Trojaner-Board - Alle Browser stürzen nacheinander ab

Hier sind die Logs
Nach dem Neustart nach Gmer ist Checkdisk durchgelaufen, soll ich da das Log auch Posten? und wenn ja, ich finde nur die hälfte, es ist mitten im satz abgeschnitten.

Gmer:

GMER Logfile:

Code:

GMER 1.0.15.15641 - hxxp://www.gmer.net

Rootkit scan 2011-10-22 21:10:01

Windows 6.1.7601 Service Pack 1 Harddisk0\DR0 -> \Device\00000075 Hitachi_ rev.SBDO

Running: x4ueymv7.exe; Driver: C:\Users\Alana\AppData\Local\Temp\fxloikod.sys
 
 

---- Kernel code sections - GMER 1.0.15 ----
 

.text           ntkrnlpa.exe!ZwSaveKey + 13D1                                                                                               82E46349 1 Byte  [06]

.text           ntkrnlpa.exe!KiDispatchInterrupt + 5A2                                                                                      82E7FD52 19 Bytes  [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3}

?               C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{881423FE-9FF1-47A4-999D-4CE603112C37}\MpKslc8fd236b.sys  Das System kann die angegebene Datei nicht finden. !

?               C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{881423FE-9FF1-47A4-999D-4CE603112C37}\MpKsl82537ed3.sys  Das System kann die angegebene Datei nicht finden. !

.text           C:\Windows\system32\DRIVERS\nvlddmkm.sys                                                                                    section is writeable [0x8F414340, 0x3EE217, 0xE8000020]

init            C:\Windows\system32\drivers\tifm21.sys                                                                                      entry point in "init" section [0x90296EBF]

?               C:\Windows\system32\Drivers\PROCEXP113.SYS                                                                                  Das System kann die angegebene Datei nicht finden. !

?               C:\Users\Alana\AppData\Local\Temp\catchme.sys                                                                               Das System kann die angegebene Datei nicht finden. !
 

---- Devices - GMER 1.0.15 ----
 

AttachedDevice  \Driver\volmgr \Device\HarddiskVolume1                                                                                      fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)

AttachedDevice  \Driver\volmgr \Device\HarddiskVolume1                                                                                      rdyboost.sys (ReadyBoost Driver/Microsoft Corporation)

AttachedDevice  \Driver\volmgr \Device\HarddiskVolume2                                                                                      fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)

AttachedDevice  \Driver\volmgr \Device\HarddiskVolume2                                                                                      rdyboost.sys (ReadyBoost Driver/Microsoft Corporation)

AttachedDevice  \Driver\volmgr \Device\HarddiskVolume3                                                                                      fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)

AttachedDevice  \Driver\volmgr \Device\HarddiskVolume3                                                                                      rdyboost.sys (ReadyBoost Driver/Microsoft Corporation)
 

Device          \Driver\ACPI_HAL \Device\0000005b                                                                                           halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation)
 

AttachedDevice  \FileSystem\fastfat \Fat                                                                                                    fltmgr.sys (Microsoft Dateisystem-Filter-Manager/Microsoft Corporation)
 

---- EOF - GMER 1.0.15 ----

--- --- ---

Osam:

OSAM Logfile:

Code:

Report of OSAM: Autorun Manager v5.0.11926.0

hxxp://www.online-solutions.ru/en/

Saved at 21:54:14 on 22.10.2011
 

OS: Windows 7 Home Premium Edition Service Pack 1 (Build 7601), 32-bit

Default Browser: Google Inc. Google Chrome 14.0.835.202
 

Scanner Settings

[x] Rootkits detection (hidden registry)

[x] Rootkits detection (hidden files)

[x] Retrieve files information

[x] Check Microsoft signatures
 

Filters

[ ] Trusted entries

[ ] Empty entries

[x] Hidden registry entries (rootkit activity)

[x] Exclusively opened files

[x] Not found files

[x] Files without detailed information

[x] Existing files

[ ] Non-startable services

[ ] Non-startable drivers

[x] Active entries

[x] Disabled entries
 
 

[Common]

-----( %SystemRoot%\Tasks )-----

"GoogleUpdateTaskUserS-1-5-21-2425095979-3527390611-2644240043-1000Core.job" - "Google Inc." - C:\Users\Alana\AppData\Local\Google\Update\GoogleUpdate.exe

"GoogleUpdateTaskUserS-1-5-21-2425095979-3527390611-2644240043-1000UA.job" - "Google Inc." - C:\Users\Alana\AppData\Local\Google\Update\GoogleUpdate.exe
 

[Control Panel Objects]

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )-----

"QuickTime" - "Apple Inc." - C:\Program Files\QuickTime\QTSystem\QuickTime.cpl
 

[Drivers]

-----( HKLM\SYSTEM\CurrentControlSet\Services )-----

"catchme" (catchme) - ? - C:\Users\Alana\AppData\Local\Temp\catchme.sys  (File not found)

"MBAMProtector" (MBAMProtector) - "Malwarebytes Corporation" - C:\Windows\system32\drivers\mbam.sys

"MpKsl0244d968" (MpKsl0244d968) - ? - C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{B9A87D9E-BAF2-4B66-85A1-6369AB760FCC}\MpKsl0244d968.sys  (File not found)

"MpKsl0f680d40" (MpKsl0f680d40) - ? - C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{18F54B91-5D4B-45C1-AA7C-1EAA7AD049F5}\MpKsl0f680d40.sys  (File not found)

"MpKsl1bfb7423" (MpKsl1bfb7423) - "Microsoft Corporation" - C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{44AED5F1-E4AB-4509-99C3-03FF9EE528F9}\MpKsl1bfb7423.sys

"MpKsl38a47190" (MpKsl38a47190) - ? - C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{E6B2C171-1730-4082-8BA3-BABCAA6382EE}\MpKsl38a47190.sys  (File not found)

"MpKsl61d521cc" (MpKsl61d521cc) - ? - C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{E553E236-2BE9-4E8E-87EB-8153A20934B5}\MpKsl61d521cc.sys  (File not found)

"MpKsld73352f5" (MpKsld73352f5) - ? - C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{B9A87D9E-BAF2-4B66-85A1-6369AB760FCC}\MpKsld73352f5.sys  (File not found)
 

[Explorer]

-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----

{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396} "{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396}" - ? - C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll

-----( HKLM\Software\Classes\Protocols\Handler )-----

{FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} "IEProtocolHandler Class" - "Skype Technologies" - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----

{23170F69-40C1-278A-1000-000100020000} "7-Zip Shell Extension" - "Igor Pavlov" - C:\Program Files\7-Zip\7-zip.dll

{09A47860-11B0-4DA5-AFA5-26D86198A780} "EPP" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\shellext.dll

{B9E1D2CB-CCFF-4AA6-9579-D7A4754030EF} "iTunes" - "Apple Inc." - C:\Program Files\iTunes\iTunesMiniPlayer.dll

{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396} "OpenOffice.org Column Handler" - ? - C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll

{087B3AE3-E237-4467-B8DB-5A38AB959AC9} "OpenOffice.org Infotip Handler" - ? - C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll

{AE424E85-F6DF-4910-A6A9-438797986431} "OpenOffice.org Property Handler" - ? - C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\propertyhdl.dll

{63542C48-9552-494A-84F7-73AA6A7C99C1} "OpenOffice.org Property Sheet Handler" - ? - C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll

{3B092F0C-7696-40E3-A80F-68D74DA84210} "OpenOffice.org Thumbnail Viewer" - ? - C:\Program Files\OpenOffice.org 3\Basis\program\shlxthdl\shlxthdl.dll

{45AC2688-0253-4ED8-97DE-B5370FA7D48A} "Shell Extension for Malware scanning" - ? -   (File not found | COM-object registry key not found)

{B41DB860-8EE4-11D2-9906-E49FADC173CA} "WinRAR" - "Alexander Roshal" - D:\Program Files\WinRAR\rarext.dll
 

[Internet Explorer]

-----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )-----

ITBar7Height "ITBar7Height" - ? -   (File not found | COM-object registry key not found)

<binary data> "ITBar7Layout" - ? -   (File not found | COM-object registry key not found)

<binary data> "{EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107}" - ? -   (File not found | COM-object registry key not found)

-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----

{8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.6.0_22" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab

{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} "Java Plug-in 1.6.0_22" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab

{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_22" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\npjpi160_22.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab

{D27CDB6E-AE6D-11CF-96B8-444553540000} "Shockwave Flash Object" - "Adobe Systems, Inc." - C:\Windows\system32\Macromed\Flash\Flash10l.ocx / hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----

{DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2ssv.dll
 

[Logon]

-----( %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup )-----

"desktop.ini" - ? - C:\Users\Alana\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini

-----( %AllUsersProfile%\Microsoft\Windows\Start Menu\Programs\Startup )-----

"desktop.ini" - ? - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini

-----( HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run )-----

"KiesHelper" - "Samsung" - C:\Program Files\Samsung\Kies\KiesHelper.exe /s

"KiesPDLR" - ? - C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe

"puush" - ? - C:\Program Files\puush\puush.exe

-----( HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\Wds\rdpwd )-----

"StartupPrograms" - ? - rdpclip  (File not found)

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----

"Malwarebytes' Anti-Malware" - "Malwarebytes Corporation" - "C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray

"MSC" - "Microsoft Corporation" - "C:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey
 

[Services]

-----( HKLM\SYSTEM\CurrentControlSet\Services )-----

"@C:\Program Files\Microsoft Security Client\Antimalware\MpAsDesc.dll,-243" (NisSrv) - "Microsoft Corporation" - C:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe

"Apple Mobile Device" (Apple Mobile Device) - "Apple Inc." - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

"Dienst "Bonjour"" (Bonjour Service) - "Apple Inc." - C:\Program Files\Bonjour\mDNSResponder.exe

"Hotspot Shield Monitoring Service" (HssWd) - ? - C:\Program Files\Hotspot Shield\bin\hsswd.exe  (File found, but it contains no detailed information)

"Hotspot Shield Routing Service" (HssSrv) - ? - C:\Program Files\Hotspot Shield\HssWPR\hsssrv.exe

"Hotspot Shield Service" (hshld) - ? - C:\Program Files\Hotspot Shield\bin\openvpnas.exe  (File found, but it contains no detailed information)

"Hotspot Shield Tray Service" (HssTrayService) - ? - C:\Program Files\Hotspot Shield\bin\HssTrayService.EXE  (File found, but it contains no detailed information)

"iPod-Dienst" (iPod Service) - "Apple Inc." - C:\Program Files\iPod\bin\iPodService.exe

"MBAMService" (MBAMService) - "Malwarebytes Corporation" - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe

"Microsoft .NET Framework NGEN v4.0.30319_X86" (clr_optimization_v4.0.30319_32) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

"Microsoft Antimalware Service" (MsMpSvc) - "Microsoft Corporation" - C:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe
 

[Winsock Providers]

-----( HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries )-----

"mdnsNSP" - "Apple Inc." - C:\Program Files\Bonjour\mdnsNSP.dll
 

===[ Logfile end ]=========================================[ Logfile end ]===

--- --- ---

und aswMBR:

aswMBR version 0.9.8.986 Copyright(c) 2011 AVAST Software
Run date: 2011-10-22 21:56:44
-----------------------------
21:56:44.490 OS Version: Windows 6.1.7601 Service Pack 1
21:56:44.490 Number of processors: 2 586 0x4802
21:56:44.490 ComputerName: SCHLÄPPTOP UserName: Alana
21:57:09.865 Initialize success
22:13:32.773 AVAST engine defs: 11102201
22:19:39.030 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\00000074
22:19:39.030 Disk 0 Vendor: Hitachi_ SBDO Size: 114473MB BusType: 3
22:19:41.077 Disk 0 MBR read successfully
22:19:41.077 Disk 0 MBR scan
22:19:41.092 Disk 0 Windows 7 default MBR code
22:19:41.108 Disk 0 scanning sectors +234436545
22:19:41.186 Disk 0 scanning C:\Windows\system32\drivers
22:19:58.163 Service scanning
22:19:59.194 Service MpKsl1bfb7423 C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{44AED5F1-E4AB-4509-99C3-03FF9EE528F9}\MpKsl1bfb7423.sys **LOCKED** 32
22:19:59.209 Service MpNWMon C:\Windows\system32\DRIVERS\MpNWMon.sys **LOCKED** 32
22:19:59.881 Modules scanning
22:20:17.529 Disk 0 trace - called modules:
22:20:17.607 ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys halmacpi.dll storport.sys nvstor.sys
22:20:18.169 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x85b60168]
22:20:18.185 3 CLASSPNP.SYS[88ddf59e] -> nt!IofCallDriver -> [0x85591418]
22:20:18.201 5 ACPI.sys[88c2d3d4] -> nt!IofCallDriver -> \Device\00000074[0x85591540]
22:20:18.794 AVAST engine scan C:\Windows
22:20:22.529 AVAST engine scan C:\Windows\system32
22:23:31.215 AVAST engine scan C:\Windows\system32\drivers
22:23:48.963 AVAST engine scan C:\Users\Alana
22:32:53.213 AVAST engine scan C:\ProgramData
22:33:29.965 Scan finished successfully
22:37:30.454 Disk 0 MBR has been saved successfully to "C:\Users\Alana\Desktop\MBR.dat"
22:37:30.485 The log file has been saved successfully to "C:\Users\Alana\Desktop\aswMBR.txt"