Hijack This Log und Logs
 

Hallo!
Wollte mal einen von den Experten fragen, ob mit meinem PC alles passt. Habe Antivir und die Windows Firewall und gestern CCleaner laufen lassen, dann Hijack This, Malwarebytes Anti-Malware, dann The Avenger, RSIT und GMER und poste mal die Logs:

"Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:47:47, on 03.02.2010
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16982)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Thomson\SpeedTouch USB\dragdiag.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Eraser\Eraser.exe
C:\Program Files\Aon\OnlineFestplatte\OnlineFestplatte.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Prevx\prevx.exe
C:\Program Files\Feed Reader\feedreader.exe
C:\Windows\system32\wuauclt.exe
C:\Program Files\Java\jre6\bin\javaw.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = h**p://w*w.telekom.at/suche
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = h**p://w*w.telekom.at
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = h**p://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = h**p://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = h**p://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = h**p://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Telekom Austria TA AG
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = ftp=proxy.aon.at:8080;h**p=proxy.aon.at:8080
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.aon.at;<local>
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [Eraser] C:\Program Files\Eraser\Eraser.exe -hide
O4 - HKCU\..\Run: [OnlineFestplatte] C:\Program Files\aon\Onlinefestplatte\OnlineFestplatte.exe /tray
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETZWERKDIENST')
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O13 - Gopher Prefix:
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{F5779413-9AD7-446A-93F2-0CD80DFFF767}: NameServer = 195.3.96.67 195.3.96.68
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Avira AntiVir Planer (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: CSIScanner - Prevx - C:\Program Files\Prevx\prevx.exe

--
End of file - 4741 bytes"


"Malwarebytes' Anti-Malware 1.40
Datenbank Version: 2749
Windows 6.0.6000

03.02.2010 18:47:07
mbam-log-2010-02-03 (18-47-07).txt

Scan-Methode: Vollständiger Scan (C:\|D:\|)
Durchsuchte Objekte: 181433
Laufzeit: 42 minute(s), 36 second(s)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)"


"Logfile of The Avenger Version 2.0, (c) by Swandog46
http://swandog46.geekstogo.com

Platform: Windows Vista

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.
No rootkits found!


Completed script processing.

*******************

Finished! Terminate."

"Logfile of random's system information tool 1.06 (written by random/random)
Run by PCN at 2010-02-03 18:54:35
Microsoft® Windows Vista™ Home Premium
System drive C: has 127 GB (58%) free of 218 GB
Total RAM: 1022 MB (53% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:54:45, on 03.02.2010
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16982)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Windows\system32\conime.exe
C:\Program Files\Prevx\prevx.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Thomson\SpeedTouch USB\dragdiag.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\Adobe\Reader 9.0\Reader\reader_sl.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Eraser\Eraser.exe
C:\Program Files\Aon\OnlineFestplatte\OnlineFestplatte.exe
C:\Users\PCN\Sonstiges\RSIT.exe
C:\Program Files\Trend Micro\HijackThis\PCN.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = h**p://w*w.telekom.at/suche
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = h**p://w*w.telekom.at
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = h**p://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = h**p://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = h**p://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = h**p://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Telekom Austria TA AG
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = ftp=proxy.aon.at:8080;http=proxy.aon.at:8080
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.aon.at;<local>
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [Eraser] C:\Program Files\Eraser\Eraser.exe -hide
O4 - HKCU\..\Run: [OnlineFestplatte] C:\Program Files\aon\Onlinefestplatte\OnlineFestplatte.exe /tray
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETZWERKDIENST')
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O13 - Gopher Prefix:
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Avira AntiVir Planer (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: CSIScanner - Prevx - C:\Program Files\Prevx\prevx.exe

--
End of file - 4475 bytes

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-02-27 75128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-09-16 41760]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"=C:\Program Files\Windows Defender\MSASCui.exe [2006-11-02 1004136]
"RtHDVCpl"=C:\Windows\RtHDVCpl.exe [2007-01-18 4349952]
"SpeedTouch USB Diagnostics"=C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe [2004-01-26 866816]
"avgnt"=C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [2009-03-02 209153]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2009-02-27 35696]
"SunJavaUpdateSched"=C:\Program Files\Java\jre6\bin\jusched.exe [2009-09-16 149280]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Eraser"=C:\Program Files\Eraser\Eraser.exe [2009-06-10 334224]
"OnlineFestplatte"=C:\Program Files\aon\Onlinefestplatte\OnlineFestplatte.exe [2008-01-25 253976]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\aawservice]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0ccd0077-997d-11de-9ae7-806e6f6e6963}]
shell\AutoRun\command - E:\Start.exe


======List of files/folders created in the last 1 months======

2010-02-03 18:54:35 ----D---- C:\rsit
2010-02-03 18:51:36 ----D---- C:\Avenger
2010-02-03 18:51:36 ----A---- C:\avenger.txt
2010-01-22 23:38:54 ----A---- C:\Windows\system32\mshtml.dll
2010-01-22 23:38:53 ----A---- C:\Windows\system32\wininet.dll
2010-01-22 23:38:53 ----A---- C:\Windows\system32\ieframe.dll
2010-01-22 23:38:52 ----A---- C:\Windows\system32\urlmon.dll
2010-01-22 23:38:52 ----A---- C:\Windows\system32\mstime.dll
2010-01-22 23:38:51 ----A---- C:\Windows\system32\mshtmled.dll
2010-01-22 23:38:51 ----A---- C:\Windows\system32\iertutil.dll
2010-01-22 23:38:51 ----A---- C:\Windows\system32\iedkcs32.dll
2010-01-22 23:38:51 ----A---- C:\Windows\system32\ieapfltr.dll
2010-01-22 23:38:51 ----A---- C:\Windows\system32\ie4uinit.exe
2010-01-22 23:38:51 ----A---- C:\Windows\system32\icardie.dll
2010-01-22 23:38:51 ----A---- C:\Windows\system32\dxtmsft.dll
2010-01-22 23:38:50 ----A---- C:\Windows\system32\pngfilt.dll
2010-01-22 23:38:50 ----A---- C:\Windows\system32\occache.dll
2010-01-22 23:38:50 ----A---- C:\Windows\system32\msfeeds.dll
2010-01-22 23:38:50 ----A---- C:\Windows\system32\jsproxy.dll
2010-01-22 23:38:50 ----A---- C:\Windows\system32\ieUnatt.exe
2010-01-22 23:38:50 ----A---- C:\Windows\system32\iernonce.dll
2010-01-22 23:38:50 ----A---- C:\Windows\system32\ieencode.dll
2010-01-22 23:38:50 ----A---- C:\Windows\system32\ieaksie.dll
2010-01-22 23:38:50 ----A---- C:\Windows\system32\dxtrans.dll
2010-01-22 23:38:50 ----A---- C:\Windows\system32\advpack.dll
2010-01-22 23:38:50 ----A---- C:\Windows\system32\admparse.dll
2010-01-22 23:38:49 ----A---- C:\Windows\system32\mshtmler.dll
2010-01-22 23:38:49 ----A---- C:\Windows\system32\ieui.dll
2010-01-22 23:38:49 ----A---- C:\Windows\system32\iesetup.dll
2010-01-22 23:38:49 ----A---- C:\Windows\system32\ieakui.dll
2010-01-17 18:13:26 ----HDC---- C:\ProgramData\{0D7E394B-F031-4F44-89E9-4FCDA45969B0}
2010-01-17 17:58:58 ----D---- C:\Program Files\Telekom Austria
2010-01-17 17:11:43 ----D---- C:\Program Files\Lavasoft
2010-01-17 17:10:53 ----D---- C:\Program Files\Common Files\Wise Installation Wizard
2010-01-15 22:56:31 ----D---- C:\ProgramData\Lavasoft
2010-01-14 02:27:50 ----A---- C:\Windows\system32\t2embed.dll
2010-01-14 02:27:50 ----A---- C:\Windows\system32\lpk.dll
2010-01-14 02:27:50 ----A---- C:\Windows\system32\fontsub.dll
2010-01-14 02:27:50 ----A---- C:\Windows\system32\dciman32.dll
2010-01-14 02:27:50 ----A---- C:\Windows\system32\atmlib.dll
2010-01-14 02:27:50 ----A---- C:\Windows\system32\atmfd.dll

======List of files/folders modified in the last 1 months======

2010-02-03 18:54:45 ----D---- C:\Windows\Prefetch
2010-02-03 18:54:30 ----D---- C:\Windows\Temp
2010-02-03 18:51:36 ----D---- C:\Windows\system32\drivers
2010-02-03 18:51:36 ----D---- C:\Windows\System32
2010-02-03 17:59:00 ----D---- C:\Windows\Debug
2010-02-03 17:59:00 ----D---- C:\Windows
2010-02-03 17:52:21 ----D---- C:\Users\PCN\AppData\Roaming\vlc
2010-02-03 17:37:01 ----D---- C:\Program Files\JDownloader 0.8
2010-02-02 21:24:36 ----SHD---- C:\System Volume Information
2010-02-02 03:38:07 ----D---- C:\Windows\system32\catroot2
2010-02-01 14:14:45 ----A---- C:\Windows\system32\PerfStringBackup.INI
2010-02-01 14:14:43 ----D---- C:\Windows\inf
2010-01-23 13:55:41 ----D---- C:\Windows\system32\migration
2010-01-23 13:55:41 ----D---- C:\Program Files\Internet Explorer
2010-01-23 13:55:39 ----D---- C:\Windows\AppPatch
2010-01-23 13:40:24 ----D---- C:\Windows\winsxs
2010-01-22 23:37:26 ----D---- C:\Windows\system32\catroot
2010-01-18 23:50:02 ----D---- C:\ProgramData\PrevxCSI
2010-01-18 12:05:46 ----D---- C:\ProgramData
2010-01-17 18:13:26 ----SHD---- C:\Windows\Installer
2010-01-17 17:58:58 ----D---- C:\Program Files
2010-01-17 17:10:53 ----D---- C:\Program Files\Common Files
2010-01-17 17:08:11 ----D---- C:\Program Files\Java
2010-01-09 23:27:38 ----D---- C:\Users\PCN\AppData\Roaming\dvdcss
2010-01-09 23:23:23 ----D---- C:\Windows\Minidump
2010-01-07 13:29:01 ----D---- C:\Program Files\Mozilla Firefox
2010-01-05 01:17:46 ----A---- C:\Windows\system32\mrt.exe
2010-01-04 17:42:36 ----D---- C:\Windows\Microsoft.NET
2010-01-04 17:42:25 ----RSD---- C:\Windows\assembly

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 avgio;avgio; \??\C:\Program Files\Avira\AntiVir Desktop\avgio.sys [2009-02-13 11608]
R2 avgntflt;avgntflt; C:\Windows\system32\DRIVERS\avgntflt.sys [2009-12-07 56816]
R3 alcan5wn;SpeedTouch USB ADSL PPP Networking Driver (NDISWAN); C:\Windows\system32\DRIVERS\alcan5wn.sys [2003-12-08 53600]
R3 alcaudsl;SpeedTouch ADSL Modem ATM Transport; C:\Windows\system32\DRIVERS\alcaudsl.sys [2003-12-08 70688]
R3 FETNDIS;VIA Rhine-Familie--Fast-Ethernet-Adaptertreiberdienst; C:\Windows\system32\DRIVERS\fetnd5.sys [2006-11-02 45568]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHDA.sys [2007-01-18 1729632]
R3 WUDFRd;WUDFRd; C:\Windows\system32\DRIVERS\WUDFRd.sys [2006-11-02 82560]
S3 Ad-Watch Connect Filter;Ad-Watch Connect Kernel Filter; \??\C:\Windows\system32\drivers\NSDriver.sys [2008-04-29 15648]
S3 Ad-Watch Real-Time Scanner;AW Real-Time Scanner; \??\C:\Windows\system32\drivers\AWRTPD.sys [2008-04-29 12960]
S3 Ad-Watch Registry Filter;Ad-Watch Registry Kernel Filter; \??\C:\Windows\system32\drivers\AWRTRD.sys [2008-04-29 15648]
S3 ATIAVPCI;ATI Unified AVStream service; C:\Windows\system32\DRIVERS\atinavrr.sys [2006-11-02 377472]
S3 drmkaud;Microsoft Kernel-DRM-Audioentschlüsselung; C:\Windows\system32\drivers\drmkaud.sys [2006-11-02 5632]
S3 HdAudAddService;Microsoft 1.1 UAA-Funktionstreiber für High Definition Audio-Dienst; C:\Windows\system32\drivers\HdAudio.sys [2006-11-02 235520]
S3 MSKSSRV;Microsoft Streaming Service Proxy; C:\Windows\system32\drivers\MSKSSRV.sys [2006-11-02 8192]
S3 MSPCLOCK;Microsoft Proxy für Streaming Clock; C:\Windows\system32\drivers\MSPCLOCK.sys [2006-11-02 5888]
S3 MSPQM;Microsoft Proxy für Streaming Quality Manager; C:\Windows\system32\drivers\MSPQM.sys [2006-11-02 5504]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink-Konvertierung; C:\Windows\system32\drivers\MSTEE.sys [2006-11-02 6016]
S3 Ph3xIB32;Philips 713x Inbox PCI TV Card; C:\Windows\system32\DRIVERS\Ph3xIB32.sys [2006-11-02 1083520]
S4 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\Windows\system32\drivers\wmiacpi.sys [2006-11-02 11264]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 aawservice;Lavasoft Ad-Aware Service; C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe [2008-07-17 611664]
R2 AntiVirSchedulerService;Avira AntiVir Planer; C:\Program Files\Avira\AntiVir Desktop\sched.exe [2009-05-13 108289]
R2 AntiVirService;Avira AntiVir Guard; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [2009-07-21 185089]
R2 CSIScanner;CSIScanner; C:\Program Files\Prevx\prevx.exe [2009-09-06 4368952]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2006-10-26 441136]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]

-----------------EOF-----------------"



"GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-02-03 22:38:15
Windows 6.0.6000
Running: i3dsxbx5.exe; Driver: C:\Users\PCN\AppData\Local\Temp\kxtdipoc.sys


---- Kernel code sections - GMER 1.0.15 ----

? system32\drivers\nfsrks.sys Das System kann den angegebenen Pfad nicht finden. !

---- Devices - GMER 1.0.15 ----

AttachedDevice \FileSystem\fastfat \Fat fltmgr.sys (Microsoft Dateisystem-Filter-Manager/Microsoft Corporation)

---- EOF - GMER 1.0.15 ----"


Wär naturgemäß sehr dankbar für eine Analyse!