-15 15:34        11776        ----a-w-        c:\windows\system32\mshta.exe

2012-04-15 15:32 . 2012-04-15 15:32        979456        ----a-w-        c:\windows\system32\MFH264Dec.dll

2012-04-15 15:32 . 2012-04-15 15:32        357376        ----a-w-        c:\windows\system32\MFHEAACdec.dll

2012-04-15 15:32 . 2012-04-15 15:32        98816        ----a-w-        c:\windows\system32\mfps.dll

2012-04-15 15:32 . 2012-04-15 15:32        302592        ----a-w-        c:\windows\system32\mfmp4src.dll

2012-04-15 15:32 . 2012-04-15 15:32        2873344        ----a-w-        c:\windows\system32\mf.dll

2012-04-15 15:32 . 2012-04-15 15:32        261632        ----a-w-        c:\windows\system32\mfreadwrite.dll

2012-04-15 15:32 . 2012-04-15 15:32        209920        ----a-w-        c:\windows\system32\mfplat.dll

2012-04-15 15:32 . 2012-04-15 15:32        586240        ----a-w-        c:\windows\system32\stobject.dll

2012-04-15 15:32 . 2012-04-15 15:32        135680        ----a-w-        c:\windows\system32\XpsRasterService.dll

2012-04-15 15:32 . 2012-04-15 15:32        258048        ----a-w-        c:\windows\system32\winspool.drv

2012-04-15 15:32 . 2012-04-15 15:32        847360        ----a-w-        c:\windows\system32\OpcServices.dll

2012-04-15 15:32 . 2012-04-15 15:32        667648        ----a-w-        c:\windows\system32\printfilterpipelinesvc.exe

2012-04-15 15:32 . 2012-04-15 15:32        26112        ----a-w-        c:\windows\system32\printfilterpipelineprxy.dll

2012-04-15 15:32 . 2012-04-15 15:32        1554432        ----a-w-        c:\windows\system32\xpsservices.dll

2012-04-15 15:30 . 2012-04-15 15:30        4096        ----a-w-        c:\windows\system32\drivers\de-DE\dxgkrnl.sys.mui

2012-04-15 15:30 . 2012-04-15 15:30        369664        ----a-w-        c:\windows\system32\WMPhoto.dll

2012-04-15 15:30 . 2012-04-15 15:30        321024        ----a-w-        c:\windows\system32\PhotoMetadataHandler.dll

2012-04-15 15:30 . 2012-04-15 15:30        189440        ----a-w-        c:\windows\system32\WindowsCodecsExt.dll

2012-04-15 15:30 . 2012-04-15 15:30        974848        ----a-w-        c:\windows\system32\WindowsCodecs.dll

2012-04-12 18:10 . 2012-01-04 19:39        70304        ----a-w-        c:\windows\system32\FlashPlayerCPLApp.cpl

2012-03-06 06:39 . 2012-04-15 15:58        3602816        ----a-w-        c:\windows\system32\ntkrnlpa.exe

2012-03-06 06:39 . 2012-04-15 15:58        3550080        ----a-w-        c:\windows\system32\ntoskrnl.exe

2012-02-29 15:11 . 2012-04-15 16:12        5120        ----a-w-        c:\windows\system32\wmi.dll

2012-02-29 15:11 . 2012-04-15 16:12        172032        ----a-w-        c:\windows\system32\wintrust.dll

2012-02-28 01:18 . 2012-04-16 16:23        1799168        ----a-w-        c:\windows\system32\jscript9.dll

2012-02-28 01:11 . 2012-04-16 16:23        1127424        ----a-w-        c:\windows\system32\wininet.dll

2012-02-28 01:03 . 2012-04-16 16:23        2382848        ----a-w-        c:\windows\system32\mshtml.tlb

2012-02-23 08:18 . 2010-01-14 21:10        237072        ------w-        c:\windows\system32\MpSigStub.exe

2012-02-07 09:02 . 2012-02-07 09:02        1070352        ----a-w-        c:\windows\system32\MSCOMCTL.OCX

2012-02-02 15:16 . 2012-04-15 13:29        2044416        ----a-w-        c:\windows\system32\win32k.sys

.

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-10 1233920]

"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-18 125952]

"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-01-19 39408]

"BullGuard"="c:\program files\BullGuard Software\BullGuard\BullGuard.exe" [2008-04-13 308552]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"BullGuard"="c:\program files\BullGuard Software\BullGuard\bullguard.exe" [2008-04-13 308552]

"RtHDVCpl"="RtHDVCpl.exe" [2007-11-14 4706304]

"Skytel"="Skytel.exe" [2007-10-11 1826816]

"Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2008-02-07 220160]

"toolbar_eula_launcher"="c:\program files\GoogleEULA\EULALauncher.exe" [2007-02-09 16896]

"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2011-11-01 59240]

"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2011-10-24 421888]

"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2011-12-08 421736]

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-04-04 843712]

"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-01-18 254696]

.

c:\users\Janet\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2009-2-26 97680]

.

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

WISO Mein Steuer-Sparbuch heute.lnk - c:\program files\WISO\Steuersoftware 2012\mshaktuell.exe [2012-2-5 1370224]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]

"AppInit_DLLs"=c:\progra~1\Google\GOOGLE~1\GoogleDesktopNetwork3.dll

.

R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-12 253600]

S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-04-04 63928]

S3 3xHybrid;Philips SAA713x PCI Card;c:\windows\system32\DRIVERS\3xHybrid.sys [2008-01-08 1302368]

.

.

--- Andere Dienste/Treiber im Speicher ---

.

*NewlyCreated* - WS2IFSL

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

BullGuard        REG_MULTI_SZ           BgMainSvc BsFileScan BsMailProxy

LocalServiceAndNoImpersonation        REG_MULTI_SZ           FontCache

.

Inhalt des "geplante Tasks" Ordners

.

2012-04-20 c:\windows\Tasks\Adobe Flash Player Updater.job

- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-12 18:10]

.

2012-04-20 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files\Google\Update\GoogleUpdate.exe [2009-02-21 12:55]

.

2012-04-20 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files\Google\Update\GoogleUpdate.exe [2009-02-21 12:55]

.

.

------- Zusätzlicher Suchlauf -------

.

uStart Page = hxxp://www.google.de/

mStart Page = about:blank

mSearch Bar = hxxp://www.google.com/ie

IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200

IE: Felder mit Bestellhelfer ausfüllen - file://c:\program files\DHL\DHL Bestellhelfer\fillFormContext.html

IE: Felder mit Bestellhelfer merken - file://c:\program files\DHL\DHL Bestellhelfer\assignContext.html

IE: Nach Microsoft &Excel exportieren - c:\progra~1\MICROS~3\Office10\EXCEL.EXE/3000

IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000

IE: {{0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - hxxp://rover.ebay.com/rover/1/707-37276-17534-25/4

Trusted Zone: fernuni-hagen.de\ca

Trusted Zone: fernuni-hagen.de\pos

TCP: Interfaces\{0A534F7E-8C94-48C5-ADAD-357149947882}: NameServer = 62.109.123.197 213.191.74.19

DPF: {445F47D7-E043-4BD6-82EB-7A1BD0EBA773} - hxxp://www.psapoll.com/CopyGuardIE.cab

DPF: {E9B39AC7-B9FB-48CA-84A0-1659A05C0008} - hxxp://www.wohnmoebel.de/priess/install/KPSA-home%20Priess.cab

FF - ProfilePath - c:\users\Janet\AppData\Roaming\Mozilla\Firefox\Profiles\jnqba3oc.default\

FF - prefs.js: browser.startup.homepage - hxxp://alice.aol.de/

FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA}

FF - Ext: RealPlayer Browser Record Plugin: {ABDE892B-13A8-4d1b-88E6-365A6E755758} - c:\program files\real\realplayer\browserrecord\firefox\ext

FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension

FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}

.

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net

Rootkit scan 2012-04-20 20:37

Windows 6.0.6002 Service Pack 2 NTFS

.

Scanne versteckte Prozesse... 

.

Scanne versteckte Autostarteinträge... 

.

Scanne versteckte Dateien... 

.

Scan erfolgreich abgeschlossen

versteckte Dateien: 0

.

**************************************************************************

.

Zeit der Fertigstellung: 2012-04-20  20:52:13

ComboFix-quarantined-files.txt  2012-04-20 18:51

ComboFix2.txt  2012-04-19 19:26

.

Vor Suchlauf: 19 Verzeichnis(se), 264.175.034.368 Bytes frei

Nach Suchlauf: 19 Verzeichnis(se), 264.176.742.400 Bytes frei

.

- - End Of File - - 22283F06F0A310FD6D009E34F54F01B2

Ich brauch den Quarantäneordner von Combofix. Bitte folgendes machen:

1.) GANZ WICHTIG!! Virenscanner deaktivieren, der darf das Packen nicht beeinflussen!
2.) Ordner Quarantine in C:\Qoobox in eine Datei zippen
3.) die erstellte ZIP-Datei hier hochladen => http://www.trojaner-board.de/54791-a...ner-board.html

Hinweis: Die Datei bitte wie in der Anleitung zum UpChannel angegeben auch da hochladen. Bitte NICHT die ZIP-Datei hier als Anhang in den Thread posten!

4.) Wenns erfolgreich war Bescheid sagen
5.) Erst dann wieder den Virenscanner einschalten

Ich habe den Ordner gerade hochgeladen.

Bitte nun Logs mit GMER und OSAM erstellen und posten.
GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus - die Online-Abfrage durch OSAM bitte überspringen.
Bei OSAM bitte darauf auch achten, dass Du das Log auch als *.log und nicht *.html oder so abspeicherst.

Hinweis: Zum Entpacken von OSAM bitte WinRAR oder 7zip verwenden! Stell auch unbedingt den Virenscanner ab, besonders der Scanner von McAfee meldet oft einen Fehalarm in OSAM!

Downloade dir bitte

aswMBR.exe und speichere die Datei auf deinem Desktop.

Starte die aswMBR.exe - (aswMBR.exe Anleitung)
Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten".
Das Tool wird dich fragen, ob Du mit der aktuellen Virendefinition von AVAST! dein System scannen willst. Beantworte diese Frage bitte mit Ja. (Sollte deine Firewall fragen, bitte den Zugriff auf das Internet zulassen )
Der Download der Definitionen kann je nach Verbindung eine Weile dauern.
Klicke auf Scan.
Warte bitte bis Scan finished successfully im DOS-Fenster steht.
Drücke auf Save Log und speichere diese auf dem Desktop.

Poste mir die aswMBR.txt in deiner nächsten Antwort.

Wichtig: Drücke keinesfalls einen der Fix Buttons ohne Anweisung

Hinweis: Sollte der Scan Button ausgeblendet sein, schließe das Tool und starte es erneut. Sollte der Scan abbrechen und das Programm abstürzen, dann teile mir das mit und wähle unter AV Scan die Einstellung (none).

Noch ein Hinweis: Sollte aswMBR abstürzen und es kommt eine Meldung wie "aswMBR.exe funktioniert nicht mehr, dann mach Folgendes:
Starte aswMBR neu, wähle unten links im Drop-Down-Menü (unten links im Fenster von aswMBR) bei "AV scan" (none) aus und klick nochmal auf den Scan-Button.

Hallo Arne,

ich wollte mich nur kurz melden. Leider habe ich privat sehr viel zu tun und bin daher nicht dazu gekommen hier weiter zu machen. Daher kommen meine Antworten in den nächsten Tagen etwas später. Ich hoffe, dass dies ok für Dich ist. Heute habe ich GMER ausprobiert. Leider stürzt es im normalen und abgesicherten Modus ab. Ich mache dann morgen oder übermorgen mit OSAM weiter.

Janet

Ich kann osam nicht ausführen bzw. nicht mal entpacken. Beim entpacken zeigen mir 7-Zip und Winrar an, dass die Datei mfc80u.dll beschädigt ist.

Code:



!   C:\Users\Janet\Downloads\osam_autorun_manager_5_0_portable.rar: CRC-Fehler in mfc80u.dll. Die Datei ist fehlerhaft.

!   C:\Users\Janet\Downloads\osam_autorun_manager_5_0_portable.rar: Unerwartetes Archivende.

Ein erneuter Download brachte keine Besserung. Was kann ich tun?

Du musst den Virenscanner vor dem Entpacken abschalten
Evtl. ist das RAR-Achiv von OSAM auch fehlerhaft übertragen worden einfach nochmal neu runterladen

Hier das Log von osam:

OSAM Logfile:

Code:

Report of OSAM: Autorun Manager v5.0.11926.0

hxxp://www.online-solutions.ru/en/

Saved at 21:50:55 on 25.04.2012
 

OS: Windows Vista Home Premium Edition Service Pack 2 (Build 6002), 32-bit

Default Browser: Microsoft Corporation Internet Explorer 9.00.8112.16421
 

Scanner Settings

[x] Rootkits detection (hidden registry)

[x] Rootkits detection (hidden files)

[x] Retrieve files information

[x] Check Microsoft signatures
 

Filters

[ ] Trusted entries

[ ] Empty entries

[x] Hidden registry entries (rootkit activity)

[x] Exclusively opened files

[x] Not found files

[x] Files without detailed information

[x] Existing files

[ ] Non-startable services

[ ] Non-startable drivers

[x] Active entries

[x] Disabled entries
 
 

[AppInit DLLs]

-----( HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows )-----

"AppInit_DLLs" - "Google" - C:\PROGRA~1\Google\GOOGLE~1\GoogleDesktopNetwork3.dll
 

[Common]

-----( %SystemRoot%\Tasks )-----

"GoogleUpdateTaskMachineCore.job" - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe

"GoogleUpdateTaskMachineUA.job" - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe

"Adobe Flash Player Updater.job" - "Adobe Systems Incorporated" - C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
 

[Control Panel Objects]

-----( %SystemRoot%\system32 )-----

"Ddbaccpl.cpl" - "DataDesign AG" - C:\Windows\system32\Ddbaccpl.cpl

"ddBACCTM.cpl" - "DataDesign AG" - C:\Windows\system32\ddBACCTM.cpl

"FlashPlayerCPLApp.cpl" - "Adobe Systems Incorporated" - C:\Windows\system32\FlashPlayerCPLApp.cpl

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )-----

"QuickTime" - "Apple Inc." - C:\Program Files\QuickTime\QTSystem\QuickTime.cpl
 

[Drivers]

-----( HKLM\SYSTEM\CurrentControlSet\Services )-----

"atksgt" (atksgt) - ? - C:\Windows\System32\DRIVERS\atksgt.sys  (File found, but it contains no detailed information)

"BullGuard Email Monitor" (Reconn) - "BullGuard Ltd." - C:\Program Files\BullGuard Software\BullGuard\reconn.sys

"BullGuard File Monitor Driver" (BdFileSpy) - "BullGuard Ltd." - C:\Windows\system32\drivers\BdFileSpy.sys

"catchme" (catchme) - ? - C:\Users\Janet\AppData\Local\Temp\catchme.sys  (File not found)

"IP in IP Tunnel Driver" (IpInIp) - ? - C:\Windows\System32\DRIVERS\ipinip.sys  (File not found)

"IPX Traffic Filter Driver" (NwlnkFlt) - ? - C:\Windows\System32\DRIVERS\nwlnkflt.sys  (File not found)

"IPX Traffic Forwarder Driver" (NwlnkFwd) - ? - C:\Windows\System32\DRIVERS\nwlnkfwd.sys  (File not found)

"lirsgt" (lirsgt) - ? - C:\Windows\System32\DRIVERS\lirsgt.sys  (File found, but it contains no detailed information)

"PDNMp50 NDIS Protocol Driver" (PDNMp50) - "Printing Communications Assoc., Inc. (PCAUSA)" - C:\Windows\system32\drivers\PDNMp50.sys

"PDNSp50 NDIS Protocol Driver" (PDNSp50) - "Printing Communications Assoc., Inc. (PCAUSA)" - C:\Windows\system32\drivers\PDNSp50.sys

"PxHelp20" (PxHelp20) - "Sonic Solutions" - C:\Windows\System32\Drivers\PxHelp20.sys
 

[Explorer]

-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----

{F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll

-----( HKLM\Software\Classes\Protocols\Filter )-----

{807563E5-5146-11D5-A672-00B0D022E945} "Microsoft Office InfoPath XML Mime Filter" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL

-----( HKLM\Software\Classes\Protocols\Handler )-----

{3D9F03FA-7A94-11D3-BE81-0050048385D1} "Data Page Pluggable Protocol mso-offdap Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\WEBCOM~1\10\OWC10.DLL

{314111c7-a502-11d2-bbca-00c04f8ec294} "HxProtocol Class" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll

{828030A1-22C1-4009-854F-8E305202313F} "livecall" - "Microsoft Corporation" - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL

{CD00020A-8B95-11D1-82DB-00C04FB1625D} "Microsoft PKM KnowledgePluggable Class" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Web Folders\PKMCDO.DLL

{828030A1-22C1-4009-854F-8E305202313F} "msnim" - "Microsoft Corporation" - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----

{911051fa-c21c-4246-b470-070cd8df6dc4} ".cab or .zip files" - ? -   (File not found | COM-object registry key not found)

{23170F69-40C1-278A-1000-000100020000} "7-Zip Shell Extension" - "Igor Pavlov" - C:\Program Files\7-Zip\7-zip.dll

{1b24a030-9b20-49bc-97ac-1be4426f9e59} "ActiveDirectory Folder" - ? -   (File not found | COM-object registry key not found)

{34449847-FD14-4fc8-A75A-7432F5181EFB} "ActiveDirectory Folder" - ? -   (File not found | COM-object registry key not found)

{0F8604A5-4ECE-4DE1-BA7D-CF10F8AA4F48} "Contacts folder" - ? -   (File not found | COM-object registry key not found)

{A70C977A-BF00-412C-90B7-034C51DA2439} "DesktopContext Class" - "NVIDIA Corporation" - C:\Program Files\NVIDIA Corporation\Display\nvui.dll

{2C2577C2-63A7-40e3-9B7F-586602617ECB} "Explorer Query Band" - ? -   (File not found | COM-object registry key not found)

{FAC3CBF6-8697-43d0-BAB9-DCD1FCE19D75} "IE User Assist" - ? -   (File not found | COM-object registry key not found)

{B9E1D2CB-CCFF-4AA6-9579-D7A4754030EF} "iTunes" - "Apple Inc." - C:\Program Files\iTunes\iTunesMiniPlayer.dll

{00020d75-0000-0000-c000-000000000046} "lnkfile" - ? -   (File not found | COM-object registry key not found)

{42042206-2D85-11D3-8CFF-005004838597} "Microsoft Office HTML Icon Handler" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\msohevi.dll

{993BE281-6695-4BA5-8A2A-7AACBFAAB69E} "Microsoft Office Metadata Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll

{5858A72C-C2B4-4dd7-B2BF-B76DB1BD9F6C} "Microsoft Office OneNote Namespace Extension for Windows Desktop Search" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\Office12\ONFILTER.DLL

{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97} "Microsoft Office Thumbnail Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll

{97F68CE3-7146-45FF-BE24-D9A7DD7CB8A2} "NeroCoverEdLiveIcons Class" - "Nero AG" - C:\Program Files\Nero\Nero8\Nero CoverDesigner\CoverEdExtension.dll

{3D1975AF-48C6-4f8e-A182-BE0E08FA86A9} "NVIDIA CPL Context Menu Extension" - "NVIDIA Corporation" - C:\Windows\system32\nvshext.dll

{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4} "RealOne Player Context Menu Class" - "RealNetworks, Inc." - c:\program files\real\realplayer\rpshell.dll

{C8494E42-ACDD-4739-B0FB-217361E4894F} "Sam Account Folder" - ? -   (File not found | COM-object registry key not found)

{E29F9716-5C08-4FCD-955A-119FDB5A522D} "Sam Account Folder" - ? -   (File not found | COM-object registry key not found)

{BDEADF00-C265-11D0-BCED-00A0C90AB50F} "Webordner" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\WEBFOL~1\MSONSEXT.DLL

{da67b8ad-e81b-4c70-9b91b417b5e33527} "Windows Search Shell Service" - ? -   (File not found | COM-object registry key not found)

{B41DB860-8EE4-11D2-9906-E49FADC173CA} "WinRAR" - ? - C:\Program Files\WinRAR\rarext.dll
 

[Internet Explorer]

-----( HKCU\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----

"eBay - Der weltweite Online-Marktplatz" - ? - hxxp://rover.ebay.com/rover/1/707-37276-17534-15/4  (HTTP value)

-----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )-----

<binary data> "Google Toolbar" - "Google Inc." - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll

ITBar7Height "ITBar7Height" - ? -   (File not found | COM-object registry key not found)

<binary data> "ITBar7Layout" - ? -   (File not found | COM-object registry key not found)

-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----

{E9B39AC7-B9FB-48CA-84A0-1659A05C0008} "ActiveFormX Element" - ? - C:\PROGRA~1\KPSA-H~1\axOPL.ocx  (File not found) / hxxp://www.wohnmoebel.de/priess/install/KPSA-home%20Priess.cab

{445F47D7-E043-4BD6-82EB-7A1BD0EBA773} "CopyGuardCtrl Class" - "Penn, Schoen & Berland Associates, LLC" - C:\Windows\Downloaded Program Files\CopyGuardIE.dll / hxxp://www.psapoll.com/CopyGuardIE.cab

{CAFEEFAC-0016-0000-0004-ABCDEFFEDCBA} "Java Plug-in 1.6.0_04" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_04-windows-i586.cab

{8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.6.0_31" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab

{CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} "Java Plug-in 1.6.0_31" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab

{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_31" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\npjpi160_31.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab

{D27CDB6E-AE6D-11CF-96B8-444553540000} "Shockwave Flash Object" - "Adobe Systems, Inc." - C:\Windows\system32\Macromed\Flash\Flash11e.ocx / hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

{1E54D648-B804-468d-BC78-4AFFED8E262E} "System Requirements Lab Class" - "Husdawg, LLC" - C:\Windows\Downloaded Program Files\sysreqlab_srl.dll / hxxp://www.systemrequirementslab.com/srl_bin/sysreqlab_srl.cab

{1E54D648-B804-468d-BC78-4AFFED8E262F} "System Requirements Lab Class" - "Husdawg, LLC" - C:\Windows\Downloaded Program Files\sysreqlab_nvd.dll / hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab

{17492023-C23A-453E-A040-C7C580BBF700} "Windows Genuine Advantage Validation Tool" - "Microsoft Corporation" - C:\Windows\system32\LegitCheckControl.DLL / hxxp://download.microsoft.com/download/5/b/0/5b0d4654-aa20-495c-b89f-c1c34c691085/LegitCheckControl.cab

{6414512B-B978-451D-A0D8-FCFDF33E833C} "WUWebControl Class" - "Microsoft Corporation" - C:\Windows\system32\wuweb.dll / hxxp://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1228413342227

{8FFBE65D-2C9C-4669-84BD-5829DC0B603C} "{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}" - ? -   (File not found | COM-object registry key not found) / hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab

{E2883E8F-472F-4FB0-9522-AC9BF37916A7} "{E2883E8F-472F-4FB0-9522-AC9BF37916A7}" - ? -   (File not found | COM-object registry key not found) / hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----

{48E73304-E1D6-4330-914C-F5F514E3486C} "An OneNote senden" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll

{23BC42E9-46AB-481f-A200-69524B689A6B} "DHL Bestellhelfer" - ? -   (File not found | COM-object registry key not found)

"eBay - Der weltweite Online-Marktplatz" - ? - hxxp://rover.ebay.com/rover/1/707-37276-17534-25/4  (HTTP value)

{FF059E31-CC5A-4E2E-BF3B-96E929D65503} "Research" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL

-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar )-----

<binary data> "Google Toolbar" - "Google Inc." - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----

{18DF081C-E8AD-4283-A596-FA578C2EBDC3} "Adobe PDF Link Helper" - "Adobe Systems Incorporated" - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

{AA58ED58-01DD-4d91-8333-CF10577473F7} "Google Toolbar Helper" - "Google Inc." - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll

{AF69DE43-7D58-4638-B6FA-CE66B5AD205D} "Google Toolbar Notifier BHO" - "Google Inc." - C:\Program Files\Google\GoogleToolbarNotifier\5.7.7227.1100\swg.dll

{DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2ssv.dll

{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} "Java(tm) Plug-In SSV Helper" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\ssv.dll

{3049C3E9-B461-4BC5-8870-4C09146192CA} "RealPlayer Download and Record Plugin for Internet Explorer" - "RealPlayer" - c:\program files\real\realplayer\rpbrowserrecordplugin.dll

{9030D464-4C02-4ABF-8ECC-5164760863C6} "Windows Live Anmelde-Hilfsprogramm" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

{5C255C8A-E604-49b4-9D64-90988571CECB} "{5C255C8A-E604-49b4-9D64-90988571CECB}" - ? -   (File not found | COM-object registry key not found)
 

[Logon]

-----( %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup )-----

"OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE  (Shortcut exists | File exists)

"desktop.ini" - ? - C:\Users\Janet\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini

-----( %AllUsersProfile%\Microsoft\Windows\Start Menu\Programs\Startup )-----

"desktop.ini" - ? - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini

"WISO Mein Steuer-Sparbuch heute.lnk" - "Buhl Tax Service, Hannover" - C:\Program Files\WISO\Steuersoftware 2012\mshaktuell.exe  (Shortcut exists | File exists)

-----( HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run )-----

"BullGuard" - "BullGuard Software" - "C:\Program Files\BullGuard Software\BullGuard\BullGuard.exe"

"swg" - "Google Inc." - "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"

-----( HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\Wds\rdpwd )-----

"StartupPrograms" - ? - rdpclip  (File not found)

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----

"Adobe ARM" - "Adobe Systems Incorporated" - "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

"APSDaemon" - "Apple Inc." - "C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe"

"BullGuard" - "BullGuard Software" - "C:\Program Files\BullGuard Software\BullGuard\bullguard.exe" -boot

"Google Desktop Search" - "Google" - "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup

"iTunesHelper" - "Apple Inc." - "C:\Program Files\iTunes\iTunesHelper.exe"

"QuickTime Task" - "Apple Inc." - "C:\Program Files\QuickTime\QTTask.exe" -atboottime

"SunJavaUpdateSched" - "Sun Microsystems, Inc." - "C:\Program Files\Common Files\Java\Java Update\jusched.exe"

"toolbar_eula_launcher" - " " - C:\Program Files\GoogleEULA\EULALauncher.exe
 

[Print Monitors]

-----( HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors )-----

"Microsoft Document Imaging Writer Monitor" - "Microsoft Corporation" - C:\Windows\system32\mdimon.dll

"Send To Microsoft OneNote Monitor" - "Microsoft Corporation" - C:\Windows\system32\msonpmon.dll
 

[Services]

-----( HKLM\SYSTEM\CurrentControlSet\Services )-----

"@c:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe,-100" (WPFFontCache_v0400) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe

"Adobe Acrobat Update Service" (AdobeARMservice) - "Adobe Systems Incorporated" - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe

"Adobe Flash Player Update Service" (AdobeFlashPlayerUpdateSvc) - "Adobe Systems Incorporated" - C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe

"Apple Mobile Device" (Apple Mobile Device) - "Apple Inc." - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

"ASP.NET State Service" (aspnet_state) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe

"BullGuard Email Monitoring Service" (BsMailProxy) - "BullGuard Ltd." - C:\Program Files\BullGuard Software\BullGuard\BsMailProxy.dll

"BullGuard File Scan Service" (BsFileScan) - "BullGuard Ltd." - C:\Program Files\BullGuard Software\BullGuard\BsFileScan.dll

"BullGuard LiveUpdate" (BGLiveSvc) - "BullGuard Software" - C:\Program Files\BullGuard Software\BullGuard\BullGuardUpdate.exe

"BullGuard Main Service" (BgMainSvc) - "BullGuard, Ltd." - C:\Program Files\BullGuard Software\BullGuard\BsMain.dll

"Cyberlink RichVideo Service(CRVS)" (RichVideo) - ? - C:\Program Files\CyberLink\Shared Files\RichVideo.exe

"Dienst "Bonjour"" (Bonjour Service) - "Apple Inc." - C:\Program Files\Bonjour\mDNSResponder.exe

"FABS - Helping agent for MAGIX media database" (Fabs) - "MAGIX AG" - C:\Program Files\Common Files\MAGIX Services\Database\bin\FABS.exe

"Firebird Server - MAGIX Instance" (FirebirdServerMAGIXInstance) - "MAGIX®" - C:\Program Files\Common Files\MAGIX Services\Database\bin\fbserver.exe

"GnabService" (GnabService) - "Empolis GmbH" - c:\program files\common files\gnab\service\servicecontroller.exe

"Google Software Updater" (gusvc) - "Google" - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

"Google Update Service (gupdate1c99423b8ae4260)" (gupdate1c99423b8ae4260) - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe

"Google Update-Dienst (gupdatem)" (gupdatem) - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe

"GoogleDesktopManager" (GoogleDesktopManager) - "Google" - C:\Program Files\Google\Google Desktop Search\GoogleDesktopManager.exe

"InstallDriver Table Manager" (IDriverT) - "Macrovision Corporation" - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

"iPod-Dienst" (iPod Service) - "Apple Inc." - C:\Program Files\iPod\bin\iPodService.exe

"Microsoft .NET Framework NGEN v4.0.30319_X86" (clr_optimization_v4.0.30319_32) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

"Microsoft Office Diagnostics Service" (odserv) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE

"Nero BackItUp Scheduler 3" (Nero BackItUp Scheduler 3) - "Nero AG" - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe

"NMIndexingService" (NMIndexingService) - "Nero AG" - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe

"NVIDIA Display Driver Service" (nvsvc) - "NVIDIA Corporation" - C:\Windows\system32\nvvsvc.exe

"NVIDIA Stereoscopic 3D Driver Service" (Stereo Service) - "NVIDIA Corporation" - C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe

"Office Source Engine" (ose) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE

"Sceneo PVR Service" (srvcPVR) - "Buhl Data Service GmbH" - C:\Program Files\Sceneo\AbsolutTV\Services\PVR\PVRService.exe

"X10 Device Network Service" (x10nets) - "X10" - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe
 

[Winsock Providers]

-----( HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries )-----

"mdnsNSP" - "Apple Inc." - C:\Program Files\Bonjour\mdnsNSP.dll
 

===[ Logfile end ]=========================================[ Logfile end ]===

Soll ich gleich mit aswmbr weiter machen oder wertest Du erst das Log aus?

Die anderen Logs kannst du sofort erstelle

Hier das Log

Code:



aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software

Run date: 2012-04-25 22:00:50

-----------------------------

22:00:50.849    OS Version: Windows 6.0.6002 Service Pack 2

22:00:50.864    Number of processors: 2 586 0xF0B

22:00:50.864    ComputerName: JANET-PC  UserName: Janet

22:01:28.835    Initialize success

22:02:35.779    AVAST engine defs: 12042500

22:03:30.566    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\0000008c

22:03:30.566    Disk 0 Vendor: WDC_WD50 01.0 Size: 476940MB BusType: 6

22:03:30.582    Disk 0 MBR read successfully

22:03:30.582    Disk 0 MBR scan

22:03:30.691    Disk 0 Windows VISTA default MBR code

22:03:30.691    Disk 0 Partition 1 80 (A) 07    HPFS/NTFS NTFS       456456 MB offset 63

22:03:30.707    Disk 0 Partition - 00     0F Extended LBA             20481 MB offset 934822350

22:03:30.738    Disk 0 Partition 2 00     0B        FAT32 MSDOS5.0    20481 MB offset 934822413

22:03:30.738    Disk 0 scanning sectors +976768065

22:03:30.800    Disk 0 scanning C:\Windows\system32\drivers

22:03:49.879    Service scanning

22:04:23.887    Modules scanning

22:04:35.540    Disk 0 trace - called modules:

22:04:35.556    ntkrnlpa.exe CLASSPNP.SYS disk.sys acpi.sys hal.dll storport.sys nvstor32.sys 

22:04:35.556    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x85b6eac8]

22:04:35.556    3 CLASSPNP.SYS[881ac8b3] -> nt!IofCallDriver -> [0x84479950]

22:04:35.571    5 acpi.sys[806a06bc] -> nt!IofCallDriver -> \Device\0000008c[0x84e2a8f8]

22:04:36.492    AVAST engine scan C:\Windows

22:04:46.117    AVAST engine scan C:\Windows\system32

22:10:33.546    AVAST engine scan C:\Windows\system32\drivers

22:10:58.911    AVAST engine scan C:\Users\Janet

22:29:15.669    AVAST engine scan C:\ProgramData

22:36:13.001    Scan finished successfully

22:39:27.003    Disk 0 MBR has been saved successfully to "C:\Users\Janet\Downloads\MBR.dat"

22:39:27.034    The log file has been saved successfully to "C:\Users\Janet\Downloads\aswMBR.txt"

Sieht ok aus. Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SASW und poste die Logs.
Denk dran beide Tools zu updaten vor dem Scan!!

Hier kommt das Log von Superantispyware:

Code:



SUPERAntiSpyware Scan Log

hxxp://www.superantispyware.com
 

Generated 04/30/2012 at 09:37 PM
 

Application Version : 5.0.1148
 

Core Rules Database Version : 8530

Trace Rules Database Version: 6342
 

Scan type       : Complete Scan

Total Scan Time : 02:43:19
 

Operating System Information

Windows Vista Home Premium 32-bit, Service Pack 2 (Build 6.00.6002)

UAC On - Administrator
 

Memory items scanned      : 882

Memory threats detected   : 0

Registry items scanned    : 36607

Registry threats detected : 0

File items scanned        : 233554

File threats detected     : 12
 

Adware.Tracking Cookie

        C:\Users\Janet\AppData\Roaming\Microsoft\Windows\Cookies\9Q6M39VF.txt [ /maxis.112.2o7.net ]

        C:\USERS\JANET\AppData\Roaming\Microsoft\Windows\Cookies\Low\6LZE4G7F.txt [ Cookie:janet@apmebf.com/ ]

        C:\USERS\JANET\AppData\Roaming\Microsoft\Windows\Cookies\Low\BG6MJAWI.txt [ Cookie:janet@fl01.ct2.comclick.com/ ]

        C:\USERS\JANET\AppData\Roaming\Microsoft\Windows\Cookies\Low\JHWFJ4RP.txt [ Cookie:janet@ad.yieldmanager.com/ ]

        C:\USERS\JANET\AppData\Roaming\Microsoft\Windows\Cookies\Low\9DX9LPYK.txt [ Cookie:janet@doubleclick.net/ ]

        C:\USERS\JANET\AppData\Roaming\Microsoft\Windows\Cookies\Low\JHL1EUPR.txt [ Cookie:janet@adfarm1.adition.com/ ]

        C:\USERS\JANET\AppData\Roaming\Microsoft\Windows\Cookies\Low\ADZ0XQUY.txt [ Cookie:janet@clickandbuy.com/ ]

        C:\USERS\JANET\Cookies\9Q6M39VF.txt [ Cookie:janet@maxis.112.2o7.net/ ]

        .divx.112.2o7.net [ C:\USERS\JANET\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]

        delivery.ibanner.de [ C:\USERS\JANET\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\UKLYYJVA ]
 

Trojan.Agent/Gen-Bancos

        C:\PROGRAM FILES\SCENEO\ABSOLUTTV\BDSUPDATE.DLL
 

Trojan.Agent/Gen-FakeAV

        C:\PROGRAM FILES\WINRAR\DEFAULT.SFX

Log von Malwarebytes folgt.