Trojaner-Board - Avira Meldung cryptnet32.dll

Trojaner-Board (https://www.trojaner-board.de/)

- Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)

- - Avira Meldung cryptnet32.dll (https://www.trojaner-board.de/96394-avira-meldung-cryptnet32-dll.html)

Combofix Logfile:

Code:

ComboFix 11-03-15.01 - Fanny 15.03.2011  22:31:12.2.2 - x86

Microsoft Windows XP Home Edition  5.1.2600.3.1252.49.1031.18.1013.516 [GMT 1:00]

ausgeführt von:: c:\dokumente und einstellungen\Fanny\Desktop\cofi.exe.exe

Benutzte Befehlsschalter :: c:\dokumente und einstellungen\Fanny\Desktop\CFScript.txt

AV: AntiVir Desktop *Disabled/Updated* {AD166499-45F9-482A-A743-FDD3350758C7}

.

.

(((((((((((((((((((((((   Dateien erstellt von 2011-02-15 bis 2011-03-15  ))))))))))))))))))))))))))))))

.

.

2011-03-15 12:18 . 2011-03-15 12:18        --------        d-----w-        c:\programme\CCleaner

2011-03-13 20:45 . 2011-03-13 20:45        --------        d-----w-        C:\_OTL

2011-03-09 17:45 . 2011-03-09 17:45        --------        d-----w-        c:\dokumente und einstellungen\Fanny\Anwendungsdaten\Malwarebytes

2011-03-09 17:44 . 2010-12-20 17:09        38224        ----a-w-        c:\windows\system32\drivers\mbamswissarmy.sys

2011-03-09 17:44 . 2011-03-09 17:44        --------        d-----w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\Malwarebytes

2011-03-09 17:44 . 2010-12-20 17:08        20952        ----a-w-        c:\windows\system32\drivers\mbam.sys

2011-03-09 17:44 . 2011-03-09 18:59        --------        d-----w-        c:\programme\Malwarebytes' Anti-Malware

2011-02-23 07:49 . 2011-02-23 07:49        --------        d-----w-        c:\programme\Safari

.

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2011-02-09 13:53 . 2008-04-14 12:00        270848        ----a-w-        c:\windows\system32\sbe.dll

2011-02-09 13:53 . 2008-04-14 12:00        186880        ----a-w-        c:\windows\system32\encdec.dll

2011-02-02 07:58 . 2008-08-07 09:24        2067456        ----a-w-        c:\windows\system32\mstscax.dll

2011-01-27 11:57 . 2008-08-07 09:24        677888        ----a-w-        c:\windows\system32\mstsc.exe

2011-01-21 14:44 . 2008-04-14 12:00        440832        ----a-w-        c:\windows\system32\shimgvw.dll

2011-01-07 14:09 . 2008-04-14 12:00        290048        ----a-w-        c:\windows\system32\atmfd.dll

2010-12-31 14:03 . 2008-04-14 12:00        1855104        ----a-w-        c:\windows\system32\win32k.sys

2010-12-22 12:34 . 2008-04-14 12:00        301568        ----a-w-        c:\windows\system32\kerberos.dll

2010-12-20 23:06 . 2008-04-14 12:00        832512        ----a-w-        c:\windows\system32\wininet.dll

2010-12-20 23:06 . 2008-04-14 12:00        78336        ----a-w-        c:\windows\system32\ieencode.dll

2010-12-20 23:06 . 2008-04-14 12:00        1830912        ----a-w-        c:\windows\system32\inetcpl.cpl

2010-12-20 23:06 . 2008-04-14 12:00        17408        ----a-w-        c:\windows\system32\corpol.dll

2010-12-20 17:25 . 2008-04-14 12:00        737792        ----a-w-        c:\windows\system32\lsasrv.dll

2010-12-20 12:55 . 2008-04-14 12:00        389120        ----a-w-        c:\windows\system32\html.iec

2010-12-16 09:35 . 2008-08-07 12:53        348160        ----a-w-        c:\windows\system32\msvcr71.dll

2010-12-16 09:35 . 2008-08-07 12:53        499712        ----a-w-        c:\windows\system32\msvcp71.dll

2006-05-03 10:06        163328        --sh--r-        c:\windows\system32\flvDX.dll

2007-02-21 11:47        31232        --sh--r-        c:\windows\system32\msfDX.dll

2008-03-16 13:30        216064        --sh--r-        c:\windows\system32\nbDX.dll

.

.

(((((((((((((((((((((((((((((   SnapShot@2011-03-15_12.42.04   )))))))))))))))))))))))))))))))))))))))))

.

+ 2011-03-15 21:03 . 2011-03-15 21:03        16384              c:\windows\Temp\Perflib_Perfdata_72c.dat

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Sony Ericsson PC Suite"="c:\programme\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe" [2009-09-24 434176]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-12-19 135168]

"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-12-19 159744]

"Persistence"="c:\windows\system32\igfxpers.exe" [2007-12-19 131072]

"RTHDCPL"="RTHDCPL.EXE" [2008-05-07 16862208]

"SynTPEnh"="c:\programme\Synaptics\SynTP\SynTPEnh.exe" [2008-01-11 1028096]

"MGSysCtrl"="c:\programme\System Control Manager\MGSysCtrl.exe" [2008-06-10 782336]

"LanguageShortcut"="c:\programme\HomeCinema\PowerDVD\Language\Language.exe" [2007-01-08 52256]

"QuickFinder Scheduler"="c:\programme\WordPerfect Office X3\Programs\QFSCHD130.EXE" [2007-01-02 83568]

"UCam_Menu"="c:\programme\HomeCinema\YouCam\MUITransfer\MUIStartMenu.exe" [2008-12-03 218408]

"avgnt"="c:\programme\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]

"QuickTime Task"="c:\programme\QuickTime\QTTask.exe" [2009-09-05 417792]

"Adobe Reader Speed Launcher"="c:\programme\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-12-21 35760]

"Adobe ARM"="c:\programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-21 932288]

"TkBellExe"="c:\programme\real\realplayer\update\realsched.exe" [2010-12-16 274608]

"Corel Photo Downloader"="c:\programme\Corel\Corel MediaOne\Corel Photo Downloader.exe" [2007-08-17 483144]

.

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

.

c:\dokumente und einstellungen\All Users\Startmen\Programme\Autostart\

Bluetooth.lnk - c:\programme\WIDCOMM\Bluetooth Software\BTTray.exe [2008-4-14 596584]

Device Detector 2.lnk - c:\programme\Olympus\DeviceDetector\DevDtct2.exe [2010-1-29 114688]

McAfee Security Scan Plus.lnk - c:\programme\McAfee Security Scan\2.0.181\SSScheduler.exe [2010-1-15 255536]

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Programme\\Windows Live\\Messenger\\wlcsdk.exe"=

"c:\\Programme\\Windows Live\\Messenger\\msnmsgr.exe"=

"c:\\Programme\\Windows Live\\Sync\\WindowsLiveSync.exe"=

"c:\\Programme\\Google\\Google Earth\\client\\googleearth.exe"=

.

R2 AntiVirSchedulerService;Avira AntiVir Planer;c:\programme\Avira\AntiVir Desktop\sched.exe [29.05.2009 12:20 108289]

R3 RSUSBSTOR;RTS5121.Sys Realtek USB Card Reader;c:\windows\system32\drivers\RTS5121.sys [07.08.2008 11:01 156160]

R3 RT80x86;Ralink 802.11n Wireless Driver;c:\windows\system32\drivers\rt2860.sys [23.05.2009 16:08 572416]

R3 seehcri;Sony Ericsson seehcri Device Driver;c:\windows\system32\drivers\seehcri.sys [08.11.2009 22:27 27632]

S2 gupdate1ca60bf25e90f32;Google Update Service (gupdate1ca60bf25e90f32);c:\programme\Google\Update\GoogleUpdate.exe [08.11.2009 23:02 133104]

S2 Micro Star SCM;Micro Star SCM;c:\programme\System Control Manager\MSIService.exe [07.08.2008 11:30 159744]

S2 OMSI download service;Sony Ericsson OMSI download service;c:\programme\Sony Ericsson\Sony Ericsson PC Suite\SupServ.exe [08.11.2009 22:27 90112]

S3 McComponentHostService;McAfee Security Scan Component Host Service;c:\programme\McAfee Security Scan\2.0.181\McCHSvc.exe [15.01.2010 13:49 227232]

S3 s1018bus;Sony Ericsson Device 1018 driver (WDM);c:\windows\system32\drivers\s1018bus.sys [17.07.2009 19:27 86696]

S3 s1018mdfl;Sony Ericsson Device 1018 USB WMC Modem Filter;c:\windows\system32\drivers\s1018mdfl.sys [17.07.2009 19:27 15016]

S3 s1018mdm;Sony Ericsson Device 1018 USB WMC Modem Driver;c:\windows\system32\drivers\s1018mdm.sys [17.07.2009 19:27 114472]

S3 s1018mgmt;Sony Ericsson Device 1018 USB WMC Device Management Drivers (WDM);c:\windows\system32\drivers\s1018mgmt.sys [17.07.2009 19:27 108328]

S3 s1018nd5;Sony Ericsson Device 1018 USB Ethernet Emulation (NDIS);c:\windows\system32\drivers\s1018nd5.sys [17.07.2009 19:27 26024]

S3 s1018obex;Sony Ericsson Device 1018 USB WMC OBEX Interface;c:\windows\system32\drivers\s1018obex.sys [17.07.2009 19:27 104616]

S3 s1018unic;Sony Ericsson Device 1018 USB Ethernet Emulation (WDM);c:\windows\system32\drivers\s1018unic.sys [17.07.2009 19:27 109736]

.

Inhalt des "geplante Tasks" Ordners

.

2010-11-04 c:\windows\Tasks\AppleSoftwareUpdate.job

- c:\programme\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]

.

2008-08-13 c:\windows\Tasks\Critical Battery Alarm Program.job

- c:\windows\system32\shutdown.exe [2008-04-14 12:00]

.

2011-03-15 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\programme\Google\Update\GoogleUpdate.exe [2009-11-08 22:02]

.

2011-03-14 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\programme\Google\Update\GoogleUpdate.exe [2009-11-08 22:02]

.

2011-03-15 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-1223508753-2124911804-4176259086-1006.job

- c:\programme\Real\RealUpgrade\realupgrade.exe [2010-11-05 10:33]

.

2011-03-03 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-1223508753-2124911804-4176259086-1006.job

- c:\programme\Real\RealUpgrade\realupgrade.exe [2010-11-05 10:33]

.

.

------- Zusätzlicher Suchlauf -------

.

uStart Page = hxxp://www.google.de/

uDefault_Search_URL = hxxp://www.google.com/ie

mStart Page = hxxp://www.aldi.com

uSearchAssistant = hxxp://www.google.com/ie

uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200

IE: Nach Microsoft &Excel exportieren - c:\progra~1\MICROS~4\OFFICE11\EXCEL.EXE/3000

IE: Senden an &Bluetooth-Gerät... - c:\programme\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm

IE: Senden an Bluetooth - c:\programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm

IE: Öffnen mit WordPerfect - c:\programme\WordPerfect Office X3\Programs\WPLauncher.hta

IE: {{0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - hxxp://rover.ebay.com/rover/1/707-37276-17534-25/4

FF - ProfilePath - c:\dokumente und einstellungen\Fanny\Anwendungsdaten\Mozilla\Firefox\Profiles\6526jd7b.default\

FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\programme\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

.

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net

Rootkit scan 2011-03-15 22:37

Windows 5.1.2600 Service Pack 3 NTFS

.

Scanne versteckte Prozesse... 

.

Scanne versteckte Autostarteinträge... 

.

Scanne versteckte Dateien... 

.

Scan erfolgreich abgeschlossen

versteckte Dateien: 0

.

**************************************************************************

.

--------------------- Gesperrte Registrierungsschluessel ---------------------

.

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\€–€|ÿÿÿÿÀ•€|ù•6~*]

"7040110900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL"

.

--------------------- Durch laufende Prozesse gestartete DLLs ---------------------

.

- - - - - - - > 'explorer.exe'(3344)

c:\windows\system32\btmmhook.dll

c:\windows\system32\WPDShServiceObj.dll

c:\windows\system32\PortableDeviceTypes.dll

c:\windows\system32\PortableDeviceApi.dll

.

Zeit der Fertigstellung: 2011-03-15  22:40:15

ComboFix-quarantined-files.txt  2011-03-15 21:40

ComboFix2.txt  2011-03-15 12:48

.

Vor Suchlauf: 10 Verzeichnis(se), 118.708.785.152 Bytes frei

Nach Suchlauf: 11 Verzeichnis(se), 118.699.544.576 Bytes frei

.

- - End Of File - - 68CBB506B5C050F5FA88423B76D57E5C

--- --- ---

Gruß Fanny

Bitte nun dieses Tool von Kaspersky ausführen und das Log posten => http://www.trojaner-board.de/82358-t...entfernen.html

2011/03/16 20:50:34.0593 0708 TDSS rootkit removing tool 2.4.21.0 Mar 10 2011 12:26:28
2011/03/16 20:50:34.0921 0708 ================================================================================
2011/03/16 20:50:34.0921 0708 SystemInfo:
2011/03/16 20:50:34.0921 0708
2011/03/16 20:50:34.0921 0708 OS Version: 5.1.2600 ServicePack: 3.0
2011/03/16 20:50:34.0921 0708 Product type: Workstation
2011/03/16 20:50:34.0937 0708 ComputerName: BENUTZER-628C25
2011/03/16 20:50:34.0937 0708 UserName: Fanny
2011/03/16 20:50:34.0937 0708 Windows directory: C:\WINDOWS
2011/03/16 20:50:34.0937 0708 System windows directory: C:\WINDOWS
2011/03/16 20:50:34.0937 0708 Processor architecture: Intel x86
2011/03/16 20:50:34.0937 0708 Number of processors: 2
2011/03/16 20:50:34.0937 0708 Page size: 0x1000
2011/03/16 20:50:34.0937 0708 Boot type: Normal boot
2011/03/16 20:50:34.0937 0708 ================================================================================
2011/03/16 20:50:35.0390 0708 Initialize success
2011/03/16 20:50:43.0453 2572 ================================================================================
2011/03/16 20:50:43.0453 2572 Scan started
2011/03/16 20:50:43.0453 2572 Mode: Manual;
2011/03/16 20:50:43.0453 2572 ================================================================================
2011/03/16 20:50:44.0437 2572 ACPI (ac407f1a62c3a300b4f2b5a9f1d55b2c) C:\WINDOWS\system32\DRIVERS\ACPI.sys
2011/03/16 20:50:44.0515 2572 ACPIEC (9e1ca3160dafb159ca14f83b1e317f75) C:\WINDOWS\system32\DRIVERS\ACPIEC.sys
2011/03/16 20:50:44.0687 2572 aec (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys
2011/03/16 20:50:44.0796 2572 AFD (7e775010ef291da96ad17ca4b17137d7) C:\WINDOWS\System32\drivers\afd.sys
2011/03/16 20:50:45.0234 2572 AsyncMac (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
2011/03/16 20:50:45.0281 2572 atapi (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\drivers\atapi.sys
2011/03/16 20:50:45.0343 2572 Atmarpc (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
2011/03/16 20:50:45.0406 2572 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
2011/03/16 20:50:45.0609 2572 avgio (0b497c79824f8e1bf22fa6aacd3de3a0) C:\Programme\Avira\AntiVir Desktop\avgio.sys
2011/03/16 20:50:45.0703 2572 avgntflt (14fe36d8f2c6a2435275338d061a0b66) C:\WINDOWS\system32\DRIVERS\avgntflt.sys
2011/03/16 20:50:45.0750 2572 avipbb (6d52060b59e7d79cd2a044b6add1f1ef) C:\WINDOWS\system32\DRIVERS\avipbb.sys
2011/03/16 20:50:45.0859 2572 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
2011/03/16 20:50:46.0000 2572 btaudio (faba1418646a2b433c0bded6ff92d2fa) C:\WINDOWS\system32\drivers\btaudio.sys
2011/03/16 20:50:46.0140 2572 BTDriver (2f9f111d31aa3fbbe5781d829a4524e6) C:\WINDOWS\system32\DRIVERS\btport.sys
2011/03/16 20:50:46.0218 2572 BTKRNL (aef038061bc1cafb4865d43a85beb1a1) C:\WINDOWS\system32\DRIVERS\btkrnl.sys
2011/03/16 20:50:46.0312 2572 BTWDNDIS (80f61de965c116051614ac2f04222ff7) C:\WINDOWS\system32\DRIVERS\btwdndis.sys
2011/03/16 20:50:46.0359 2572 btwhid (949eca9c56f657c06d3166d51f3226c7) C:\WINDOWS\system32\DRIVERS\btwhid.sys
2011/03/16 20:50:46.0421 2572 btwmodem (5922bae0cd84924b9cd7e6bb515ee070) C:\WINDOWS\system32\DRIVERS\btwmodem.sys
2011/03/16 20:50:46.0515 2572 BTWUSB (179a37c86fd2b9cc28eb93d093d394c7) C:\WINDOWS\system32\Drivers\btwusb.sys
2011/03/16 20:50:46.0734 2572 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
2011/03/16 20:50:46.0796 2572 CCDECODE (0be5aef125be881c4f854c554f2b025c) C:\WINDOWS\system32\DRIVERS\CCDECODE.sys
2011/03/16 20:50:46.0921 2572 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
2011/03/16 20:50:47.0125 2572 Cdfs (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys
2011/03/16 20:50:47.0265 2572 Cdrom (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys
2011/03/16 20:50:47.0484 2572 CmBatt (0f6c187d38d98f8df904589a5f94d411) C:\WINDOWS\system32\DRIVERS\CmBatt.sys
2011/03/16 20:50:47.0546 2572 Compbatt (6e4c9f21f0fae8940661144f41b13203) C:\WINDOWS\system32\DRIVERS\compbatt.sys
2011/03/16 20:50:47.0781 2572 Disk (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys
2011/03/16 20:50:47.0843 2572 dmboot (0dcfc8395a99fecbb1ef771cec7fe4ea) C:\WINDOWS\system32\drivers\dmboot.sys
2011/03/16 20:50:47.0921 2572 dmio (53720ab12b48719d00e327da470a619a) C:\WINDOWS\system32\drivers\dmio.sys
2011/03/16 20:50:47.0968 2572 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
2011/03/16 20:50:48.0031 2572 DMusic (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys
2011/03/16 20:50:48.0125 2572 drmkaud (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys
2011/03/16 20:50:48.0265 2572 Fastfat (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys
2011/03/16 20:50:48.0312 2572 Fdc (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\drivers\Fdc.sys
2011/03/16 20:50:48.0343 2572 Fips (b0678a548587c5f1967b0d70bacad6c1) C:\WINDOWS\system32\drivers\Fips.sys
2011/03/16 20:50:48.0375 2572 Flpydisk (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\drivers\Flpydisk.sys
2011/03/16 20:50:48.0500 2572 FltMgr (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\DRIVERS\fltMgr.sys
2011/03/16 20:50:48.0546 2572 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
2011/03/16 20:50:48.0578 2572 Ftdisk (8f1955ce42e1484714b542f341647778) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
2011/03/16 20:50:48.0625 2572 Gpc (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys
2011/03/16 20:50:48.0750 2572 HDAudBus (573c7d0a32852b48f3058cfd8026f511) C:\WINDOWS\system32\DRIVERS\HDAudBus.sys
2011/03/16 20:50:48.0859 2572 HidUsb (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys
2011/03/16 20:50:48.0984 2572 HTTP (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys
2011/03/16 20:50:49.0328 2572 i8042prt (e283b97cfbeb86c1d86baed5f7846a92) C:\WINDOWS\system32\DRIVERS\i8042prt.sys
2011/03/16 20:50:49.0609 2572 ialm (0f68e2ec713f132ffb19e45415b09679) C:\WINDOWS\system32\DRIVERS\igxpmp32.sys
2011/03/16 20:50:49.0937 2572 iaStor (e5a0034847537eaee3c00349d5c34c5f) C:\WINDOWS\system32\DRIVERS\iaStor.sys
2011/03/16 20:50:50.0078 2572 Imapi (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys
2011/03/16 20:50:50.0390 2572 IntcAzAudAddService (12cd9f66b64b25cbe18f1bb2c6f54832) C:\WINDOWS\system32\drivers\RtkHDAud.sys
2011/03/16 20:50:50.0703 2572 intelppm (4c7d2750158ed6e7ad642d97bffae351) C:\WINDOWS\system32\DRIVERS\intelppm.sys
2011/03/16 20:50:50.0765 2572 Ip6Fw (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\DRIVERS\Ip6Fw.sys
2011/03/16 20:50:50.0812 2572 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
2011/03/16 20:50:50.0843 2572 IpInIp (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys
2011/03/16 20:50:50.0906 2572 IpNat (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys
2011/03/16 20:50:51.0000 2572 IPSec (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys
2011/03/16 20:50:51.0078 2572 IRENUM (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys
2011/03/16 20:50:51.0156 2572 isapnp (6dfb88f64135c525433e87648bda30de) C:\WINDOWS\system32\DRIVERS\isapnp.sys
2011/03/16 20:50:51.0265 2572 Kbdclass (1704d8c4c8807b889e43c649b478a452) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
2011/03/16 20:50:51.0359 2572 kbdhid (b6d6c117d771c98130497265f26d1882) C:\WINDOWS\system32\DRIVERS\kbdhid.sys
2011/03/16 20:50:51.0390 2572 kmixer (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys
2011/03/16 20:50:51.0500 2572 KSecDD (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys
2011/03/16 20:50:51.0687 2572 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
2011/03/16 20:50:51.0796 2572 Modem (6fb74ebd4ec57a6f1781de3852cc3362) C:\WINDOWS\system32\drivers\Modem.sys
2011/03/16 20:50:51.0906 2572 Mouclass (b24ce8005deab254c0251e15cb71d802) C:\WINDOWS\system32\DRIVERS\mouclass.sys
2011/03/16 20:50:52.0000 2572 mouhid (66a6f73c74e1791464160a7065ce711a) C:\WINDOWS\system32\DRIVERS\mouhid.sys
2011/03/16 20:50:52.0109 2572 MountMgr (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys
2011/03/16 20:50:52.0156 2572 MRxDAV (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
2011/03/16 20:50:52.0281 2572 MRxSmb (f3aefb11abc521122b67095044169e98) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
2011/03/16 20:50:52.0359 2572 Msfs (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys
2011/03/16 20:50:52.0468 2572 MSKSSRV (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys
2011/03/16 20:50:52.0500 2572 MSPCLOCK (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
2011/03/16 20:50:52.0531 2572 MSPQM (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys
2011/03/16 20:50:52.0609 2572 mssmbios (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
2011/03/16 20:50:52.0656 2572 MSTEE (e53736a9e30c45fa9e7b5eac55056d1d) C:\WINDOWS\system32\drivers\MSTEE.sys
2011/03/16 20:50:52.0734 2572 Mup (2f625d11385b1a94360bfc70aaefdee1) C:\WINDOWS\system32\drivers\Mup.sys
2011/03/16 20:50:52.0796 2572 NABTSFEC (5b50f1b2a2ed47d560577b221da734db) C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys
2011/03/16 20:50:52.0890 2572 NDIS (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys
2011/03/16 20:50:52.0953 2572 NdisIP (7ff1f1fd8609c149aa432f95a8163d97) C:\WINDOWS\system32\DRIVERS\NdisIP.sys
2011/03/16 20:50:53.0000 2572 NdisTapi (1ab3d00c991ab086e69db84b6c0ed78f) C:\WINDOWS\system32\DRIVERS\ndistapi.sys
2011/03/16 20:50:53.0093 2572 Ndisuio (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys
2011/03/16 20:50:53.0156 2572 NdisWan (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys
2011/03/16 20:50:53.0218 2572 NDProxy (9282bd12dfb069d3889eb3fcc1000a9b) C:\WINDOWS\system32\drivers\NDProxy.sys
2011/03/16 20:50:53.0250 2572 NetBIOS (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys
2011/03/16 20:50:53.0281 2572 NetBT (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys
2011/03/16 20:50:53.0343 2572 Npfs (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys
2011/03/16 20:50:53.0468 2572 Ntfs (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys
2011/03/16 20:50:53.0593 2572 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
2011/03/16 20:50:53.0671 2572 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
2011/03/16 20:50:53.0687 2572 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
2011/03/16 20:50:53.0765 2572 Parport (f84785660305b9b903fb3bca8ba29837) C:\WINDOWS\system32\drivers\Parport.sys
2011/03/16 20:50:53.0843 2572 PartMgr (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys
2011/03/16 20:50:53.0906 2572 ParVdm (c2bf987829099a3eaa2ca6a0a90ecb4f) C:\WINDOWS\system32\drivers\ParVdm.sys
2011/03/16 20:50:53.0984 2572 PCI (387e8dedc343aa2d1efbc30580273acd) C:\WINDOWS\system32\DRIVERS\pci.sys
2011/03/16 20:50:54.0296 2572 Pcmcia (a2a966b77d61847d61a3051df87c8c97) C:\WINDOWS\system32\drivers\Pcmcia.sys
2011/03/16 20:50:54.0562 2572 PptpMiniport (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys
2011/03/16 20:50:54.0609 2572 PSched (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys
2011/03/16 20:50:54.0703 2572 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
2011/03/16 20:50:54.0796 2572 PxHelp20 (1962166e0ceb740704f30fa55ad3d509) C:\WINDOWS\system32\Drivers\PxHelp20.sys
2011/03/16 20:50:54.0953 2572 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys
2011/03/16 20:50:55.0000 2572 Rasl2tp (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
2011/03/16 20:50:55.0031 2572 RasPppoe (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys
2011/03/16 20:50:55.0062 2572 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys
2011/03/16 20:50:55.0171 2572 Rdbss (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys
2011/03/16 20:50:55.0203 2572 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
2011/03/16 20:50:55.0296 2572 RDPWD (6728e45b66f93c08f11de2e316fc70dd) C:\WINDOWS\system32\drivers\RDPWD.sys
2011/03/16 20:50:55.0375 2572 redbook (ed761d453856f795a7fe056e42c36365) C:\WINDOWS\system32\DRIVERS\redbook.sys
2011/03/16 20:50:55.0484 2572 ROOTMODEM (d8b0b4ade32574b2d9c5cc34dc0dbbe7) C:\WINDOWS\system32\Drivers\RootMdm.sys
2011/03/16 20:50:55.0531 2572 RSUSBSTOR (680a7aba84a7863c89b5440c9c1e0895) C:\WINDOWS\system32\Drivers\RTS5121.sys
2011/03/16 20:50:55.0671 2572 RT80x86 (aebf31765a926746dd7946fa14c52297) C:\WINDOWS\system32\DRIVERS\RT2860.sys
2011/03/16 20:50:55.0718 2572 RTLE8023xp (7174f20ad9b7b7878a51ecca03c499c2) C:\WINDOWS\system32\DRIVERS\Rtenicxp.sys
2011/03/16 20:50:55.0828 2572 s1018bus (12a851f30853a5a8e7b50341fa4b0ffb) C:\WINDOWS\system32\DRIVERS\s1018bus.sys
2011/03/16 20:50:55.0906 2572 s1018mdfl (a0141d5dc689a892b3f30446cbe52575) C:\WINDOWS\system32\DRIVERS\s1018mdfl.sys
2011/03/16 20:50:55.0953 2572 s1018mdm (07d430e4b2bfde6b07f31f1da6e7cab0) C:\WINDOWS\system32\DRIVERS\s1018mdm.sys
2011/03/16 20:50:55.0984 2572 s1018mgmt (d73c20d3f0f825c8fd23f841cdcb14c0) C:\WINDOWS\system32\DRIVERS\s1018mgmt.sys
2011/03/16 20:50:56.0109 2572 s1018nd5 (895a1a2812dbd5afdd5ca4686a89a33c) C:\WINDOWS\system32\DRIVERS\s1018nd5.sys
2011/03/16 20:50:56.0171 2572 s1018obex (a986e9683c74fa06456fd2ad34ba1490) C:\WINDOWS\system32\DRIVERS\s1018obex.sys
2011/03/16 20:50:56.0203 2572 s1018unic (da83525924c23f30f37ac1d1f11d6f15) C:\WINDOWS\system32\DRIVERS\s1018unic.sys
2011/03/16 20:50:56.0312 2572 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys
2011/03/16 20:50:56.0390 2572 seehcri (e5b56569a9f79b70314fede6c953641e) C:\WINDOWS\system32\DRIVERS\seehcri.sys
2011/03/16 20:50:56.0500 2572 Serial (cf24eb4f0412c82bcd1f4f35a025e31d) C:\WINDOWS\system32\drivers\Serial.sys
2011/03/16 20:50:56.0562 2572 Sfloppy (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys
2011/03/16 20:50:56.0687 2572 SLIP (866d538ebe33709a5c9f5c62b73b7d14) C:\WINDOWS\system32\DRIVERS\SLIP.sys
2011/03/16 20:50:56.0781 2572 splitter (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys
2011/03/16 20:50:56.0890 2572 sr (50fa898f8c032796d3b1b9951bb5a90f) C:\WINDOWS\system32\DRIVERS\sr.sys
2011/03/16 20:50:57.0015 2572 Srv (0f6aefad3641a657e18081f52d0c15af) C:\WINDOWS\system32\DRIVERS\srv.sys
2011/03/16 20:50:57.0234 2572 ssmdrv (5ec550b8952882ee856b862cf648522d) C:\WINDOWS\system32\DRIVERS\ssmdrv.sys
2011/03/16 20:50:57.0328 2572 streamip (77813007ba6265c4b6098187e6ed79d2) C:\WINDOWS\system32\DRIVERS\StreamIP.sys
2011/03/16 20:50:57.0390 2572 swenum (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys
2011/03/16 20:50:57.0437 2572 swmidi (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys
2011/03/16 20:50:57.0593 2572 SynTP (a9ad7fad373975d4dbeabb0ead240bb1) C:\WINDOWS\system32\DRIVERS\SynTP.sys
2011/03/16 20:50:57.0625 2572 sysaudio (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys
2011/03/16 20:50:57.0750 2572 Tcpip (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys
2011/03/16 20:50:57.0828 2572 TDPIPE (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys
2011/03/16 20:50:57.0859 2572 TDTCP (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys
2011/03/16 20:50:57.0937 2572 TermDD (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys
2011/03/16 20:50:58.0093 2572 Udfs (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys
2011/03/16 20:50:58.0203 2572 Update (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys
2011/03/16 20:50:58.0296 2572 usbccgp (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys
2011/03/16 20:50:58.0359 2572 usbehci (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys
2011/03/16 20:50:58.0453 2572 usbhub (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys
2011/03/16 20:50:58.0500 2572 usbstor (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
2011/03/16 20:50:58.0515 2572 usbuhci (26496f9dee2d787fc3e61ad54821ffe6) C:\WINDOWS\system32\DRIVERS\usbuhci.sys
2011/03/16 20:50:58.0593 2572 usbvideo (63bbfca7f390f4c49ed4b96bfb1633e0) C:\WINDOWS\system32\Drivers\usbvideo.sys
2011/03/16 20:50:58.0671 2572 VgaSave (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys
2011/03/16 20:50:58.0796 2572 VNUSB (c48e230878ea1946f0c4026a9d8e9a61) C:\WINDOWS\system32\DRIVERS\VNUSB.sys
2011/03/16 20:50:58.0875 2572 VolSnap (a5a712f4e880874a477af790b5186e1d) C:\WINDOWS\system32\drivers\VolSnap.sys
2011/03/16 20:50:59.0000 2572 Wanarp (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys
2011/03/16 20:50:59.0218 2572 wdmaud (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys
2011/03/16 20:50:59.0343 2572 WmiAcpi (c42584fd66ce9e17403aebca199f7bdb) C:\WINDOWS\system32\DRIVERS\wmiacpi.sys
2011/03/16 20:50:59.0468 2572 WpdUsb (cf4def1bf66f06964dc0d91844239104) C:\WINDOWS\system32\DRIVERS\wpdusb.sys
2011/03/16 20:50:59.0531 2572 WS2IFSL (6abe6e225adb5a751622a9cc3bc19ce8) C:\WINDOWS\System32\drivers\ws2ifsl.sys
2011/03/16 20:50:59.0593 2572 WSTCODEC (c98b39829c2bbd34e454150633c62c78) C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS
2011/03/16 20:50:59.0671 2572 WudfPf (f15feafffbb3644ccc80c5da584e6311) C:\WINDOWS\system32\DRIVERS\WudfPf.sys
2011/03/16 20:50:59.0703 2572 WudfRd (28b524262bce6de1f7ef9f510ba3985b) C:\WINDOWS\system32\DRIVERS\wudfrd.sys
2011/03/16 20:50:59.0968 2572 ================================================================================
2011/03/16 20:50:59.0968 2572 Scan finished
2011/03/16 20:50:59.0968 2572 ================================================================================
2011/03/16 20:51:39.0343 2540 Deinitialize success

Ok. Bitte nun Logs mit GMER und OSAM erstellen und posten.
GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus - die Online-Abfrage durch OSAM bitte überspringen.
Bei OSAM bitte darauf auch achten, dass Du das Log auch als *.log und nicht *.html oder so abspeicherst.

Downloade Dir danach bitte MBRCheck (by a_d_13) und speichere die Datei auf dem Desktop.

Doppelklick auf die MBRCheck.exe.
Vista und Win7 User mit Rechtsklick "als Administrator starten"
Das Tool braucht nur einige Sekunden.
Danach solltest du eine MBRCheck_<Datum>_<Uhrzeit>.txt auf dem Desktop finden.

Poste mir bitte den Inhalt des .txt Dokumentes

Also sorry das es so gedauert hat war auf Lehrgang.
Das erste Programm hat sich aufgehängt.
Hier der osam log.

OSAM Logfile:

Code:

Report of OSAM: Autorun Manager v5.0.11926.0

hxxp://www.online-solutions.ru/en/

Saved at 19:22:01 on 20.03.2011
 

OS: Windows XP Home Edition Service Pack 3 (Build 2600)

Default Browser: Apple Inc. Safari 5.0.3 (7533.19.4)
 

Scanner Settings

[x] Rootkits detection (hidden registry)

[x] Rootkits detection (hidden files)

[x] Retrieve files information

[x] Check Microsoft signatures
 

Filters

[ ] Trusted entries

[ ] Empty entries

[x] Hidden registry entries (rootkit activity)

[x] Exclusively opened files

[x] Not found files

[x] Files without detailed information

[x] Existing files

[ ] Non-startable services

[ ] Non-startable drivers

[x] Active entries

[x] Disabled entries
 
 

[Common]

-----( %SystemRoot%\Tasks )-----

"AppleSoftwareUpdate.job" - "Apple Inc." - C:\Programme\Apple Software Update\SoftwareUpdate.exe

"GoogleUpdateTaskMachineCore.job" - "Google Inc." - C:\Programme\Google\Update\GoogleUpdate.exe

"GoogleUpdateTaskMachineUA.job" - "Google Inc." - C:\Programme\Google\Update\GoogleUpdate.exe

"RealUpgradeLogonTaskS-1-5-21-1223508753-2124911804-4176259086-1006.job" - "RealNetworks, Inc." - C:\Programme\Real\RealUpgrade\realupgrade.exe

"RealUpgradeScheduledTaskS-1-5-21-1223508753-2124911804-4176259086-1006.job" - "RealNetworks, Inc." - C:\Programme\Real\RealUpgrade\realupgrade.exe
 

[Control Panel Objects]

-----( %SystemRoot%\system32 )-----

"bdeadmin.cpl" - "Borland Software Corporation" - C:\WINDOWS\system32\bdeadmin.cpl

"btcpl.cpl" - "Broadcom Corporation." - C:\WINDOWS\system32\btcpl.cpl

"Ddbaccpl.cpl" - "DataDesign AG" - C:\WINDOWS\system32\Ddbaccpl.cpl

"ddBACCTM.cpl" - "DataDesign AG" - C:\WINDOWS\system32\ddBACCTM.cpl

"infocardcpl.cpl" - "Microsoft Corporation" - C:\WINDOWS\system32\infocardcpl.cpl

"ISUSPM.cpl" - "Macrovision Corporation" - C:\WINDOWS\system32\ISUSPM.cpl

"javacpl.cpl" - "Sun Microsystems, Inc." - C:\WINDOWS\system32\javacpl.cpl

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )-----

"Avira AntiVir Personal - Free Antivirus " - "Avira GmbH" - C:\PROGRA~1\Avira\ANTIVI~1\avconfig.cpl

"QuickTime" - "Apple Inc." - C:\Programme\QuickTime\QTSystem\QuickTime.cpl
 

[Drivers]

-----( HKLM\SYSTEM\CurrentControlSet\Services )-----

"avgio" (avgio) - "Avira GmbH" - C:\Programme\Avira\AntiVir Desktop\avgio.sys

"avgntflt" (avgntflt) - "Avira GmbH" - C:\WINDOWS\System32\DRIVERS\avgntflt.sys

"avipbb" (avipbb) - "Avira GmbH" - C:\WINDOWS\System32\DRIVERS\avipbb.sys

"catchme" (catchme) - ? - C:\DOKUME~1\Fanny\LOKALE~1\Temp\catchme.sys  (File not found)

"Changer" (Changer) - ? - C:\WINDOWS\system32\drivers\Changer.sys  (File not found)

"i2omgmt" (i2omgmt) - ? - C:\WINDOWS\system32\drivers\i2omgmt.sys  (File not found)

"kfadifod" (kfadifod) - ? - C:\DOKUME~1\Fanny\LOKALE~1\Temp\kfadifod.sys  (Hidden registry entry, rootkit activity | File not found)

"lbrtfdc" (lbrtfdc) - ? - C:\WINDOWS\system32\drivers\lbrtfdc.sys  (File not found)

"PCIDump" (PCIDump) - ? - C:\WINDOWS\system32\drivers\PCIDump.sys  (File not found)

"PDCOMP" (PDCOMP) - ? - C:\WINDOWS\system32\drivers\PDCOMP.sys  (File not found)

"PDFRAME" (PDFRAME) - ? - C:\WINDOWS\system32\drivers\PDFRAME.sys  (File not found)

"PDRELI" (PDRELI) - ? - C:\WINDOWS\system32\drivers\PDRELI.sys  (File not found)

"PDRFRAME" (PDRFRAME) - ? - C:\WINDOWS\system32\drivers\PDRFRAME.sys  (File not found)

"PxHelp20" (PxHelp20) - "Sonic Solutions" - C:\WINDOWS\System32\Drivers\PxHelp20.sys

"ssmdrv" (ssmdrv) - "Avira GmbH" - C:\WINDOWS\System32\DRIVERS\ssmdrv.sys

"VN Series Device" (VNUSB) - "OLYMPUS OPTICAL CO.,LTD." - C:\WINDOWS\System32\DRIVERS\VNUSB.sys

"WDICA" (WDICA) - ? - C:\WINDOWS\system32\drivers\WDICA.sys  (File not found)
 

[Explorer]

-----( HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components )-----

{89B4C1CD-B018-4511-B0A1-5476DBF70820} "StubPath" - "Microsoft Corporation" - c:\WINDOWS\system32\Rundll32.exe c:\WINDOWS\system32\mscories.dll,Install

-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----

{F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\PDFShell.dll

-----( HKLM\Software\Classes\Protocols\Filter )-----

{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll

{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll

{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll

{807553E5-5146-11D5-A672-00B0D022E945} "text/xml" - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE11\MSOXMLMF.DLL

-----( HKLM\Software\Classes\Protocols\Handler )-----

{32505114-5902-49B2-880A-1F7738E5A384} "Data Page Plugable Protocal mso-offdap11 Handler" - "Microsoft Corporation" - C:\PROGRA~1\GEMEIN~1\MICROS~1\WEBCOM~1\11\OWC11.DLL

{3D9F03FA-7A94-11D3-BE81-0050048385D1} "Data Page Pluggable Protocol mso-offdap Handler" - "Microsoft Corporation" - C:\PROGRA~1\GEMEIN~1\MICROS~1\WEBCOM~1\10\OWC10.DLL

{828030A1-22C1-4009-854F-8E305202313F} "livecall" - "Microsoft Corporation" - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL

{0A9007C0-4076-11D3-8789-0000F8105754} "Microsoft Infotech Storage Protocol for IE 4.0" - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Information Retrieval\MSITSS.DLL

{828030A1-22C1-4009-854F-8E305202313F} "msnim" - "Microsoft Corporation" - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL

{03C514A3-1EFB-4856-9F99-10D7BE1653C0} "Windows Live Mail HTML Asynchronous Pluggable Protocol Handler" - "Microsoft Corporation" - C:\Programme\Windows Live\Mail\mailcomm.dll

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----

{6af09ec9-b429-11d4-a1fb-0090960218cb} "Bluetooth-Umgebung" - "Broadcom Corporation." - C:\WINDOWS\system32\BTNEIG~1.DLL

{0563DB41-F538-4B37-A92D-4659049B7766} "CLSID_WLMCMimeFilter" - "Microsoft Corporation" - C:\Programme\Windows Live\Mail\mailcomm.dll

{42071714-76d4-11d1-8b24-00a0c9068ff3} "CPL-Erweiterung für Anzeigeverschiebung" - ? - deskpan.dll  (File not found)

{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA} "Kontextmenü für die Verschlüsselung" - ? -   (File not found | COM-object registry key not found)

{42042206-2D85-11D3-8CFF-005004838597} "Microsoft Office HTML Icon Handler" - "Microsoft Corporation" - C:\Programme\Microsoft Office\OFFICE11\msohev.dll

{993BE281-6695-4BA5-8A2A-7AACBFAAB69E} "Microsoft Office Metadata Handler" - "Microsoft Corporation" - C:\PROGRA~1\GEMEIN~1\MICROS~1\OFFICE12\msoshext.dll

{00020D75-0000-0000-C000-000000000046} "Microsoft Office Outlook" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~4\OFFICE11\MLSHEXT.DLL

{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97} "Microsoft Office Thumbnail Handler" - "Microsoft Corporation" - C:\PROGRA~1\GEMEIN~1\MICROS~1\OFFICE12\msoshext.dll

{7842554E-6BED-11D2-8CDB-B05550C10000} "Monitor Class" - "Broadcom Corporation." - C:\WINDOWS\system32\btncopy.dll

{0006F045-0000-0000-C000-000000000046} "Outlook-Dateisymbolerweiterung" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~4\OFFICE11\OLKFSTUB.DLL

{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4} "RealOne Player Context Menu Class" - "RealNetworks, Inc." - c:\programme\real\realplayer\rpshell.dll

{45AC2688-0253-4ED8-97DE-B5370FA7D48A} "Shell Extension for Malware scanning" - "Avira GmbH" - C:\Programme\Avira\AntiVir Desktop\shlext.dll

{E37E2028-CE1A-4f42-AF05-6CEABC4E5D75} "Shell Icon Handler for Application References" - "Microsoft Corporation" - c:\WINDOWS\system32\dfshim.dll

{764BF0E1-F219-11ce-972D-00AA00A14F56} "Shellerweiterungen für die Dateikomprimierung" - ? -   (File not found | COM-object registry key not found)

{e82a2d71-5b2f-43a0-97b8-81be15854de8} "ShellLink for Application References" - "Microsoft Corporation" - c:\WINDOWS\system32\dfshim.dll

{BDEADF00-C265-11D0-BCED-00A0C90AB50F} "Webordner" - "Microsoft Corporation" - C:\PROGRA~1\GEMEIN~1\MICROS~1\WEBFOL~1\MSONSEXT.DLL

{2BE99FD4-A181-4996-BFA9-58C5FFD11F6C} "Windows Live Photo Gallery Autoplay Drop Target" - "Microsoft Corporation" - C:\Programme\Windows Live\Photo Gallery\WLXPhotoGallery.exe

{00F30F64-AC33-42F5-8FD1-5DC2D3FDE06C} "Windows Live Photo Gallery Editor Drop Target" - "Microsoft Corporation" - C:\Programme\Windows Live\Photo Gallery\WLXPhotoGallery.exe

{00F3712A-CA79-45B4-9E4D-D7891E7F8B9D} "Windows Live Photo Gallery Editor Shim" - "Microsoft Corporation" - C:\Programme\Windows Live\Photo Gallery\PhotoViewerShim.dll

{00F30F90-3E96-453B-AFCD-D71989ECC2C7} "Windows Live Photo Gallery Viewer Autoplay Shim" - "Microsoft Corporation" - C:\Programme\Windows Live\Photo Gallery\PhotoViewerShim.dll

{00F33137-EE26-412F-8D71-F84E4C2C6625} "Windows Live Photo Gallery Viewer Autoplay Shim" - "Microsoft Corporation" - C:\Programme\Windows Live\Photo Gallery\PhotoViewerShim.dll

{00F374B7-B390-4884-B372-2FC349F2172B} "Windows Live Photo Gallery Viewer Drop Target" - "Microsoft Corporation" - C:\Programme\Windows Live\Photo Gallery\WLXPhotoGallery.exe

{00F346CB-35A4-465B-8B8F-65A29DBAB1F6} "Windows Live Photo Gallery Viewer Shim" - "Microsoft Corporation" - C:\Programme\Windows Live\Photo Gallery\PhotoViewerShim.dll

{B41DB860-8EE4-11D2-9906-E49FADC173CA} "WinRAR" - ? - C:\Programme\WinRAR\rarext.dll

{06A2568A-CED6-4187-BB20-400B8C02BE5A} "{06A2568A-CED6-4187-BB20-400B8C02BE5A}" - "Microsoft Corporation" - C:\Programme\Windows Live\Photo Gallery\WLXPhotoAcquireWizard.exe
 

[Internet Explorer]

-----( HKCU\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----

"eBay - Der weltweite Online-Marktplatz" - ? - hxxp://rover.ebay.com/rover/1/707-37276-17534-25/4  (HTTP value)

-----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )-----

<binary data> "ITBar7Layout" - ? -   (File not found | COM-object registry key not found)

<binary data> "{2318C2B1-4965-11D4-9B18-009027A5CD4F}" - ? -   (File not found | COM-object registry key not found)

-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----

{8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.6.0_11" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\npjpi160_11.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab

{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} "Java Plug-in 1.6.0_11" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\npjpi160_11.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab

{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_11" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\npjpi160_11.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab

{166B1BCA-3F9C-11CF-8075-444553540000} "Shockwave ActiveX Control" - "Adobe Systems, Inc." - C:\WINDOWS\system32\Adobe\Director\SwDir.dll / hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab

{8FFBE65D-2C9C-4669-84BD-5829DC0B603C} "{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}" - ? -   (File not found | COM-object registry key not found) / hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab

-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----

"@btrez.dll,-4015" - ? - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm

"eBay - Der weltweite Online-Marktplatz" - ? - hxxp://rover.ebay.com/rover/1/707-37276-17534-25/4  (HTTP value)

{5F7B1267-94A9-47F5-98DB-E99415F33AEC} "In Blog veröffentlichen" - "Microsoft Corporation" - C:\Programme\Windows Live\Writer\WriterBrowserExtension.dll

{FF059E31-CC5A-4E2E-BF3B-96E929D65503} "Recherchieren" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----

{18DF081C-E8AD-4283-A596-FA578C2EBDC3} "Adobe PDF Link Helper" - "Adobe Systems Incorporated" - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

{DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\jp2ssv.dll

{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} "Java(tm) Plug-In SSV Helper" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\ssv.dll

{E7E6F031-17CE-4C07-BC86-EABFE594F69C} "JQSIEStartDetectorImpl Class" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

{3049C3E9-B461-4BC5-8870-4C09146192CA} "RealPlayer Download and Record Plugin for Internet Explorer" - "RealPlayer" - C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll

{9030D464-4C02-4ABF-8ECC-5164760863C6} "Windows Live Anmelde-Hilfsprogramm" - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

{5C255C8A-E604-49b4-9D64-90988571CECB} "{5C255C8A-E604-49b4-9D64-90988571CECB}" - ? -   (File not found | COM-object registry key not found)
 

[Logon]

-----( %AllUsersProfile%\Startmenü\Programme\Autostart )-----

"Bluetooth.lnk" - "Broadcom Corporation." - C:\Programme\WIDCOMM\Bluetooth Software\BTTray.exe  (Shortcut exists | File exists)

"desktop.ini" - ? - C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\desktop.ini

"Device Detector 2.lnk" - "OLYMPUS Corporation." - C:\Programme\Olympus\DeviceDetector\DevDtct2.exe  (Shortcut exists | File exists)

"McAfee Security Scan Plus.lnk" - "McAfee, Inc." - C:\Programme\McAfee Security Scan\2.0.181\SSScheduler.exe  (Shortcut exists | File exists)

-----( %UserProfile%\Startmenü\Programme\Autostart )-----

"desktop.ini" - ? - C:\Dokumente und Einstellungen\Fanny\Startmenü\Programme\Autostart\desktop.ini

-----( HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run )-----

"Sony Ericsson PC Suite" - "Sony Ericsson Mobile Communications AB" - "C:\Programme\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe" /systray /nologon

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----

"Adobe ARM" - "Adobe Systems Incorporated" - "C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe"

"Adobe Reader Speed Launcher" - "Adobe Systems Incorporated" - "C:\Programme\Adobe\Reader 9.0\Reader\Reader_sl.exe"

"avgnt" - "Avira GmbH" - "C:\Programme\Avira\AntiVir Desktop\avgnt.exe" /min

"Corel Photo Downloader" - "Corel, Inc." - "C:\Programme\Corel\Corel MediaOne\Corel Photo Downloader.exe" -startup

"LanguageShortcut" - ? - C:\Programme\HomeCinema\PowerDVD\Language\Language.exe

"MGSysCtrl" - "Mirco-Star International  CO., LTD." - C:\Programme\System Control Manager\MGSysCtrl.exe

"QuickFinder Scheduler" - "Corel Corporation" - "C:\Programme\WordPerfect Office X3\Programs\QFSCHD130.EXE"

"QuickTime Task" - "Apple Inc." - "C:\Programme\QuickTime\QTTask.exe" -atboottime

"TkBellExe" - "RealNetworks, Inc." - "C:\programme\real\realplayer\update\realsched.exe"  -osboot

"UCam_Menu" - "CyberLink Corp." - "C:\Programme\HomeCinema\YouCam\MUITransfer\MUIStartMenu.exe" "C:\Programme\HomeCinema\YouCam" UpdateWithCreateOnce "Software\CyberLink\YouCam\2.0"
 

[Print Monitors]

-----( HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors )-----

"Bluetooth-Druckeranschluss" - "Broadcom Corporation." - C:\WINDOWS\system32\bthcrp.dll

"Microsoft Document Imaging Writer Monitor" - "Microsoft Corporation" - C:\WINDOWS\system32\mdimon.dll
 

[Services]

-----( HKLM\SYSTEM\CurrentControlSet\Services )-----

".NET Runtime Optimization Service v2.0.50727_X86" (clr_optimization_v2.0.50727_32) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

"Anwendungsverwaltung" (AppMgmt) - ? - C:\WINDOWS\System32\appmgmts.dll  (File not found)

"Apple Mobile Device" (Apple Mobile Device) - "Apple Inc." - C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

"ASP.NET-Zustandsdienst" (aspnet_state) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe

"Avira AntiVir Guard" (AntiVirService) - "Avira GmbH" - C:\Programme\Avira\AntiVir Desktop\avguard.exe

"Avira AntiVir Planer" (AntiVirSchedulerService) - "Avira GmbH" - C:\Programme\Avira\AntiVir Desktop\sched.exe

"Bluetooth Service" (btwdins) - "Broadcom Corporation." - C:\Programme\WIDCOMM\Bluetooth Software\bin\btwdins.exe

"Cyberlink RichVideo Service(CRVS)" (RichVideo) - ? - C:\Programme\Cyberlink\Shared files\RichVideo.exe

"Google Update Service (gupdate1ca60bf25e90f32)" (gupdate1ca60bf25e90f32) - "Google Inc." - C:\Programme\Google\Update\GoogleUpdate.exe

"Google Updater Service" (gusvc) - "Google" - C:\Programme\Google\Common\Google Updater\GoogleUpdaterService.exe

"Java Quick Starter" (JavaQuickStarterService) - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\jqs.exe

"Machine Debug Manager" (MDM) - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7DEBUG\MDM.EXE

"McAfee Security Scan Component Host Service" (McComponentHostService) - "McAfee, Inc." - C:\Programme\McAfee Security Scan\2.0.181\McCHSvc.exe

"Micro Star SCM" (Micro Star SCM) - ? - C:\Programme\System Control Manager\MSIService.exe  (File found, but it contains no detailed information)

"Office Source Engine" (ose) - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE

"ProtexisLicensing" (ProtexisLicensing) - ? - C:\WINDOWS\system32\PSIService.exe

"Sony Ericsson OMSI download service" (OMSI download service) - ? - C:\Programme\Sony Ericsson\Sony Ericsson PC Suite\SupServ.exe  (File found, but it contains no detailed information)

"Windows CardSpace" (idsvc) - "Microsoft Corporation" - c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe

"Windows Presentation Foundation Font Cache 3.0.0.0" (FontCache3.0.0.0) - "Microsoft Corporation" - c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
 

[Winlogon]

-----( HKCU\Control Panel\IOProcs )-----

"MVB" - ? - mvfs32.dll  (File not found)

-----( HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions )-----

{c6dc5466-785a-11d2-84d0-00c04fb169f7} "Softwareinstallation" - ? - appmgmts.dll  (File not found)
 

===[ Logfile end ]=========================================[ Logfile end ]===

--- --- ---

If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru

MBRcheck
MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:
Windows Version: Windows XP Home Edition
Windows Information: Service Pack 3 (build 2600)
Logical Drives Mask: 0x0000000c

Kernel Drivers (total 124):
0x804D7000 \WINDOWS\system32\ntkrnlpa.exe
0x806E6000 \WINDOWS\system32\hal.dll
0xF7AF3000 \WINDOWS\system32\KDCOM.DLL
0xF7A03000 \WINDOWS\system32\BOOTVID.dll
0xF74C3000 ACPI.sys
0xF7AF5000 \WINDOWS\system32\DRIVERS\WMILIB.SYS
0xF74B2000 pci.sys
0xF75F3000 isapnp.sys
0xF7A07000 compbatt.sys
0xF7A0B000 \WINDOWS\system32\DRIVERS\BATTC.SYS
0xF7603000 MountMgr.sys
0xF7493000 ftdisk.sys
0xF7873000 PartMgr.sys
0xF7A0F000 ACPIEC.sys
0xF7BBB000 \WINDOWS\system32\DRIVERS\OPRGHDLR.SYS
0xF7613000 VolSnap.sys
0xF73CB000 iaStor.sys
0xF7623000 disk.sys
0xF7633000 \WINDOWS\system32\DRIVERS\CLASSPNP.SYS
0xF73AB000 fltMgr.sys
0xF7399000 sr.sys
0xF7643000 PxHelp20.sys
0xF7382000 KSecDD.sys
0xF736F000 WudfPf.sys
0xF72E2000 Ntfs.sys
0xF72B5000 NDIS.sys
0xF729B000 Mup.sys
0xF5CED000 \SystemRoot\system32\DRIVERS\igxpmp32.sys
0xF5CD9000 \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS
0xF5CB1000 \SystemRoot\system32\DRIVERS\HDAudBus.sys
0xF5C97000 \SystemRoot\system32\DRIVERS\Rtenicxp.sys
0xF5C0B000 \SystemRoot\system32\DRIVERS\RT2860.sys
0xF78BB000 \SystemRoot\system32\DRIVERS\usbuhci.sys
0xF5BE7000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
0xF78C3000 \SystemRoot\system32\DRIVERS\usbehci.sys
0xF7853000 \SystemRoot\system32\DRIVERS\i8042prt.sys
0xF78CB000 \SystemRoot\system32\DRIVERS\kbdclass.sys
0xF5BB1000 \SystemRoot\system32\DRIVERS\SynTP.sys
0xF7B39000 \SystemRoot\system32\DRIVERS\USBD.SYS
0xF78D3000 \SystemRoot\system32\DRIVERS\mouclass.sys
0xF7213000 \SystemRoot\system32\DRIVERS\CmBatt.sys
0xF720F000 \SystemRoot\system32\DRIVERS\wmiacpi.sys
0xF7863000 \SystemRoot\system32\DRIVERS\intelppm.sys
0xF5AC0000 \SystemRoot\system32\DRIVERS\btkrnl.sys
0xF7C7D000 \SystemRoot\system32\DRIVERS\audstub.sys
0xF7B3B000 \SystemRoot\System32\Drivers\RootMdm.sys
0xF78DB000 \SystemRoot\System32\Drivers\Modem.SYS
0xF7653000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
0xF720B000 \SystemRoot\system32\DRIVERS\ndistapi.sys
0xF5AA9000 \SystemRoot\system32\DRIVERS\ndiswan.sys
0xF7663000 \SystemRoot\system32\DRIVERS\raspppoe.sys
0xF7673000 \SystemRoot\system32\DRIVERS\raspptp.sys
0xF78E3000 \SystemRoot\system32\DRIVERS\TDI.SYS
0xF5A98000 \SystemRoot\system32\DRIVERS\psched.sys
0xF7683000 \SystemRoot\system32\DRIVERS\msgpc.sys
0xF78EB000 \SystemRoot\system32\DRIVERS\ptilink.sys
0xF78F3000 \SystemRoot\system32\DRIVERS\raspti.sys
0xF7693000 \SystemRoot\system32\DRIVERS\termdd.sys
0xF78FB000 \SystemRoot\system32\DRIVERS\seehcri.sys
0xF7B3D000 \SystemRoot\system32\DRIVERS\swenum.sys
0xF5A75000 \SystemRoot\system32\DRIVERS\ks.sys
0xF5A17000 \SystemRoot\system32\DRIVERS\update.sys
0xF71FF000 \SystemRoot\system32\DRIVERS\mssmbios.sys
0xF7943000 \SystemRoot\system32\DRIVERS\btport.sys
0xF636D000 \SystemRoot\System32\Drivers\NDProxy.SYS
0x9C800000 \SystemRoot\system32\drivers\RtkHDAud.sys
0x9C7DC000 \SystemRoot\system32\drivers\portcls.sys
0x9F6CA000 \SystemRoot\system32\drivers\drmk.sys
0x9F6BA000 \SystemRoot\system32\DRIVERS\usbhub.sys
0xF7B9F000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
0xF7C50000 \SystemRoot\System32\Drivers\Null.SYS
0xF7BA1000 \SystemRoot\System32\Drivers\Beep.SYS
0x9EA7A000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
0x9EA72000 \SystemRoot\System32\drivers\vga.sys
0xF7BA3000 \SystemRoot\System32\Drivers\mnmdd.SYS
0xF7BA5000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0x9EA6A000 \SystemRoot\System32\Drivers\Msfs.SYS
0x9EA62000 \SystemRoot\System32\Drivers\Npfs.SYS
0xA2AC6000 \SystemRoot\system32\DRIVERS\rasacd.sys
0x9C709000 \SystemRoot\system32\DRIVERS\ipsec.sys
0x9C6B0000 \SystemRoot\system32\DRIVERS\tcpip.sys
0x9C67E000 \SystemRoot\system32\DRIVERS\netbt.sys
0x9C658000 \SystemRoot\system32\DRIVERS\ipnat.sys
0x9C636000 \SystemRoot\System32\drivers\afd.sys
0x9F68A000 \SystemRoot\system32\DRIVERS\netbios.sys
0x9F67A000 \SystemRoot\system32\DRIVERS\wanarp.sys
0x9EA5A000 \SystemRoot\system32\DRIVERS\ssmdrv.sys
0x9C5E3000 \SystemRoot\system32\DRIVERS\rdbss.sys
0x9C573000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
0x9E448000 \SystemRoot\System32\Drivers\Fips.SYS
0x9C549000 \SystemRoot\System32\Drivers\RTS5121.sys
0x9E5AA000 \SystemRoot\system32\DRIVERS\hidusb.sys
0x9E428000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
0x9E418000 \SystemRoot\System32\Drivers\btwusb.sys
0x9C7C4000 \SystemRoot\system32\DRIVERS\kbdhid.sys
0x9C7C0000 \SystemRoot\system32\DRIVERS\mouhid.sys
0x9B444000 \SystemRoot\system32\DRIVERS\avipbb.sys
0xF7BB1000 \??\C:\Programme\Avira\AntiVir Desktop\avgio.sys
0x95E95000 \SystemRoot\system32\DRIVERS\btwdndis.sys
0x95E14000 \SystemRoot\system32\drivers\btaudio.sys
0x96AA2000 \SystemRoot\system32\DRIVERS\btwhid.sys
0x96BD8000 \SystemRoot\system32\DRIVERS\btwmodem.sys
0x95DF0000 \SystemRoot\System32\Drivers\Fastfat.SYS
0x95D28000 \SystemRoot\System32\Drivers\dump_iaStor.sys
0xBF800000 \SystemRoot\System32\win32k.sys
0x96379000 \SystemRoot\System32\drivers\Dxapi.sys
0x96BB8000 \SystemRoot\System32\watchdog.sys
0xBF000000 \SystemRoot\System32\drivers\dxg.sys
0x96757000 \SystemRoot\System32\drivers\dxgthk.sys
0xBF024000 \SystemRoot\System32\igxpgd32.dll
0xBF012000 \SystemRoot\System32\igxprd32.dll
0xBF04F000 \SystemRoot\System32\igxpdv32.DLL
0xBF1E7000 \SystemRoot\System32\igxpdx32.DLL
0xBF47A000 \SystemRoot\System32\ATMFD.DLL
0x95D14000 \SystemRoot\system32\DRIVERS\avgntflt.sys
0x9637D000 \SystemRoot\system32\DRIVERS\ndisuio.sys
0x95CBF000 \SystemRoot\system32\DRIVERS\mrxdav.sys
0x95BC7000 \SystemRoot\system32\DRIVERS\srv.sys
0x959FA000 \SystemRoot\system32\drivers\wdmaud.sys
0xF77A3000 \SystemRoot\system32\drivers\sysaudio.sys
0x9524B000 \SystemRoot\System32\Drivers\HTTP.sys
0x94C4A000 \??\C:\DOKUME~1\Fanny\LOKALE~1\Temp\kfadifod.sys
0x94C1F000 \SystemRoot\system32\drivers\kmixer.sys
0x7C910000 \WINDOWS\system32\ntdll.dll

Processes (total 50):
0 System Idle Process
4 System
744 C:\WINDOWS\system32\smss.exe
792 csrss.exe
816 C:\WINDOWS\system32\winlogon.exe
860 C:\WINDOWS\system32\services.exe
872 C:\WINDOWS\system32\lsass.exe
1060 C:\WINDOWS\system32\svchost.exe
1104 svchost.exe
1144 C:\WINDOWS\system32\svchost.exe
1184 C:\Programme\WIDCOMM\Bluetooth Software\bin\btwdins.exe
1252 C:\WINDOWS\system32\svchost.exe
1340 svchost.exe
1420 svchost.exe
1584 C:\WINDOWS\system32\spoolsv.exe
1632 C:\Programme\Avira\AntiVir Desktop\sched.exe
1676 svchost.exe
1732 C:\Programme\Avira\AntiVir Desktop\avguard.exe
1744 C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
1832 C:\Programme\Java\jre6\bin\jqs.exe
1888 C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7DEBUG\MDM.EXE
1936 C:\Programme\System Control Manager\MSIService.exe
1968 C:\Programme\Sony Ericsson\Sony Ericsson PC Suite\SupServ.exe
2024 C:\WINDOWS\system32\PSIService.exe
2044 C:\Programme\Cyberlink\Shared files\RichVideo.exe
184 C:\WINDOWS\system32\svchost.exe
716 C:\WINDOWS\explorer.exe
1956 C:\WINDOWS\system32\igfxtray.exe
2052 C:\WINDOWS\system32\hkcmd.exe
2060 C:\WINDOWS\system32\igfxpers.exe
2068 C:\WINDOWS\RTHDCPL.exe
2076 C:\Programme\Synaptics\SynTP\SynTPEnh.exe
2084 C:\Programme\System Control Manager\MGSysCtrl.exe
2148 C:\Programme\Avira\AntiVir Desktop\avgnt.exe
2156 C:\WINDOWS\system32\igfxsrvc.exe
2184 C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe
2228 C:\Programme\Corel\Corel MediaOne\Corel Photo Downloader.exe
2252 C:\Programme\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe
2284 C:\Programme\WIDCOMM\Bluetooth Software\BTTray.exe
2304 C:\Programme\Olympus\DeviceDetector\DevDtct2.exe
2320 C:\WINDOWS\system32\wbem\unsecapp.exe
2400 C:\Programme\McAfee Security Scan\2.0.181\SSScheduler.exe
2456 wmiprvse.exe
2828 C:\WINDOWS\system32\wbem\wmiapsrv.exe
2856 C:\PROGRA~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXE
3172 alg.exe
3036 C:\Programme\Real\RealPlayer\Update\realsched.exe
1704 C:\WINDOWS\system32\wscntfy.exe
1208 C:\Programme\Safari\Safari.exe
2932 C:\Dokumente und Einstellungen\Fanny\Desktop\MBRCheck.exe

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`00007e00 (NTFS)
\\.\D: --> \\.\PhysicalDrive0 at offset 0x00000021`7a521200 (FAT32)

PhysicalDrive0 Model Number: ST9160310AS, Rev: SD03

Size Device Name MBR Status
--------------------------------------------
149 GB \\.\PhysicalDrive0 Windows XP MBR code detected
SHA1: ADFE55CD0C6ED2E00B22375835E4C2736CE9AD11

Done!

GMER hat sich bei drei Versuchen aufgehängt.
Hoffentlich ist das Ding bald platt.

Gruß Fanny

Sieht ok aus. Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SASW und poste die Logs.
Denk dran beide Tools zu updaten vor dem Scan!!

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Datenbank Version: 6149

Windows 5.1.2600 Service Pack 3
Internet Explorer 7.0.5730.13

24.03.2011 09:52:04
mbam-log-2011-03-24 (09-52-04).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|)
Durchsuchte Objekte: 209299
Laufzeit: 34 Minute(n), 18 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)

Ach kacke manno.
Wie hab ich mir das jetzt wieder eingefangen.

SUPERAntiSpyware Scan Log
hxxp://www.superantispyware.com

Generated 03/24/2011 at 11:24 AM

Application Version : 4.50.1002

Core Rules Database Version : 6666
Trace Rules Database Version: 4478

Scan type : Complete Scan
Total Scan Time : 01:17:33

Memory items scanned : 576
Memory threats detected : 0
Registry items scanned : 7717
Registry threats detected : 0
File items scanned : 64028
File threats detected : 1

Trojan.Agent/Gen-FakeAV
C:\PROGRAMME\WINRAR\DEFAULT.SFX

Nur ein Fehlalarm. Rechner sonst soweit wieder ok?

Ja läuft wieder einwandfrei.:Boogie:
Danke, bis zum nächsten mal.

Gruß Fanny

Dann wären wir durch! :abklatsch:

Bitte abschließend die Updates prüfen, unten mein Leitfaden dazu.
Für noch mehr Sicherheit solltest Du nach der beseitigten Infektion auch möglichst alle Passwörter ändern.

Microsoftupdate

Windows XP: Besuch mit dem IE die MS-Updateseite und lass Dir alle wichtigen Updates installieren.

Windows Vista/7: Anleitung Windows-Update

PDF-Reader aktualisieren
Dein Adobe Reader ist nicht aktuell, was ein großes Sicherheitsrisiko darstellt. Du solltest daher besser die alte Version über Systemsteuerung => Software deinstallieren, indem Du dort auf "Adobe Reader x.0" klickst und das Programm entfernst.

Ich empfehle einen alternativen PDF-Reader wie SumatraPDF oder Foxit PDF Reader, beide sind sehr viel schlanker und flotter als der AdobeReader.

Bitte überprüf bei der Gelegenheit auch die Aktualität des Flashplayers, hier der direkte Downloadlink:

Mozilla und andere Browser => http://filepony.de/?q=Flash+Player
Internet Explorer => http://fpdownload.adobe.com/get/flas..._player_ax.exe

Java-Update
Veraltete Java-Installationen sind ein Sicherheitsrisiko, daher solltest Du die alten Versionen löschen (falls vorhanden, am besten mit JavaRa) und auf die neuste aktualisieren. Beende dazu alle Programme (v.a. die Browser), klick danach auf Start, Systemsteuerung, Software und deinstalliere darüber alle aufgelisteten Java-Versionen. Lad Dir danach von hier das aktuelle Java SE Runtime Environment (JRE) herunter und installiere es.