Trojaner-Board - Dauert sehr lange bis sich mein Internetbrowser öffnet

Trojaner-Board (https://www.trojaner-board.de/)

- Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)

- - Dauert sehr lange bis sich mein Internetbrowser öffnet (https://www.trojaner-board.de/95211-dauert-sehr-lange-internetbrowser-oeffnet.html)

Code:

All processes killed

========== OTL ==========

Service stllssvr stopped successfully!

Service stllssvr deleted successfully!

File   File not found not found.

Service AddFiltr stopped successfully!

Service AddFiltr deleted successfully!

File   File not found not found.

Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\D3dtwain deleted successfully.

C:\Users\Markus\AppData\Roaming\D3dvis\txttab.exe moved successfully.

C:\ProgramData\{DE8EABB5-1C85-4410-A68D-79BD8A4518F4} folder moved successfully.

========== COMMANDS ==========

C:\Windows\System32\drivers\etc\Hosts moved successfully.

HOSTS file reset successfully

 

[EMPTYTEMP]

 

User: All Users

 

User: Default

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

->Flash cache emptied: 0 bytes

 

User: Default User

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

->Flash cache emptied: 0 bytes

 

User: Markus

->Temp folder emptied: 204991797 bytes

->Temporary Internet Files folder emptied: 55719528 bytes

->Java cache emptied: 146932 bytes

->FireFox cache emptied: 52507771 bytes

->Google Chrome cache emptied: 0 bytes

->Flash cache emptied: 14896 bytes

 

User: Public

->Temp folder emptied: 0 bytes

 

%systemdrive% .tmp files removed: 0 bytes

%systemroot% .tmp files removed: 0 bytes

%systemroot%\System32 .tmp files removed: 0 bytes

%systemroot%\System32\drivers .tmp files removed: 0 bytes

Windows Temp folder emptied: 10632152 bytes

RecycleBin emptied: 1126 bytes

 

Total Files Cleaned = 309.00 mb

 

 

OTL by OldTimer - Version 3.2.20.6 log created on 02052011_061122
 

Files\Folders moved on Reboot...

File\Folder C:\Windows\temp\TMP000000273151828696D42878 not found!
 

Registry entries deleted on Reboot...

Dann bitte jetzt CF ausführen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix

Lade dir ComboFix hier herunter auf deinen Desktop. Benenne es beim Runterladen um in cofi.exe.

http://saved.im/mtm0nzyzmzd5/cofi.jpg

Dann folgende Anleitung durchlesen und abarbeiten -> CCleaner Systembereinigung

Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.

Starte cofi.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.

Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.

Wichtiger Hinweis:

Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

Hi Arne, hie das combofix-logfile. Kurze Anmerkung, mein AntiVir-Guard
(das Schirmchen) lässt sich immer noch nicht aktivieren bzw. öffnen.
Bin momentan also nur sicherheitshalber auf meiner gmx- und der trojaner-
board-seite.

Code:

ComboFix 11-02-06.02 - Markus 07/02/2011  19:16:16.3.1 - x86

Microsoft® Windows Vista™ Home Premium   6.0.6002.2.1252.44.1033.18.1013.227 [GMT 1:00]

Running from: c:\users\Markus\Downloads\ComboFix.exe

AV: AntiVir Desktop *Disabled/Outdated* {090F9C29-64CE-6C6F-379C-5901B49A85B7}

SP: AntiVir Desktop *Disabled/Outdated* {B26E7DCD-42F4-63E1-0D2C-6273CF1DCF0A}

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.
 

(((((((((((((((((((((((((   Files Created from 2011-01-07 to 2011-02-07  )))))))))))))))))))))))))))))))

.
 

2011-02-07 18:31 . 2011-02-07 18:31        --------        d-----w-        c:\users\Public\AppData\Local\temp

2011-02-07 18:31 . 2011-02-07 18:31        --------        d-----w-        c:\users\Default\AppData\Local\temp

2011-02-07 18:10 . 2011-02-07 18:11        --------        d-----w-        C:\32788R22FWJFW

2011-02-05 04:56 . 2011-02-05 04:56        --------        d-----w-        C:\_OTL

2011-02-04 06:22 . 2011-01-13 09:41        5890896        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{093EF4AE-5790-4D29-853A-9F1A7E6D9173}\mpengine.dll

2011-02-02 16:15 . 2010-12-20 17:09        38224        ----a-w-        c:\windows\system32\drivers\mbamswissarmy.sys

2011-02-02 16:15 . 2010-12-20 17:08        20952        ----a-w-        c:\windows\system32\drivers\mbam.sys

2011-02-02 16:15 . 2011-02-02 20:40        --------        d-----w-        c:\program files\Malwarebytes' Anti-Malware

2011-01-31 20:03 . 2011-01-31 20:03        --------        d-----w-        c:\users\Markus\AppData\Roaming\Uniblue

2011-01-31 20:02 . 2011-01-31 20:02        --------        d-----w-        c:\program files\Uniblue

2011-01-31 20:02 . 2011-01-31 20:02        --------        d-----w-        c:\users\Markus\AppData\Local\PackageAware

2011-01-30 16:58 . 2011-01-30 17:08        --------        d-----w-        c:\programdata\REPORTS

2011-01-30 16:58 . 2011-01-30 17:02        --------        d-----w-        c:\programdata\LOGFILES

2011-01-30 16:58 . 2011-01-30 16:58        --------        d-----w-        c:\programdata\INFECTED

2011-01-28 05:57 . 2011-02-05 05:11        --------        d-----w-        c:\users\Markus\AppData\Roaming\D3dvis

2011-01-12 19:33 . 2010-12-28 15:55        413696        ----a-w-        c:\windows\system32\odbc32.dll

2011-01-12 19:33 . 2010-12-28 15:53        253952        ----a-w-        c:\program files\Common Files\System\ado\msadox.dll

2011-01-12 19:33 . 2010-12-28 15:53        241664        ----a-w-        c:\program files\Common Files\System\ado\msadomd.dll

2011-01-12 19:33 . 2010-12-28 15:53        708608        ----a-w-        c:\program files\Common Files\System\ado\msado15.dll

2011-01-12 19:33 . 2010-12-28 15:53        57344        ----a-w-        c:\program files\Common Files\System\msadc\msadcs.dll

2011-01-12 19:33 . 2010-12-28 15:53        180224        ----a-w-        c:\program files\Common Files\System\msadc\msadco.dll

2011-01-12 19:33 . 2010-12-14 14:49        1169408        ----a-w-        c:\windows\system32\sdclt.exe
 

.

((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2010-12-22 21:39 . 2009-03-19 07:26        135096        ----a-w-        c:\windows\system32\drivers\avipbb.sys

2010-11-23 09:51 . 2009-03-19 07:26        61960        ----a-w-        c:\windows\system32\drivers\avgntflt.sys

2010-11-22 08:31 . 2010-11-22 08:31        94848        ----a-w-        C:\uwldapow.sys

2010-11-12 17:53 . 2010-11-23 13:33        472808        ----a-w-        c:\windows\system32\deployJava1.dll

.
 

(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown 

REGEDIT4
 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]

"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]

"RegistryBooster"="c:\program files\Uniblue\RegistryBooster\launcher.exe" [2011-01-21 67456]
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-11-15 815104]

"IgfxTray"="c:\windows\system32\igfxtray.exe" [2006-11-06 98304]

"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2006-11-06 106496]

"Persistence"="c:\windows\system32\igfxpers.exe" [2006-11-06 81920]

"HP Health Check Scheduler"="c:\program files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe" [2006-11-10 46704]

"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-07-10 116040]

"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-05-27 413696]

"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-07-30 289064]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]

"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2010-11-09 281768]

"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2010-03-31 202256]

"DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2010-09-01 1164584]

"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2010-12-20 963976]

"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
 

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"EnableUIADesktopToggle"= 0 (0x0)
 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"aux1"=wdmaud.drv
 

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]

BootExecute        REG_MULTI_SZ           \0
 

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]

"DisableMonitoring"=dword:00000001
 

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]

"DisableMonitoring"=dword:00000001
 

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]

"DisableMonitoring"=dword:00000001
 

R2 AntiVirSchedulerService;Avira AntiVir Planer;c:\program files\Avira\AntiVir Desktop\sched.exe [2010-11-09 135336]

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]

R2 gupdate1c9deaa14fed3cc;Google Update Service (gupdate1c9deaa14fed3cc);c:\program files\Google\Update\GoogleUpdate.exe [2009-05-27 133104]

R3 iatmunin;iatmunin;c:\users\Pim\AppData\Local\Temp\iatmunin.sys [x]

R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
 
 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

bthsvcs        REG_MULTI_SZ           BthServ

HPZ12        REG_MULTI_SZ           Pml Driver HPZ12 Net Driver HPZ12

LocalServiceAndNoImpersonation        REG_MULTI_SZ           FontCache

.

Contents of the 'Scheduled Tasks' folder
 

2011-02-07 c:\windows\Tasks\Google Software Updater.job

- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-04-30 10:30]
 

2011-02-07 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files\Google\Update\GoogleUpdate.exe [2009-05-27 09:02]
 

2011-02-07 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files\Google\Update\GoogleUpdate.exe [2009-05-27 09:02]
 

2011-02-07 c:\windows\Tasks\RegistryBooster.job

- c:\program files\Uniblue\RegistryBooster\rbmonitor.exe [2011-01-21 14:19]
 

2011-02-07 c:\windows\Tasks\User_Feed_Synchronization-{0798338A-4626-44DD-9D57-0FE79EFEF1D8}.job

- c:\windows\system32\msfeedssync.exe [2010-12-15 04:25]
 

2010-11-12 c:\windows\Tasks\User_Feed_Synchronization-{52C964EE-F448-412B-8FE7-0550962111FD}.job

- c:\windows\system32\msfeedssync.exe [2010-12-15 04:25]

.

.

------- Supplementary Scan -------

.

uStart Page = hxxp://www.google.de/

mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_GB&c=71&bd=PRESARIO&pf=laptop

mSearchMigratedDefaultURL = hxxp://www.Google.com/

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000

FF - ProfilePath - c:\users\Markus\AppData\Roaming\Mozilla\Firefox\Profiles\6ywjg3vy.default\

FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}

FF - Ext: RealPlayer Browser Record Plugin: {ABDE892B-13A8-4d1b-88E6-365A6E755758} - c:\programdata\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext

FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension

FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}

FF - Ext: Yahoo! Toolbar: {635abd67-4fe9-1b23-4f01-e679fa7484c1} - %profile%\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}

FF - user.js: yahoo.ytff.general.dontshowhpoffer - true

.

- - - - ORPHANS REMOVED - - - -
 

HKLM-Run-WAWifiMessage - %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe

HKLM-Run-hpWirelessAssistant - %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe

AddRemove-CCleaner - c:\users\Markus\Desktop\CCleaner\uninst.exe

AddRemove-Uniblue RegistryBooster - c:\programdata\{DE8EABB5-1C85-4410-A68D-79BD8A4518F4}\rbia.exe

AddRemove-{09FF4DB8-7DE9-4D47-B7DB-915DB7D9A8CA} - c:\programdata\{DE8EABB5-1C85-4410-A68D-79BD8A4518F4}\rbia.exe
 
 
 

**************************************************************************
 

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net

Rootkit scan 2011-02-07 19:32

Windows 6.0.6002 Service Pack 2 NTFS
 

scanning hidden processes ...  
 

scanning hidden autostart entries ... 
 

scanning hidden files ...  
 
 

c:\users\Markus\AppData\Local\Temp\catchme.dll 53248 bytes executable
 

scan completed successfully

hidden files: 1
 

**************************************************************************

.

--------------------- LOCKED REGISTRY KEYS ---------------------
 

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000
 

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

Completion time: 2011-02-07  19:40:48

ComboFix-quarantined-files.txt  2011-02-07 18:40
 

Pre-Run: 33,958,313,984 bytes free

Post-Run: 33,824,866,304 bytes free
 

- - End Of File - - 7E79A352BB2851A829F754205BA18CF0

Combofix - Scripten

1. Starte das Notepad (Start / Ausführen / notepad[Enter])

2. Jetzt füge mit copy/paste den ganzen Inhalt der untenstehenden Codebox in das Notepad Fenster ein.

Code:

File::

c:\users\Pim\AppData\Local\Temp\iatmunin.sys
 

Driver::

iatmunin

3. Speichere im Notepad als CFScript.txt auf dem Desktop.

4. Deaktivere den Guard Deines Antivirenprogramms und eine eventuell vorhandene Software Firewall.
(Auch Guards von Ad-, Spyware Programmen und den Tea Timer (wenn vorhanden) !)

5. Dann ziehe die CFScript.txt auf die cofi.exe, so wie es im unteren Bild zu sehen ist. Damit wird Combofix neu gestartet.

http://users.pandora.be/bluepatchy/m...s/CFScript.gif

6. Nach dem Neustart (es wird gefragt ob Du neustarten willst), poste bitte die folgenden Log Dateien:
Combofix.txt

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!

Code:

ComboFix 11-02-07.05 - Markus 08/02/2011  16:54:09.4.1 - x86

Microsoft® Windows Vista™ Home Premium   6.0.6002.2.1252.44.1033.18.1013.353 [GMT 1:00]

Running from: c:\users\Markus\Desktop\ComboFix.exe

Command switches used :: c:\users\Markus\Desktop\CFScript.txt

AV: AntiVir Desktop *Disabled/Outdated* {090F9C29-64CE-6C6F-379C-5901B49A85B7}

SP: AntiVir Desktop *Disabled/Outdated* {B26E7DCD-42F4-63E1-0D2C-6273CF1DCF0A}

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 

FILE ::

"c:\users\Pim\AppData\Local\Temp\iatmunin.sys"

.
 

(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))

.
 

.

(((((((((((((((((((((((((((((((((((((((   Drivers/Services   )))))))))))))))))))))))))))))))))))))))))))))))))

.
 

-------\Legacy_IATMUNIN

-------\Service_iatmunin
 
 

(((((((((((((((((((((((((   Files Created from 2011-01-08 to 2011-02-08  )))))))))))))))))))))))))))))))

.
 

2011-02-08 16:09 . 2011-02-08 16:09        --------        d-----w-        c:\users\Public\AppData\Local\temp

2011-02-08 16:09 . 2011-02-08 16:09        --------        d-----w-        c:\users\Default\AppData\Local\temp

2011-02-05 04:56 . 2011-02-05 04:56        --------        d-----w-        C:\_OTL

2011-02-04 06:22 . 2011-01-13 09:41        5890896        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{093EF4AE-5790-4D29-853A-9F1A7E6D9173}\mpengine.dll

2011-02-02 16:15 . 2010-12-20 17:09        38224        ----a-w-        c:\windows\system32\drivers\mbamswissarmy.sys

2011-02-02 16:15 . 2010-12-20 17:08        20952        ----a-w-        c:\windows\system32\drivers\mbam.sys

2011-02-02 16:15 . 2011-02-02 20:40        --------        d-----w-        c:\program files\Malwarebytes' Anti-Malware

2011-01-31 20:03 . 2011-01-31 20:03        --------        d-----w-        c:\users\Markus\AppData\Roaming\Uniblue

2011-01-31 20:02 . 2011-01-31 20:02        --------        d-----w-        c:\program files\Uniblue

2011-01-31 20:02 . 2011-01-31 20:02        --------        d-----w-        c:\users\Markus\AppData\Local\PackageAware

2011-01-30 16:58 . 2011-01-30 17:08        --------        d-----w-        c:\programdata\REPORTS

2011-01-30 16:58 . 2011-01-30 17:02        --------        d-----w-        c:\programdata\LOGFILES

2011-01-30 16:58 . 2011-01-30 16:58        --------        d-----w-        c:\programdata\INFECTED

2011-01-28 05:57 . 2011-02-05 05:11        --------        d-----w-        c:\users\Markus\AppData\Roaming\D3dvis

2011-01-12 19:33 . 2010-12-28 15:55        413696        ----a-w-        c:\windows\system32\odbc32.dll

2011-01-12 19:33 . 2010-12-28 15:53        253952        ----a-w-        c:\program files\Common Files\System\ado\msadox.dll

2011-01-12 19:33 . 2010-12-28 15:53        241664        ----a-w-        c:\program files\Common Files\System\ado\msadomd.dll

2011-01-12 19:33 . 2010-12-28 15:53        708608        ----a-w-        c:\program files\Common Files\System\ado\msado15.dll

2011-01-12 19:33 . 2010-12-28 15:53        57344        ----a-w-        c:\program files\Common Files\System\msadc\msadcs.dll

2011-01-12 19:33 . 2010-12-28 15:53        180224        ----a-w-        c:\program files\Common Files\System\msadc\msadco.dll

2011-01-12 19:33 . 2010-12-14 14:49        1169408        ----a-w-        c:\windows\system32\sdclt.exe
 

.

((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2010-12-22 21:39 . 2009-03-19 07:26        135096        ----a-w-        c:\windows\system32\drivers\avipbb.sys

2010-11-23 09:51 . 2009-03-19 07:26        61960        ----a-w-        c:\windows\system32\drivers\avgntflt.sys

2010-11-22 08:31 . 2010-11-22 08:31        94848        ----a-w-        C:\uwldapow.sys

2010-11-12 17:53 . 2010-11-23 13:33        472808        ----a-w-        c:\windows\system32\deployJava1.dll

.
 

(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown 

REGEDIT4
 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]

"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]

"RegistryBooster"="c:\program files\Uniblue\RegistryBooster\launcher.exe" [2011-01-21 67456]
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-11-15 815104]

"IgfxTray"="c:\windows\system32\igfxtray.exe" [2006-11-06 98304]

"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2006-11-06 106496]

"Persistence"="c:\windows\system32\igfxpers.exe" [2006-11-06 81920]

"HP Health Check Scheduler"="c:\program files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe" [2006-11-10 46704]

"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-07-10 116040]

"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-05-27 413696]

"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-07-30 289064]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]

"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2010-11-09 281768]

"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2010-03-31 202256]

"DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2010-09-01 1164584]

"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2010-12-20 963976]

"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
 

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"EnableUIADesktopToggle"= 0 (0x0)
 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"aux1"=wdmaud.drv
 

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]

BootExecute        REG_MULTI_SZ           \0
 

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]

"DisableMonitoring"=dword:00000001
 

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]

"DisableMonitoring"=dword:00000001
 

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]

"DisableMonitoring"=dword:00000001
 

R2 AntiVirSchedulerService;Avira AntiVir Planer;c:\program files\Avira\AntiVir Desktop\sched.exe [2010-11-09 135336]

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]

R2 gupdate1c9deaa14fed3cc;Google Update Service (gupdate1c9deaa14fed3cc);c:\program files\Google\Update\GoogleUpdate.exe [2009-05-27 133104]

R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
 
 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

bthsvcs        REG_MULTI_SZ           BthServ

HPZ12        REG_MULTI_SZ           Pml Driver HPZ12 Net Driver HPZ12

LocalServiceAndNoImpersonation        REG_MULTI_SZ           FontCache

.

Contents of the 'Scheduled Tasks' folder
 

2011-02-08 c:\windows\Tasks\Google Software Updater.job

- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-04-30 10:30]
 

2011-02-08 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files\Google\Update\GoogleUpdate.exe [2009-05-27 09:02]
 

2011-02-08 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files\Google\Update\GoogleUpdate.exe [2009-05-27 09:02]
 

2011-02-08 c:\windows\Tasks\RegistryBooster.job

- c:\program files\Uniblue\RegistryBooster\rbmonitor.exe [2011-01-21 14:19]
 

2011-02-08 c:\windows\Tasks\User_Feed_Synchronization-{0798338A-4626-44DD-9D57-0FE79EFEF1D8}.job

- c:\windows\system32\msfeedssync.exe [2010-12-15 04:25]
 

2010-11-12 c:\windows\Tasks\User_Feed_Synchronization-{52C964EE-F448-412B-8FE7-0550962111FD}.job

- c:\windows\system32\msfeedssync.exe [2010-12-15 04:25]

.

.

------- Supplementary Scan -------

.

uStart Page = hxxp://www.google.de/

mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_GB&c=71&bd=PRESARIO&pf=laptop

mSearchMigratedDefaultURL = hxxp://www.Google.com/

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000

FF - ProfilePath - c:\users\Markus\AppData\Roaming\Mozilla\Firefox\Profiles\6ywjg3vy.default\

FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}

FF - Ext: RealPlayer Browser Record Plugin: {ABDE892B-13A8-4d1b-88E6-365A6E755758} - c:\programdata\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext

FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension

FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}

FF - Ext: Yahoo! Toolbar: {635abd67-4fe9-1b23-4f01-e679fa7484c1} - %profile%\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}

FF - user.js: yahoo.ytff.general.dontshowhpoffer - true

.
 

**************************************************************************
 

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net

Rootkit scan 2011-02-08 19:46

Windows 6.0.6002 Service Pack 2 NTFS
 

scanning hidden processes ...  
 

scanning hidden autostart entries ... 
 

scanning hidden files ...  
 

scan completed successfully

hidden files: 0
 

**************************************************************************

.

--------------------- LOCKED REGISTRY KEYS ---------------------
 

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000
 

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

------------------------ Other Running Processes ------------------------

.

c:\windows\System32\LEXBCES.EXE

c:\windows\System32\LEXPPS.EXE

c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

c:\program files\Hewlett-Packard\HP Health Check\hphc_service.exe

c:\windows\system32\DRIVERS\xaudio.exe

c:\program files\Hewlett-Packard\Shared\hpqwmiex.exe

c:\windows\system32\conime.exe

c:\windows\ehome\ehmsas.exe

c:\program files\iPod\bin\iPodService.exe

.

**************************************************************************

.

Completion time: 2011-02-08  19:54:40 - machine was rebooted

ComboFix-quarantined-files.txt  2011-02-08 18:54

ComboFix2.txt  2011-02-07 18:40
 

Pre-Run: 32,949,858,304 bytes free

Post-Run: 33,356,500,992 bytes free
 

- - End Of File - - FFE246CDE9B03FD88AD439F43F55922F

Ok. Bitte nun Logs mit GMER und OSAM erstellen und posten.
GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus - die Online-Abfrage durch OSAM bitte überspringen.
Bei OSAM bitte darauf auch achten, dass Du das Log auch als *.log und nicht *.html oder so abspeicherst.

Downloade Dir danach bitte MBRCheck (by a_d_13) und speichere die Datei auf dem Desktop.

Doppelklick auf die MBRCheck.exe.
Vista und Win7 User mit Rechtsklick "als Administrator starten"
Das Tool braucht nur einige Sekunden.
Danach solltest du eine MBRCheck_<Datum>_<Uhrzeit>.txt auf dem Desktop finden.

Poste mir bitte den Inhalt des .txt Dokumentes

Hi Arne,
hattest Recht, GMER ist zweimal abgeschmiert.
Nun zu diesem ominösen OSAM, wenn ich es
von dem vorgegebenen link runterladen möchte,
dann in Verbindung mit dem Windows Media Player...

Kann dass denn sein oder bin ich mal wieder einfach
nur zu doof???

:stirn:

Gruss masi76

Nimm diesen Ersatzlink für OSAM => File-Upload.net - osam.zip

Hi Arne,

der Download soweit so gut...

Und dann...???

Zip hin Zip her...

Bin kurz davor mein Laptob aus dem Fenster zu werfen,
das einzige was mir noch Hoffnung gibt, habe mit Euch
schon schwierigere Dinge bewältigt...

Ich versteh nicht, welches Problem du hast. :balla:

Code:

Report of OSAM: Autorun Manager v5.0.11926.0

hxxp://www.online-solutions.ru/en/

Saved at 06:57:49 on 11.02.2011
 

OS: Windows Vista Home Premium Edition Service Pack 2 (Build 6002), 32-bit

Default Browser: Mozilla Corporation Firefox 3.5.16
 

Scanner Settings

[x] Rootkits detection (hidden registry)

[x] Rootkits detection (hidden files)

[x] Retrieve files information

[x] Check Microsoft signatures
 

Filters

[ ] Trusted entries

[ ] Empty entries

[x] Hidden registry entries (rootkit activity)

[x] Exclusively opened files

[x] Not found files

[x] Files without detailed information

[x] Existing files

[ ] Non-startable services

[ ] Non-startable drivers

[x] Active entries

[x] Disabled entries
 
 

[Common]

-----( %SystemRoot%\Tasks )-----

"Google Software Updater.job" - "Google" - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

"GoogleUpdateTaskMachineCore.job" - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe

"GoogleUpdateTaskMachineUA.job" - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe

"RegistryBooster.job" - "Uniblue Systems Limited" - C:\Program Files\Uniblue\RegistryBooster\rbmonitor.exe
 

[Control Panel Objects]

-----( %SystemRoot%\system32 )-----

"DivXControlPanelApplet.cpl" - "DivX, Inc." - C:\Windows\system32\DivXControlPanelApplet.cpl

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )-----

"QuickTime" - "Apple Inc." - C:\Program Files\QuickTime\QTSystem\QuickTime.cpl
 

[Drivers]

-----( HKLM\SYSTEM\CurrentControlSet\Services )-----

"avgio" (avgio) - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\avgio.sys

"avgntflt" (avgntflt) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avgntflt.sys

"avipbb" (avipbb) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avipbb.sys

"catchme" (catchme) - ? - C:\ComboFix\catchme.sys  (File not found)

"IP in IP Tunnel Driver" (IpInIp) - ? - C:\Windows\System32\DRIVERS\ipinip.sys  (File not found)

"IPX Traffic Filter Driver" (NwlnkFlt) - ? - C:\Windows\System32\DRIVERS\nwlnkflt.sys  (File not found)

"IPX Traffic Forwarder Driver" (NwlnkFwd) - ? - C:\Windows\System32\DRIVERS\nwlnkfwd.sys  (File not found)

"PxHelp20" (PxHelp20) - "Sonic Solutions" - C:\Windows\System32\Drivers\PxHelp20.sys

"ssmdrv" (ssmdrv) - "Avira GmbH" - C:\Windows\System32\DRIVERS\ssmdrv.sys

"upperdev" (upperdev) - ? - C:\Windows\System32\DRIVERS\usbser_lowerflt.sys  (File not found)
 

[Explorer]

-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----

{F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll

-----( HKLM\Software\Classes\Protocols\Filter )-----

{807553E5-5146-11D5-A672-00B0D022E945} "text/xml" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL

-----( HKLM\Software\Classes\Protocols\Handler )-----

{32505114-5902-49B2-880A-1F7738E5A384} "Data Page Plugable Protocal mso-offdap11 Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\WEBCOM~1\11\OWC11.DLL

{3D9F03FA-7A94-11D3-BE81-0050048385D1} "Data Page Pluggable Protocol mso-offdap Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\WEBCOM~1\10\OWC10.DLL

{FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} "IEProtocolHandler Class" - "Skype Technologies" - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL

{0A9007C0-4076-11D3-8789-0000F8105754} "Microsoft Infotech Storage Protocol for IE 4.0" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks )-----

{AEB6717E-7E19-11d0-97EE-00C04FD91972} "{AEB6717E-7E19-11d0-97EE-00C04FD91972}" - ? -   (File not found | COM-object registry key not found)

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----

{911051fa-c21c-4246-b470-070cd8df6dc4} ".cab or .zip files" - ? -   (File not found | COM-object registry key not found)

{1b24a030-9b20-49bc-97ac-1be4426f9e59} "ActiveDirectory Folder" - ? -   (File not found | COM-object registry key not found)

{34449847-FD14-4fc8-A75A-7432F5181EFB} "ActiveDirectory Folder" - ? -   (File not found | COM-object registry key not found)

{0F8604A5-4ECE-4DE1-BA7D-CF10F8AA4F48} "Contacts folder" - ? -   (File not found | COM-object registry key not found)

{2C2577C2-63A7-40e3-9B7F-586602617ECB} "Explorer Query Band" - ? -   (File not found | COM-object registry key not found)

{6872d785-fe43-44cb-9b2a-2df4c5eb13b2} "HotShellExt" - ? - C:\Program Files\eFax Messenger 4.3\J2GShell.dll  (File not found)

{FAC3CBF6-8697-43d0-BAB9-DCD1FCE19D75} "IE User Assist" - ? -   (File not found | COM-object registry key not found)

{B9E1D2CB-CCFF-4AA6-9579-D7A4754030EF} "iTunes" - "Apple Inc." - C:\Program Files\iTunes\iTunesMiniPlayer.dll

{42042206-2D85-11D3-8CFF-005004838597} "Microsoft Office HTML Icon Handler" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\OFFICE11\msohev.dll

{00020d75-0000-0000-c000-000000000046} "Microsoft Office Outlook" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\OFFICE11\MLSHEXT.DLL

{0006F045-0000-0000-C000-000000000046} "Outlook File Icon Extension" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\OFFICE11\OLKFSTUB.DLL

{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4} "RealOne Player Context Menu Class" - "RealNetworks, Inc." - c:\program files\real\realplayer\rpshell.dll

{C8494E42-ACDD-4739-B0FB-217361E4894F} "Sam Account Folder" - ? -   (File not found | COM-object registry key not found)

{E29F9716-5C08-4FCD-955A-119FDB5A522D} "Sam Account Folder" - ? -   (File not found | COM-object registry key not found)

{45AC2688-0253-4ED8-97DE-B5370FA7D48A} "Shell Extension for Malware scanning" - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\shlext.dll

{7F67036B-66F1-411A-AD85-759FB9C5B0DB} "ShellViewRTF" - "XSS" - C:\Windows\System32\ShellvRTF.dll

{BDEADF00-C265-11D0-BCED-00A0C90AB50F} "Web Folders" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\WEBFOL~1\MSONSEXT.DLL

{da67b8ad-e81b-4c70-9b91b417b5e33527} "Windows Search Shell Service" - ? -   (File not found | COM-object registry key not found)
 

[Internet Explorer]

-----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )-----

<binary data> "ITBar7Layout" - ? -   (File not found | COM-object registry key not found)

-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----

{8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.6.0_23" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab

{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} "Java Plug-in 1.6.0_23" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab

{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_23" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\npjpi160_23.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab

{8FFBE65D-2C9C-4669-84BD-5829DC0B603C} "{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}" - ? -   (File not found | COM-object registry key not found) / hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab

-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----

"PDFill PDF Editor" - "PlotSoft LLC" - C:\Program Files\PlotSoft\PDFill\DownloadPDF.exe

{FF059E31-CC5A-4E2E-BF3B-96E929D65503} "Research" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL

-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar )-----

{98889811-442D-49dd-99D7-DC866BE87DBC} "Babylon Toolbar" - "Babylon Ltd." - C:\Program Files\BabylonToolbar\BabylonToolbar\1.4.19.14\BabylonToolbarTlbr.dll

{DB4E9724-F518-4dfd-9C7C-78B52103CAB9} "facemoods Toolbar" - "facemoods.com" - C:\Program Files\facemoods.com\facemoods\1.4.17.4\facemoodsTlbr.dll

<binary data> "SweetIM Toolbar for Internet Explorer" - "SweetIM Technologies Ltd." - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----

{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} "Adobe PDF Reader Link Helper" - "Adobe Systems Incorporated" - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

{2EECD738-5844-4a99-B4B6-146BF802613B} "CescrtHlpr Object" - "Babylon BHO" - C:\Program Files\BabylonToolbar\BabylonToolbar\1.4.19.14\bh\BabylonToolbar.dll

{64182481-4F71-486b-A045-B233BD0DA8FC} "CescrtHlpr Object" - "facemoods.com BHO" - C:\Program Files\facemoods.com\facemoods\1.4.17.4\bh\facemoods.dll

{AA58ED58-01DD-4d91-8333-CF10577473F7} "Google Toolbar Helper" - "Google Inc." - c:\program files\google\googletoolbar2.dll

{AF69DE43-7D58-4638-B6FA-CE66B5AD205D} "Google Toolbar Notifier BHO" - "Google Inc." - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll

{DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2ssv.dll

{3049C3E9-B461-4BC5-8870-4C09146192CA} "RealPlayer Download and Record Plugin for Internet Explorer" - "RealPlayer" - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll

{EEE6C35C-6118-11DC-9C72-001320C79847} "SweetIM Toolbar Helper" - "SweetIM Technologies Ltd." - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll
 

[Logon]

-----( %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup )-----

"desktop.ini" - ? - C:\Users\Markus\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini

-----( %AllUsersProfile%\Microsoft\Windows\Start Menu\Programs\Startup )-----

"desktop.ini" - ? - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini

-----( HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run )-----

"RegistryBooster" - "Uniblue Systems Limited" - "C:\Program Files\Uniblue\RegistryBooster\launcher.exe" delay 20000 

-----( HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\Wds\rdpwd )-----

"StartupPrograms" - ? - rdpclip  (File not found)

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----

"Adobe Reader Speed Launcher" - "Adobe Systems Incorporated" - "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"

"AppleSyncNotifier" - "Apple Inc." - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe

"avgnt" - "Avira GmbH" - "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min

"BabylonToolbar" - "Babylon Ltd." - "C:\Program Files\BabylonToolbar\BabylonToolbar\1.4.19.14\BabylonToolbarsrv.exe" /md I

"DivXUpdate" - ? - "C:\Program Files\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW

"facemoods" - "facemoods.com" - "C:\Program Files\facemoods.com\facemoods\1.4.17.4\facemoodssrv.exe" /md I

"HP Health Check Scheduler" - "Hewlett-Packard" - C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe

"iTunesHelper" - "Apple Inc." - "C:\Program Files\iTunes\iTunesHelper.exe"

"Malwarebytes Anti-Malware (reboot)" - "Malwarebytes Corporation" - "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript

"QuickTime Task" - "Apple Inc." - "C:\Program Files\QuickTime\QTTask.exe" -atboottime

"SunJavaUpdateSched" - "Sun Microsystems, Inc." - "C:\Program Files\Common Files\Java\Java Update\jusched.exe"

"SweetIM" - "SweetIM Technologies Ltd." - C:\Program Files\SweetIM\Messenger\SweetIM.exe

"TkBellExe" - "RealNetworks, Inc." - "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot
 

[Print Monitors]

-----( HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors )-----

"CUSTPDF Writer Monitor" - ? - C:\Windows\system32\custmon2k.dll  (File found, but it contains no detailed information)

"Microsoft Document Imaging Writer Monitor" - "Microsoft Corporation" - C:\Windows\system32\mdimon.dll

"PCL hpz3l4v2" - "Hewlett-Packard Company" - C:\Windows\system32\hpz3l4v2.dll

"Redmon" - ? - C:\Windows\system32\redmonnt.dll  (File found, but it contains no detailed information)
 

[Services]

-----( HKLM\SYSTEM\CurrentControlSet\Services )-----

"@C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe,-100" (WPFFontCache_v0400) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe

"Apple Mobile Device" (Apple Mobile Device) - "Apple Inc." - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

"Avira AntiVir Guard" (AntiVirService) - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\avguard.exe

"Avira AntiVir Planer" (AntiVirSchedulerService) - "Avira GmbH" - C:\Program Files\Avira\AntiVir Desktop\sched.exe

"Google Software Updater" (gusvc) - "Google" - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

"Google Update Service (gupdate1c9deaa14fed3cc)" (gupdate1c9deaa14fed3cc) - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe

"HP Health Check Service" (HP Health Check Service) - "Hewlett-Packard" - C:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe

"hpqwmiex" (hpqwmiex) - "Hewlett-Packard Development Company, L.P." - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe

"InstallDriver Table Manager" (IDriverT) - "Macrovision Corporation" - C:\Program Files\Roxio\Roxio MyDVD Basic v9\InstallShield\Driver\1050\Intel 32\IDriverT.exe

"iPod Service" (iPod Service) - "Apple Inc." - C:\Program Files\iPod\bin\iPodService.exe

"Microsoft .NET Framework NGEN v4.0.30319_X86" (clr_optimization_v4.0.30319_32) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

"Net Driver HPZ12" (Net Driver HPZ12) - "Hewlett-Packard" - C:\Windows\system32\HPZinw12.dll

"Office Source Engine" (ose) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE

"Pml Driver HPZ12" (Pml Driver HPZ12) - "Hewlett-Packard" - C:\Windows\system32\HPZipm12.dll

"RoxMediaDB9" (RoxMediaDB9) - "Sonic Solutions" - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe

"ServiceLayer" (ServiceLayer) - "Nokia." - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
 

===[ Logfile end ]=========================================[ Logfile end ]===
 

If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru

Code:

MBRCheck, version 1.2.3

(c) 2010, AD
 

Command-line:                        

Windows Version:                Windows Vista Home Premium Edition

Windows Information:                Service Pack 2 (build 6002), 32-bit

Base Board Manufacturer:        Hewlett-Packard

BIOS Manufacturer:                Hewlett-Packard

System Manufacturer:                Hewlett-Packard

System Product Name:                Presario C500 (RT154EA#ABU)

Logical Drives Mask:                0x0000001c
 

Kernel Drivers (total 148):

  0x82200000 \SystemRoot\system32\ntkrnlpa.exe

  0x825BA000 \SystemRoot\system32\hal.dll

  0x80401000 \SystemRoot\system32\kdcom.dll

  0x80408000 \SystemRoot\system32\mcupdate_GenuineIntel.dll

  0x80478000 \SystemRoot\system32\PSHED.dll

  0x80489000 \SystemRoot\system32\BOOTVID.dll

  0x80491000 \SystemRoot\system32\CLFS.SYS

  0x804D2000 \SystemRoot\system32\CI.dll

  0x80608000 \SystemRoot\system32\drivers\Wdf01000.sys

  0x80684000 \SystemRoot\system32\drivers\WDFLDR.SYS

  0x80691000 \SystemRoot\system32\drivers\acpi.sys

  0x806D7000 \SystemRoot\system32\drivers\WMILIB.SYS

  0x806E0000 \SystemRoot\system32\drivers\msisadrv.sys

  0x806E8000 \SystemRoot\system32\drivers\pci.sys

  0x8070F000 \SystemRoot\System32\drivers\partmgr.sys

  0x8071E000 \SystemRoot\system32\DRIVERS\compbatt.sys

  0x80721000 \SystemRoot\system32\DRIVERS\BATTC.SYS

  0x8072B000 \SystemRoot\system32\drivers\volmgr.sys

  0x8073A000 \SystemRoot\System32\drivers\volmgrx.sys

  0x80784000 \SystemRoot\system32\drivers\intelide.sys

  0x8078B000 \SystemRoot\system32\drivers\PCIIDEX.SYS

  0x80799000 \SystemRoot\System32\drivers\mountmgr.sys

  0x807A9000 \SystemRoot\system32\drivers\atapi.sys

  0x807B1000 \SystemRoot\system32\drivers\ataport.SYS

  0x807CF000 \SystemRoot\system32\drivers\msahci.sys

  0x805B2000 \SystemRoot\system32\drivers\fltmgr.sys

  0x807D9000 \SystemRoot\system32\drivers\fileinfo.sys

  0x807E9000 \SystemRoot\System32\Drivers\PxHelp20.sys

  0x82C01000 \SystemRoot\System32\Drivers\ksecdd.sys

  0x82C72000 \SystemRoot\system32\drivers\ndis.sys

  0x82D7D000 \SystemRoot\system32\drivers\msrpc.sys

  0x82DA8000 \SystemRoot\system32\drivers\NETIO.SYS

  0x82E0A000 \SystemRoot\System32\drivers\tcpip.sys

  0x82EF4000 \SystemRoot\System32\drivers\fwpkclnt.sys

  0x86404000 \SystemRoot\System32\Drivers\Ntfs.sys

  0x86514000 \SystemRoot\system32\drivers\volsnap.sys

  0x8654D000 \SystemRoot\System32\Drivers\spldr.sys

  0x86555000 \SystemRoot\System32\Drivers\mup.sys

  0x86564000 \SystemRoot\System32\drivers\ecache.sys

  0x8658B000 \SystemRoot\system32\drivers\disk.sys

  0x8659C000 \SystemRoot\system32\drivers\CLASSPNP.SYS

  0x865BD000 \SystemRoot\system32\drivers\crcdisk.sys

  0x865E8000 \SystemRoot\system32\DRIVERS\tunnel.sys

  0x865F3000 \SystemRoot\system32\DRIVERS\tunmp.sys

  0x82F0F000 \SystemRoot\system32\DRIVERS\intelppm.sys

  0x865FC000 \SystemRoot\system32\DRIVERS\cpqbttn.sys

  0x82F1E000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS

  0x82F2E000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS

  0x82F35000 \SystemRoot\system32\DRIVERS\wmiacpi.sys

  0x89E0E000 \SystemRoot\system32\DRIVERS\igdkmd32.sys

  0x8A4BC000 \SystemRoot\System32\drivers\dxgkrnl.sys

  0x8A55C000 \SystemRoot\System32\drivers\watchdog.sys

  0x8A568000 \SystemRoot\system32\DRIVERS\HDAudBus.sys

  0x82F3E000 \SystemRoot\system32\DRIVERS\bcmwl6.sys

  0x8A5F5000 \SystemRoot\system32\DRIVERS\usbuhci.sys

  0x8A606000 \SystemRoot\system32\DRIVERS\USBPORT.SYS

  0x8A644000 \SystemRoot\system32\DRIVERS\usbehci.sys

  0x8A653000 \SystemRoot\system32\DRIVERS\Rtnicxp.sys

  0x8A664000 \SystemRoot\system32\DRIVERS\CmBatt.sys

  0x8A668000 \SystemRoot\system32\DRIVERS\i8042prt.sys

  0x8A67B000 \SystemRoot\system32\DRIVERS\kbdclass.sys

  0x8A686000 \SystemRoot\system32\DRIVERS\SynTP.sys

  0x8A6B1000 \SystemRoot\system32\DRIVERS\USBD.SYS

  0x8A6B3000 \SystemRoot\system32\DRIVERS\mouclass.sys

  0x8A6BE000 \SystemRoot\system32\DRIVERS\cdrom.sys

  0x8A6D6000 \SystemRoot\System32\Drivers\GEARAspiWDM.sys

  0x8A6D9000 \SystemRoot\system32\DRIVERS\serscan.sys

  0x8A6E1000 \SystemRoot\system32\DRIVERS\msiscsi.sys

  0x8A710000 \SystemRoot\system32\DRIVERS\storport.sys

  0x8A751000 \SystemRoot\system32\DRIVERS\TDI.SYS

  0x8A75C000 \SystemRoot\system32\DRIVERS\rasl2tp.sys

  0x8A773000 \SystemRoot\system32\DRIVERS\ndistapi.sys

  0x8A77E000 \SystemRoot\system32\DRIVERS\ndiswan.sys

  0x8A7A1000 \SystemRoot\system32\DRIVERS\raspppoe.sys

  0x8A7B0000 \SystemRoot\system32\DRIVERS\raspptp.sys

  0x8A7C4000 \SystemRoot\system32\DRIVERS\rassstp.sys

  0x8A7D9000 \SystemRoot\system32\DRIVERS\termdd.sys

  0x8A7E9000 \SystemRoot\system32\DRIVERS\swenum.sys

  0x82FC4000 \SystemRoot\system32\DRIVERS\ks.sys

  0x8A7EB000 \SystemRoot\system32\DRIVERS\mssmbios.sys

  0x89E00000 \SystemRoot\system32\DRIVERS\umbus.sys

  0x8A7F5000 \SystemRoot\system32\DRIVERS\kbdhid.sys

  0x8AA09000 \SystemRoot\system32\DRIVERS\usbhub.sys

  0x8AA3E000 \SystemRoot\System32\Drivers\NDProxy.SYS

  0x8AA4F000 \SystemRoot\system32\drivers\CHDART.sys

  0x8AA78000 \SystemRoot\system32\drivers\portcls.sys

  0x8AAA5000 \SystemRoot\system32\drivers\drmk.sys

  0x8AACA000 \SystemRoot\system32\DRIVERS\HSXHWAZL.sys

  0x8AE0B000 \SystemRoot\system32\DRIVERS\HSX_DPV.sys

  0x8AF0E000 \SystemRoot\system32\DRIVERS\HSX_CNXT.sys

  0x8AFC2000 \SystemRoot\system32\drivers\modem.sys

  0x8AFCF000 \SystemRoot\system32\DRIVERS\hidusb.sys

  0x8AFD8000 \SystemRoot\system32\DRIVERS\mouhid.sys

  0x8AFE0000 \SystemRoot\System32\Drivers\Fs_Rec.SYS

  0x8AFE9000 \SystemRoot\System32\Drivers\Null.SYS

  0x8AFF0000 \SystemRoot\System32\Drivers\Beep.SYS

  0x8AB07000 \SystemRoot\System32\drivers\vga.sys

  0x8AB13000 \SystemRoot\System32\drivers\VIDEOPRT.SYS

  0x8AFF7000 \SystemRoot\System32\DRIVERS\RDPCDD.sys

  0x8AE00000 \SystemRoot\system32\drivers\rdpencdd.sys

  0x8AB34000 \SystemRoot\System32\Drivers\Msfs.SYS

  0x8AB3F000 \SystemRoot\System32\Drivers\Npfs.SYS

  0x8AB4D000 \SystemRoot\System32\DRIVERS\rasacd.sys

  0x8AB56000 \SystemRoot\system32\DRIVERS\tdx.sys

  0x8AB6C000 \SystemRoot\system32\DRIVERS\smb.sys

  0x8AB80000 \SystemRoot\system32\drivers\afd.sys

  0x8ABC8000 \SystemRoot\System32\DRIVERS\netbt.sys

  0x82DE3000 \SystemRoot\system32\DRIVERS\pacer.sys

  0x82FEE000 \SystemRoot\system32\DRIVERS\netbios.sys

  0x805E4000 \SystemRoot\system32\DRIVERS\wanarp.sys

  0x8ABFA000 \SystemRoot\system32\DRIVERS\ssmdrv.sys

  0x8B206000 \SystemRoot\system32\DRIVERS\rdbss.sys

  0x8B242000 \SystemRoot\system32\drivers\nsiproxy.sys

  0x8B24C000 \SystemRoot\System32\Drivers\dfsc.sys

  0x8B263000 \SystemRoot\system32\DRIVERS\avipbb.sys

  0x8B289000 \??\C:\Program Files\Avira\AntiVir Desktop\avgio.sys

  0x8B28B000 \SystemRoot\System32\Drivers\crashdmp.sys

  0x8B298000 \SystemRoot\System32\Drivers\dump_dumpata.sys

  0x8B2A3000 \SystemRoot\System32\Drivers\dump_msahci.sys

  0x92C70000 \SystemRoot\System32\win32k.sys

  0x8B2AD000 \SystemRoot\System32\drivers\Dxapi.sys

  0x8B2B7000 \SystemRoot\system32\DRIVERS\monitor.sys

  0x92E90000 \SystemRoot\System32\TSDDD.dll

  0x92EB0000 \SystemRoot\System32\cdd.dll

  0x8B2C6000 \SystemRoot\system32\drivers\luafv.sys

  0x8B2E1000 \SystemRoot\system32\DRIVERS\avgntflt.sys

  0x8B2FE000 \SystemRoot\system32\DRIVERS\lltdio.sys

  0x8B30E000 \SystemRoot\system32\DRIVERS\nwifi.sys

  0x8B338000 \SystemRoot\system32\DRIVERS\ndisuio.sys

  0x8B342000 \SystemRoot\system32\DRIVERS\rspndr.sys

  0xA6406000 \SystemRoot\system32\drivers\spsys.sys

  0xA64B6000 \SystemRoot\system32\drivers\HTTP.sys

  0xA6523000 \SystemRoot\System32\DRIVERS\srvnet.sys

  0xA6540000 \SystemRoot\system32\DRIVERS\bowser.sys

  0xA6559000 \SystemRoot\System32\drivers\mpsdrv.sys

  0xA656E000 \SystemRoot\system32\drivers\mrxdav.sys

  0xA658F000 \SystemRoot\system32\DRIVERS\mrxsmb.sys

  0xA65AE000 \SystemRoot\system32\DRIVERS\mrxsmb10.sys

  0xA65E7000 \SystemRoot\system32\DRIVERS\mrxsmb20.sys

  0x8B355000 \SystemRoot\System32\DRIVERS\srv2.sys

  0x8B37D000 \SystemRoot\System32\DRIVERS\srv.sys

  0xA6400000 \SystemRoot\system32\DRIVERS\mdmxsdk.sys

  0xAB40E000 \SystemRoot\system32\drivers\peauth.sys

  0xAB4EC000 \SystemRoot\System32\Drivers\secdrv.SYS

  0xAB4F6000 \SystemRoot\System32\drivers\tcpipreg.sys

  0xAB502000 \SystemRoot\system32\DRIVERS\xaudio.sys

  0xAB50A000 \SystemRoot\system32\DRIVERS\cdfs.sys

  0x77250000 \Windows\System32\ntdll.dll
 

Processes (total 62):

       0 System Idle Process

       4 System

     380 C:\Windows\System32\smss.exe

     432 csrss.exe

     484 C:\Windows\System32\wininit.exe

     492 csrss.exe

     540 C:\Windows\System32\winlogon.exe

     560 C:\Windows\System32\services.exe

     576 C:\Windows\System32\lsass.exe

     584 C:\Windows\System32\lsm.exe

     748 C:\Windows\System32\svchost.exe

     816 C:\Windows\System32\svchost.exe

     852 C:\Windows\System32\svchost.exe

     940 C:\Windows\System32\svchost.exe

    1012 C:\Windows\System32\svchost.exe

    1024 C:\Windows\System32\svchost.exe

    1104 C:\Windows\System32\audiodg.exe

    1124 C:\Windows\System32\svchost.exe

    1144 C:\Windows\System32\SLsvc.exe

    1172 C:\Windows\System32\svchost.exe

    1332 C:\Windows\System32\svchost.exe

    1560 C:\Windows\System32\LEXBCES.EXE

    1604 C:\Windows\System32\spoolsv.exe

    1612 C:\Windows\System32\LEXPPS.EXE

    1688 C:\Windows\System32\svchost.exe

    1968 C:\Windows\System32\dwm.exe

    2008 C:\Windows\explorer.exe

    2020 C:\Windows\System32\taskeng.exe

     404 C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

     420 C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

     480 C:\Windows\System32\igfxtray.exe

     552 C:\Windows\System32\hkcmd.exe

     372 C:\Windows\System32\igfxpers.exe

     920 C:\Program Files\iTunes\iTunesHelper.exe

    1060 C:\Program Files\Avira\AntiVir Desktop\avgnt.exe

    1136 C:\Program Files\Common Files\Real\Update_OB\realsched.exe

     744 C:\Windows\System32\svchost.exe

    1296 C:\Program Files\DivX\DivX Update\DivXUpdate.exe

     624 C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Service.exe

    1696 C:\Program Files\Common Files\Java\Java Update\jusched.exe

     980 C:\Program Files\SweetIM\Messenger\SweetIM.exe

    1436 C:\Program Files\Windows Sidebar\sidebar.exe

     448 C:\Windows\ehome\ehtray.exe

    2116 C:\Windows\System32\svchost.exe

    2156 C:\Windows\System32\svchost.exe

    2188 C:\Windows\System32\svchost.exe

    2240 C:\Windows\System32\svchost.exe

    2300 C:\Windows\System32\svchost.exe

    2360 C:\Windows\System32\SearchIndexer.exe

    2436 C:\Windows\System32\drivers\XAudio.exe

    2456 C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe

    2928 C:\Windows\System32\taskeng.exe

    2960 C:\Windows\System32\taskeng.exe

    2968 C:\Program Files\Uniblue\RegistryBooster\rbmonitor.exe

    3380 C:\Windows\ehome\ehmsas.exe

    3768 C:\Program Files\iPod\bin\iPodService.exe

    3968 C:\Windows\System32\svchost.exe

    1944 C:\Program Files\Mozilla Firefox\firefox.exe

    3248 C:\Windows\System32\SearchProtocolHost.exe

    3364 C:\Windows\System32\SearchFilterHost.exe

    2568 C:\Windows\System32\conime.exe

    2072 C:\Users\Markus\Desktop\MBRCheck.exe
 

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`00007e00  (NTFS)

\\.\D: --> \\.\PhysicalDrive0 at offset 0x00000011`5a4a4a00  (NTFS)
 

PhysicalDrive0 Model Number: ST98823AS, Rev: 7.24    
 

      Size  Device Name          MBR Status

  --------------------------------------------

     74 GB  \\.\PhysicalDrive0   Unknown MBR code

            SHA1: D94F393960D1CD66C2071F2D7260A5196DF105AC
 
 

Found non-standard or infected MBR.

Enter 'Y' and hit ENTER for more options, or 'N' to exit: 
 

Done!

Jetzt hat alles geklappt.
Habe seit ich eben meinen laptob hochgefahren habe,
nicht mehr meine Google-Start-Standartseite sondern
dieses elendige Babylon mit all den unsinnigen icon...
Habe beim Osam-Scan auch gesehen, dass er dieses
als "gefährdend" eingestuft hat...

Gruss masi76

Zitat:

74 GB \\.\PhysicalDrive0 Unknown MBR code
SHA1: D94F393960D1CD66C2071F2D7260A5196DF105AC

Hast Du noch andere Betriebssysteme außer Vista installiert?

Wenn nicht: Schau mal hier => Vista Notfall/Recovery-CD 32-Bit - Dr. Windows

Lad das iso runter, brenn es zB mit ImgBurn per Imagebrennfunktion auf eine CD und starte damit den Rechner (von dieser CD booten).

Falls Du eine normale Vista-Installations-DVD hast, brauchst Du das o.g. Image nicht sondern kannst einfach von der Vista-DVD booten.

Klick auf Computerreparaturoptionen, weiter, Eingabeaufforderung - die Konsole öffnet sich. Da bitte bootrec.exe /fixboot eintippen (mit enter bestätigen), dann bootrec.exe /fixmbr eintippen (mit enter bestätigen) - Rechner neustarten, CD vorher rausnehmen.

Hi Arne,

gibt´s noch andere Möglichkeiten, wie wir weiter verfahren können?

Gruss masi76