Trojaner-Board - Backdoor:Win32/Cbot.B - Trojan:Win32/FakeSysdef

Trojaner-Board (https://www.trojaner-board.de/)

- Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)

- - Backdoor:Win32/Cbot.B - Trojan:Win32/FakeSysdef (https://www.trojaner-board.de/98501-backdoor-win32-cbot-b-trojan-win32-fakesysdef.html)

unhide abgeschlossen und Daten sind wieder sichtbar.

soweit schonmal vielen, vielen Dank.
gehts noch weiter?

Dann bitte jetzt CF ausführen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix

Lade dir ComboFix hier herunter auf deinen Desktop. Benenne es beim Runterladen um in cofi.exe.

http://saved.im/mtm0nzyzmzd5/cofi.jpg

Dann folgende Anleitung durchlesen und abarbeiten -> CCleaner Systembereinigung

Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.

Starte cofi.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.

Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.

Wichtiger Hinweis:

Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

so ein Mist : habe alles augeführt und nach dem neustart ist mein Laptop( vielleicht zu heiß geworden?) ausgegangen, und zwar beim erstellen der text datei :

ComboFix 11-05-01.04 - Basti 02.05.2011 17:09:45.1.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.49.1031.18.3069.1750 [GMT 2:00]
ausgeführt von:: C:\Users\Basti\Desktop\cofi.exe
AV: Microsoft Security Essentials *Disabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160}
SP: Microsoft Security Essentials *Disabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

soll ich die schritte nochmal durchgehen bzw combofix nochmal starten?

Combofix Logfile:

Code:

ComboFix 11-05-01.04 - Basti 02.05.2011  18:25:46.3.2 - x86

Microsoft® Windows Vista™ Home Premium   6.0.6001.1.1252.49.1031.18.3069.1887 [GMT 2:00]

ausgeführt von:: c:\users\Basti\Desktop\cofi.exe

AV: Microsoft Security Essentials *Disabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160}

SP: Microsoft Security Essentials *Disabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

.

(((((((((((((((((((((((   Dateien erstellt von 2011-04-02 bis 2011-05-02  ))))))))))))))))))))))))))))))

.

.

2011-05-02 16:34 . 2011-05-02 16:34        --------        d-----w-        c:\users\Basti\AppData\Local\temp

2011-05-02 16:34 . 2011-05-02 16:34        --------        d-----w-        c:\users\Default\AppData\Local\temp

2011-05-02 15:41 . 2011-04-18 07:15        7071056        ----a-w-        c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{2B6ED82E-EE30-4BC3-83D2-3C9B06D0476D}\mpengine.dll

2011-05-02 12:51 . 2011-05-02 12:51        --------        d-----w-        C:\_OTL

2011-04-29 20:56 . 2011-04-29 20:56        --------        d-----w-        c:\users\Basti\AppData\Roaming\Malwarebytes

2011-04-29 20:55 . 2010-12-20 16:09        38224        ----a-w-        c:\windows\system32\drivers\mbamswissarmy.sys

2011-04-29 20:55 . 2011-04-29 20:55        --------        d-----w-        c:\programdata\Malwarebytes

2011-04-29 20:55 . 2010-12-20 16:08        20952        ----a-w-        c:\windows\system32\drivers\mbam.sys

2011-04-29 20:55 . 2011-04-29 20:55        --------        d-----w-        c:\program files\Malwarebytes' Anti-Malware

2011-04-29 01:01 . 2011-04-29 01:01        --------        d-----w-        C:\864b01153e3fdf37d2b00c296bc673

2011-04-28 14:44 . 2011-03-03 14:56        28672        ----a-w-        c:\windows\system32\Apphlpdm.dll

2011-04-28 14:44 . 2011-03-03 13:01        4240384        ----a-w-        c:\windows\system32\GameUXLegacyGDFs.dll

2011-04-27 23:03 . 2011-04-27 23:03        --------        d-----w-        c:\program files\CCleaner

2011-04-27 16:58 . 2011-04-27 16:58        --------        d-----w-        c:\program files\Autorun Angel

2011-04-24 22:47 . 2011-04-24 22:47        --------        d-----w-        c:\users\Basti\AppData\Local\Hewlett-Packard

2011-04-24 22:39 . 2011-04-18 07:15        7071056        ----a-w-        c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll

2011-04-23 11:43 . 2011-04-23 11:43        --------        d-----w-        c:\users\Default\AppData\Roaming\Apple Computer

2011-04-23 11:43 . 2011-04-23 11:43        --------        d-----w-        c:\users\Default\AppData\Local\Apple Computer

2011-04-23 09:33 . 2011-04-23 09:33        --------        d-----w-        c:\users\Default\AppData\Local\Microsoft Help

2011-04-23 03:50 . 2010-11-30 09:43        439632        ------w-        c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{833E3C26-5181-43A0-B116-3A6D25999A37}\gapaengine.dll

2011-04-23 02:51 . 2011-04-23 02:53        --------        d-----w-        c:\program files\Microsoft Security Client

2011-04-22 17:11 . 2011-05-01 15:16        --------        d-----w-        c:\programdata\Kaspersky Lab Setup Files

2011-04-22 12:42 . 2011-04-11 07:04        7071056        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{DD666115-A1E9-4B59-BE2B-A1A96B8996FD}\mpengine.dll

2011-04-14 17:59 . 2011-02-16 15:29        34304        ----a-w-        c:\windows\system32\atmlib.dll

2011-04-14 17:59 . 2011-02-16 13:24        292864        ----a-w-        c:\windows\system32\atmfd.dll

2011-04-14 17:59 . 2011-02-22 12:52        213504        ----a-w-        c:\windows\system32\drivers\mrxsmb10.sys

2011-04-14 17:59 . 2011-02-22 12:52        79360        ----a-w-        c:\windows\system32\drivers\mrxsmb20.sys

2011-04-14 17:59 . 2011-02-22 12:51        105984        ----a-w-        c:\windows\system32\drivers\mrxsmb.sys

2011-04-14 17:59 . 2011-02-22 12:51        69632        ----a-w-        c:\windows\system32\drivers\bowser.sys

2011-04-14 17:59 . 2011-03-10 16:12        1161728        ----a-w-        c:\windows\system32\mfc42u.dll

2011-04-14 17:59 . 2011-03-10 16:12        1136640        ----a-w-        c:\windows\system32\mfc42.dll

2011-04-14 17:59 . 2011-02-18 13:31        304640        ----a-w-        c:\windows\system32\drivers\srv.sys

2011-04-14 17:59 . 2011-02-18 13:31        146432        ----a-w-        c:\windows\system32\drivers\srv2.sys

2011-04-14 17:59 . 2011-02-18 13:31        102400        ----a-w-        c:\windows\system32\drivers\srvnet.sys

2011-04-14 17:57 . 2011-03-03 10:49        2409784        ----a-w-        c:\program files\Windows Mail\OESpamFilter.dat

2011-04-12 13:02 . 2011-04-12 13:02        --------        d-----w-        c:\windows\system32\EventProviders

2011-04-07 23:50 . 2010-01-01 08:00        135168        ----a-w-        c:\program files\Mozilla Firefox\components\browsercomps.dll

2011-04-07 23:50 . 2011-03-08 23:36        49152        ----a-w-        c:\program files\Mozilla Firefox\distribution\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}\components\XPATLCOM.dll

2011-04-07 23:50 . 2010-01-01 08:00        8704        ----a-w-        c:\program files\Mozilla Firefox\mozalloc.dll

2011-04-07 23:50 . 2010-01-01 08:00        774144        ----a-w-        c:\program files\Mozilla Firefox\mozsqlite3.dll

2011-04-07 23:50 . 2010-01-01 08:00        720896        ----a-w-        c:\program files\Mozilla Firefox\libGLESv2.dll

2011-04-07 23:50 . 2010-01-01 08:00        1974616        ----a-w-        c:\program files\Mozilla Firefox\D3DCompiler_42.dll

2011-04-07 23:50 . 2010-01-01 08:00        1892184        ----a-w-        c:\program files\Mozilla Firefox\d3dx9_42.dll

2011-04-07 23:50 . 2010-01-01 08:00        1867776        ----a-w-        c:\program files\Mozilla Firefox\mozjs.dll

2011-04-07 23:50 . 2010-01-01 08:00        135168        ----a-w-        c:\program files\Mozilla Firefox\libEGL.dll

.

.

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2011-03-03 14:56 . 2011-04-28 14:44        173056        ----a-w-        c:\windows\apppatch\AcXtrnal.dll

2011-03-03 14:56 . 2011-04-28 14:44        459776        ----a-w-        c:\windows\apppatch\AcSpecfc.dll

2011-03-03 14:56 . 2011-04-28 14:44        2153984        ----a-w-        c:\windows\apppatch\AcGenral.dll

2011-03-03 14:56 . 2011-04-28 14:44        541696        ----a-w-        c:\windows\apppatch\AcLayers.dll

2011-02-02 20:40 . 2010-05-06 01:00        472808        ----a-w-        c:\windows\system32\deployJava1.dll

2010-01-01 08:00 . 2011-04-07 23:50        135168        ----a-w-        c:\program files\mozilla firefox\components\browsercomps.dll

.

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-21 1233920]

"LightScribe Control Panel"="c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe" [2008-02-26 2289664]

"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952]

"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-01-21 61440]

"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-01-18 1033512]

"UCam_Menu"="c:\program files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" [2007-12-24 222504]

"QlbCtrl.exe"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2008-03-14 202032]

"OnScreenDisplay"="c:\program files\Hewlett-Packard\HP QuickTouch\HPKBDAPP.exe" [2007-11-01 554288]

"HP Health Check Scheduler"="c:\program files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe" [2008-04-15 70912]

"HP Software Update"="c:\program files\Hp\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]

"hpWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2007-11-20 488752]

"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-03-18 421888]

"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-06-15 141624]

"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-10-29 249064]

"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2010-11-30 997408]

"Malwarebytes' Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2010-12-20 963976]

.

c:\users\Basti\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

OpenOffice.org 3.2.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2010-5-20 1195008]

.

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

BTTray.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2008-1-16 727592]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]

@="Service"

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

@="Driver"

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ICQ]

2011-01-05 08:18        133432        ----a-w-        c:\program files\ICQ7.1\ICQ.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]

2007-01-19 10:55        5674352        ----a-w-        c:\program files\MSN Messenger\msnmsgr.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]

"DisableMonitoring"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]

"DisableMonitoring"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]

"DisableMonitoring"=dword:00000001

.

R1 MpKsl2aa47320;MpKsl2aa47320;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{CA4F610B-8554-4819-9F87-A07676D91B2E}\MpKsl2aa47320.sys [x]

R1 MpKsl2bc25f13;MpKsl2bc25f13;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{4C690F24-9248-496F-8A71-9857976DD880}\MpKsl2bc25f13.sys [x]

R1 MpKsl605b82a4;MpKsl605b82a4;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{4C690F24-9248-496F-8A71-9857976DD880}\MpKsl605b82a4.sys [x]

R1 MpKsl91d2fe12;MpKsl91d2fe12;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{D6D0CB9E-5D18-428D-BFBB-395754A19FC4}\MpKsl91d2fe12.sys [x]

R1 MpKslbbca455d;MpKslbbca455d;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{EACB07E9-977D-4BC1-8F99-AB480491753A}\MpKslbbca455d.sys [x]

R1 MpKslf3bdd319;MpKslf3bdd319;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{EACB07E9-977D-4BC1-8F99-AB480491753A}\MpKslf3bdd319.sys [x]

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]

R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-07-20 136176]

R3 gupdatem;Google Update-Dienst (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2010-07-20 136176]

R3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\DRIVERS\MpNWMon.sys [2010-10-24 43392]

R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [2010-10-24 54144]

R3 NisSrv;Microsoft-Netzwerkinspektion;c:\program files\Microsoft Security Client\Antimalware\NisSrv.exe [2010-11-11 206360]

R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]

S1 M9207;LifeView M9207 USB Digital TV BOX;c:\windows\system32\DRIVERS\M9207BDA.sys [2005-09-23 36096]

S2 AESTFilters;Andrea ST Filters Service;c:\windows\System32\DriverStore\FileRepository\stwrt.inf_9a642328\aestsrv.exe [2008-02-12 73728]

S2 ezSharedSvc;Easybits Shared Services for Windows;c:\windows\system32\svchost.exe [2008-01-21 21504]

S2 hpsrv;HP Service;c:\windows\system32\Hpservice.exe [2008-03-18 19456]

S2 Recovery Service for Windows;Recovery Service for Windows;c:\windows\SMINST\BLService.exe [2008-03-26 341328]

S3 Com4QLBEx;Com4QLBEx;c:\program files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe [2008-04-03 193840]

S3 enecir;ENE CIR Receiver;c:\windows\system32\DRIVERS\enecir.sys [2008-01-24 52736]

S3 JMCR;JMCR;c:\windows\system32\DRIVERS\jmcr.sys [2008-04-11 84240]

S3 jumi;%Jumi%;c:\windows\system32\DRIVERS\jumi.sys [2010-06-03 13112]

.

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

bthsvcs        REG_MULTI_SZ           BthServ

.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost  - NetSvcs

ezSharedSvc

.

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]

2008-02-26 12:06        451872        ----a-w-        c:\program files\Common Files\LightScribe\LSRunOnce.exe

.

Inhalt des "geplante Tasks" Ordners

.

2011-05-02 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files\Google\Update\GoogleUpdate.exe [2010-07-20 10:07]

.

2011-05-02 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files\Google\Update\GoogleUpdate.exe [2010-07-20 10:07]

.

2011-05-02 c:\windows\Tasks\User_Feed_Synchronization-{4AD6CB10-A3E1-46A1-808C-09598B52C3FE}.job

- c:\windows\system32\msfeedssync.exe [2008-01-21 02:24]

.

.

------- Zusätzlicher Suchlauf -------

.

uStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=de_de&c=83&bd=Pavilion&pf=cnnb

mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=de_de&c=83&bd=Pavilion&pf=cnnb

IE: &AOL Toolbar-Suche - c:\programdata\AOL\ieToolbar\resources\de-DE\local\search.html

IE: Bild an &Bluetooth-Gerät senden... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm

IE: Free YouTube Download - c:\users\Basti\AppData\Roaming\DVDVideoSoftIEHelpers\youtubedownload.htm

IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000

IE: Seite an &Bluetooth-Gerät senden... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm

IE: {{71BFC818-0CED-42D6-9C87-5142918957EE} - c:\program files\ICQ7.1\ICQ.exe

FF - ProfilePath - c:\users\Basti\AppData\Roaming\Mozilla\Firefox\Profiles\la5trnmw.default\

FF - prefs.js: browser.search.selectedEngine - Google

FF - prefs.js: browser.startup.homepage - hxxp://de.yahoo.com/

.

- - - - Entfernte verwaiste Registrierungseinträge - - - -

.

URLSearchHooks-{EEE6C35D-6118-11DC-9C72-001320C79847} - c:\program files\SweetIM\Toolbars\Internet Explorer\mgHelper.dll

WebBrowser-{EEE6C35B-6118-11DC-9C72-001320C79847} - (no file)

HKLM-Run-SysTrayApp - %ProgramFiles%\IDT\WDM\sttray.exe

.

.

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover

Rootkit scan 2011-05-02 18:34

Windows 6.0.6001 Service Pack 1 NTFS

.

Scanne versteckte Prozesse... 

.

Scanne versteckte Autostarteinträge... 

.

Scanne versteckte Dateien... 

.

Scan erfolgreich abgeschlossen

versteckte Dateien: 0

.

**************************************************************************

.

--------------------- Gesperrte Registrierungsschluessel ---------------------

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

--------------------- Durch laufende Prozesse gestartete DLLs ---------------------

.

- - - - - - - > 'Explorer.exe'(5064)

c:\windows\system32\btmmhook.dll

.

Zeit der Fertigstellung: 2011-05-02  18:37:16

ComboFix-quarantined-files.txt  2011-05-02 16:37

.

Vor Suchlauf: 1.535.115.264 Bytes frei

Nach Suchlauf: 1.430.265.856 Bytes frei

.

- - End Of File - - 7386F274D42B0F53E6EF4EDBEC7533A1

--- --- ---

Ok. Bitte nun Logs mit GMER und OSAM erstellen und posten.
GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus - die Online-Abfrage durch OSAM bitte überspringen.
Bei OSAM bitte darauf auch achten, dass Du das Log auch als *.log und nicht *.html oder so abspeicherst.

Downloade Dir danach bitte MBRCheck (by a_d_13) und speichere die Datei auf dem Desktop.

Doppelklick auf die MBRCheck.exe.
Vista und Win7 User mit Rechtsklick "als Administrator starten"
Das Tool braucht nur wenige Sekunden.
Danach solltest du eine MBRCheck_<Datum>_<Uhrzeit>.txt auf dem Desktop finden.

Poste mir bitte den Inhalt des .txt Dokumentes

GMER funktioniert nicht und schließt dann automatisch, daher geh ich dann jetzt zu OSAM über:kaffee:

Ich kann die OSAM RAR Datei irgendwie nicht entpacken. So als wenn ich kein geeignetes Programm dafür hätte.

wie entpacke ich das hxxp://www2.online-solutions.ru/en/download_file.php?p=131115 ?

Entschuldige, hab grade so gar keinen Durchblick.

WinRAR oder 7zip nutzen!

:) danke.
OSAM Logfile:

Code:

Report of OSAM: Autorun Manager v5.0.11926.0

Online Solutions. Complex Protection for Information Systems

Saved at 22:39:29 on 02.05.2011
 

OS: Windows Vista Home Premium Edition Service Pack 1 (Build 6001), 32-bit

Default Browser: Mozilla Corporation Firefox 4.0
 

Scanner Settings

[x] Rootkits detection (hidden registry)

[x] Rootkits detection (hidden files)

[x] Retrieve files information

[x] Check Microsoft signatures
 

Filters

[ ] Trusted entries

[ ] Empty entries

[x] Hidden registry entries (rootkit activity)

[x] Exclusively opened files

[x] Not found files

[x] Files without detailed information

[x] Existing files

[ ] Non-startable services

[ ] Non-startable drivers

[x] Active entries

[x] Disabled entries
 
 

[Common]

-----( %SystemRoot%\Tasks )-----

"GoogleUpdateTaskMachineCore.job" - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe

"GoogleUpdateTaskMachineUA.job" - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe
 

[Control Panel Objects]

-----( %SystemRoot%\system32 )-----

"hpaccelerometercp.CPL" - "Hewlett-Packard Corporation" - C:\Windows\system32\hpaccelerometercp.CPL

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )-----

"ProtectSmart Hard Drive Protection" - "Hewlett-Packard Corporation" - C:\Windows\system32\hpaccelerometercp.CPL

"QuickTime" - "Apple Inc." - C:\Program Files\QuickTime\QTSystem\QuickTime.cpl
 

[Drivers]

-----( HKLM\SYSTEM\CurrentControlSet\Services )-----

"catchme" (catchme) - ? - C:\Users\Basti\AppData\Local\Temp\catchme.sys  (File not found)

"IP in IP Tunnel Driver" (IpInIp) - ? - C:\Windows\System32\DRIVERS\ipinip.sys  (File not found)

"IPX Traffic Filter Driver" (NwlnkFlt) - ? - C:\Windows\System32\DRIVERS\nwlnkflt.sys  (File not found)

"IPX Traffic Forwarder Driver" (NwlnkFwd) - ? - C:\Windows\System32\DRIVERS\nwlnkfwd.sys  (File not found)

"MpKsl2aa47320" (MpKsl2aa47320) - ? - c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{CA4F610B-8554-4819-9F87-A07676D91B2E}\MpKsl2aa47320.sys  (File not found)

"MpKsl2bc25f13" (MpKsl2bc25f13) - ? - c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{4C690F24-9248-496F-8A71-9857976DD880}\MpKsl2bc25f13.sys  (File not found)

"MpKsl605b82a4" (MpKsl605b82a4) - ? - c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{4C690F24-9248-496F-8A71-9857976DD880}\MpKsl605b82a4.sys  (File not found)

"MpKsl91d2fe12" (MpKsl91d2fe12) - ? - c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{D6D0CB9E-5D18-428D-BFBB-395754A19FC4}\MpKsl91d2fe12.sys  (File not found)

"MpKslbbca455d" (MpKslbbca455d) - ? - c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{EACB07E9-977D-4BC1-8F99-AB480491753A}\MpKslbbca455d.sys  (File not found)

"MpKslf3bdd319" (MpKslf3bdd319) - ? - c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{EACB07E9-977D-4BC1-8F99-AB480491753A}\MpKslf3bdd319.sys  (File not found)
 

[Explorer]

-----( HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components )-----

{10880D85-AAD9-4558-ABDC-2AB1552D831F} "LightScribe Control Panel" - "Hewlett-Packard Company" - "C:\Program Files\Common Files\LightScribe\LSRunOnce.exe"

-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----

{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396} "{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396}" - ? - C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll

-----( HKLM\Software\Classes\Protocols\Filter )-----

{807563E5-5146-11D5-A672-00B0D022E945} "Microsoft Office InfoPath XML Mime Filter" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL

-----( HKLM\Software\Classes\Protocols\Handler )-----

{314111c7-a502-11d2-bbca-00c04f8ec294} "HxProtocol Class" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll

{FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} "IEProtocolHandler Class" - "Skype Technologies" - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL

{828030A1-22C1-4009-854F-8E305202313F} "livecall" - "Microsoft Corporation" - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL

{0A9007C0-4076-11D3-8789-0000F8105754} "Microsoft Infotech Storage Protocol for IE 4.0" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll

{828030A1-22C1-4009-854F-8E305202313F} "msnim" - "Microsoft Corporation" - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks )-----

{AEB6717E-7E19-11d0-97EE-00C04FD91972} "{AEB6717E-7E19-11d0-97EE-00C04FD91972}" - ? -   (File not found | COM-object registry key not found)

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----

{911051fa-c21c-4246-b470-070cd8df6dc4} ".cab or .zip files" - ? -   (File not found | COM-object registry key not found)

{23170F69-40C1-278A-1000-000100020000} "7-Zip Shell Extension" - "Igor Pavlov" - C:\Program Files\7-Zip\7-zip.dll

{1b24a030-9b20-49bc-97ac-1be4426f9e59} "ActiveDirectory Folder" - ? -   (File not found | COM-object registry key not found)

{34449847-FD14-4fc8-A75A-7432F5181EFB} "ActiveDirectory Folder" - ? -   (File not found | COM-object registry key not found)

{0F8604A5-4ECE-4DE1-BA7D-CF10F8AA4F48} "Contacts folder" - ? -   (File not found | COM-object registry key not found)

{09A47860-11B0-4DA5-AFA5-26D86198A780} "EPP" - "Microsoft Corporation" - c:\PROGRA~1\MICROS~4\shellext.dll

{2C2577C2-63A7-40e3-9B7F-586602617ECB} "Explorer Query Band" - ? -   (File not found | COM-object registry key not found)

{B9E1D2CB-CCFF-4AA6-9579-D7A4754030EF} "iTunes" - "Apple Inc." - C:\Program Files\iTunes\iTunesMiniPlayer.dll

{00020d75-0000-0000-c000-000000000046} "lnkfile" - ? -   (File not found | COM-object registry key not found)

{FC9FB64A-1EB2-4CCF-AF5E-1A497A9B5C2D} "Meine freigegebenen Ordner" - "Microsoft Corporation" - C:\Program Files\MSN Messenger\fsshext.8.1.0178.00.dll

{42042206-2D85-11D3-8CFF-005004838597} "Microsoft Office HTML Icon Handler" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\msohevi.dll

{993BE281-6695-4BA5-8A2A-7AACBFAAB69E} "Microsoft Office Metadata Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll

{5858A72C-C2B4-4dd7-B2BF-B76DB1BD9F6C} "Microsoft Office OneNote Namespace Extension for Windows Desktop Search" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\Office12\ONFILTER.DLL

{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97} "Microsoft Office Thumbnail Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll

{7842554E-6BED-11D2-8CDB-B05550C10000} "Monitor Class" - "Broadcom Corporation." - C:\Windows\system32\btncopy.dll

{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396} "OpenOffice.org Column Handler" - ? - C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll

{087B3AE3-E237-4467-B8DB-5A38AB959AC9} "OpenOffice.org Infotip Handler" - ? - C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll

{63542C48-9552-494A-84F7-73AA6A7C99C1} "OpenOffice.org Property Sheet Handler" - ? - C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll

{3B092F0C-7696-40E3-A80F-68D74DA84210} "OpenOffice.org Thumbnail Viewer" - ? - C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll

{C8494E42-ACDD-4739-B0FB-217361E4894F} "Sam Account Folder" - ? -   (File not found | COM-object registry key not found)

{E29F9716-5C08-4FCD-955A-119FDB5A522D} "Sam Account Folder" - ? -   (File not found | COM-object registry key not found)

{45AC2688-0253-4ED8-97DE-B5370FA7D48A} "Shell Extension for Malware scanning" - ? -   (File not found | COM-object registry key not found)

{7F67036B-66F1-411A-AD85-759FB9C5B0DB} "ShellViewRTF" - "XSS" - C:\Windows\System32\ShellvRTF.dll

{5E2121EE-0300-11D4-8D3B-444553540000} "SimpleShlExt Class" - ? - C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\atiacmxx.dll

{da67b8ad-e81b-4c70-9b91b417b5e33527} "Windows Search Shell Service" - ? -   (File not found | COM-object registry key not found)
 

[Internet Explorer]

-----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )-----

<binary data> "AOL Toolbar" - "AOL LLC" - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll

<binary data> "ITBar7Layout" - ? -   (File not found | COM-object registry key not found)

-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----

{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} "Java Plug-in 1.6.0_05" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab

{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} "Java Plug-in 1.6.0_20" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab

{8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.6.0_24" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab

{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} "Java Plug-in 1.6.0_24" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab

{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_24" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\npjpi160_24.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab

-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----

"@btrez.dll,-4015" - ? - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm

{48E73304-E1D6-4330-914C-F5F514E3486C} "An OneNote senden" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll

"ICQ7.1" - "ICQ, LLC." - C:\Program Files\ICQ7.1\ICQ.exe

{FF059E31-CC5A-4E2E-BF3B-96E929D65503} "Research" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL

-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar )-----

{DE9C389F-3316-41A7-809B-AA305ED9D922} "AOL Toolbar" - "AOL LLC" - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----

{7C554162-8CB7-45A4-B8F4-8EA1C75885F9} "AOL Toolbar BHO" - "AOL LLC" - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll

{DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2ssv.dll
 

[Logon]

-----( %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup )-----

"desktop.ini" - ? - C:\Users\Basti\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini

"OpenOffice.org 3.2.lnk" - ? - C:\Program Files\OpenOffice.org 3\program\quickstart.exe  (Shortcut exists | File found, but it contains no detailed information | File exists)

-----( %AllUsersProfile%\Microsoft\Windows\Start Menu\Programs\Startup )-----

"desktop.ini" - ? - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini

"BTTray.lnk" - "Broadcom Corporation." - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe  (Shortcut exists | File exists)

-----( HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run )-----

"LightScribe Control Panel" - "Hewlett-Packard Company" - C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden

-----( HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\Wds\rdpwd )-----

"StartupPrograms" - ? - rdpclip  (File not found)

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----

"HP Health Check Scheduler" - "Hewlett-Packard" - c:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe

"HP Software Update" - "Hewlett-Packard" - C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe

"hpWirelessAssistant" - "Hewlett-Packard Development Company, L.P." - C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe

"iTunesHelper" - "Apple Inc." - "C:\Program Files\iTunes\iTunesHelper.exe"

"Malwarebytes' Anti-Malware (reboot)" - "Malwarebytes Corporation" - "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript

"MSC" - "Microsoft Corporation" - "c:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey

"OnScreenDisplay" - " Hewlett-Packard Development Company, L.P." - C:\Program Files\Hewlett-Packard\HP QuickTouch\HPKBDAPP.exe

"QlbCtrl.exe" - " Hewlett-Packard Development Company, L.P." - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start

"QuickTime Task" - "Apple Inc." - "C:\Program Files\QuickTime\QTTask.exe" -atboottime

"StartCCC" - "Advanced Micro Devices, Inc." - "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"

"SunJavaUpdateSched" - "Sun Microsystems, Inc." - "C:\Program Files\Common Files\Java\Java Update\jusched.exe"

"UCam_Menu" - "CyberLink Corp." - "C:\Program Files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\YouCam" update "Software\CyberLink\YouCam\2.0"
 

[Print Monitors]

-----( HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors )-----

"Send To Microsoft OneNote Monitor" - "Microsoft Corporation" - C:\Windows\system32\msonpmon.dll
 

[Services]

-----( HKLM\SYSTEM\CurrentControlSet\Services )-----

"@c:\Program Files\Microsoft Security Client\Antimalware\MpAsDesc.dll,-243" (NisSrv) - "Microsoft Corporation" - c:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe

"@c:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe,-100" (WPFFontCache_v0400) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe

"Apple Mobile Device" (Apple Mobile Device) - "Apple Inc." - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

"Com4QLBEx" (Com4QLBEx) - "Hewlett-Packard Development Company, L.P." - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe

"Cyberlink RichVideo Service(CRVS)" (RichVideo) - ? - C:\Program Files\CyberLink\Shared Files\RichVideo.exe

"Dienst "Bonjour"" (Bonjour Service) - "Apple Inc." - C:\Program Files\Bonjour\mDNSResponder.exe

"Easybits Shared Services for Windows" (ezSharedSvc) - "EasyBits Sofware AS" - C:\Windows\System32\ezsvc7.dll

"GameConsoleService" (GameConsoleService) - "WildTangent, Inc." - C:\Program Files\HP Games\My HP Game Console\GameConsoleService.exe

"Google Update Service (gupdate)" (gupdate) - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe

"Google Update-Dienst (gupdatem)" (gupdatem) - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe

"HP Health Check Service" (HP Health Check Service) - "Hewlett-Packard" - c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe

"hpqwmiex" (hpqwmiex) - "Hewlett-Packard Development Company, L.P." - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe

"InstallDriver Table Manager" (IDriverT) - "Macrovision Corporation" - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe

"iPod-Dienst" (iPod Service) - "Apple Inc." - C:\Program Files\iPod\bin\iPodService.exe

"LightScribeService Direct Disc Labeling Service" (LightScribeService) - "Hewlett-Packard Company" - C:\Program Files\Common Files\LightScribe\LSSrvc.exe

"Microsoft .NET Framework NGEN v4.0.30319_X86" (clr_optimization_v4.0.30319_32) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

"Microsoft Antimalware Service" (MsMpSvc) - "Microsoft Corporation" - c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe

"Microsoft Office Diagnostics Service" (odserv) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE

"Office Source Engine" (ose) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE

"Recovery Service for Windows" (Recovery Service for Windows) - ? - C:\Windows\SMINST\BLService.exe
 

[Winsock Providers]

-----( HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries )-----

"mdnsNSP" - "Apple Inc." - C:\Program Files\Bonjour\mdnsNSP.dll
 

===[ Logfile end ]=========================================[ Logfile end ]===

--- --- ---
If You have questions or want to get some help, You can visit Online Solutions :: Index

MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:
Windows Version: Windows Vista Home Premium Edition
Windows Information: Service Pack 1 (build 6001), 32-bit
Base Board Manufacturer: Hewlett-Packard
BIOS Manufacturer: Hewlett-Packard
System Manufacturer: Hewlett-Packard
System Product Name: HP Pavilion dv7 Notebook PC
Logical Drives Mask: 0x0000001c

Kernel Drivers (total 202):
0x82013000 \SystemRoot\system32\ntkrnlpa.exe
0x823CC000 \SystemRoot\system32\hal.dll
0x8040C000 \SystemRoot\system32\kdcom.dll
0x80414000 \SystemRoot\system32\PSHED.dll
0x80425000 \SystemRoot\system32\BOOTVID.dll
0x8042D000 \SystemRoot\system32\CLFS.SYS
0x8046E000 \SystemRoot\system32\CI.dll
0x8054E000 \SystemRoot\system32\drivers\Wdf01000.sys
0x805CA000 \SystemRoot\system32\drivers\WDFLDR.SYS
0x80608000 \SystemRoot\system32\drivers\acpi.sys
0x8064E000 \SystemRoot\system32\drivers\WMILIB.SYS
0x80657000 \SystemRoot\system32\drivers\msisadrv.sys
0x8065F000 \SystemRoot\system32\drivers\pci.sys
0x80686000 \SystemRoot\system32\drivers\isapnp.sys
0x80695000 \SystemRoot\system32\drivers\mpio.sys
0x806B1000 \SystemRoot\System32\drivers\partmgr.sys
0x806C0000 \SystemRoot\system32\DRIVERS\compbatt.sys
0x806C3000 \SystemRoot\system32\DRIVERS\BATTC.SYS
0x806CD000 \SystemRoot\system32\drivers\volmgr.sys
0x806DC000 \SystemRoot\System32\drivers\volmgrx.sys
0x80726000 \SystemRoot\system32\drivers\intelide.sys
0x8072D000 \SystemRoot\system32\drivers\PCIIDEX.SYS
0x8073B000 \SystemRoot\system32\drivers\pciide.sys
0x80742000 \SystemRoot\system32\drivers\aliide.sys
0x80749000 \SystemRoot\system32\drivers\amdide.sys
0x80750000 \SystemRoot\system32\drivers\cmdide.sys
0x80758000 \SystemRoot\System32\drivers\mountmgr.sys
0x80768000 \SystemRoot\system32\drivers\msdsm.sys
0x80782000 \SystemRoot\system32\drivers\nvraid.sys
0x8079D000 \SystemRoot\system32\drivers\CLASSPNP.SYS
0x807BE000 \SystemRoot\system32\drivers\viaide.sys
0x82601000 \SystemRoot\system32\drivers\iastorv.sys
0x826A2000 \SystemRoot\system32\drivers\atapi.sys
0x826AA000 \SystemRoot\system32\drivers\ataport.SYS
0x826C8000 \SystemRoot\system32\drivers\lsi_scsi.sys
0x826E2000 \SystemRoot\system32\drivers\storport.sys
0x82723000 \SystemRoot\system32\drivers\nvstor.sys
0x82730000 \SystemRoot\system32\drivers\msahci.sys
0x8273A000 \SystemRoot\system32\drivers\hpcisss.sys
0x82745000 \SystemRoot\system32\drivers\adp94xx.sys
0x827AF000 \SystemRoot\system32\drivers\adpahci.sys
0x807C6000 \SystemRoot\system32\drivers\adpu160m.sys
0x805D7000 \SystemRoot\system32\drivers\SCSIPORT.SYS
0x8A807000 \SystemRoot\system32\drivers\adpu320.sys
0x8A82D000 \SystemRoot\system32\drivers\djsvs.sys
0x8A841000 \SystemRoot\system32\drivers\arc.sys
0x8A857000 \SystemRoot\system32\drivers\arcsas.sys
0x8A86D000 \SystemRoot\system32\drivers\elxstor.sys
0x8A901000 \SystemRoot\system32\drivers\i2omp.sys
0x8A90B000 \SystemRoot\system32\drivers\iirsp.sys
0x8A91B000 \SystemRoot\system32\drivers\iteatapi.sys
0x8A927000 \SystemRoot\system32\drivers\iteraid.sys
0x8A933000 \SystemRoot\system32\drivers\lsi_fc.sys
0x8A94D000 \SystemRoot\system32\drivers\lsi_sas.sys
0x8A965000 \SystemRoot\system32\drivers\megasas.sys
0x8AA09000 \SystemRoot\system32\drivers\megasr.sys
0x8AAC0000 \SystemRoot\system32\drivers\mraid35x.sys
0x8AACB000 \SystemRoot\system32\drivers\nfrd960.sys
0x8AC07000 \SystemRoot\system32\drivers\ql2300.sys
0x8AD3F000 \SystemRoot\system32\drivers\ql40xx.sys
0x8AD94000 \SystemRoot\system32\drivers\sisraid2.sys
0x8ADA1000 \SystemRoot\system32\drivers\sisraid4.sys
0x8ADB6000 \SystemRoot\system32\drivers\symc8xx.sys
0x8ADC2000 \SystemRoot\system32\drivers\sym_hi.sys
0x8ADCD000 \SystemRoot\system32\drivers\sym_u3.sys
0x8AAD9000 \SystemRoot\system32\drivers\uliahci.sys
0x8ADD8000 \SystemRoot\system32\drivers\ulsata.sys
0x8AB15000 \SystemRoot\system32\drivers\ulsata2.sys
0x8AB41000 \SystemRoot\system32\drivers\vsmraid.sys
0x8AB62000 \SystemRoot\system32\drivers\fltmgr.sys
0x8AB94000 \SystemRoot\system32\drivers\fileinfo.sys
0x8A96F000 \SystemRoot\System32\Drivers\ksecdd.sys
0x8AE08000 \SystemRoot\system32\drivers\ndis.sys
0x8AF13000 \SystemRoot\system32\drivers\msrpc.sys
0x8AF3E000 \SystemRoot\system32\drivers\NETIO.SYS
0x8B00C000 \SystemRoot\System32\drivers\tcpip.sys
0x8B0F6000 \SystemRoot\System32\drivers\fwpkclnt.sys
0x8B209000 \SystemRoot\System32\Drivers\Ntfs.sys
0x8B318000 \SystemRoot\system32\drivers\wd.sys
0x8B320000 \SystemRoot\system32\drivers\volsnap.sys
0x8B359000 \SystemRoot\System32\Drivers\spldr.sys
0x8B361000 \SystemRoot\system32\drivers\sbp2port.sys
0x8B376000 \SystemRoot\System32\Drivers\mup.sys
0x8B385000 \SystemRoot\System32\drivers\ecache.sys
0x8B3AC000 \SystemRoot\system32\DRIVERS\hpdskflt.sys
0x8B3B5000 \SystemRoot\system32\drivers\disk.sys
0x8B3C6000 \SystemRoot\system32\DRIVERS\AtiPcie.sys
0x8B3CE000 \SystemRoot\system32\drivers\crcdisk.sys
0x8B111000 \SystemRoot\system32\DRIVERS\tunnel.sys
0x8B200000 \SystemRoot\system32\DRIVERS\tunmp.sys
0x8B11C000 \SystemRoot\system32\DRIVERS\processr.sys
0x9EC04000 \SystemRoot\system32\DRIVERS\atikmdag.sys
0x9F0D3000 \SystemRoot\System32\drivers\dxgkrnl.sys
0x9F172000 \SystemRoot\System32\drivers\watchdog.sys
0x9F17F000 \SystemRoot\system32\DRIVERS\HDAudBus.sys
0x9F191000 \SystemRoot\system32\DRIVERS\ohci1394.sys
0x9F1A1000 \SystemRoot\system32\DRIVERS\1394BUS.SYS
0x9F1AF000 \SystemRoot\system32\DRIVERS\jmcr.sys
0x9F809000 \SystemRoot\system32\DRIVERS\athr.sys
0x9F8ED000 \SystemRoot\system32\DRIVERS\Rtlh86.sys
0x9F90E000 \SystemRoot\system32\DRIVERS\cdrom.sys
0x9F926000 \SystemRoot\system32\DRIVERS\GEARAspiWDM.sys
0x9F92C000 \SystemRoot\system32\DRIVERS\usbohci.sys
0x9F936000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
0x9F974000 \SystemRoot\system32\DRIVERS\usbehci.sys
0x9F983000 \SystemRoot\system32\DRIVERS\i8042prt.sys
0x9F996000 \SystemRoot\system32\DRIVERS\HpqKbFiltr.sys
0x9F99B000 \SystemRoot\system32\DRIVERS\kbdclass.sys
0x9F9A6000 \SystemRoot\system32\DRIVERS\SynTP.sys
0x9F9D5000 \SystemRoot\system32\DRIVERS\USBD.SYS
0x9F9D7000 \SystemRoot\system32\DRIVERS\mouclass.sys
0x9F9E2000 \SystemRoot\system32\DRIVERS\CmBatt.sys
0x9F9E6000 \SystemRoot\system32\DRIVERS\enecir.sys
0x9F1C4000 \SystemRoot\system32\DRIVERS\Accelerometer.sys
0x9F800000 \SystemRoot\system32\DRIVERS\wmiacpi.sys
0x9F9FE000 \SystemRoot\system32\DRIVERS\jumi.sys
0x9F1CF000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
0x9F1DF000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
0x8B12B000 \SystemRoot\system32\DRIVERS\msiscsi.sys
0x9F1E6000 \SystemRoot\system32\DRIVERS\TDI.SYS
0x8B159000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
0x9F1F1000 \SystemRoot\system32\DRIVERS\ndistapi.sys
0x8B170000 \SystemRoot\system32\DRIVERS\ndiswan.sys
0x8B193000 \SystemRoot\system32\DRIVERS\raspppoe.sys
0x8B1A2000 \SystemRoot\system32\DRIVERS\raspptp.sys
0x8B1B6000 \SystemRoot\system32\DRIVERS\rassstp.sys
0x8B1CB000 \SystemRoot\system32\DRIVERS\termdd.sys
0x9F1FC000 \SystemRoot\system32\DRIVERS\swenum.sys
0x8AF78000 \SystemRoot\system32\DRIVERS\ks.sys
0x8B1DB000 \SystemRoot\system32\DRIVERS\circlass.sys
0x8B1E9000 \SystemRoot\system32\DRIVERS\mssmbios.sys
0x8B1F3000 \SystemRoot\system32\DRIVERS\umbus.sys
0x8AFA2000 \SystemRoot\system32\DRIVERS\usbhub.sys
0x8B000000 \SystemRoot\system32\DRIVERS\mouhid.sys
0x8AFD6000 \SystemRoot\system32\DRIVERS\kbdhid.sys
0x8AFDF000 \SystemRoot\System32\Drivers\NDProxy.SYS
0x8ABA4000 \SystemRoot\system32\drivers\HdAudio.sys
0xA2405000 \SystemRoot\system32\drivers\portcls.sys
0xA2432000 \SystemRoot\system32\drivers\drmk.sys
0xA2457000 \SystemRoot\system32\DRIVERS\stwrt.sys
0xA24B8000 \SystemRoot\system32\DRIVERS\hidir.sys
0xA24C3000 \SystemRoot\system32\DRIVERS\MpFilter.sys
0xA24EA000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
0xA24F3000 \SystemRoot\System32\Drivers\Null.SYS
0xA24FA000 \SystemRoot\System32\Drivers\Beep.SYS
0xA2501000 \SystemRoot\System32\drivers\vga.sys
0xA250D000 \SystemRoot\System32\drivers\VIDEOPRT.SYS
0xA252E000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0xA2536000 \SystemRoot\system32\drivers\rdpencdd.sys
0xA253E000 \SystemRoot\system32\DRIVERS\usbccgp.sys
0xA2555000 \SystemRoot\System32\Drivers\usbvideo.sys
0xA2576000 \SystemRoot\System32\Drivers\Msfs.SYS
0xA2581000 \SystemRoot\System32\Drivers\Npfs.SYS
0xA258F000 \SystemRoot\System32\DRIVERS\rasacd.sys
0xA2598000 \SystemRoot\system32\DRIVERS\tdx.sys
0xA25AE000 \SystemRoot\system32\DRIVERS\smb.sys
0xA260E000 \SystemRoot\system32\drivers\afd.sys
0xA2656000 \SystemRoot\System32\DRIVERS\netbt.sys
0xA2688000 \SystemRoot\system32\DRIVERS\pacer.sys
0xA269E000 \SystemRoot\system32\DRIVERS\netbios.sys
0xA26AC000 \SystemRoot\system32\DRIVERS\wanarp.sys
0xA26BF000 \SystemRoot\system32\DRIVERS\rdbss.sys
0xA26FB000 \SystemRoot\System32\Drivers\BTHUSB.sys
0xA2708000 \SystemRoot\System32\Drivers\bthport.sys
0xA2788000 \SystemRoot\system32\drivers\nsiproxy.sys
0xA279B000 \SystemRoot\system32\DRIVERS\BdaSup.SYS
0xA279E000 \SystemRoot\System32\Drivers\dfsc.sys
0xA27B5000 \SystemRoot\system32\DRIVERS\rfcomm.sys
0xA27DE000 \SystemRoot\system32\DRIVERS\BthEnum.sys
0xA25C2000 \SystemRoot\system32\DRIVERS\bthpan.sys
0xA2801000 \SystemRoot\system32\drivers\btwavdt.sys
0xA2868000 \SystemRoot\system32\drivers\btwaudio.sys
0xA28E8000 \SystemRoot\system32\DRIVERS\btwrchid.sys
0xA28EB000 \SystemRoot\System32\Drivers\crashdmp.sys
0xA28F8000 \SystemRoot\System32\Drivers\dump_dumpata.sys
0xA2903000 \SystemRoot\System32\Drivers\dump_msahci.sys
0xAA460000 \SystemRoot\System32\win32k.sys
0xA290D000 \SystemRoot\System32\drivers\Dxapi.sys
0xA2917000 \SystemRoot\system32\DRIVERS\monitor.sys
0xAA680000 \SystemRoot\System32\TSDDD.dll
0xAA6A0000 \SystemRoot\System32\cdd.dll
0xA2926000 \SystemRoot\system32\drivers\luafv.sys
0xA2941000 \SystemRoot\system32\drivers\spsys.sys
0xA29F0000 \SystemRoot\system32\DRIVERS\lltdio.sys
0xAC809000 \SystemRoot\system32\DRIVERS\nwifi.sys
0xAC833000 \SystemRoot\system32\DRIVERS\ndisuio.sys
0xAC83D000 \SystemRoot\system32\DRIVERS\rspndr.sys
0xAC850000 \SystemRoot\system32\drivers\HTTP.sys
0xAC8BD000 \SystemRoot\System32\DRIVERS\srvnet.sys
0xAC8DA000 \SystemRoot\system32\DRIVERS\bowser.sys
0xAC8F3000 \SystemRoot\System32\drivers\mpsdrv.sys
0xAC908000 \SystemRoot\system32\drivers\mrxdav.sys
0xAC928000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
0xAC947000 \SystemRoot\system32\DRIVERS\mrxsmb10.sys
0xAC980000 \SystemRoot\system32\DRIVERS\mrxsmb20.sys
0xAC998000 \SystemRoot\System32\DRIVERS\srv2.sys
0xB0A0D000 \SystemRoot\System32\DRIVERS\srv.sys
0xB0A74000 \SystemRoot\system32\drivers\peauth.sys
0xB0B52000 \SystemRoot\System32\Drivers\secdrv.SYS
0xB0B5C000 \SystemRoot\System32\drivers\tcpipreg.sys
0xB0B68000 \SystemRoot\system32\DRIVERS\cdfs.sys
0x77480000 \WINDOWS\System32\ntdll.dll

Processes (total 81):
0 System Idle Process
4 System
448 C:\WINDOWS\System32\smss.exe
580 csrss.exe
640 C:\WINDOWS\System32\wininit.exe
656 csrss.exe
688 C:\WINDOWS\System32\services.exe
700 C:\WINDOWS\System32\lsass.exe
708 C:\WINDOWS\System32\lsm.exe
852 C:\WINDOWS\System32\svchost.exe
888 C:\WINDOWS\System32\winlogon.exe
960 C:\WINDOWS\System32\svchost.exe
1000 C:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe
1092 C:\WINDOWS\System32\Ati2evxx.exe
1116 C:\WINDOWS\System32\svchost.exe
1148 C:\WINDOWS\System32\svchost.exe
1192 C:\WINDOWS\System32\svchost.exe
1204 C:\WINDOWS\System32\DriverStore\FileRepository\stwrt.inf_9a642328\stacsv.exe
1292 C:\WINDOWS\System32\audiodg.exe
1500 C:\WINDOWS\System32\SLsvc.exe
1536 C:\WINDOWS\System32\svchost.exe
1616 C:\WINDOWS\System32\Ati2evxx.exe
1672 C:\WINDOWS\System32\hpservice.exe
1764 C:\WINDOWS\System32\svchost.exe
1972 C:\WINDOWS\System32\dwm.exe
2024 C:\WINDOWS\explorer.exe
2032 C:\WINDOWS\System32\wlanext.exe
384 C:\WINDOWS\System32\spoolsv.exe
12 C:\WINDOWS\System32\svchost.exe
568 C:\WINDOWS\System32\taskeng.exe
1796 C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
1560 C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
2080 C:\Program Files\Hewlett-Packard\HP QuickTouch\HPKBDAPP.exe
2148 C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
2172 C:\WINDOWS\System32\DriverStore\FileRepository\stwrt.inf_9a642328\AEstSrv.exe
2188 C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
2200 C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
2240 C:\Program Files\Bonjour\mDNSResponder.exe
2248 C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
2260 C:\WINDOWS\System32\svchost.exe
2304 C:\Program Files\Common Files\LightScribe\LSSrvc.exe
2476 C:\WINDOWS\System32\svchost.exe
2544 C:\WINDOWS\SMINST\BLService.exe
2552 C:\Program Files\iTunes\iTunesHelper.exe
2612 C:\Program Files\Common Files\Java\Java Update\jusched.exe
2632 C:\WINDOWS\System32\taskeng.exe
2656 C:\Program Files\Microsoft Security Client\msseces.exe
2708 C:\Program Files\CyberLink\Shared Files\RichVideo.exe
2776 C:\Program Files\Windows Sidebar\sidebar.exe
2880 C:\WINDOWS\System32\svchost.exe
2904 C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
2984 C:\WINDOWS\System32\svchost.exe
3036 C:\WINDOWS\System32\SearchIndexer.exe
3108 C:\WINDOWS\ehome\ehtray.exe
3228 C:\Program Files\Windows Media Player\wmpnscfg.exe
3332 C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
3504 C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
3624 WmiPrvSE.exe
3652 C:\Program Files\OpenOffice.org 3\program\soffice.exe
3780 C:\Program Files\OpenOffice.org 3\program\soffice.bin
3916 C:\WINDOWS\ehome\ehmsas.exe
3980 C:\Program Files\Windows Media Player\wmpnetwk.exe
4064 C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
1440 C:\WINDOWS\ehome\ehsched.exe
2212 C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe
3100 C:\Program Files\WIDCOMM\Bluetooth Software\BTStackServer.exe
2964 C:\Program Files\iPod\bin\iPodService.exe
3544 C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
2992 C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
4216 C:\WINDOWS\ehome\ehrecvr.exe
4904 C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
5672 C:\Users\Basti\Downloads\osam.exe
5688 C:\WINDOWS\System32\SearchProtocolHost.exe
6108 C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Service.exe
4716 C:\WINDOWS\System32\wuauclt.exe
5832 C:\WINDOWS\System32\notepad.exe
3720 C:\Program Files\Mozilla Firefox\firefox.exe
1660 C:\WINDOWS\System32\SearchFilterHost.exe
4856 C:\WINDOWS\explorer.exe
2960 C:\Users\Basti\Desktop\MBRCheck.exe
4896 C:\WINDOWS\System32\conime.exe

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`00007e00 (NTFS)
\\.\D: --> \\.\PhysicalDrive0 at offset 0x00000038`02700000 (NTFS)

PhysicalDrive0 Model Number: WDCWD2500BEVS-60UST0, Rev: 01.01A01

Size Device Name MBR Status
--------------------------------------------
232 GB \\.\PhysicalDrive0 Unknown MBR code
SHA1: 08F21ADD893776C287CC68A3558F8D095B50ED3C

Found non-standard or infected MBR.
Enter 'Y' and hit ENTER for more options, or 'N' to exit:

Done!

Entschuldige daß es so lang gedauert hat, mein Rechner geht neuerdings einfach aus zwischendurch...

Wir sollten den MBR manuell fixen. Sichere für den Fall der Fälle alle wichtigen Daten.

Hast Du noch andere Betriebssysteme außer Vista installiert?
Wenn nicht: Schau mal hier => Vista Notfall/Recovery-CD 32-Bit - Dr. Windows

Lad das iso runter, brenn es zB mit ImgBurn per Imagebrennfunktion auf eine CD und starte damit den Rechner (von dieser CD booten).

Falls Du eine normale Vista-Installations-DVD hast, brauchst Du das o.g. Image nicht sondern kannst einfach von der Vista-DVD booten.

Klick auf Computerreparaturoptionen, weiter, Eingabeaufforderung - die Konsole öffnet sich. Da bitte bootrec.exe /fixboot eintippen (mit enter bestätigen), dann bootrec.exe /fixmbr eintippen (mit enter bestätigen) - Rechner neustarten, CD vorher rausnehmen. Erstell danach wieder neue Logs mit MBRCheck und wenn es geht GMER.

hm ja das wird ein weilchen dauern und ich hoffe mein laptop geht nicht wieder aus mittendrin..:glaskugel:

Hi Arne,
also bei mir hat so gut wie nix geklappt. Hab mir das Iso runtergeladen, aber mein computer war nicht fähig es zu brennen (weiß leider nicht genau warum, vermute es liegt am Laufwerk bzw Brenner). Eine Vista-Installations-Dvd hab ich ,glaube ich, nicht. Außer es geht auch mit den beiden Backup dvd, welche ich direkt nach der erstinstallation gebrannt habe. geht das?

entschuldige meine Computerunfähigkeit...

Wenn du nicht weißt warum, wie kommst du auf den Brenner?
Wie du ein Image brennst ist dir bekannt?