Trojaner-Board
Seite 3 von 3 12 3
100 Beiträge dieses Themas auf einer Seite anzeigen

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   Anfangs TR/Dropper.Gen, nun permanente Meldungen zu TR/Sirefef.AG.35, TR/ATRAPS.Gen2 und TR/Small.FI (https://www.trojaner-board.de/116739-anfangs-tr-dropper-gen-permanente-meldungen-tr-sirefef-ag-35-tr-atraps-gen2-tr-small-fi.html)

K-Runa 21.06.2012 15:59
Ich habe echt keinen Plan, wieso das beim letzten Mal nicht gleich so aussah...
Hier das neue Logbuch:
[code]
Combofix Logfile:
Code:
ComboFix 12-06-21.01 - XXXXX 21.06.2012  16:40:12.2.2 - x86
Microsoft Windows XP Home Edition  5.1.2600.3.1252.49.1031.18.1023.565 [GMT 2:00]
ausgeführt von:: c:\dokumente und einstellungen\XXXXX\Desktop\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {AD166499-45F9-482A-A743-FDD3350758C7}
.
.
((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
---- Vorheriger Suchlauf -------
.
c:\dokumente und einstellungen\All Users\Anwendungsdaten\TEMP
c:\dokumente und einstellungen\All Users\Anwendungsdaten\TEMP\{5DB1DF0C-AABC-4362-8A6D-CEFDFB036E41}\PostBuild.exe
c:\dokumente und einstellungen\XXXXX\4.0
c:\dokumente und einstellungen\XXXXX\WINDOWS
c:\dokumente und einstellungen\XXXXX2\WINDOWS
c:\dokumente und einstellungen\XXXXX4\WINDOWS
c:\windows\Downloaded Program Files\Quarantine
c:\windows\IsUn0407.exe
c:\windows\System\SET2A.tmp
c:\windows\system32\is-IORRH.tmp
c:\windows\unin0407.exe
D:\install.exe
.
.
(((((((((((((((((((((((  Dateien erstellt von 2012-05-21 bis 2012-06-21  ))))))))))))))))))))))))))))))
.
.
2012-06-21 09:24 . 2012-06-21 09:24        --------        d-----w-        c:\windows\LastGood
2012-06-20 21:15 . 2012-06-20 21:15        --------        d-----w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\SweetIM
2012-06-20 12:14 . 2012-06-20 19:17        --------        d-----w-        c:\programme\SweetIM
2012-06-20 12:13 . 2012-06-20 12:13        --------        d-----w-        c:\dokumente und einstellungen\XXXXX\Anwendungsdaten\pdfforge
2012-06-20 12:13 . 2004-03-08 23:00        662288        ----a-w-        c:\windows\system32\MSCOMCT2.OCX
2012-06-20 12:13 . 1998-07-06 16:55        158208        ----a-w-        c:\windows\system32\MSCMCDE.DLL
2012-06-20 12:13 . 1998-07-06 16:55        64512        ----a-w-        c:\windows\system32\MSCC2DE.DLL
2012-06-20 12:13 . 1998-07-05 23:00        23552        ----a-w-        c:\windows\system32\MSMPIDE.DLL
2012-06-20 12:13 . 2012-06-20 12:13        --------        d-----w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\Premium
2012-06-20 12:12 . 2012-06-20 12:13        --------        d-----w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\InstallMate
2012-06-17 16:51 . 2012-06-17 16:51        --------        d-----w-        c:\programme\Google
2012-06-14 17:23 . 2012-06-14 17:23        --------        d-----w-        c:\programme\Lame For Audacity
2012-06-13 22:10 . 2012-06-13 22:10        --------        d-----w-        C:\_OTL
2012-06-13 21:00 . 2012-05-11 14:40        521728        -c----w-        c:\windows\system32\dllcache\jsdbgui.dll
2012-06-10 10:40 . 2012-06-14 17:47        --------        d-----w-        c:\dokumente und einstellungen\XXXXX\Anwendungsdaten\Audacity
2012-06-09 14:11 . 2012-06-17 15:17        --------        d-----w-        c:\programme\Opera Next
2012-06-09 10:07 . 2012-06-09 10:19        --------        d-----w-        c:\dokumente und einstellungen\XXXXX\Anwendungsdaten\BullGuard
2012-06-09 10:06 . 2012-06-09 10:08        --------        d-----w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\BullGuard
2012-06-09 10:06 . 2012-06-09 17:10        --------        d-----w-        c:\programme\BullGuard Backup
2012-06-07 23:51 . 2012-06-07 23:51        --------        d-----w-        c:\dokumente und einstellungen\NetworkService\Lokale Einstellungen\Anwendungsdaten\PCHealth
2012-06-07 15:01 . 2012-06-07 15:01        --------        d-----w-        c:\dokumente und einstellungen\XXXXX\Anwendungsdaten\SUPERAntiSpyware.com
2012-06-07 15:01 . 2012-06-07 15:01        --------        d-----w-        c:\programme\SUPERAntiSpyware
2012-06-07 15:01 . 2012-06-07 15:01        --------        d-----w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\SUPERAntiSpyware.com
2012-06-07 14:54 . 2012-06-07 14:54        --------        d-----w-        c:\dokumente und einstellungen\XXXXX\Anwendungsdaten\ElevatedDiagnostics
2012-06-07 14:10 . 2012-06-07 14:10        --------        d-----w-        c:\programme\Microsoft Download Manager
2012-06-07 13:40 . 2012-06-07 13:40        159744        ----a-w-        c:\programme\Internet Explorer\PLUGINS\npqtplugin3.dll
2012-06-07 13:40 . 2012-06-07 13:40        159744        ----a-w-        c:\programme\Internet Explorer\PLUGINS\npqtplugin2.dll
2012-06-07 13:40 . 2012-06-07 13:40        159744        ----a-w-        c:\programme\Internet Explorer\PLUGINS\npqtplugin.dll
2012-06-07 12:59 . 2012-06-07 12:59        --------        d-----w-        c:\dokumente und einstellungen\XXXXX\Lokale Einstellungen\Anwendungsdaten\Secunia PSI
2012-06-07 12:58 . 2012-06-07 14:18        --------        d-----w-        c:\programme\Secunia_PSI
2012-05-26 20:58 . 2012-05-26 20:58        --------        d-----w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\ATI
.
.
.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-06-09 17:13 . 2012-04-06 14:23        426184        ----a-w-        c:\windows\system32\FlashPlayerApp.exe
2012-06-09 17:13 . 2011-05-13 09:36        70344        ----a-w-        c:\windows\system32\FlashPlayerCPLApp.cpl
2012-06-02 13:19 . 2007-08-24 11:43        15896        ----a-w-        c:\windows\system32\wuapi.dll.mui
2012-06-02 13:19 . 2007-06-21 09:32        18456        ----a-w-        c:\windows\system32\wuaueng.dll.mui
2012-06-02 13:19 . 2004-08-03 12:01        329240        ----a-w-        c:\windows\system32\wucltui.dll
2012-06-02 13:19 . 2004-08-03 11:59        219160        ----a-w-        c:\windows\system32\wuaucpl.cpl
2012-06-02 13:19 . 2004-08-03 11:59        210968        ----a-w-        c:\windows\system32\wuweb.dll
2012-06-02 13:19 . 2007-06-21 09:32        15896        ----a-w-        c:\windows\system32\wuaucpl.cpl.mui
2012-06-02 13:19 . 2004-06-22 15:41        53784        ----a-w-        c:\windows\system32\wuauclt.exe
2012-06-02 13:19 . 2004-06-22 15:36        97304        ----a-w-        c:\windows\system32\cdm.dll
2012-06-02 13:19 . 2007-06-21 09:32        23576        ----a-w-        c:\windows\system32\wucltui.dll.mui
2012-06-02 13:19 . 2004-08-03 12:06        577048        ----a-w-        c:\windows\system32\wuapi.dll
2012-06-02 13:19 . 2004-06-22 15:41        1933848        ----a-w-        c:\windows\system32\wuaueng.dll
2012-06-02 13:18 . 2007-06-22 13:00        18160        ----a-w-        c:\windows\system32\mucltui.dll.mui
2012-06-02 13:18 . 2006-11-18 16:24        275696        ----a-w-        c:\windows\system32\mucltui.dll
2012-06-02 13:18 . 2005-05-26 02:19        214256        ----a-w-        c:\windows\system32\muweb.dll
2012-05-31 13:22 . 2004-06-22 23:15        604160        ----a-w-        c:\windows\system32\crypt32.dll
2012-05-26 19:55 . 2005-05-03 20:23        192512        ----a-w-        c:\windows\system32\ati2evxx.dll
2012-05-26 19:55 . 2010-06-13 09:49        118784        ----a-w-        c:\windows\system32\atibtmon.exe
2012-05-26 19:55 . 2005-05-03 19:52        888832        ----a-w-        c:\windows\system32\ati2cqag.dll
2012-05-26 19:54 . 2009-02-04 05:03        638976        ----a-w-        c:\windows\system32\atiok3x2.dll
2012-05-26 19:54 . 2005-05-03 20:24        43520        ----a-w-        c:\windows\system32\ati2edxx.dll
2012-05-26 19:54 . 2001-11-09 09:01        24064        ----a-w-        c:\windows\system32\ativcoxx.dll
2012-05-26 19:54 . 2010-10-02 11:14        99856        ----a-w-        c:\windows\system32\drivers\AtihdXP3.sys
2012-05-26 19:54 . 2010-06-13 09:49        159744        ----a-w-        c:\windows\system32\atiapfxx.exe
2012-05-26 19:54 . 2005-05-03 20:24        217088        ----a-w-        c:\windows\system32\atipdlxx.dll
2012-05-26 19:54 . 2005-05-03 20:14        5374560        ----a-w-        c:\windows\system32\ati3duag.dll
2012-05-26 19:54 . 2011-05-02 21:33        956160        ----a-w-        c:\windows\system32\ativvamv.dll
2012-05-26 19:54 . 2010-06-13 09:49        65024        ----a-w-        c:\windows\system32\atimpc32.dll
2012-05-26 19:54 . 2009-02-04 03:58        65024        ----a-w-        c:\windows\system32\amdpcom32.dll
2012-05-26 19:54 . 2009-02-04 03:53        237568        ----a-w-        c:\windows\system32\atiadlxx.dll
2012-05-26 19:54 . 2005-05-03 20:22        53248        ----a-w-        c:\windows\system32\ATIDDC.DLL
2012-05-26 19:54 . 2009-02-04 04:56        442368        ----a-w-        c:\windows\system32\ATIDEMGX.dll
2012-05-26 19:54 . 2005-05-03 20:28        305664        ----a-w-        c:\windows\system32\ati2dvag.dll
2012-05-26 19:53 . 2005-05-03 20:24        159744        ----a-w-        c:\windows\system32\Oemdspif.dll
2012-05-26 19:53 . 2005-05-03 23:04        311296        ----a-w-        c:\windows\system32\atiiiexx.dll
2012-05-26 19:53 . 2005-05-03 20:44        19976192        ----a-w-        c:\windows\system32\atioglxx.dll
2012-05-26 19:53 . 2008-10-21 17:40        294912        ----a-w-        c:\windows\system32\ATIODE.exe
2012-05-26 19:53 . 2005-05-03 20:28        7746048        ----a-w-        c:\windows\system32\drivers\ati2mtag.sys
2012-05-26 19:53 . 2005-05-03 19:57        53248        ----a-w-        c:\windows\system32\drivers\ati2erec.dll
2012-05-26 19:53 . 2005-05-03 20:24        26112        ----a-w-        c:\windows\system32\Ati2mdxx.exe
2012-05-26 19:53 . 2005-05-03 19:57        847872        ----a-w-        c:\windows\system32\atikvmag.dll
2012-05-26 19:52 . 2005-05-03 20:22        647168        ----a-w-        c:\windows\system32\ati2evxx.exe
2012-05-26 19:52 . 2005-05-03 20:08        3900800        ----a-w-        c:\windows\system32\ativvaxx.dll
2012-05-26 19:52 . 2005-05-03 19:57        17408        ----a-w-        c:\windows\system32\atitvo32.dll
2012-05-26 19:52 . 2008-10-21 17:40        45056        ----a-w-        c:\windows\system32\ATIODCLI.exe
2012-05-16 15:07 . 2004-02-06 16:07        916992        ----a-w-        c:\windows\system32\wininet.dll
2012-05-15 13:56 . 2004-06-22 15:36        1863296        ----a-w-        c:\windows\system32\win32k.sys
2012-05-11 14:40 . 2004-06-22 15:36        43520        ----a-w-        c:\windows\system32\licmgr10.dll
2012-05-11 14:40 . 2004-06-22 15:36        1469440        ----a-w-        c:\windows\system32\inetcpl.cpl
2012-05-11 11:38 . 2004-10-11 12:32        385024        ----a-w-        c:\windows\system32\html.iec
2012-05-09 12:59 . 2011-10-20 18:42        137928        ----a-w-        c:\windows\system32\drivers\avipbb.sys
2012-05-09 12:59 . 2011-10-20 18:42        83392        ----a-w-        c:\windows\system32\drivers\avgntflt.sys
2012-05-05 03:14 . 2002-08-29 03:41        2029056        ----a-w-        c:\windows\system32\ntkrnlpa.exe
2012-05-05 03:14 . 2002-08-29 03:41        2150912        ----a-w-        c:\windows\system32\ntoskrnl.exe
2012-05-02 13:46 . 2004-06-22 15:41        139656        ----a-w-        c:\windows\system32\drivers\rdpwd.sys
2012-04-14 12:47 . 2012-04-14 12:47        76800        ----a-w-        c:\windows\system32\drivers\SSHDRV84.sys
2012-04-04 13:56 . 2009-10-19 12:10        22344        ----a-w-        c:\windows\system32\drivers\mbam.sys
2011-06-09 10:03 . 2011-06-05 23:27        143240        ----a-w-        c:\programme\Gemeinsame Dateien\ApnStub.exe
2010-01-26 22:11 . 2011-01-25 22:59        444283        ----a-w-        c:\programme\Gemeinsame Dateien\WinPcapNmap.exe
2009-08-09 00:11 . 2009-08-09 00:11        10437264        ----a-w-        c:\programme\opera\program\plugins\PDFNetC.dll
2009-08-09 00:30 . 2009-08-09 00:30        107760        ----a-w-        c:\programme\opera\program\plugins\ScorchPDFWrapper.dll
.
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{EEE6C35D-6118-11DC-9C72-001320C79847}"= "c:\programme\SweetIM\Toolbars\Internet Explorer\mgHelper.dll" [2012-06-04 130904]
.
[HKEY_CLASSES_ROOT\clsid\{eee6c35d-6118-11dc-9c72-001320c79847}]
[HKEY_CLASSES_ROOT\SweetIM_URLSearchHook.ToolbarURLSearchHook.1]
[HKEY_CLASSES_ROOT\TypeLib\{EEE6C35F-6118-11DC-9C72-001320C79847}]
[HKEY_CLASSES_ROOT\SweetIM_URLSearchHook.ToolbarURLSearchHook]
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{EEE6C35C-6118-11DC-9C72-001320C79847}]
2012-06-04 14:12        1310040        ----a-w-        c:\programme\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{EEE6C35B-6118-11DC-9C72-001320C79847}"= "c:\programme\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll" [2012-06-04 1310040]
.
[HKEY_CLASSES_ROOT\clsid\{eee6c35b-6118-11dc-9c72-001320c79847}]
[HKEY_CLASSES_ROOT\SWEETIE.IEToolbar.1]
[HKEY_CLASSES_ROOT\TypeLib\{EEE6C35E-6118-11DC-9C72-001320C79847}]
[HKEY_CLASSES_ROOT\SWEETIE.IEToolbar]
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{EEE6C35B-6118-11DC-9C72-001320C79847}"= "c:\programme\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll" [2012-06-04 1310040]
.
[HKEY_CLASSES_ROOT\clsid\{eee6c35b-6118-11dc-9c72-001320c79847}]
[HKEY_CLASSES_ROOT\SWEETIE.IEToolbar.1]
[HKEY_CLASSES_ROOT\TypeLib\{EEE6C35E-6118-11DC-9C72-001320C79847}]
[HKEY_CLASSES_ROOT\SWEETIE.IEToolbar]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"H/PC Connection Agent"="c:\programme\Microsoft ActiveSync\wcescomm.exe" [2006-11-13 1289000]
"Pando Media Booster"="c:\programme\Pando Networks\Media Booster\PMB.exe" [2011-09-09 3077528]
"WMPNSCFG"="c:\programme\Windows Media Player\WMPNSCFG.exe" [2006-11-03 204288]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AGRSMMSG"="AGRSMMSG.exe" [2005-03-08 88203]
"CHotkey"="mHotkey.exe" [2004-02-24 508416]
"ledpointer"="CNYHKey.exe" [2004-02-03 5794816]
"Adobe ARM"="c:\programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712]
"avgnt"="c:\programme\Avira\AntiVir Desktop\avgnt.exe" [2012-05-09 348624]
"EEventManager"="c:\programme\Epson Software\Event Manager\EEventManager.exe" [2010-10-12 979328]
"StartCCC"="c:\programme\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2012-04-05 98304]
"QuickTime Task"="c:\programme\QuickTime\qttask.exe" [2011-10-24 421888]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
"DWQueuedReporting"="c:\progra~1\GEMEIN~1\MICROS~1\DW\dwtrig20.exe" [2007-02-26 437160]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\programme\SUPERAntiSpyware\SASSEH.DLL" [2011-07-19 113024]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"UIHost"="c:\dokumente und einstellungen\All Users\Anwendungsdaten\TuneUp Software\TuneUp Utilities 2012\WinStyler\tu_logonui.exe"
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2011-05-04 17:54        551296        ----a-w-        c:\programme\SUPERAntiSpyware\SASWINLO.DLL
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute        REG_MULTI_SZ          autocheck autochk *\0OODBS
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\BsMain]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2012-01-03 07:37        843712        ----a-w-        c:\programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\H/PC Connection Agent]
2006-11-13 11:50        1289000        ----a-w-        c:\programme\Microsoft ActiveSync\wcescomm.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NBJ]
2005-06-02 14:03        1957888        ----a-w-        c:\programme\Ahead\Nero BackItUp\NBJ.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2001-07-09 09:50        155648        ----a-w-        c:\windows\system32\NeroCheck.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PC Suite Tray]
2010-12-21 10:53        1483264        ----a-w-        c:\programme\Nokia\Nokia PC Suite 7\PCSuite.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCMService]
2005-04-07 14:43        127118        ----a-w-        c:\programme\Home Cinema\PowerCinema\PCMService.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2011-10-24 12:28        421888        ----a-w-        c:\programme\QuickTime\QTTask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
2004-11-02 18:24        32768        ----a-w-        c:\programme\Home Cinema\PowerDVD\PDVDServ.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2011-04-08 10:59        254696        ----a-w-        c:\programme\Gemeinsame Dateien\Java\Java Update\jusched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WMPNSCFG]
2006-11-03 08:56        204288        ----a-w-        c:\programme\Windows Media Player\wmpnscfg.exe
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"NCLaunch"=c:\windows\NCLAUNCH.EXe
"NBJ"="c:\programme\Ahead\Nero BackItUp\NBJ.exe"
"WMPNSCFG"=c:\programme\Windows Media Player\WMPNSCFG.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"ATICustomerCare"="c:\programme\ATI\ATICustomerCare\ATICustomerCare.exe"
"Adobe ARM"="c:\programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe"
"ATIPTA"="c:\programme\ATI Technologies\ATI Control Panel\atiptaxx.exe"
"VX1000"=c:\windows\vVX1000.exe
"QuickTime Task"="c:\programme\QuickTime\qttask.exe" -atboottime
"KernelFaultCheck"=%systemroot%\system32\dumprep 0 -k
"Adobe Reader Speed Launcher"="c:\programme\Adobe\Reader 10.0\Reader\Reader_sl.exe"
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Programme\\Microsoft ActiveSync\\rapimgr.exe"=
"c:\\Programme\\Pando Networks\\Media Booster\\PMB.exe"=
"c:\\Programme\\EPSON Software\\Event Manager\\EEventManager.exe"=
.
R1 avkmgr;avkmgr;c:\windows\system32\drivers\avkmgr.sys [20.10.2011 20:42 36000]
R1 SASDIFSV;SASDIFSV;c:\programme\SUPERAntiSpyware\sasdifsv.sys [22.07.2011 18:27 12880]
R1 SASKUTIL;SASKUTIL;c:\programme\SUPERAntiSpyware\SASKUTIL.SYS [12.07.2011 23:55 67664]
R1 SSHDRV84;SSHDRV84;c:\windows\system32\drivers\SSHDRV84.sys [14.04.2012 14:47 76800]
R2 !SASCORE;SAS Core Service;c:\programme\SUPERAntiSpyware\SASCore.exe [12.08.2011 01:38 116608]
R2 ABBYY.Licensing.FineReader.Sprint.9.0;ABBYY FineReader 9.0 Sprint Licensing Service;c:\programme\Gemeinsame Dateien\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe [14.05.2009 17:07 759048]
R2 AntiVirSchedulerService;Avira Planer;c:\programme\Avira\AntiVir Desktop\sched.exe [20.10.2011 20:42 86224]
R2 BsMain;BullGuard main service;c:\windows\System32\SvcHost.exe -k BullGuard_Main [22.06.2004 17:36 14336]
R2 BsUpdate;BullGuard update service;c:\programme\BullGuard Backup\BullGuardUpdate.exe [09.06.2012 12:08 331096]
R2 npf;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [27.01.2010 04:09 50704]
R3 3xHybrid;3xHybrid service;c:\windows\system32\drivers\3xHybrid.sys [09.12.2004 16:58 1025920]
R3 AtiHDAudioService;ATI Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdXP3.sys [02.10.2010 13:14 99856]
R3 cmudax;C-Media High Definition Audio Interface;c:\windows\system32\drivers\cmudax.sys [04.04.2005 14:06 1287296]
R3 UKBFLT;UKBFLT;c:\windows\system32\drivers\UKBFLT.sys [23.06.2004 11:32 11672]
S0 PDDSLHND;PDDSLHND; [x]
S2 dtgntdd;dtgntdd; [x]
S2 DTGuardService;DTGuardService; [x]
S2 gupdate;Google Update-Dienst (gupdate);c:\programme\Google\Update\GoogleUpdate.exe [17.06.2012 18:51 116648]
S2 SkypeUpdate;Skype Updater;c:\programme\Skype\Updater\Updater.exe [29.02.2012 08:50 158856]
S3 BgRaSvc;BgRaSvc;c:\programme\BullGuard Backup\Support\BgRaSvc.exe [26.11.2010 14:20 125784]
S3 CardReaderFilter;Card Reader Filter;c:\windows\system32\drivers\USBCRFT.SYS [04.04.2005 11:27 17408]
S3 gupdatem;Google Update-Dienst (gupdatem);c:\programme\Google\Update\GoogleUpdate.exe [17.06.2012 18:51 116648]
S3 HTCAND32;HTC Device Driver;c:\windows\system32\drivers\ANDROIDUSB.sys [05.06.2011 00:29 24576]
S3 IIUSBISP;USB Mass Storage for USB ISP;c:\windows\system32\Drivers\iiusbisp.sys --> c:\windows\system32\Drivers\iiusbisp.sys [?]
S3 PDDSLADP;ProDyne DSL Adapter;c:\windows\system32\DRIVERS\PDDSLADP.SYS --> c:\windows\system32\DRIVERS\PDDSLADP.SYS [?]
S3 PRISM_A00;CREATIX 802.11g Driver;c:\windows\system32\drivers\PRISMA00.sys [25.06.2004 11:47 380736]
S3 XDva288;XDva288; [x]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
BullGuard_Main        REG_MULTI_SZ          BsMain
.
Inhalt des "geplante Tasks" Ordners
.
2012-06-21 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\programme\Google\Update\GoogleUpdate.exe [2012-06-17 16:51]
.
2012-06-21 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\programme\Google\Update\GoogleUpdate.exe [2012-06-17 16:51]
.
2012-06-21 c:\windows\Tasks\User_Feed_Synchronization-{2EF742D4-4E03-411D-969D-2209FE511C80}.job
- c:\windows\system32\msfeedssync.exe [2006-10-17 03:31]
.
2012-06-21 c:\windows\Tasks\User_Feed_Synchronization-{3F92B61E-D798-494B-8489-ED4055E7ED66}.job
- c:\windows\system32\msfeedssync.exe [2006-10-17 03:31]
.
2012-06-21 c:\windows\Tasks\User_Feed_Synchronization-{AF956C0B-8C67-475F-A1E3-FAE2CFD0BBC1}.job
- c:\windows\system32\msfeedssync.exe [2006-10-17 03:31]
.
2012-06-21 c:\windows\Tasks\User_Feed_Synchronization-{EE91F686-F3D1-4728-A322-42076A29379D}.job
- c:\windows\system32\msfeedssync.exe [2006-10-17 03:31]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://de.wikipedia.org/wiki/Wikipedia:Hauptseite
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: Google Sidewiki... - c:\programme\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html
IE: Nach Microsoft &Excel exportieren - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.1.1
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
DPF: {6218F7B5-0D3A-48BA-AE4C-49DCFA63D400} - hxxp://www.myheritage.com/Genoogle/Components/ActiveX/SearchEngineQuery.dll
DPF: {BA162249-F2C5-4851-8ADC-FC58CB424243} - hxxp://static.pe.schuelervz.net/photouploader/ImageUploader5.cab?nocache=1208886004
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
WebBrowser-{76AEEA42-E04A-4B62-83AB-DF4B2BE2541E} - (no file)
WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
WebBrowser-{C424171E-592A-415A-9EB1-DFD6D95D3530} - (no file)
HKLM-Run-Cmaudio - cmicnfg.cpl
SafeBoot-WudfPf
SafeBoot-WudfRd
MSConfigStartUp-Adobe Reader Speed Launcher - c:\programme\Adobe\Reader 9.0\Reader\Reader_sl.exe
MSConfigStartUp-DivXUpdate - c:\programme\DivX\DivX Update\DivXUpdate.exe
MSConfigStartUp-iTunesHelper - c:\programme\iTunes\iTunesHelper.exe
MSConfigStartUp-NSLauncher - c:\programme\Nokia\Nokia Software Launcher\NSLauncher.exe
MSConfigStartUp-PlusService - c:\programme\Messenger Plus!\PlusService.exe
AddRemove-conduitEngine - c:\programme\ConduitEngine\ConduitEngineUninstall.exe
AddRemove-LSI Soft Modem - c:\windows\agrsmdel
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2012-06-21 16:53
Windows 5.1.2600 Service Pack 3 NTFS
.
Scanne versteckte Prozesse...
.
Scanne versteckte Autostarteinträge...
.
Scanne versteckte Dateien...
.
Scan erfolgreich abgeschlossen
versteckte Dateien: 0
.
**************************************************************************
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\S-1-5-21-2315146459-1594303470-113591373-1008\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\Ø•€|ÿÿÿÿ•€|ù•6~*]
"7040110900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL"
"7040211900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL"
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\System*]
"OOCC7.00.00.01PROSTATION"="B70BA71050CBE6555599D7B8D06722F91F0BB71505D13583F7E4AD8F3E50369CA0A40403DE036B732005227389588BE33E08E22DE53A1FF910DF6823F522DB3591969424726725AC4F1404E2C16E8BF7A1EF98C2F81FE46E770C1F86ED2B752F2F89F8BC5C2BA2028309D9879482BC0205B79AB23E1BD31AA1B5159331EB9E5146BF9142CFD270E701B5C79A7BBDBEC2C2E8EC921C1EBC2B25394EDE2EB87AD6448B86E4E23A214530053684599E36705E205628DCEC73C4B98914A8363B2EEDBDD2BF85928DCBF61B714EE5F1F84933FA0F63EFAB1DD1FEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74C5D575E7D6A3B9808BA7FD869164D6794A2D97226D213B5558EDD5E5BE2F6E66769DEED448B2184F56066C35B5315DA0779BAF6AACE6802EB0BD11E76AA38A60E9405BA86851F0FD7A24A0FC2C63714C6927CB5C43C2B6D989B379D8F125AC2FAAB40BEC79C899B579204B386E127142583A093B6881CE553DB7CA90006B0C1BD4273EDCAA37CF5359290DBCCD7E968129ADC8EA4E549E05DA7B0358CD0F21E8961A5D016A7F83C357612C4FA916AF7821A8AB878B626A87D4E86C740763DA315850504F565E3E21F084BBFBEA875F66EB6A7B7DE9608D77B92D4FCE7AB0D771A9DE036F750832EBD84A5B188ED3C73D39B56474ACE2ADFA7AB18829759478CD78E2D2DF08F063C611C30150BE354CB32E55C346E622A8450436C1EA41E33AD903080C077FB7C785DF39875BF43B6358E28A3E145048A614DF996A4284B7BF88BCD175DE525D8270A26B57563F6C03672E83BC48B1E326078E27D030265B0DF9227D183DC4EF55EC2BE8049F31FB4AB69A1D2E9C2CAEA43AD832CB653A745277572B4C5BDEC0F0BE6BE16BAB68E37C484C0416D305D639FD0584F5582FD10EA065566CE312BC3E85A9C3528354CD185D72702825C582F5CC650BC84B98A4E171BEC3459A1E81A0D043FC580B89473C47D2C30EE14F442B8784D6A0167A21E6D0FC98CB63EB6F95DD084CECA53D7EA30101A100EE91F78C3D22772983CD00305C06F84CAF95E2F94AE3E7D2059386EC5B1AC854DB2F71162C929132E3051E4C593D4D20D8C566A4113B0232E628D195A87189CAE86D4AC4ED112B13BFC968EEFECE7558BF150C0C7749434344AE3E595388102C843BC53146415D3C82046AF92B8868AE467ADA95CCF17C90A317A38F1720408C50B6C6E147F582578DC38DB95658796CDF085818BA35AA017FBC3544165AC24E4C0D5CB02A477F27BB77B0AB1E430410ED5208A34F3F11A59D2E96426C67D70770F1C9F68D98231987CD196742D3E760421FE66074868BAE221C5F318CDEBAA63E297FE23A8FAF5AD39AFBF41BAE0469DA1D31F0E2CB82CD697E7F6E339E3B4A46D5564E31ED7"
"OODEFRAG14.00.00.01PROFESSIONAL"="0B38ED0C4AFDBEAF211E1EC6E633A215F47415BA4338707EFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74C5D575E7D6A3B98088EDD5E5BE2F6E667C038D530D6EB3452C038D530D6EB345205C1E771DFB3D8D09933A6750C0B315ACB9CA90622C316ED5F34370551DE62FDF62AF74145F4EA2192258C3CF05E19B924052C3066241D6A317DE76C43392CD50701E487AA92CEB7F9783C5351843D493B45DAB114F2CFF0B8A57BAD27D27DCE9151AD644C77E98997FB6847233B04F66115B527F965B4106E66650DC4F19CB3D6F955EC8C21E3BD1354469A7FD41769C7FA441D0B421687AB4C1D4908F59502FB2DE42A6D2028AFFA790EC22536E17805548F195FE402CE31BB9B1180CC36EC0871E51A991AE76E40377A2BF55B95B193D22491AFBB4A0F23676009E27B135BE7A16AACDE4716BEB62D4F3077D1A95451F814705CCA05A4075B6D48069A8367EC6E04472CF5EB161ACD4FA5D33CD3D48123769568A98C22C9744ADCE65621DEC9574CC31787E42288E3C2D058D0945D4A7A625379037F4DB9E40144A4EECC469836DD6DD971C1428008F86AF85AABC7B502F8F15C173F1E0B31A0740437A7D15533D786503C0709E82CBEA149351DA6328DD7AA7E38F2C355B5BB54EB9A1A6D5ECF5EC4F9057B3E8A126C1983D5B33F92C6282FF14D041F929DE8BF691250B77B5C9A4F7E7D2CDC145457E50741FB080EA8129F70D2A04624EBC108AA30B782D201B44425EAE81696DB5F12D41247AEBC864215D2573A024CF5E67085178354F1B86034DA2746CB066BE29C1276A9929E83EB99987E88CF3265F9B071022CE74850CEA4311F9B95BD14C6F60AB1FEC99618C4AC647F85E1E139A1F5083A6CACAAECB78E5C5486C0F8BD74062A98E11C6A918541FCA4ED1CCAC1095E8C2242C3510557DFB55A66CADBA6D8258216B30643916C3ECD4E459ABFA55E80612D7105D8E1EDF7B95C5EE7E9DB63A24CA89AB7B18B3AFD65EF50A9795E54610EE382F942A2BD2C891758800CC30A3F5F62009627C936D076101B4A1139A07FBE613EE0F03C8E45E9DBFE2F9193C3B23AE810BB786729F859CAF2B287597FC9C358362D2D722E02458FC243AAD80F26FD773BF0E2D4DF2E074EE8CBC0332F25908A3C0525E2E812A5AC59C0EC716CB672DB38B903D9AC1A1F5F54B38211F1E73DD1E643E679161ABDBE395FD114DEF67FF800C85C0CE6DC65D3CFBBF9118E5F859A1275687A8AB4E2E79E0AB6C5EFED33C45008D35A640A3F97B769B4A4CF4CCAE2DDDF01FC226D8CDD0A61DCE3AC1540C9289136840727B829B076A79084E10EC2AB776E6C3EC559E8C038E99DA5597DA4CDB82F1F2E30809D9D50A9F0FE47F8DE24E6D005413309E74995E7F6EE9E6289CA815213BE93681A2C18"
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------
.
- - - - - - - > 'winlogon.exe'(1076)
c:\programme\SUPERAntiSpyware\SASWINLO.DLL
c:\windows\system32\Ati2evxx.dll
c:\windows\system32\atiadlxx.dll
.
- - - - - - - > 'explorer.exe'(2016)
c:\progra~1\WINDOW~2\wmpband.dll
c:\windows\HKCYDLL.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Zeit der Fertigstellung: 2012-06-21  16:57:55
ComboFix-quarantined-files.txt  2012-06-21 14:57
.
Vor Suchlauf: 14 Verzeichnis(se), 45.586.669.568 Bytes frei
Nach Suchlauf: 15 Verzeichnis(se), 45.522.325.504 Bytes frei
.
- - End Of File - - A69B57C48753C89476E67430A03D7357
--- --- ---

cosinus 21.06.2012 19:04
Bitte nun Logs mit GMER und OSAM erstellen und posten.
GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus - die Online-Abfrage durch OSAM bitte überspringen.
Bei OSAM bitte darauf auch achten, dass Du das Log auch als *.log und nicht *.html oder so abspeicherst.

Hinweis: Zum Entpacken von OSAM bitte WinRAR oder 7zip verwenden! Stell auch unbedingt den Virenscanner ab, besonders der Scanner von McAfee meldet oft einen Fehalarm in OSAM!

Downloade dir bitte aswMBR.exe und speichere die Datei auf deinem Desktop.
  • Starte die aswMBR.exe - (aswMBR.exe Anleitung)
    Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten".
  • Das Tool wird dich fragen, ob Du mit der aktuellen Virendefinition von AVAST! dein System scannen willst. Beantworte diese Frage bitte mit Ja. (Sollte deine Firewall fragen, bitte den Zugriff auf das Internet zulassen )
    Der Download der Definitionen kann je nach Verbindung eine Weile dauern.
  • Klicke auf Scan.
  • Warte bitte bis Scan finished successfully im DOS-Fenster steht.
  • Drücke auf Save Log und speichere diese auf dem Desktop.
Poste mir die aswMBR.txt in deiner nächsten Antwort.

Wichtig: Drücke keinesfalls einen der Fix Buttons ohne Anweisung

Hinweis: Sollte der Scan Button ausgeblendet sein, schließe das Tool und starte es erneut. Sollte der Scan abbrechen und das Programm abstürzen, dann teile mir das mit und wähle unter AV Scan die Einstellung (none).



Noch ein Hinweis: Sollte aswMBR abstürzen und es kommt eine Meldung wie "aswMBR.exe funktioniert nicht mehr, dann mach Folgendes:
Starte aswMBR neu, wähle unten links im Drop-Down-Menü (unten links im Fenster von aswMBR) bei "AV scan" (none) aus und klick nochmal auf den Scan-Button.

K-Runa 22.06.2012 00:10
Okay, erstmal GMER, die weiteren Logs folgen...

[code]
GMER Logfile:
Code:
GMER 1.0.15.15641 - hxxp://www.gmer.net
Rootkit scan 2012-06-22 01:10:00
Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP1T0L0-17 ST3250823AS rev.3.03
Running: 2oo0o6ox.exe; Driver: C:\DOKUME~1\YYYYY~1\LOKALE~1\Temp\axldqpob.sys


---- System - GMER 1.0.15 ----

SSDT            F7D82F6C                                                                                                                      ZwCreateThread
SSDT            F7D82F58                                                                                                                      ZwOpenProcess
SSDT            F7D82F5D                                                                                                                      ZwOpenThread

---- Kernel code sections - GMER 1.0.15 ----

.text          C:\WINDOWS\system32\DRIVERS\ati2mtag.sys                                                                                      section is writeable [0xF653D000, 0x2DC7EC, 0xE8000020]
.text          C:\WINDOWS\system32\drivers\ACEDRV05.sys                                                                                      section is writeable [0xAE601000, 0x30A4A, 0xE8000020]
.pklstb        C:\WINDOWS\system32\drivers\ACEDRV05.sys                                                                                      entry point in ".pklstb" section [0xAE643000]
.relo2          C:\WINDOWS\system32\drivers\ACEDRV05.sys                                                                                      unknown last section [0xAE65E000, 0x8E, 0x42000040]
.text          C:\WINDOWS\system32\drivers\SSHDRV84.sys                                                                                      section is writeable [0xAE5B7000, 0x233D4, 0xE8000020]
.pklstb        C:\WINDOWS\system32\drivers\SSHDRV84.sys                                                                                      entry point in ".pklstb" section [0xAE5E9000]
.relo2          C:\WINDOWS\system32\drivers\SSHDRV84.sys                                                                                      unknown last section [0xAE5FF000, 0x8E, 0x42000040]
init            C:\WINDOWS\system32\DRIVERS\UKBFLT.sys                                                                                        entry point in "init" section [0xF7D562E0]
?              System32\Drivers\hiber_WMILIB.SYS                                                                                            Das System kann den angegebenen Pfad nicht finden. !

---- Devices - GMER 1.0.15 ----

AttachedDevice  \FileSystem\Fastfat \Fat                                                                                                      fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
AttachedDevice  \FileSystem\Fastfat \Fat                                                                                                      fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)

---- Registry - GMER 1.0.15 ----

Reg            HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\System                                                                       
Reg            HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\System@OOCC7.00.00.01PROSTATION                                                B70BA71050CBE6555599D7B8D06722F91F0BB71505D13583F7E4AD8F3E50369CA0A40403DE036B732005227389588BE33E08E22DE53A1FF910DF6823F522DB3591969424726725AC4F1404E2C16E8BF7A1EF98C2F81FE46E770C1F86ED2B752F2F89F8BC5C2BA2028309D9879482BC0205B79AB23E1BD31AA1B5159331EB9E5146BF9142CFD270E701B5C79A7BBDBEC2C2E8EC921C1EBC2B25394EDE2EB87AD6448B86E4E23A214530053684599E36705E205628DCEC73C4B98914A8363B2EEDBDD2BF85928DCBF61B714EE5F1F84933FA0F63EFAB1DD1FEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74C5D575E7D6A3B9808BA7FD869164D6794A2D97226D213B5558EDD5E5BE2F6E66769DEED448B2184F56066C35B5315DA0779BAF6AACE6802EB0BD11E76AA38A60E9405BA86851F0FD7A24A0FC2C63714C6927CB5C43C2B6D989B379D8F125AC2FAAB40BEC79C899B579204B386E127142583A093B6881CE553DB7CA90006B0C1BD4273EDCAA37CF5359290DBCCD7E968129ADC8EA4E549E05DA7B0358CD0F21E8961A5D016A7F83C357612C4FA916AF7821A8AB878B626A87D4E86C740763DA315850504F565E3E21F084BBFBEA875F66EB6A7B7DE9608D77B92D4FCE7AB0D771A9DE036F750832EBD84A5B188ED3C73D39B56474ACE2ADFA7A
Reg            HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\System@OODEFRAG14.00.00.01PROFESSIONAL                                        0B38ED0C4AFDBEAF211E1EC6E633A215F47415BA4338707EFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74C5D575E7D6A3B98088EDD5E5BE2F6E667C038D530D6EB3452C038D530D6EB345205C1E771DFB3D8D09933A6750C0B315ACB9CA90622C316ED5F34370551DE62FDF62AF74145F4EA2192258C3CF05E19B924052C3066241D6A317DE76C43392CD50701E487AA92CEB7F9783C5351843D493B45DAB114F2CFF0B8A57BAD27D27DCE9151AD644C77E98997FB6847233B04F66115B527F965B4106E66650DC4F19CB3D6F955EC8C21E3BD1354469A7FD41769C7FA441D0B421687AB4C1D4908F59502FB2DE42A6D2028AFFA790EC22536E17805548F195FE402CE31BB9B1180CC36EC0871E51A991AE76E40377A2BF55B95B193D22491AFBB4A0F23676009E27B135BE7A16AACDE4716BEB62D4F3077D1A95451F814705CCA05A4075B6D48069A8367EC6E04472CF5EB161ACD4FA5D33CD3D48123769568A98C22C9744ADCE65621DEC9574CC31787E42288E3C2D058D0945D4A7A625379037F4DB9E40144A4EECC469836DD6DD971C1428008F86AF85AABC7B502F8F15C173F1E0B31A0740437A7D15533D786503C0709E82CBEA149351DA6328DD7AA7E38F2C355B5BB54EB9A1A6D5ECF5EC4F9057B3E8A126C1983D5B33F92C6282FF14D041
Reg            HKLM\SOFTWARE\Classes\CLSID\{811A4731-5D4B-72E9-EE1C-5DBBC92A5CA6}\InprocServer32@RuntimeVersion                              v1.1.4322
Reg            HKLM\SOFTWARE\Classes\CLSID\{811A4731-5D4B-72E9-EE1C-5DBBC92A5CA6}\InprocServer32@Class                                      Microsoft.Office.Interop.Access.AllDatabaseDiagramsClass
Reg            HKLM\SOFTWARE\Classes\CLSID\{811A4731-5D4B-72E9-EE1C-5DBBC92A5CA6}\InprocServer32@Assembly                                    Microsoft.Office.Interop.Access, Version=11.0.0.0, Culture=neutral, PublicKeyToken=71e9bce111e9429c
Reg            HKLM\SOFTWARE\Classes\CLSID\{811A4731-5D4B-72E9-EE1C-5DBBC92A5CA6}\InprocServer32\11.0.0.0                                   
Reg            HKLM\SOFTWARE\Classes\CLSID\{811A4731-5D4B-72E9-EE1C-5DBBC92A5CA6}\InprocServer32\11.0.0.0@RuntimeVersion                    v1.1.4322
Reg            HKLM\SOFTWARE\Classes\CLSID\{811A4731-5D4B-72E9-EE1C-5DBBC92A5CA6}\InprocServer32\11.0.0.0@Class                              Microsoft.Office.Interop.Access.AllDatabaseDiagramsClass
Reg            HKLM\SOFTWARE\Classes\CLSID\{811A4731-5D4B-72E9-EE1C-5DBBC92A5CA6}\InprocServer32\11.0.0.0@Assembly                          Microsoft.Office.Interop.Access, Version=11.0.0.0, Culture=neutral, PublicKeyToken=71e9bce111e9429c
Reg            HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ffwp\OpenWithProgids@Lucom GmbH.FormsForWeb\xae Filler 3.1 

---- EOF - GMER 1.0.15 ----
Edit: OSAM-Log nun auch:

Code:
Report of OSAM: Autorun Manager v5.0.11926.0
hxxp://www.online-solutions.ru/en/
Saved at 01:25:03 on 22.06.2012

OS: Windows XP Home Edition Service Pack 3 (Build 2600)
Default Browser: Microsoft Corporation Internet Explorer 8.00.6001.18702

Scanner Settings
[x] Rootkits detection (hidden registry)
[x] Rootkits detection (hidden files)
[x] Retrieve files information
[x] Check Microsoft signatures

Filters
[ ] Trusted entries
[ ] Empty entries
[x] Hidden registry entries (rootkit activity)
[x] Exclusively opened files
[x] Not found files
[x] Files without detailed information
[x] Existing files
[ ] Non-startable services
[ ] Non-startable drivers
[x] Active entries
[x] Disabled entries


[Boot Execute]
-----( HKLM\SYSTEM\CurrentControlSet\Control\Session Manager )-----
"BootExecute" - ? - OODBS  (File not found)

[Common]
-----( %SystemRoot%\Tasks )-----
"GoogleUpdateTaskMachineCore.job" - "Google Inc." - C:\Programme\Google\Update\GoogleUpdate.exe
"GoogleUpdateTaskMachineUA.job" - "Google Inc." - C:\Programme\Google\Update\GoogleUpdate.exe

[Control Panel Objects]
-----( %SystemRoot%\system32 )-----
"FlashPlayerCPLApp.cpl" - "Adobe Systems Incorporated" - C:\WINDOWS\system32\FlashPlayerCPLApp.cpl
"infocardcpl.cpl" - "Microsoft Corporation" - C:\WINDOWS\system32\infocardcpl.cpl
"javacpl.cpl" - "Sun Microsystems, Inc." - C:\WINDOWS\system32\javacpl.cpl
"QTW32.CPL" - "Apple Computer, Inc." - C:\WINDOWS\system32\QTW32.CPL
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )-----
"Adobe Gamma" - "Adobe Systems, Inc." - C:\Programme\Gemeinsame Dateien\Adobe\Calibration\Adobe Gamma.cpl
"Avira AntiVir Personal - Free Antivirus " - "Avira Operations GmbH & Co. KG" - C:\PROGRA~1\Avira\ANTIVI~1\avconfig.cpl
"Avira AntiVir PersonalEdition Classic " - "Avira Operations GmbH & Co. KG" - C:\PROGRA~1\Avira\ANTIVI~1\avconfig.cpl
"NokiaConnectionManager" - "Nokia" - C:\PROGRA~1\Nokia\NOKIAP~1\CONNEC~1.CPL
"Pando" - "Pando Networks" - C:\Programme\Pando Networks\Media Booster\PMB.cpl
"QuickTime" - "Apple Inc." - C:\Programme\QuickTime\QTSystem\QuickTime.cpl

[Drivers]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"ACEDRV05" (ACEDRV05) - "Protect Software GmbH" - C:\WINDOWS\system32\drivers\ACEDRV05.sys
"avgntflt" (avgntflt) - "Avira GmbH" - C:\WINDOWS\System32\DRIVERS\avgntflt.sys
"avipbb" (avipbb) - "Avira GmbH" - C:\WINDOWS\System32\DRIVERS\avipbb.sys
"avkmgr" (avkmgr) - "Avira GmbH" - C:\WINDOWS\System32\DRIVERS\avkmgr.sys
"axldqpob" (axldqpob) - ? - C:\DOKUME~1\YYYYY~1\LOKALE~1\Temp\axldqpob.sys  (Hidden registry entry, rootkit activity | File not found)
"Card Reader Filter" (CardReaderFilter) - "ICSI Technology Ltd." - C:\WINDOWS\system32\Drivers\USBCRFT.SYS
"catchme" (catchme) - ? - C:\DOKUME~1\YYYYY~1\LOKALE~1\Temp\catchme.sys  (File not found)
"Changer" (Changer) - ? - C:\WINDOWS\system32\drivers\Changer.sys  (File not found)
"cpuz132" (cpuz132) - ? - C:\WINDOWS\system32\drivers\cpuz132.sys  (File not found)
"dtgntdd" (dtgntdd) - ? - C:\WINDOWS\system32\drivers\dtgntdd.sys  (File not found)
"i2omgmt" (i2omgmt) - ? - C:\WINDOWS\system32\drivers\i2omgmt.sys  (File not found)
"lbrtfdc" (lbrtfdc) - ? - C:\WINDOWS\system32\drivers\lbrtfdc.sys  (File not found)
"Logitech QuickCam Express(PID_0928)" (PID_0928) - ? - C:\WINDOWS\System32\DRIVERS\LV561AV.SYS  (File not found)
"Logitech USB Monitor Filter" (LVUSBSta) - ? - C:\WINDOWS\System32\drivers\lvusbsta.sys  (File not found)
"NetGroup Packet Filter Driver" (npf) - "CACE Technologies, Inc." - C:\WINDOWS\System32\drivers\npf.sys
"NTSIM" (NTSIM) - "VIA Networking Technologies, Inc.      " - C:\WINDOWS\System32\ntsim.sys
"Padus ASPI Shell" (pfc) - "Padus, Inc." - C:\WINDOWS\System32\drivers\pfc.sys
"PCIDump" (PCIDump) - ? - C:\WINDOWS\system32\drivers\PCIDump.sys  (File not found)
"PDCOMP" (PDCOMP) - ? - C:\WINDOWS\system32\drivers\PDCOMP.sys  (File not found)
"PDDSLHND" (PDDSLHND) - ? - C:\WINDOWS\system32\drivers\PDDSLHND.sys  (File not found)
"PDFRAME" (PDFRAME) - ? - C:\WINDOWS\system32\drivers\PDFRAME.sys  (File not found)
"PDRELI" (PDRELI) - ? - C:\WINDOWS\system32\drivers\PDRELI.sys  (File not found)
"PDRFRAME" (PDRFRAME) - ? - C:\WINDOWS\system32\drivers\PDRFRAME.sys  (File not found)
"ProDyne DSL Adapter" (PDDSLADP) - ? - C:\WINDOWS\System32\DRIVERS\PDDSLADP.SYS  (File not found)
"PxHelp20" (PxHelp20) - "Sonic Solutions" - C:\WINDOWS\System32\Drivers\PxHelp20.sys
"SASDIFSV" (SASDIFSV) - "SUPERAdBlocker.com and SUPERAntiSpyware.com" - C:\Programme\SUPERAntiSpyware\SASDIFSV.SYS
"SASKUTIL" (SASKUTIL) - "SUPERAdBlocker.com and SUPERAntiSpyware.com" - C:\Programme\SUPERAntiSpyware\SASKUTIL.SYS
"SSHDRV84" (SSHDRV84) - ? - C:\WINDOWS\system32\drivers\SSHDRV84.sys
"ssmdrv" (ssmdrv) - "Avira GmbH" - C:\WINDOWS\System32\DRIVERS\ssmdrv.sys
"TAP-Win32 Adapter V9" (tap0901) - "The OpenVPN Project" - C:\WINDOWS\System32\DRIVERS\tap0901.sys
"USB Mass Storage for USB ISP" (IIUSBISP) - ? - C:\WINDOWS\System32\Drivers\iiusbisp.sys  (File not found)
"VIA Rhine Family Fast Ethernet Adapter Driver Service" (FETNDISB) - "VIA Technologies, Inc.              " - C:\WINDOWS\System32\DRIVERS\fetnd5b.sys
"WAN Miniport (ATW)" (wanatw) - ? - C:\WINDOWS\System32\DRIVERS\wanatw4.sys  (File not found)
"WDICA" (WDICA) - ? - C:\WINDOWS\system32\drivers\WDICA.sys  (File not found)
"XDva288" (XDva288) - ? - C:\WINDOWS\system32\drivers\XDva288.sys  (File not found)

[Explorer]
-----( HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components )-----
{89B4C1CD-B018-4511-B0A1-5476DBF70820} "StubPath" - "Microsoft Corporation" - C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install
-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----
{7D4D6379-F301-4311-BEBA-E26EB0561882} "NeroDigitalColumnHandler Class" - "Nero AG" - C:\Programme\Gemeinsame Dateien\Ahead\Lib\NeroDigitalExt.dll
{F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\PDFShell.dll
-----( HKLM\Software\Classes\Protocols\Filter )-----
{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll
{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll
{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll
{807553E5-5146-11D5-A672-00B0D022E945} "text/xml" - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE11\MSOXMLMF.DLL
-----( HKLM\Software\Classes\Protocols\Handler )-----
{32505114-5902-49B2-880A-1F7738E5A384} "Data Page Plugable Protocal mso-offdap11 Handler" - "Microsoft Corporation" - C:\PROGRA~1\GEMEIN~1\MICROS~1\WEBCOM~1\11\OWC11.DLL
{3D9F03FA-7A94-11D3-BE81-0050048385D1} "Data Page Pluggable Protocol mso-offdap Handler" - "Microsoft Corporation" - C:\PROGRA~1\GEMEIN~1\MICROS~1\WEBCOM~1\10\OWC10.DLL
{314111c7-a502-11d2-bbca-00c04f8ec294} "HxProtocol Class" - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Help\hxds.dll
{FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} "IEProtocolHandler Class" - "Skype Technologies" - C:\PROGRA~1\GEMEIN~1\Skype\SKYPE4~1.DLL
{828030A1-22C1-4009-854F-8E305202313F} "livecall" - "Microsoft Corporation" - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
{0A9007C0-4076-11D3-8789-0000F8105754} "Microsoft Infotech Storage Protocol for IE 4.0" - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Information Retrieval\msitss.dll
{828030A1-22C1-4009-854F-8E305202313F} "msnim" - "Microsoft Corporation" - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
{03C514A3-1EFB-4856-9F99-10D7BE1653C0} "Windows Live Mail HTML Asynchronous Pluggable Protocol Handler" - "Microsoft Corporation" - C:\Programme\Windows Live\Mail\mailcomm.dll
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks )-----
{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} "SABShellExecuteHook Class" - "SuperAdBlocker.com" - C:\Programme\SUPERAntiSpyware\SASSEH.DLL
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----
{EBDF1F20-C829-11D1-8233-0020AF3E97A9} "4shared_Desktop" - ? -  (File not found | COM-object registry key not found)
{23170F69-40C1-278A-1000-000100020000} "7-Zip Shell Extension" - "Igor Pavlov" - C:\Programme\7-Zip\7-zip.dll
{9458E603-FF43-4134-9036-04B4C71791E3} "BackupCopyHook Class" - "BullGuard Ltd." - C:\Programme\BullGuard Backup\BackupShellHook.dll
{1F25C6E4-E60D-421A-863F-D0C76F6AB211} "BullGuard Online-Laufwerk" - "BullGuard Ltd." - C:\Programme\BullGuard Backup\BackupShellNamespace.dll
{0563DB41-F538-4B37-A92D-4659049B7766} "CLSID_WLMCMimeFilter" - "Microsoft Corporation" - C:\Programme\Windows Live\Mail\mailcomm.dll
{42071714-76d4-11d1-8b24-00a0c9068ff3} "CPL-Erweiterung für Anzeigeverschiebung" - ? -  (File not found | COM-object registry key not found)
{872A9397-E0D6-4e28-B64D-52B8D0A7EA35} "DisplayCplExt Class" - "Advanced Micro Devices, Inc." - c:\Programme\ATI Technologies\ATI.ACE\Core-Static\atiamaxx.dll
{88895560-9AA2-1069-930E-00AA0030EBC8} "Erweiterung für HyperTerminal-Icons" - ? -  (File not found | COM-object registry key not found)
{1D2680C9-0E2A-469d-B787-065558BC7D43} "Fusion Cache" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll
{73B24247-042E-4EF5-ADC2-42F62E6FD654} "ICQ Lite Shell Extension" - ? -  (File not found | COM-object registry key not found)
{FAC3CBF6-8697-43d0-BAB9-DCD1FCE19D75} "IE User Assist" - ? -  (File not found | COM-object registry key not found)
{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA} "Kontextmenü für die Verschlüsselung" - ? -  (File not found | COM-object registry key not found)
{32683183-48a0-441b-a342-7c2a440a9478} "Media Band" - ? -  (File not found | COM-object registry key not found)
{BC476F4C-D9D7-4100-8D4E-E043F6DEC409} "Microsoft Browser Architecture" - ? -  (File not found | COM-object registry key not found)
{42042206-2D85-11D3-8CFF-005004838597} "Microsoft Office HTML Icon Handler" - "Microsoft Corporation" - C:\Programme\Microsoft Office\OFFICE11\msohev.dll
{993BE281-6695-4BA5-8A2A-7AACBFAAB69E} "Microsoft Office Metadata Handler" - "Microsoft Corporation" - C:\PROGRA~1\GEMEIN~1\MICROS~1\OFFICE12\msoshext.dll
{00020D75-0000-0000-C000-000000000046} "Microsoft Office Outlook" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\OFFICE11\MLSHEXT.DLL
{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97} "Microsoft Office Thumbnail Handler" - "Microsoft Corporation" - C:\PROGRA~1\GEMEIN~1\MICROS~1\OFFICE12\msoshext.dll
{49BF5420-FA7F-11cf-8011-00A0C90A8F78} "Mobiles Gerät" - "Microsoft Corporation" - C:\PROGRA~1\MI3AA1~1\Wcesview.dll
{B327765E-D724-4347-8B16-78AE18552FC3} "NeroDigitalIconHandler Class" - "Nero AG" - C:\Programme\Gemeinsame Dateien\Ahead\Lib\NeroDigitalExt.dll
{7F1CF152-04F8-453A-B34C-E609530A9DC8} "NeroDigitalPropSheetHandler Class" - "Nero AG" - C:\Programme\Gemeinsame Dateien\Ahead\Lib\NeroDigitalExt.dll
{416651E4-9C3C-11D9-8BDE-F66BAD1E3F3A} "Nokia Phone Browser" - "Nokia" - C:\Programme\Nokia\Nokia PC Suite 7\PhoneBrowser.dll
{0006F045-0000-0000-C000-000000000046} "Outlook-Dateisymbolerweiterung" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\OFFICE11\OLKFSTUB.DLL
{45AC2688-0253-4ED8-97DE-B5370FA7D48A} "Shell Extension for Malware scanning" - "Avira Operations GmbH & Co. KG" - C:\Programme\Avira\AntiVir Desktop\shlext.dll
{E37E2028-CE1A-4f42-AF05-6CEABC4E5D75} "Shell Icon Handler for Application References" - "Microsoft Corporation" - C:\WINDOWS\system32\dfshim.dll
{764BF0E1-F219-11ce-972D-00AA00A14F56} "Shellerweiterungen für die Dateikomprimierung" - ? -  (File not found | COM-object registry key not found)
{e82a2d71-5b2f-43a0-97b8-81be15854de8} "ShellLink for Application References" - "Microsoft Corporation" - C:\WINDOWS\system32\dfshim.dll
{5E2121EE-0300-11D4-8D3B-444553540000} "SimpleShlExt Class" - "Advanced Micro Devices, Inc." - c:\Programme\ATI Technologies\ATI.ACE\Core-Static\atiacmxx.dll
{6F5C0F40-1419-4DC8-8D2F-D5EC5FCF07AB} "Sprint.ExplorerIntegration.9" - "ABBYY" - C:\Programme\Gemeinsame Dateien\ABBYY\FineReaderSprint\9.00\Integration\SprintIntegration.dll
{BDEADF00-C265-11D0-BCED-00A0C90AB50F} "Webordner" - "Microsoft Corporation" - C:\PROGRA~1\GEMEIN~1\MICROS~1\WEBFOL~1\MSONSEXT.DLL
{2BE99FD4-A181-4996-BFA9-58C5FFD11F6C} "Windows Live Photo Gallery Autoplay Drop Target" - "Microsoft Corporation" - C:\Programme\Windows Live\Photo Gallery\WLXPhotoGallery.exe
{00F30F64-AC33-42F5-8FD1-5DC2D3FDE06C} "Windows Live Photo Gallery Editor Drop Target" - "Microsoft Corporation" - C:\Programme\Windows Live\Photo Gallery\WLXPhotoGallery.exe
{00F3712A-CA79-45B4-9E4D-D7891E7F8B9D} "Windows Live Photo Gallery Editor Shim" - "Microsoft Corporation" - C:\Programme\Windows Live\Photo Gallery\PhotoViewerShim.dll
{00F30F90-3E96-453B-AFCD-D71989ECC2C7} "Windows Live Photo Gallery Viewer Autoplay Shim" - "Microsoft Corporation" - C:\Programme\Windows Live\Photo Gallery\PhotoViewerShim.dll
{00F33137-EE26-412F-8D71-F84E4C2C6625} "Windows Live Photo Gallery Viewer Autoplay Shim" - "Microsoft Corporation" - C:\Programme\Windows Live\Photo Gallery\PhotoViewerShim.dll
{00F374B7-B390-4884-B372-2FC349F2172B} "Windows Live Photo Gallery Viewer Drop Target" - "Microsoft Corporation" - C:\Programme\Windows Live\Photo Gallery\WLXPhotoGallery.exe
{00F346CB-35A4-465B-8B8F-65A29DBAB1F6} "Windows Live Photo Gallery Viewer Shim" - "Microsoft Corporation" - C:\Programme\Windows Live\Photo Gallery\PhotoViewerShim.dll
{06A2568A-CED6-4187-BB20-400B8C02BE5A} "{06A2568A-CED6-4187-BB20-400B8C02BE5A}" - "Microsoft Corporation" - C:\Programme\Windows Live\Photo Gallery\WLXPhotoAcquireWizard.exe

[Internet Explorer]
-----( HKCU\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars )-----
{32683183-48a0-441b-a342-7c2a440a9478} "{32683183-48a0-441b-a342-7c2a440a9478}" - ? -  (File not found | COM-object registry key not found)
-----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )-----
ITBar7Height "ITBar7Height" - ? -  (File not found | COM-object registry key not found)
<binary data> "ITBar7Layout" - ? -  (File not found | COM-object registry key not found)
<binary data> "SweetPacks Toolbar for Internet Explorer" - "SweetIM Technologies Ltd." - C:\Programme\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll
<binary data> "{855F3B16-6D32-4FE6-8A56-BBB695989046}" - ? -  (File not found | COM-object registry key not found)
-----( HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks )-----
{EEE6C35D-6118-11DC-9C72-001320C79847} "SweetIM ToolbarURLSearchHook Class" - "SweetIM Technologies Ltd." - C:\Programme\SweetIM\Toolbars\Internet Explorer\mgHelper.dll
-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----
{59136DB4-6CA3-4B40-8F2F-BBF84B6F1E91} "Attachment Upload Control" - "WEB.DE GmbH" - C:\WINDOWS\DOWNLO~1\MAIL_U~1.OCX / https://stream.web.de/mail/activex/mail_upload_11213.cab
{BD393C14-72AD-4790-A095-76522973D6B8} "CBreakshotControl Class" - "pixelStorm entertainment studios Inc." - C:\WINDOWS\Downloaded Program Files\banksht2.dll / hxxp://messenger.zone.msn.com/binary/Bankshot.cab57213.cab
{20A60F0D-9AFA-4515-A0FD-83BD84642501} "Checkers Class" - "Microsoft Corporation" - C:\WINDOWS\Downloaded Program Files\msgrchkr.dll / hxxp://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
{2250C29C-C5E9-4F55-BE4E-01E45A40FCF1} "CMediaMix Object" - "Microsoft Corp." - C:\WINDOWS\system32\MediaLogic.dll / hxxp://musicmix.messenger.msn.com/Medialogic.CAB
{6218F7B5-0D3A-48BA-AE4C-49DCFA63D400} "CSEQueryObject Object" - "MyHeritage Ltd." - C:\WINDOWS\Downloaded Program Files\SearchEngineQuery.dll / hxxp://www.myheritage.com/Genoogle/Components/ActiveX/SearchEngineQuery.dll
{DE22A7AB-A739-4C58-AD52-21F9CD6306B7} "CTAdjust Class" - ? - C:\WINDOWS\Downloaded Program Files\clearadjust.dll / hxxp://download.microsoft.com/download/7/E/6/7E6A8567-DFE4-4624-87C3-163549BE2704/clearadj.cab
DirectAnimation Java Classes "DirectAnimation Java Classes" - ? -  (File not found | COM-object registry key not found) / file://C:\WINDOWS\Java\classes\dajava.cab
{69EF49E5-FE46-4B92-B5FA-2193AB7A6B8A} "GameLauncher Control" - "Acclaim Game Launcher" - C:\WINDOWS\DOWNLO~1\GAMELA~1.OCX / hxxp://www.acclaim.com/cabs/acclaim_v4.cab
{BA162249-F2C5-4851-8ADC-FC58CB424243} "Image Uploader Control" - "Aurigma, Inc." - C:\WINDOWS\Downloaded Program Files\ImageUploader5.ocx / hxxp://static.pe.schuelervz.net/photouploader/ImageUploader5.cab?nocache=1208886004
{1754A1BA-A1DF-4F10-B199-AA55AA1A120F} "InstallerBehaviorFactory Class" - "Microsoft Corp." - C:\WINDOWS\Downloaded Program Files\MsnInstC.dll / https://signup.msn.com/pages/MsnInstC.cab
{8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.6.0_26" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\npjpi160_26.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} "Java Plug-in 1.6.0_26" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\npjpi160_26.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_26" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\npjpi160_26.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
{15B782AF-55D8-11D1-B477-006097098764} "Macromedia Authorware Web Player Control" - "Macromedia, Inc." - C:\WINDOWS\system32\macromed\authorwa\awswax.ocx / hxxp://fpdownload.macromedia.com/get/shockwave/cabs/authorware/awswaxd.cab
{C3F79A2B-B9B4-4A66-B012-3EE46475B072} "MessengerStatsClient Class" - "Microsoft Corporation" - C:\WINDOWS\Downloaded Program Files\MessengerStatsPAClient.dll / hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
{B479199A-1242-4E3C-AD81-7F0DF801B4AE} "Microsoft Download Manager ActiveX control" - "Microsoft Corp." - C:\WINDOWS\npMSDM.dll / hxxp://download.microsoft.com/download/C/9/C/C9C3D86D-84AC-4AF0-8584-842756A66467/MicrosoftDownloadManager.cab
Microsoft XML Parser for Java "Microsoft XML Parser for Java" - ? -  (File not found | COM-object registry key not found) / file://C:\WINDOWS\Java\classes\xmldso.cab
{B8BE5E93-A60C-4D26-A2DC-220313175592} "MSN Games - Installer" - "Microsoft Corporation" - C:\WINDOWS\Downloaded Program Files\ZIntro.ocx / hxxp://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
{4F1E5B1A-2A80-42CA-8532-2D05CB959537} "MSN Photo Upload Tool" - "Microsoft® Corporation" - C:\WINDOWS\Downloaded Program Files\MsnPUpld.dll / hxxp://gfx2.hotmail.com/mail/w2/resources/MSNPUpld.cab
{3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} "Office Update Installation Engine" - "Microsoft Corporation" - C:\WINDOWS\opuc.dll / hxxp://office.microsoft.com/officeupdate/content/opuc3.cab
{56393399-041A-4650-94C7-13DFCB1F4665} "PSFormX Control" - "Visicom Media" - C:\WINDOWS\DOWNLO~1\PESTSC~1.OCX / hxxp://www.ca.com/us/securityadvisor/pestscan/pestscan.cab
{166B1BCA-3F9C-11CF-8075-444553540000} "Shockwave ActiveX Control" - "Adobe Systems, Inc." - C:\WINDOWS\system32\Adobe\Director\SwDir.dll / hxxp://fpdownload.macromedia.com/get/shockwave/cabs/director/sw.cab
{D27CDB6E-AE6D-11CF-96B8-444553540000} "Shockwave Flash Object" - "Adobe Systems, Inc." - C:\WINDOWS\system32\Macromed\Flash\Flash11e.ocx / hxxp://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
{5D6F45B3-9043-443D-A792-115447494D24} "UnoCtrl Class" - "Microsoft" - C:\WINDOWS\Downloaded Program Files\GAME_UNO1.dll / hxxp://messenger.zone.msn.com/MessengerGamesContent/GameContent/de/uno1/GAME_UNO1.cab
{17492023-C23A-453E-A040-C7C580BBF700} "Windows Genuine Advantage Validation Tool" - "Microsoft Corporation" - C:\WINDOWS\system32\legitcheckcontrol.dll / hxxp://download.microsoft.com/download/9/b/d/9bdc68ef-6a9f-4505-8fb8-d0d2d160e512/LegitCheckControl.cab
{E77F23EB-E7AB-4502-8F37-247DBAF1A147} "Windows Live Hotmail Photo Upload Tool" - "Microsoft® Corporation" - C:\WINDOWS\Downloaded Program Files\CONFLICT.2\MsnPUpld.dll / hxxp://gfx2.hotmail.com/mail/w4/pr01/photouploadcontrol/MSNPUpld.cab
{7B297BFD-85E4-4092-B2AF-16A91B2EA103} "WScanCtl Class" - "CA" - C:\WINDOWS\Downloaded Program Files\webscan.dll / hxxp://www.ca.com/de/securityadvisor/virusinfo/webscan.cab
{0E8D0700-75DF-11D3-8B4A-0008C7450C4A} "{0E8D0700-75DF-11D3-8B4A-0008C7450C4A}" - ? -  (File not found | COM-object registry key not found) / hxxp://www.lizardtech.com/download/files/win/djvuplugin/de_DE/DjVuControl_de_DE.cab
{33564D57-0000-0010-8000-00AA00389B71} "{33564D57-0000-0010-8000-00AA00389B71}" - ? -  (File not found | COM-object registry key not found) / hxxp://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB
{67DABFBF-D0AB-41FA-9C46-CC0F21721616} "{67DABFBF-D0AB-41FA-9C46-CC0F21721616}" - ? -  (File not found | COM-object registry key not found) / hxxp://download.divx.com/player/DivXBrowserPlugin.cab
{E2883E8F-472F-4FB0-9522-AC9BF37916A7} "{E2883E8F-472F-4FB0-9522-AC9BF37916A7}" - ? -  (File not found | COM-object registry key not found) / hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----
{2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} "ClsidExtension" - "Microsoft Corporation" - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
{2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} "Create Mobile Favorite" - "Microsoft Corporation" - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
{5F7B1267-94A9-47F5-98DB-E99415F33AEC} "In Blog veröffentlichen" - "Microsoft Corporation" - C:\Programme\Windows Live\Writer\WriterBrowserExtension.dll
{FF059E31-CC5A-4E2E-BF3B-96E929D65503} "Recherchieren" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar )-----
{9421DD08-935F-4701-A9CA-22DF90AC4EA6} "Easy Photo Print" - "SEIKO EPSON CORPORATION" - C:\Programme\Epson Software\Easy Photo Print\EPTBL.dll
<binary data> "SweetPacks Toolbar for Internet Explorer" - "SweetIM Technologies Ltd." - C:\Programme\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----
{18DF081C-E8AD-4283-A596-FA578C2EBDC3} "Adobe PDF Link Helper" - "Adobe Systems Incorporated" - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
{9421DD08-935F-4701-A9CA-22DF90AC4EA6} "Easy Photo Print" - "SEIKO EPSON CORPORATION" - C:\Programme\Epson Software\Easy Photo Print\EPTBL.dll
{7b523e7c-f096-4e36-a0cb-7efeb5c675c1} "IEExtension.VDownloaderBHO" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll
{DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\jp2ssv.dll
{E7E6F031-17CE-4C07-BC86-EABFE594F69C} "JQSIEStartDetectorImpl Class" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
{EEE6C35C-6118-11DC-9C72-001320C79847} "SweetPacks Browser Helper" - "SweetIM Technologies Ltd." - C:\Programme\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll
{9030D464-4C02-4ABF-8ECC-5164760863C6} "Windows Live ID-Anmelde-Hilfsprogramm" - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

[Logon]
-----( %AllUsersProfile%\Startmenü\Programme\Autostart )-----
"desktop.ini" - ? - C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\desktop.ini
-----( %UserProfile%\Startmenü\Programme\Autostart )-----
"desktop.ini" - ? - C:\Dokumente und Einstellungen\XXXXX\Startmenü\Programme\Autostart\desktop.ini
-----( HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run )-----
"H/PC Connection Agent" - "Microsoft Corporation" - "C:\Programme\Microsoft ActiveSync\wcescomm.exe"
"Pando Media Booster" - ? - C:\Programme\Pando Networks\Media Booster\PMB.exe
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----
"Adobe ARM" - "Adobe Systems Incorporated" - "C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe"
"avgnt" - "Avira Operations GmbH & Co. KG" - "C:\Programme\Avira\AntiVir Desktop\avgnt.exe" /min
"CHotkey" - "Chicony" - mHotkey.exe
"EEventManager" - "SEIKO EPSON CORPORATION" - "C:\Programme\Epson Software\Event Manager\EEventManager.exe"
"ledpointer" - "Chicony" - CNYHKey.exe
"QuickTime Task" - "Apple Inc." - "C:\Programme\QuickTime\qttask.exe" -atboottime
"StartCCC" - "Advanced Micro Devices, Inc." - "c:\Programme\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun

[Print Monitors]
-----( HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors )-----
"EpsonNet Print Port" - "SEIKO EPSON CORPORATION" - C:\WINDOWS\system32\enppmon.dll
"Microsoft Document Imaging Writer Monitor" - "Microsoft Corporation" - C:\WINDOWS\system32\mdimon.dll
"pdfcmon" - "pdfforge GbR" - C:\WINDOWS\system32\pdfcmon.dll

[Services]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
".NET Runtime Optimization Service v2.0.50727_X86" (clr_optimization_v2.0.50727_32) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
"ABBYY FineReader 9.0 Sprint Licensing Service" (ABBYY.Licensing.FineReader.Sprint.9.0) - "ABBYY" - C:\Programme\Gemeinsame Dateien\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe
"Anwendungsverwaltung" (AppMgmt) - ? - C:\WINDOWS\System32\appmgmts.dll  (File not found)
"ASP.NET-Zustandsdienst" (aspnet_state) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe
"ATI Smart" (ATI Smart) - ? - C:\WINDOWS\system32\ati2sgag.exe
"Avira Echtzeit Scanner" (AntiVirService) - "Avira Operations GmbH & Co. KG" - C:\Programme\Avira\AntiVir Desktop\avguard.exe
"Avira Planer" (AntiVirSchedulerService) - "Avira Operations GmbH & Co. KG" - C:\Programme\Avira\AntiVir Desktop\sched.exe
"BgRaSvc" (BgRaSvc) - "BullGuard Ltd." - C:\Programme\BullGuard Backup\Support\BgRaSvc.exe
"BullGuard main service" (BsMain) - "BullGuard Ltd." - C:\Programme\BullGuard Backup\BsMain.dll
"BullGuard update service" (BsUpdate) - "BullGuard Ltd." - C:\Programme\BullGuard Backup\BullGuardUpdate.exe
"CyberLink Background Capture Service (CBCS)" (CLCapSvc) - ? - C:\Programme\Home Cinema\PowerCinema\Kernel\TV\CLCapSvc.exe
"CyberLink Task Scheduler (CTS)" (CLSched) - ? - C:\Programme\Home Cinema\PowerCinema\Kernel\TV\CLSched.exe
"DTGuardService" (DTGuardService) - ? - C:\WINDOWS\system32\drivers\DTGuardService.sys  (File not found)
"Google Update-Dienst (gupdate)" (gupdate) - "Google Inc." - C:\Programme\Google\Update\GoogleUpdate.exe
"Google Update-Dienst (gupdatem)" (gupdatem) - "Google Inc." - C:\Programme\Google\Update\GoogleUpdate.exe
"InstallDriver Table Manager" (IDriverT) - "Macrovision Corporation" - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\1150\Intel 32\IDriverT.exe
"Java Quick Starter" (JavaQuickStarterService) - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\jqs.exe
"Machine Debug Manager" (MDM) - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7DEBUG\MDM.EXE
"Microsoft .NET Framework NGEN v4.0.30319_X86" (clr_optimization_v4.0.30319_32) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
"Office Source Engine" (ose) - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE
"OpenVPN Service" (OpenVPNService) - ? - C:\Programme\OpenVPN\bin\openvpnserv.exe  (File found, but it contains no detailed information)
"SAS Core Service" (!SASCORE) - "SUPERAntiSpyware.com" - C:\Programme\SUPERAntiSpyware\SASCORE.EXE
"ServiceLayer" (ServiceLayer) - "Nokia" - C:\Programme\PC Connectivity Solution\ServiceLayer.exe
"Skype Updater" (SkypeUpdate) - "Skype Technologies" - C:\Programme\Skype\Updater\Updater.exe
"Software Jukebox v2.0 Service" (Software Jukebox v2.0 Service) - ? - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Service\Software Jukebox v2.0 Service File.exe
"Windows CardSpace" (idsvc) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
"Windows Live ID Sign-in Assistant" (wlidsvc) - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WLIDSVC.EXE
"Windows Presentation Foundation Font Cache 3.0.0.0" (FontCache3.0.0.0) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
"Windows Presentation Foundation Font Cache 4.0.0.0" (WPFFontCache_v0400) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe
"X10 Device Network Service" (x10nets) - "X10" - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe

[Winlogon]
-----( HKCU\Control Panel\IOProcs )-----
"MVB" - ? - mvfs32.dll  (File not found)
-----( HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon )-----
"UIHost" - "Microsoft Corporation" - C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TuneUp Software\TuneUp Utilities 2012\WinStyler\tu_logonui.exe
-----( HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions )-----
{c6dc5466-785a-11d2-84d0-00c04fb169f7} "Softwareinstallation" - ? - appmgmts.dll  (File not found)
-----( HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify )-----
"!SASWinLogon" - "SUPERAntiSpyware.com" - C:\Programme\SUPERAntiSpyware\SASWINLO.DLL
"WgaLogon" - "Microsoft Corporation" - C:\WINDOWS\system32\WgaLogon.dll

===[ Logfile end ]=========================================[ Logfile end ]===
--- --- ---

cosinus 22.06.2012 10:18
Was ist mit aswMBR?

K-Runa 22.06.2012 14:38
...und nun das letzte Log:
Code:
aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software
Run date: 2012-06-22 14:09:31
-----------------------------
14:09:31.437    OS Version: Windows 5.1.2600 Service Pack 3
14:09:31.437    Number of processors: 2 586 0x401
14:09:31.468    ComputerName: YYYYY  UserName:
14:09:33.406    Initialize success
14:09:48.562    AVAST engine defs: 12062101
14:10:04.531    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP1T0L0-17
14:10:04.546    Disk 0 Vendor: ST3250823AS 3.03 Size: 238475MB BusType: 3
14:10:04.609    Disk 0 MBR read successfully
14:10:04.625    Disk 0 MBR scan
14:10:04.812    Disk 0 unknown MBR code
14:10:04.828    Disk 0 Partition 1 80 (A) 07    HPFS/NTFS NTFS      120001 MB offset 63
14:10:04.921    Disk 0 Partition - 00    0F Extended LBA            118471 MB offset 245762370
14:10:04.968    Disk 0 Partition 2 00    07    HPFS/NTFS NTFS      109999 MB offset 245762433
14:10:04.984    Disk 0 Partition - 00    05    Extended              8471 MB offset 471041865
14:10:05.046    Disk 0 Partition 3 00    0B        FAT32 MSDOS5.0    8471 MB offset 471041928
14:10:05.218    Disk 0 scanning sectors +488392065
14:10:05.375    Disk 0 scanning C:\WINDOWS\system32\drivers
14:10:38.218    Service scanning
14:11:00.468    Modules scanning
14:11:22.328    Disk 0 trace - called modules:
14:11:22.390    TUKERNEL.EXE CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys pciide.sys PCIIDEX.SYS
14:11:22.421    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x87314ab8]
14:11:22.453    3 CLASSPNP.SYS[f77eefd7] -> nt!IofCallDriver -> \Device\0000006f[0x873cb9e8]
14:11:22.484    5 ACPI.sys[f7764620] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP1T0L0-17[0x873d0d98]
14:11:23.062    AVAST engine scan C:\WINDOWS
14:11:54.531    AVAST engine scan C:\WINDOWS\system32
14:20:52.218    AVAST engine scan C:\WINDOWS\system32\drivers
14:21:50.109    AVAST engine scan C:\Dokumente und Einstellungen\XXXXX
15:28:34.250    AVAST engine scan C:\Dokumente und Einstellungen\All Users
15:35:33.562    Scan finished successfully
15:39:07.000    Disk 0 MBR has been saved successfully to "C:\Dokumente und Einstellungen\XXXXX\Desktop\MBR.dat"
15:39:07.046    The log file has been saved successfully to "C:\Dokumente und Einstellungen\XXXXX\Desktop\aswMBR.txt"

cosinus 24.06.2012 15:09
Wir sollten den MBR fixen, sichere für den Fall der Fälle ALLE wichtigen Daten, auch wenn meistens alles glatt geht.

Hinweis: Mach bitte NICHT den MBR-Fix, wenn du noch andere Betriebssysteme wie zB Ubuntu installiert hast, ein MBR-Fix mit Windows-Tools macht ein parallel installiertes (Dualboot) Linux unbootbar.
Mach den Fix auch dann nicht, wenn du zB mit TrueCrypt oder anderen Verschlüsselungsprogrammen eine Vollverschlüsselung der Windowspartition bzw. gesamten Festplatte hast

Starte nach der Datensicherung aswmbr erneut und klick auf den Button FIXMBR.

Hinweis: Bitte den Virenscanner abstellen bevor du aswMBR ausführst, denn v.a. Avira meldet darin oft einen Fehalalrm!

Anschließend Windows neu starten und ein neues Log mit aswMBR machen.

K-Runa 26.06.2012 22:16
Hallo Arne,

die Daten sind nun auf einer externen Festplatte gesichert, das Fixen habe ich allerdings noch nicht durchgeführt (vor dem Fixen die ext. Festplatte abkoppeln, oder?).
Was mache ich, wenn, wie auch von der Warnung beim Klick auf 'FixMBR' mitgeteilt, das System beschädigt wird, wie kann ich es dann wieder reparieren? Lediglich die Daten von der Festplatte herüberziehen wird nicht die Lösung sein, oder?
Das Andere: auf einer Seite im Internet habe ich gelesen, dass dieses Programm nicht bei bereits vorinstallierten Windows-Betriebssystemen ausgeführt werden sollte - ist da etwas dran
Gibt es da mögliche andere Sachen, auf die ich achten sollte?
Man vergebe mir meine Unsicherheit! :-)

Grüße

cosinus 27.06.2012 12:55
Ja die Backupplatte abklemmen, dann einen MBR-Fix machen

Zitat:
Das Andere: auf einer Seite im Internet habe ich gelesen, dass dieses Programm nicht bei bereits vorinstallierten Windows-Betriebssystemen ausgeführt werden sollte - ist da etwas dran
Ist nicht ganz falsch aber auch nicht ganz richtig
Einen versauten MBR sollte man fixen egal ob vorinstalliert oder nicht
Nur geht der vom Hersteller angepasste MBR dann flöten und man kann dann evtl. nicht mehr von einer Recoverypartition allein das System recovern
Falls man aber recovern muss wäre es töricht sich nur auf diese Recoverypartition zu verlassen, für den Notfall sollte man immer Recoverymedien brennen falls keine im Lieferumfang waren (meistens muss man sie sich selber brennen, eine positive Ausnahme hab ich aber bei Samsung-Notebooks gesehen, da waren Recoverymedien beigepackt :) )

K-Runa 27.06.2012 16:28
Mit welchem Programm kann man eine solche Recovery-Disk erstellen? Nero hat - glaube ich - eine solche Funktion, gibt es da aber bessere (möglichst Freeware)?

Grüße

cosinus 28.06.2012 09:54
Das hat so nichts mit dem Brennprogramm zu tun.
Lies in deinem Handbuch zum Rechner nach, das geht bei jedem Hersteller anders

K-Runa 03.07.2012 12:48
Hallo Arne,
ich habe nun über das Windows-eigene Sicherungsprogramm und jenes von BullGuard eine Sicherung erstellt, das müsste doch soweit genügen, oder?

Mit welchen möglichen Veränderungen werde ich zu rechnen haben nach der Anwendung des Fixes? Nach dem Ausführen der letzten Programme habe ich bspw. den Verlust des "Pfeile" im Startmenü bei den Punkten Eigene Dateien, Bilder, Musik zu beklagen - was nicht wirklich dramatisch ist, allerdings möchte ich ungerne 'drastischere' Veränderungen haben.

Gibt es mögliche "harmlosere" Alternativen zu diesem Verfahren? Oder sorge ich mich unnötigerweise und das Verfahren ist weit weniger invasiv als ich erwarte?

Liebe Grüße

cosinus 03.07.2012 14:50
Du hast irgendwas eingestellt, irgendwas wurde irgendwie auf irgendwas gesichert und ich soll nun sagen, dass das so reicht? :balla:

Zitat:
Mit welchen möglichen Veränderungen werde ich zu rechnen haben nach der Anwendung des Fixes?
Nach dem MBR-Fix wird sichergestellt, dass kein Rootkit gestartet wird noch bevor Windows anfängt zu laden! Der MBR ist ein sehr wichtiger Bereich und der muss sauber sein!

Zitat:
Gibt es mögliche "harmlosere" Alternativen zu diesem Verfahren?
Nein es gibt nur einen MBR!


Alle Zeitangaben in WEZ +1. Es ist jetzt 01:52 Uhr.
Seite 3 von 3 12 3
100 Beiträge dieses Themas auf einer Seite anzeigen

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19