Trojaner-Board - Alle zwei Tage bluescreen / hängt scheinbar mit Datum zusammen

Moin

Mbr.exe hat sich nach knapp ner Minute einfach geschlossen kein Ergebnis.
Das Avira Antirootkit Tool hat folgendes ergeben:

Zitat:

Avira AntiRootkit Tool - Beta (1.0.1.17)

========================================================================================================
- Scan started Montag, 20. April 2009 - 11:26:42
========================================================================================================

--------------------------------------------------------------------------------------------------------
Configuration:
--------------------------------------------------------------------------------------------------------
- [X] Scan files
- [X] Scan registry
- [X] Scan processes
- [ ] Fast scan
- Working disk total size : 135.23 GB
- Working disk free size : 19.80 GB (14 %)
--------------------------------------------------------------------------------------------------------

Results:
Hidden value : HKEY_USERS\S-1-5-21-1104364427-2488189377-2114812828-1000\Software\SecuROM\License information -> datasecu
Hidden value : HKEY_USERS\S-1-5-21-1104364427-2488189377-2114812828-1000\Software\SecuROM\License information -> rkeysecu
Value data mismatch : HKEY_LOCAL_MACHINE\Software\Microsoft\WBEM\CIMOM -> autorecover mofs

--------------------------------------------------------------------------------------------------------
Files: 0/979061
Registry items: 3/805224
Processes: 0/65
Scan time: 00:26:21
--------------------------------------------------------------------------------------------------------
Active processes:
- tzlwezhz.exe (PID 5632) (Avira AntiRootkit Tool - Beta)
- scrnsave.scr (PID 5452)
- System (PID 4)
- smss.exe (PID 492)
- csrss.exe (PID 576)
- wininit.exe (PID 628)
- csrss.exe (PID 640)
- services.exe (PID 672)
- lsass.exe (PID 740)
- lsm.exe (PID 752)
- winlogon.exe (PID 828)
- svchost.exe (PID 932)
- nvvsvc.exe (PID 976)
- svchost.exe (PID 1004)
- svchost.exe (PID 1044)
- svchost.exe (PID 1100)
- svchost.exe (PID 1128)
- svchost.exe (PID 1148)
- audiodg.exe (PID 1240)
- SLsvc.exe (PID 1280)
- svchost.exe (PID 1356)
- svchost.exe (PID 1464)
- spoolsv.exe (PID 1652)
- svchost.exe (PID 1676)
- a2service.exe (PID 1828)
- AVKProxy.exe (PID 1872)
- AVKService.exe (PID 1908)
- AVKWCtl.exe (PID 1928)
- svchost.exe (PID 1952)
- hldasvc.exe (PID 1988)
- hldasvc.exe (PID 2016)
- IGDCTRL.EXE (PID 584)
- nHancerService.exe (PID 700)
- Locator.exe (PID 1268)
- svchost.exe (PID 1428)
- svchost.exe (PID 1548)
- SearchIndexer.exe (PID 2008)
- taskeng.exe (PID 2328)
- rundll32.exe (PID 2632)
- dwm.exe (PID 2924)
- explorer.exe (PID 2952)
- taskeng.exe (PID 2980)
- LCDMon.exe (PID 3404)
- LGDCore.exe (PID 3608)
- AVKTray.exe (PID 3740)
- CtHelper.exe (PID 3748)
- rundll32.exe (PID 3772)
- daemon.exe (PID 3784)
- pg2.exe (PID 3792)
- SetPoint.exe (PID 3812)
- miranda32.exe (PID 3828)
- StCenter.exe (PID 3872)
- sgmain.exe (PID 3888)
- winamp.exe (PID 3924)
- wmpnscfg.exe (PID 1376)
- KHALMNPR.exe (PID 2164)
- unsecapp.exe (PID 3128)
- sgbhp.exe (PID 3448)
- wmpnetwk.exe (PID 3524)
- WmiPrvSE.exe (PID 3556)
- svchost.exe (PID 3844)
- firefox.exe (PID 5224)
- explorer.exe (PID 5096)
- avirarkd.exe (PID 3544)
- GoogleUpdate.exe (PID 1576)
========================================================================================================
- Scan finished Montag, 20. April 2009 - 11:53:03
========================================================================================================

mfg

FloH