Trojaner-Board - Trojaner WIN32.Katusha.o lässt sich nicht entfernen

Trojaner-Board (https://www.trojaner-board.de/)

- Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)

- - Trojaner WIN32.Katusha.o lässt sich nicht entfernen (https://www.trojaner-board.de/99672-trojaner-win32-katusha-o-laesst-entfernen.html)

Trojaner WIN32.Katusha.o lässt sich nicht entfernen

Hallo Zusammen,

seit gestern meldet der Spybot S&D das Vorhandensein eines Viruses mit dem Namen WIN32.Katusha.o. Der Viraus lässt sich leider mit Hilfe des Programms sowie auch manuell nicht entfernen. Das System meldet, es könnte keine Winini-Datei erstellen. Wie knn ich diesen tückischen Virus bei mir entfernen?

anbei hier der Scan über OTL:
OTL.Txt:

OTL Logfile:

Code:

OTL logfile created on: 28.05.2011 15:08:58 - Run 1

OTL by OldTimer - Version 3.2.23.0     Folder = C:\Users\***\Downloads

Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation

Internet Explorer (Version = 8.0.6001.19048)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

1014,64 Mb Total Physical Memory | 202,95 Mb Available Physical Memory | 20,00% Memory free

2,24 Gb Paging File | 1,05 Gb Available in Paging File | 46,92% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files

Drive C: | 148,04 Gb Total Space | 101,66 Gb Free Space | 68,67% Space Free | Partition Type: NTFS

 

Computer Name: DANI-NOTEBOOK | User Name: *** | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user | Quick Scan

Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Processes (SafeList) ==========

 

PRC - [2011.05.28 15:03:29 | 000,580,096 | ---- | M] (OldTimer Tools) -- C:\Users\***\Downloads\OTL.exe

PRC - [2011.04.18 17:40:08 | 002,334,560 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Programme\AVG\AVG10\avgtray.exe

PRC - [2011.04.18 17:39:42 | 007,398,752 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Programme\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe

PRC - [2011.04.14 05:36:42 | 001,080,672 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Programme\AVG\AVG10\avgnsx.exe

PRC - [2011.03.28 03:00:52 | 000,351,072 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Programme\AVG\AVG10\avgcsrvx.exe

PRC - [2011.03.16 16:05:20 | 001,025,888 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Programme\AVG\AVG10\avgemcx.exe

PRC - [2011.03.16 16:05:14 | 000,656,736 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Programme\AVG\AVG10\avgchsvx.exe

PRC - [2011.02.10 07:55:18 | 001,148,256 | ---- | M] () -- C:\Programme\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSMonitor.exe

PRC - [2011.02.09 05:35:14 | 001,265,504 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Programme\AVG\AVG10\avgsrmax.exe

PRC - [2011.02.08 05:33:42 | 000,269,520 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Programme\AVG\AVG10\avgwdsvc.exe

PRC - [2011.02.08 05:33:20 | 000,658,784 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Programme\AVG\AVG10\avgrsx.exe

PRC - [2009.11.12 14:48:56 | 000,071,096 | ---- | M] () -- C:\Programme\CDBurnerXP\NMSAccessU.exe

PRC - [2009.07.29 20:32:46 | 000,066,864 | ---- | M] (Logitech Inc.) -- C:\Programme\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe

PRC - [2009.04.11 08:28:03 | 001,233,920 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Sidebar\sidebar.exe

PRC - [2009.04.11 08:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe

PRC - [2009.04.11 08:27:28 | 000,069,120 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\conime.exe

PRC - [2009.03.05 17:07:20 | 002,260,480 | RHS- | M] (Safer-Networking Ltd.) -- C:\Programme\Spybot - Search & Destroy\TeaTimer.exe

PRC - [2009.01.26 15:31:10 | 001,153,368 | ---- | M] (Safer Networking Ltd.) -- C:\Programme\Spybot - Search & Destroy\SDWinSec.exe

PRC - [2008.02.13 13:06:58 | 002,196,240 | ---- | M] () -- C:\Programme\Logitech\QuickCam\Quickcam.exe

PRC - [2008.02.13 13:02:46 | 000,564,496 | ---- | M] () -- C:\Programme\Common Files\LogiShrd\LComMgr\Communications_Helper.exe

PRC - [2008.02.13 13:02:24 | 000,405,776 | ---- | M] (Logitech Inc.) -- C:\Programme\Common Files\LogiShrd\LQCVFX\COCIManager.exe

PRC - [2008.02.05 18:20:42 | 000,150,040 | ---- | M] (Logitech Inc.) -- C:\Programme\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe

PRC - [2008.02.05 18:18:48 | 000,186,904 | ---- | M] (Logitech Inc.) -- C:\Programme\Common Files\LogiShrd\LVCOMSER\LVComSer.exe

PRC - [2007.11.13 19:38:28 | 002,510,848 | ---- | M] (OpenOffice.org) -- C:\Programme\OpenOffice.org 2.3\program\soffice.bin

PRC - [2007.11.13 19:38:26 | 002,359,296 | ---- | M] (OpenOffice.org) -- C:\Programme\OpenOffice.org 2.3\program\soffice.exe

PRC - [2007.01.23 11:53:34 | 000,565,248 | ---- | M] (MSI) -- C:\Programme\LG Software\System Control Manager\MGSysCtrl.exe

PRC - [2007.01.11 17:24:56 | 004,321,280 | ---- | M] (Realtek Semiconductor) -- C:\Windows\RtHDVCpl.exe

PRC - [2006.10.19 14:42:00 | 000,065,536 | ---- | M] (O2Micro International) -- C:\Windows\System32\o2flash.exe

PRC - [2006.10.05 12:10:12 | 000,009,216 | ---- | M] (Agere Systems) -- C:\Windows\System32\agrsmsvc.exe

PRC - [2006.03.02 16:43:24 | 000,040,960 | ---- | M] () -- C:\Programme\LG Software\System Control Manager\edd.exe

 

 
 ========== Modules (SafeList) ==========

 

MOD - [2011.05.28 15:03:29 | 000,580,096 | ---- | M] (OldTimer Tools) -- C:\Users\***\Downloads\OTL.exe

MOD - [2010.08.31 17:43:52 | 001,686,016 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_5cb72f2a088b0ed3\comctl32.dll

MOD - [2008.02.05 18:20:30 | 000,109,080 | ---- | M] (Logitech Inc.) -- C:\Windows\Temp\logishrd\LVPrcInj01.dll

 

 
 ========== Win32 Services (SafeList) ==========

 

SRV - [2011.04.18 17:39:42 | 007,398,752 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe -- (AVGIDSAgent)

SRV - [2011.02.08 05:33:42 | 000,269,520 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files\AVG\AVG10\avgwdsvc.exe -- (avgwd)

SRV - [2009.11.12 14:48:56 | 000,071,096 | ---- | M] () [Auto | Running] -- C:\Programme\CDBurnerXP\NMSAccessU.exe -- (NMSAccessU)

SRV - [2009.01.26 15:31:10 | 001,153,368 | ---- | M] (Safer Networking Ltd.) [Auto | Running] -- C:\Programme\Spybot - Search & Destroy\SDWinSec.exe -- (SBSDWSCService)

SRV - [2008.02.05 18:22:36 | 000,141,848 | ---- | M] (Logitech Inc.) [Auto | Stopped] -- C:\Programme\Common Files\LogiShrd\SrvLnch\SrvLnch.exe -- (LVSrvLauncher)

SRV - [2008.02.05 18:20:42 | 000,150,040 | ---- | M] (Logitech Inc.) [Auto | Running] -- C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe -- (LVPrcSrv)

SRV - [2008.02.05 18:18:48 | 000,186,904 | ---- | M] (Logitech Inc.) [Auto | Running] -- C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe -- (LVCOMSer)

SRV - [2008.01.19 09:38:24 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend)

SRV - [2006.10.19 14:42:00 | 000,065,536 | ---- | M] (O2Micro International) [Auto | Running] -- C:\Windows\System32\o2flash.exe -- (O2Flash)

SRV - [2006.10.05 12:10:12 | 000,009,216 | ---- | M] (Agere Systems) [Auto | Running] -- C:\Windows\System32\agrsmsvc.exe -- (AgereModemAudio)

SRV - [2006.03.02 16:43:24 | 000,040,960 | ---- | M] () [Auto | Running] -- C:\Programme\LG Software\System Control Manager\edd.exe -- (NishService)

SRV - [2004.08.18 19:36:44 | 000,450,560 | ---- | M] (Lexmark International, Inc.) [On_Demand | Stopped] -- C:\Windows\System32\lxbucoms.exe -- (lxbu_device)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV - [2011.04.14 21:28:18 | 000,134,480 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\AVGIDSDriver.sys -- (AVGIDSDriver)

DRV - [2011.04.05 00:59:56 | 000,297,168 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\Windows\System32\drivers\avgtdix.sys -- (Avgtdix)

DRV - [2011.03.16 16:03:20 | 000,032,592 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | Boot | Running] -- C:\Windows\system32\DRIVERS\avgrkx86.sys -- (Avgrkx86)

DRV - [2011.03.01 14:25:18 | 000,034,896 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | System | Running] -- C:\Windows\System32\drivers\avgmfx86.sys -- (Avgmfx86)

DRV - [2011.02.22 08:12:38 | 000,022,992 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | Boot | Running] -- C:\Windows\system32\DRIVERS\AVGIDSEH.Sys -- (AVGIDSEH)

DRV - [2011.02.10 07:53:30 | 000,028,624 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\AVGIDSShim.sys -- (AVGIDSShim)

DRV - [2011.02.10 07:53:28 | 000,024,144 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\AVGIDSFilter.sys -- (AVGIDSFilter)

DRV - [2011.01.07 06:41:46 | 000,248,656 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\Windows\System32\drivers\avgldx86.sys -- (Avgldx86)

DRV - [2010.12.20 18:09:00 | 000,038,224 | ---- | M] (Malwarebytes Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\mbamswissarmy.sys -- (MBAMSwissArmy)

DRV - [2009.11.12 14:48:56 | 000,007,168 | ---- | M] () [File_System | On_Demand | Stopped] -- C:\Windows\System32\drivers\StarOpen.sys -- (StarOpen)

DRV - [2008.02.06 04:21:37 | 004,658,456 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\lvuvc.sys -- (LVUVC) Logitech QuickCam S5500(UVC)

DRV - [2008.02.06 04:21:25 | 000,041,752 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\LVUSBSta.sys -- (LVUSBSta)

DRV - [2008.02.06 04:20:40 | 000,628,760 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\lvrs.sys -- (LVRS)

DRV - [2008.02.05 18:20:08 | 000,025,624 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\LVPr2Mon.sys -- (LVPr2Mon)

DRV - [2008.02.05 18:18:12 | 000,689,176 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\Lvckap.sys -- (LVcKap)

DRV - [2006.11.20 15:14:08 | 000,038,400 | ---- | M] (O2Micro ) [Kernel | Boot | Running] -- C:\Windows\system32\DRIVERS\o2media.sys -- (O2MDRDR)

DRV - [2006.11.17 13:58:32 | 000,031,360 | ---- | M] (O2Micro ) [Kernel | Boot | Running] -- C:\Windows\system32\DRIVERS\o2sd.sys -- (O2SDRDR)

DRV - [2006.11.08 16:29:44 | 001,161,888 | ---- | M] (Agere Systems) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\AGRSM.sys -- (AgereSoftModem)

DRV - [2006.11.04 09:35:50 | 000,059,392 | ---- | M] (Realtek Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Rtlh86.sys -- (RTL8169)

DRV - [2006.10.30 09:42:28 | 001,786,880 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\NETw3v32.sys -- (NETw3v32) Intel(R)

DRV - [2006.09.28 22:41:46 | 000,247,808 | ---- | M] (Ralink Technology Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\netr73.sys -- (netr73)

DRV - [2006.07.03 10:31:26 | 000,009,088 | ---- | M] (Windows (R) 2000 DDK provider) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\MGHwCtrl.sys -- (MGHwCtrl)

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.lge.com

 

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.lge.com

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1

IE - HKCU\..\URLSearchHook:  - Reg Error: Key error. File not found

IE - HKCU\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} -  File not found

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

 
 ========== FireFox ==========

 

FF - prefs.js..browser.search.defaultenginename: "ICQ Search"

FF - prefs.js..browser.search.param.yahoo-fr: "chr-greentree_ff&type=971163"

FF - prefs.js..browser.search.selectedEngine: "Google"

FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de/"

FF - prefs.js..extensions.enabledItems: {800b5000-a755-47e1-992b-48a1c1357f07}:1.1.5

FF - prefs.js..extensions.enabledItems: moveplayer@movenetworks.com:1.0.0.071303000004

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20

FF - prefs.js..extensions.enabledItems: {AB2CE124-6272-4b12-94A9-7303C7397BD1}:4.2.0.5198

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23

FF - prefs.js..extensions.enabledItems: {1E73965B-8B48-48be-9C8D-68B920ABC1C4}:10.0.0.1374

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA}:6.0.25

FF - prefs.js..keyword.URL: "hxxp://search.icq.com/search/afe_results.php?ch_id=afex&q="

 

FF - HKLM\software\mozilla\Firefox\Extensions\\{1E73965B-8B48-48be-9C8D-68B920ABC1C4}: C:\Program Files\AVG\AVG10\Firefox4\ [2011.05.11 16:10:55 | 000,000,000 | ---D | M]

FF - HKLM\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011.05.27 13:59:27 | 000,000,000 | ---D | M]

FF - HKLM\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011.05.27 13:59:24 | 000,000,000 | ---D | M]

 

[2009.01.07 21:47:11 | 000,000,000 | ---D | M] (No name found) -- C:\Users\***\AppData\Roaming\mozilla\Extensions

[2011.05.27 21:06:02 | 000,000,000 | ---D | M] (No name found) -- C:\Users\***\AppData\Roaming\mozilla\Firefox\Profiles\qbp86wnc.default\extensions

[2010.06.20 17:25:07 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\***\AppData\Roaming\mozilla\Firefox\Profiles\qbp86wnc.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}

[2011.05.27 21:05:57 | 000,000,000 | ---D | M] (softonic-de3 Community Toolbar) -- C:\Users\***\AppData\Roaming\mozilla\Firefox\Profiles\qbp86wnc.default\extensions\{cc05a3e3-64c3-4af2-bfc1-af0d66b69065}

[2011.05.27 21:05:53 | 000,000,000 | ---D | M] (Conduit Engine) -- C:\Users\***\AppData\Roaming\mozilla\Firefox\Profiles\qbp86wnc.default\extensions\engine@conduit.com

[2009.11.25 22:05:31 | 000,000,000 | ---D | M] (Move Media Player) -- C:\Users\***\AppData\Roaming\mozilla\Firefox\Profiles\qbp86wnc.default\extensions\moveplayer@movenetworks.com

[2011.05.26 18:21:47 | 000,000,950 | ---- | M] () -- C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\qbp86wnc.default\searchplugins\icqplugin-1.xml

[2011.02.16 22:00:07 | 000,000,950 | ---- | M] () -- C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\qbp86wnc.default\searchplugins\icqplugin-10.xml

[2009.08.11 15:32:54 | 000,000,950 | ---- | M] () -- C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\qbp86wnc.default\searchplugins\icqplugin-2.xml

[2009.08.12 15:16:19 | 000,000,950 | ---- | M] () -- C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\qbp86wnc.default\searchplugins\icqplugin-3.xml

[2009.09.13 22:49:10 | 000,000,950 | ---- | M] () -- C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\qbp86wnc.default\searchplugins\icqplugin-4.xml

[2009.10.31 00:08:22 | 000,000,950 | ---- | M] () -- C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\qbp86wnc.default\searchplugins\icqplugin-5.xml

[2009.12.21 09:56:12 | 000,000,950 | ---- | M] () -- C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\qbp86wnc.default\searchplugins\icqplugin-6.xml

[2010.01.13 19:28:55 | 000,000,950 | ---- | M] () -- C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\qbp86wnc.default\searchplugins\icqplugin-7.xml

[2010.02.20 17:35:43 | 000,000,950 | ---- | M] () -- C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\qbp86wnc.default\searchplugins\icqplugin-8.xml

[2010.03.31 07:06:42 | 000,000,950 | ---- | M] () -- C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\qbp86wnc.default\searchplugins\icqplugin-9.xml

[2009.07.25 14:22:11 | 000,000,944 | ---- | M] () -- C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\qbp86wnc.default\searchplugins\icqplugin.xml

[2011.05.27 13:59:27 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions

[2009.07.15 20:49:18 | 000,000,000 | ---D | M] ("ICQ Toolbar") -- C:\Programme\Mozilla Firefox\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}

[2010.07.18 22:50:17 | 000,000,000 | ---D | M] (Skype extension for Firefox) -- C:\Programme\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}

[2010.06.19 17:44:38 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}

[2010.12.04 00:21:55 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}

[2011.01.27 00:03:58 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}

[2011.05.11 16:58:36 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA}

File not found (No name found) -- 

[2011.05.11 16:10:55 | 000,000,000 | ---D | M] (AVG Safe Search) -- C:\PROGRAM FILES\AVG\AVG10\FIREFOX4

[2009.07.25 16:39:27 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}

[2009.09.01 23:12:01 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}

[2010.04.11 13:06:05 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA}

[2010.06.19 17:44:38 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}

[2010.12.04 00:21:55 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}

[2011.01.27 00:03:58 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}

[2011.05.11 16:58:36 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA}

[2011.04.14 18:40:03 | 000,142,296 | ---- | M] (Mozilla Foundation) -- C:\Programme\Mozilla Firefox\components\browsercomps.dll

[2011.04.14 05:08:00 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\Mozilla Firefox\plugins\npdeployJava1.dll

[2010.03.08 12:24:04 | 000,103,168 | ---- | M] (Midasplayer Ltd) -- C:\Programme\Mozilla Firefox\plugins\npmidas.dll

[2010.01.01 10:00:00 | 000,001,392 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\amazondotcom-de.xml

[2010.01.01 10:00:00 | 000,002,252 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\bing.xml

[2010.01.01 10:00:00 | 000,001,153 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml

[2010.01.01 10:00:00 | 000,006,805 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\leo_ende_de.xml

[2010.01.01 10:00:00 | 000,001,178 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\wikipedia-de.xml

[2010.01.01 10:00:00 | 000,001,105 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml

 

O1 HOSTS File: ([2006.09.18 23:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts

O1 - Hosts: 127.0.0.1       localhost

O1 - Hosts: ::1             localhost

O2 - BHO: (Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)

O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Programme\AVG\AVG10\avgssie.dll (AVG Technologies CZ, s.r.o.)

O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)

O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programme\Google\GoogleToolbarNotifier\5.6.5805.1910\swg.dll (Google Inc.)

O3 - HKLM\..\Toolbar: (ICQToolBar) - {855F3B16-6D32-4fe6-8A56-BBB695989046} -  File not found

O3 - HKLM\..\Toolbar: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No CLSID value found.

O3 - HKCU\..\Toolbar\WebBrowser: (ICQToolBar) - {855F3B16-6D32-4FE6-8A56-BBB695989046} -  File not found

O4 - HKLM..\Run: [AVG_TRAY] C:\Programme\AVG\AVG10\avgtray.exe (AVG Technologies CZ, s.r.o.)

O4 - HKLM..\Run: [LG Intelligent Update] C:\Program Files\lg_swupdate\giljabistart.exe (BIT LEADER)

O4 - HKLM..\Run: [LogitechCommunicationsManager] C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe ()

O4 - HKLM..\Run: [LogitechQuickCamRibbon] C:\Program Files\Logitech\QuickCam\Quickcam.exe ()

O4 - HKLM..\Run: [Malwarebytes' Anti-Malware (reboot)] C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)

O4 - HKLM..\Run: [MGSysCtrl] C:\Programme\LG Software\System Control Manager\MGSysCtrl.exe (MSI)

O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)

O4 - HKLM..\Run: [WinampAgent]  File not found

O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)

O4 - HKCU..\Run: [SpybotSD TeaTimer] C:\Programme\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)

O4 - HKCU..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)

O4 - Startup: C:\Users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 2.3.lnk = C:\Programme\OpenOffice.org 2.3\program\quickstart.exe ()

O8 - Extra context menu item: Google Sidewiki... - C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_950DF09FAB501E03.dll (Google Inc.)

O9 - Extra 'Tools' menuitem : Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)

O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)

O13 - gopher Prefix: missing

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab (Java Plug-in 1.6.0_25)

O16 - DPF: {CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab (Java Plug-in 1.6.0_25)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab (Java Plug-in 1.6.0_25)

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)

O18 - Protocol\Handler\bwfile-8876480 {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll (Logitech Inc.)

O18 - Protocol\Handler\fluxhttp {8E2D00A0-82C6-4821-90BC-07F290841BB6} - C:\Programme\Common Files\fluxDVD\Lib\XEB\xebnavigation.ax ()

O18 - Protocol\Handler\fluxhttp\0x00000007 {8E2D00A0-82C6-4821-90BC-07F290841BB6} - C:\Programme\Common Files\fluxDVD\Lib\XEB\xebnavigation.ax ()

O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Programme\AVG\AVG10\avgpp.dll (AVG Technologies CZ, s.r.o.)

O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Common Files\Skype\Skype4COM.dll (Skype Technologies)

O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)

O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\img34.jpg

O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\img34.jpg

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]

O34 - HKLM BootExecute: (autocheck autochk *) -  File not found

O34 - HKLM BootExecute: (C:\PROGRA~1\AVG\AVG10\avgchsvx.exe /sync) - C:\Programme\AVG\AVG10\avgchsvx.exe (AVG Technologies CZ, s.r.o.)

O34 - HKLM BootExecute: (C:\PROGRA~1\AVG\AVG10\avgrsx.exe /sync /restart) - C:\Programme\AVG\AVG10\avgrsx.exe (AVG Technologies CZ, s.r.o.)

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

 

ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)

ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - 

ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 11.0

ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework

ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll

ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack

ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework

ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE

ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - 

ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx

ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help

ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6

ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools

ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements

ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player

ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access

ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7

ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll

ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\system32\ie4uinit.exe -BaseSettings

ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install

ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding

ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts

ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1

ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player

ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help

ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface

ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\Windows\system32\unregmp2.exe /ShowWMP

ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\system32\ie4uinit.exe -UserIconConfig

ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP

 

NetSvcs: FastUserSwitchingCompatibility -  File not found

NetSvcs: Ias -  File not found

NetSvcs: Nla -  File not found

NetSvcs: Ntmssvc -  File not found

NetSvcs: NWCWorkstation -  File not found

NetSvcs: Nwsapagent -  File not found

NetSvcs: SRService -  File not found

NetSvcs: WmdmPmSp -  File not found

NetSvcs: LogonHours -  File not found

NetSvcs: PCAudit -  File not found

NetSvcs: helpsvc -  File not found

NetSvcs: uploadmgr -  File not found

 

 

CREATERESTOREPOINT

Restore point Set: OTL Restore Point

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2011.05.28 14:17:18 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner

[2011.05.28 14:17:13 | 000,000,000 | ---D | C] -- C:\Programme\CCleaner

[2011.05.28 01:49:36 | 000,000,000 | ---D | C] -- C:\Windows\System32\eu-ES

[2011.05.28 01:49:36 | 000,000,000 | ---D | C] -- C:\Windows\System32\ca-ES

[2011.05.28 01:49:35 | 000,000,000 | ---D | C] -- C:\Windows\System32\vi-VN

[2011.05.27 23:54:03 | 000,000,000 | ---D | C] -- C:\Windows\System32\EventProviders

[2011.05.27 21:43:44 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\Malwarebytes

[2011.05.27 21:43:20 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys

[2011.05.27 21:43:20 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware

[2011.05.27 21:43:19 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes

[2011.05.27 21:43:13 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys

[2011.05.27 21:43:13 | 000,000,000 | ---D | C] -- C:\Programme\Malwarebytes' Anti-Malware

[2011.05.27 14:05:15 | 000,000,000 | -HSD | C] -- C:\Config.Msi

[2011.05.11 17:03:53 | 000,000,000 | ---D | C] -- C:\Programme\Common Files\Java

[2011.05.02 14:09:32 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\AVG10

[2011.05.02 14:04:23 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG 2011

[2011.05.02 14:00:19 | 000,000,000 | ---D | C] -- C:\Windows\System32\drivers\AVG

[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

 
 ========== Files - Modified Within 30 Days ==========

 

[2011.05.28 15:06:39 | 116,341,506 | ---- | M] () -- C:\Windows\System32\drivers\AVG\incavi.avm

[2011.05.28 14:59:11 | 000,003,168 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0

[2011.05.28 14:59:11 | 000,003,168 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0

[2011.05.28 14:21:08 | 000,001,098 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job

[2011.05.28 14:17:18 | 000,000,804 | ---- | M] () -- C:\Users\Public\Desktop\CCleaner.lnk

[2011.05.28 11:07:09 | 000,595,996 | ---- | M] () -- C:\Windows\System32\perfh009.dat

[2011.05.28 11:07:08 | 000,628,742 | ---- | M] () -- C:\Windows\System32\perfh007.dat

[2011.05.28 11:07:08 | 000,126,260 | ---- | M] () -- C:\Windows\System32\perfc007.dat

[2011.05.28 11:07:08 | 000,104,070 | ---- | M] () -- C:\Windows\System32\perfc009.dat

[2011.05.28 10:59:48 | 000,001,094 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job

[2011.05.28 10:59:20 | 000,016,384 | ---- | M] () -- C:\Windows\System32\Ikeext.etl

[2011.05.28 10:59:03 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat

[2011.05.28 10:58:27 | 1064,689,664 | -HS- | M] () -- C:\hiberfil.sys

[2011.05.28 01:56:59 | 000,308,360 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT

[2011.05.27 21:43:24 | 000,000,906 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk

[2011.05.27 13:59:37 | 000,000,846 | ---- | M] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk

[2011.05.26 19:36:59 | 000,044,544 | ---- | M] () -- C:\Users\***\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2011.05.11 17:14:48 | 000,030,720 | ---- | M] () -- C:\Windows\System32\npmpsoxy.dll

[2011.05.11 16:13:54 | 000,000,846 | ---- | M] () -- C:\Users\Public\Desktop\AVG 2011.lnk

[2011.05.02 19:04:32 | 000,119,374 | ---- | M] () -- C:\Users\***\Documents\Email Fuerte Ventura.pdf

[2011.05.02 18:29:46 | 000,175,403 | ---- | M] () -- C:\Users\***\Documents\Ryanair-Fuerte Ventura.pdf

[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

 
 ========== Files Created - No Company Name ==========

 

[2011.05.28 15:06:39 | 116,341,506 | ---- | C] () -- C:\Windows\System32\drivers\AVG\incavi.avm

[2011.05.28 14:17:18 | 000,000,804 | ---- | C] () -- C:\Users\Public\Desktop\CCleaner.lnk

[2011.05.27 21:43:24 | 000,000,906 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk

[2011.05.27 13:59:36 | 000,000,858 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk

[2011.05.11 17:14:48 | 000,030,720 | ---- | C] () -- C:\Windows\System32\npmpsoxy.dll

[2011.05.02 19:04:28 | 000,119,374 | ---- | C] () -- C:\Users\***\Documents\Email Fuerte Ventura.pdf

[2011.05.02 18:29:39 | 000,175,403 | ---- | C] () -- C:\Users\***\Documents\Ryanair-Fuerte Ventura.pdf

[2011.05.02 14:04:29 | 000,000,846 | ---- | C] () -- C:\Users\Public\Desktop\AVG 2011.lnk

[2011.01.02 14:50:36 | 000,032,608 | ---- | C] () -- C:\Windows\king-uninstall.exe

[2010.12.07 23:13:01 | 000,018,904 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin

[2010.12.05 18:57:17 | 000,107,612 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin

[2010.12.05 18:57:16 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll

[2010.06.13 23:17:37 | 000,005,000 | ---- | C] () -- C:\Users\***\AppData\Local\d3d9caps.dat

[2010.03.06 04:16:53 | 000,007,168 | ---- | C] () -- C:\Windows\System32\drivers\StarOpen.sys

[2010.03.05 20:41:48 | 000,000,034 | ---- | C] () -- C:\Windows\cdplayer.ini

[2009.09.01 00:06:57 | 000,116,224 | ---- | C] () -- C:\Windows\System32\pdfcmnnt.dll

[2009.07.29 20:31:39 | 000,066,482 | ---- | C] () -- C:\Windows\System32\lvcoinst.ini

[2009.07.15 20:13:03 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat

[2008.05.08 18:05:10 | 000,000,890 | ---- | C] () -- C:\Windows\ccinst.ini

[2008.04.27 19:52:56 | 000,044,544 | ---- | C] () -- C:\Users\***\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2008.02.05 18:20:08 | 000,025,624 | ---- | C] () -- C:\Windows\System32\drivers\LVPr2Mon.sys

[2007.10.19 21:23:50 | 000,098,304 | ---- | C] () -- C:\Windows\System32\MGHwCtrl.dll

[2007.10.19 21:23:50 | 000,032,768 | ---- | C] () -- C:\Windows\System32\MGFPCtrl.dll

[2007.10.19 21:23:50 | 000,024,576 | ---- | C] () -- C:\Windows\System32\MGPwrShm.dll

[2007.07.03 04:52:13 | 000,009,589 | ---- | C] () -- C:\Windows\lg_up.ini

[2007.07.03 04:40:03 | 000,000,896 | ---- | C] () -- C:\Windows\lgcenter.ini

[2007.07.02 11:30:53 | 001,060,424 | ---- | C] () -- C:\Windows\System32\WdfCoInstaller01000.dll

[2007.07.02 11:30:45 | 000,204,800 | ---- | C] () -- C:\Windows\System32\igfxCoIn_v1187.dll

[2007.07.02 11:23:59 | 000,000,181 | ---- | C] () -- C:\Windows\lgps.ini

[2006.11.02 17:33:31 | 000,628,742 | ---- | C] () -- C:\Windows\System32\perfh007.dat

[2006.11.02 17:33:31 | 000,290,748 | ---- | C] () -- C:\Windows\System32\perfi007.dat

[2006.11.02 17:33:31 | 000,126,260 | ---- | C] () -- C:\Windows\System32\perfc007.dat

[2006.11.02 17:33:31 | 000,036,916 | ---- | C] () -- C:\Windows\System32\perfd007.dat

[2006.11.02 14:57:28 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat

[2006.11.02 14:47:37 | 000,308,360 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT

[2006.11.02 14:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll

[2006.11.02 12:33:01 | 000,595,996 | ---- | C] () -- C:\Windows\System32\perfh009.dat

[2006.11.02 12:33:01 | 000,287,440 | ---- | C] () -- C:\Windows\System32\perfi009.dat

[2006.11.02 12:33:01 | 000,104,070 | ---- | C] () -- C:\Windows\System32\perfc009.dat

[2006.11.02 12:33:01 | 000,030,674 | ---- | C] () -- C:\Windows\System32\perfd009.dat

[2006.11.02 12:25:21 | 000,180,224 | ---- | C] () -- C:\Windows\System32\igfxTMM.dll

[2006.11.02 12:23:21 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat

[2006.11.02 10:58:30 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin

[2006.11.02 10:19:00 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT

[2006.11.02 09:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini

[2006.11.02 09:25:31 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat

[2005.01.21 12:02:28 | 000,013,312 | ---- | C] () -- C:\Windows\System32\RMDevice.dll

[2004.08.19 18:47:32 | 000,098,304 | ---- | C] () -- C:\Windows\System32\lxbuinsr.dll

[2004.08.19 18:47:24 | 000,032,768 | ---- | C] () -- C:\Windows\System32\lxbucur.dll

[2004.08.19 18:46:54 | 000,131,072 | ---- | C] () -- C:\Windows\System32\lxbujswr.dll

[2003.07.11 15:55:28 | 000,040,960 | ---- | C] () -- C:\Windows\System32\lxbuvs.dll

 
 ========== LOP Check ==========

 

[2009.08.21 23:20:52 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Amazon

[2011.05.02 14:09:32 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\AVG10

[2010.03.06 04:17:31 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Canneverbe Limited

[2010.06.19 13:11:00 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Facebook

[2008.05.12 13:50:22 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\ICQ Toolbar

[2009.07.29 20:32:09 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Leadertech

[2010.05.02 15:57:12 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\uTorrent

[2011.05.28 03:47:12 | 000,032,514 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

 
 ========== Purity Check ==========

 

 

 
 ========== Custom Scans ==========

 

 
 < %SYSTEMDRIVE%\*. >

[2011.02.16 00:27:50 | 000,000,000 | -H-D | M] -- C:\$AVG

[2008.02.15 18:25:05 | 000,000,000 | -HSD | M] -- C:\$Recycle.Bin

[2011.05.28 02:03:45 | 000,000,000 | -HSD | M] -- C:\Boot

[2011.05.27 23:43:06 | 000,000,000 | -HSD | M] -- C:\Config.Msi

[2008.05.16 00:41:57 | 000,000,000 | ---D | M] -- C:\ContentComposer

[2006.11.02 15:02:03 | 000,000,000 | -HSD | M] -- C:\Documents and Settings

[2008.02.15 18:23:46 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen

[2010.08.15 17:00:31 | 000,000,000 | ---D | M] -- C:\drivers

[2007.10.19 21:17:22 | 000,000,000 | ---D | M] -- C:\Intel

[2009.08.16 10:37:16 | 000,000,000 | ---D | M] -- C:\My documents

[2010.12.04 18:07:24 | 000,000,000 | ---D | M] -- C:\PerfLogs

[2011.05.28 14:17:13 | 000,000,000 | R--D | M] -- C:\Programme

[2011.05.27 21:43:19 | 000,000,000 | -H-D | M] -- C:\ProgramData

[2008.02.15 18:23:46 | 000,000,000 | -HSD | M] -- C:\Programme

[2011.05.28 15:13:02 | 000,000,000 | -HSD | M] -- C:\System Volume Information

[2009.06.29 20:16:18 | 000,000,000 | ---D | M] -- C:\Temp

[2008.02.15 18:24:41 | 000,000,000 | R--D | M] -- C:\Users

[2011.05.28 14:28:03 | 000,000,000 | ---D | M] -- C:\Windows

 
 < %PROGRAMFILES%\*.exe >

 
 < %LOCALAPPDATA%\*.exe >

 
 < %systemroot%\*. /mp /s >

 

 
 < MD5 for: EXPLORER.EXE  >

[2008.10.29 08:20:29 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=37440D09DEAE0B672A04DCCF7ABF06BE -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16771_none_4f83bb287ccdb7e3\explorer.exe

[2008.10.29 08:29:41 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=4F554999D7D5F05DAAEBBA7B5BA1089D -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18164_none_5177ca9879e978e8\explorer.exe

[2008.10.30 05:59:17 | 002,927,616 | ---- | M] (Microsoft Corporation) MD5=50BA5850147410CDE89C523AD3BC606E -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.22298_none_51e4f8c7931bd1e1\explorer.exe

[2008.03.08 12:17:36 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=6D06CD98D954FE87FB2DB8108793B399 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16549_none_4fac29707cae347a\explorer.exe

[2008.03.08 12:17:35 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=BD06F0BF753BC704B653C3A50F89D362 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.20668_none_501f261995dcf2cf\explorer.exe

[2009.04.11 08:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 -- C:\Windows\explorer.exe

[2009.04.11 08:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6002.18005_none_53a0201e76de3a0b\explorer.exe

[2008.10.28 04:15:02 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=E7156B0B74762D9DE0E66BDCDE06E5FB -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.20947_none_5033cb5995cd990b\explorer.exe

[2006.11.02 11:45:07 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=FD8C53FB002217F6F888BCF6F5D7084D -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16386_none_4f7de5167cd15deb\explorer.exe

[2008.01.19 09:33:10 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=FFA764631CB70A30065C12EF8E174F9F -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18000_none_51b4a71279bc6ebf\explorer.exe

 
 < MD5 for: REGEDIT.EXE  >

[2008.01.19 09:33:24 | 000,134,656 | ---- | M] (Microsoft Corporation) MD5=467A3B03E924B7B7EDD16D34740574B0 -- C:\Windows\regedit.exe

[2008.01.19 09:33:24 | 000,134,656 | ---- | M] (Microsoft Corporation) MD5=467A3B03E924B7B7EDD16D34740574B0 -- C:\Windows\winsxs\x86_microsoft-windows-registry-editor_31bf3856ad364e35_6.0.6001.18000_none_f42eb564dbd8a697\regedit.exe

[2006.11.02 11:45:35 | 000,134,656 | ---- | M] (Microsoft Corporation) MD5=F13123E76FDA33E55F11E0EB832E832A -- C:\Windows\winsxs\x86_microsoft-windows-registry-editor_31bf3856ad364e35_6.0.6000.16386_none_f1f7f368deed95c3\regedit.exe

 
 < MD5 for: USERINIT.EXE  >

[2008.01.19 09:33:33 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\System32\userinit.exe

[2008.01.19 09:33:33 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6001.18000_none_dc28ba15d1aff80b\userinit.exe

[2006.11.02 11:45:50 | 000,024,576 | ---- | M] (Microsoft Corporation) MD5=22027835939F86C3E47AD8E3FBDE3D11 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6000.16386_none_d9f1f819d4c4e737\userinit.exe

 
 < MD5 for: WININIT.EXE  >

[2008.01.19 09:33:37 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=101BA3EA053480BB5D957EF37C06B5ED -- C:\Windows\System32\wininit.exe

[2008.01.19 09:33:37 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=101BA3EA053480BB5D957EF37C06B5ED -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.0.6001.18000_none_30f2b8cf0450a6a2\wininit.exe

[2006.11.02 11:45:57 | 000,095,744 | ---- | M] (Microsoft Corporation) MD5=D4385B03E8CCCEE6F0EE249F827C1F3E -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.0.6000.16386_none_2ebbf6d3076595ce\wininit.exe

 
 < MD5 for: WINLOGON.EXE  >

[2009.04.11 08:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\System32\winlogon.exe

[2009.04.11 08:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6002.18005_none_71ae7a22d2134741\winlogon.exe

[2006.11.02 11:45:57 | 000,308,224 | ---- | M] (Microsoft Corporation) MD5=9F75392B9128A91ABAFB044EA350BAAD -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6000.16386_none_6d8c3f1ad8066b21\winlogon.exe

[2008.01.19 09:33:37 | 000,314,880 | ---- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6001.18000_none_6fc30116d4f17bf5\winlogon.exe

 
 < HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

 
 < HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2011-05-27 23:32:16
 

< End of report >

--- --- ---

Extras.TxT:

OTL Logfile:

Code:

OTL Extras logfile created on: 28.05.2011 15:08:58 - Run 1

OTL by OldTimer - Version 3.2.23.0     Folder = C:\Users\***\Downloads

Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation

Internet Explorer (Version = 8.0.6001.19048)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

1014,64 Mb Total Physical Memory | 202,95 Mb Available Physical Memory | 20,00% Memory free

2,24 Gb Paging File | 1,05 Gb Available in Paging File | 46,92% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files

Drive C: | 148,04 Gb Total Space | 101,66 Gb Free Space | 68,67% Space Free | Partition Type: NTFS

 

Computer Name: DANI-NOTEBOOK | User Name: Dani | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user | Quick Scan

Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Extra Registry (SafeList) ==========

 

 
 ========== File Associations ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)

.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)

 

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]

.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

 
 ========== Shell Spawning ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]

batfile [open] -- "%1" %*

cmdfile [open] -- "%1" %*

comfile [open] -- "%1" %*

cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)

exefile [open] -- "%1" %*

helpfile [open] -- Reg Error: Key error.

hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)

htmlfile [edit] -- Reg Error: Key error.

htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"

inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)

piffile [open] -- "%1" %*

regfile [merge] -- Reg Error: Key error.

scrfile [config] -- "%1"

scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l

scrfile [open] -- "%1" /S

txtfile [edit] -- Reg Error: Key error.

Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1

Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)

Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)

Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)

Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

 
 ========== Security Center Settings ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

"cval" = 1

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

"AntiVirusOverride" = 1

"AntiSpywareOverride" = 0

"FirewallOverride" = 0

"VistaSp1" = Reg Error: Unknown registry data type -- File not found

"VistaSp2" = Reg Error: Unknown registry data type -- File not found

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

 
 ========== System Restore Settings ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore]

 
 ========== Firewall Settings ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

"DisableNotifications" = 0

"EnableFirewall" = 1

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

"DisableNotifications" = 0

"EnableFirewall" = 1

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]

"DisableNotifications" = 0

"EnableFirewall" = 1

 
 ========== Authorized Applications List ==========

 

 
 ========== Vista Active Open Ports Exception List ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

 
 ========== Vista Active Application Exception List ==========

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

"{18F4C66F-1BAF-47CE-B437-5DE4064AAEA7}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 

"{228AF9AF-B893-48F0-9144-B411BB07C653}" = protocol=6 | dir=in | app=c:\program files\logitech\desktop messenger\8876480\program\logitechdesktopmessenger.exe | 

"{363A099D-37E1-43EA-895A-969A8C705297}" = protocol=17 | dir=in | app=c:\program files\logitech\desktop messenger\8876480\program\logitechdesktopmessenger.exe | 

"{3906340B-B1F2-446A-9D24-099B6B92E7C1}" = protocol=17 | dir=in | app=c:\program files\avg\avg10\avgdiagex.exe | 

"{57AB2FF6-A9F2-4F06-A206-716B9FA99E31}" = protocol=6 | dir=in | app=c:\program files\avg\avg10\avgdiagex.exe | 

"{5D4C0393-696D-48C4-BD94-C15B5EA07304}" = protocol=6 | dir=in | app=c:\program files\avg\avg10\avgnsx.exe | 

"{61281235-C1ED-4B2B-ADAB-2876214A34CB}" = protocol=6 | dir=in | app=c:\program files\avg\avg10\avgmfapx.exe | 

"{78EF0061-0B61-4C29-B3D3-202253D14623}" = protocol=6 | dir=in | app=c:\program files\avg\avg10\avgemcx.exe | 

"{805A3E77-9F9C-46BE-BE29-A03BA2C76704}" = protocol=6 | dir=in | app=c:\program files\itunes\itunes.exe | 

"{976B86E0-7F8C-4897-86C7-5628ED24DFD9}" = protocol=17 | dir=in | app=c:\program files\avg\avg10\avgnsx.exe | 

"{978AEB42-6F95-41D1-90BC-9D31693E554C}" = protocol=17 | dir=in | app=c:\program files\avg\avg10\avgemcx.exe | 

"{9E88F43C-352F-4813-B19F-2048C27C7665}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 

"{A1EC9F9A-0619-426C-B9C5-DC67E31C0F98}" = protocol=17 | dir=in | app=c:\program files\logitech\desktop messenger\8876480\program\logitechdesktopmessenger.exe | 

"{AB0E9769-9FA4-4033-9847-61BC219F6002}" = protocol=6 | dir=in | app=c:\program files\logitech\desktop messenger\8876480\program\logitechdesktopmessenger.exe | 

"{AB56AB07-5214-4AF4-BF5E-D044DDE9BB31}" = protocol=17 | dir=in | app=c:\program files\avg\avg10\avgmfapx.exe | 

"{C244C80F-49C6-4628-95F3-FD1D8FC9FA89}" = protocol=17 | dir=in | app=c:\program files\logitech\desktop messenger\8876480\program\logitechdesktopmessenger.exe | 

"{CF60E9D7-3BBE-4329-8207-D5874B366EC1}" = dir=in | app=c:\program files\skype\phone\skype.exe | 

"{D2E2D3E9-2291-4138-9F56-C0B7A5A72FAF}" = protocol=6 | dir=in | app=c:\program files\logitech\desktop messenger\8876480\program\logitechdesktopmessenger.exe | 

"{E4C0AD93-BD10-487D-97FB-AD36A6D5DC7D}" = protocol=17 | dir=in | app=c:\program files\itunes\itunes.exe | 

"TCP Query User{78E2D04B-E7BD-48B3-898C-2DE8224DFC2A}C:\program files\soulseekns\slsk.exe" = protocol=6 | dir=in | app=c:\program files\soulseekns\slsk.exe | 

"TCP Query User{965C2BA2-A6D1-4D17-B94D-5F9D4941CB14}C:\program files\mozilla firefox\firefox.exe" = protocol=6 | dir=in | app=c:\program files\mozilla firefox\firefox.exe | 

"TCP Query User{C4E48F61-184B-46AB-B753-93DF302E65F9}C:\program files\ea games\mohaa\mohaa.exe" = protocol=6 | dir=in | app=c:\program files\ea games\mohaa\mohaa.exe | 

"TCP Query User{C8C0E0A0-A2FE-40E8-8112-E93ACDE3E6CB}C:\program files\icq6.5\icq.exe" = protocol=6 | dir=in | app=c:\program files\icq6.5\icq.exe | 

"TCP Query User{CF1B17F2-42E9-4017-AE8F-37765E853161}C:\users\***\desktop\utorrent_2.0.exe" = protocol=6 | dir=in | app=c:\users\***\desktop\utorrent_2.0.exe | 

"TCP Query User{D5ACD48A-253A-4131-8D14-82D40F4BCA94}C:\program files\internet explorer\iexplore.exe" = protocol=6 | dir=in | app=c:\program files\internet explorer\iexplore.exe | 

"TCP Query User{DC322422-4704-4650-B8A3-8B14651D00CC}C:\program files\icq6\icq.exe" = protocol=6 | dir=in | app=c:\program files\icq6\icq.exe | 

"UDP Query User{23D7AE1C-F02A-44D1-950D-E502A476E9BB}C:\users\***\desktop\utorrent_2.0.exe" = protocol=17 | dir=in | app=c:\users\***\desktop\utorrent_2.0.exe | 

"UDP Query User{40021DA0-BA4E-4C63-B5A4-A06FB7C35219}C:\program files\icq6.5\icq.exe" = protocol=17 | dir=in | app=c:\program files\icq6.5\icq.exe | 

"UDP Query User{6B65D546-41B4-42BD-917B-A929D860D040}C:\program files\internet explorer\iexplore.exe" = protocol=17 | dir=in | app=c:\program files\internet explorer\iexplore.exe | 

"UDP Query User{A17C1EFC-6759-41B3-A617-0BF4E7885C92}C:\program files\icq6\icq.exe" = protocol=17 | dir=in | app=c:\program files\icq6\icq.exe | 

"UDP Query User{A9FB1B05-D1D7-4E41-BBA7-15D974C5944E}C:\program files\soulseekns\slsk.exe" = protocol=17 | dir=in | app=c:\program files\soulseekns\slsk.exe | 

"UDP Query User{C4AAB6BC-29F0-479C-92FB-2E951C2884BA}C:\program files\ea games\mohaa\mohaa.exe" = protocol=17 | dir=in | app=c:\program files\ea games\mohaa\mohaa.exe | 

"UDP Query User{D66576F5-BFFF-4864-B17F-57F0D38BCB94}C:\program files\mozilla firefox\firefox.exe" = protocol=17 | dir=in | app=c:\program files\mozilla firefox\firefox.exe | 

 
 ========== HKEY_LOCAL_MACHINE Uninstall List ==========

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}" = PDFCreator

"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu

"{07287123-B8AC-41CE-8346-3D777245C35B}" = Bonjour

"{0DEA94ED-915A-4834-A87E-388D012C8E02}" = Medal of Honor Allied Assault

"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer

"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148

"{230E8DDC-FB78-4F9F-8461-22ED20DBC3BA}" = AVG 2011

"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer

"{26A24AE4-039D-4CA4-87B4-2F83216019FF}" = Java(TM) 6 Update 25

"{3562A082-CF01-419B-8A02-233E31B8A83C}" = O2Micro Flash Memory Card Windows Driver V3.00

"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile

"{447E63B1-507A-45FF-A6FE-E8A5B960E7FD}" = Druckstudio FotoKalender

"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater

"{53735ECE-E461-4FD0-B742-23A352436D3A}" = Logitech Updater

"{57752979-A1C9-4C02-856B-FBB27AC4E02C}" = QuickTime

"{6444D9D9-CD6C-4464-B970-55C606C944DC}" = Logitech QuickCam

"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update

"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin

"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable

"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053

"{7E265513-8CDA-4631-B696-F40D983F3B07}_is1" = CDBurnerXP

"{81717D01-32F6-449C-85E1-41AFD678E545}" = LG Intelligent Update

"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570

"{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek 8169 PCI, 8168 and 8101E PCIe Ethernet Network Card Driver for Windows Vista

"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight

"{900B1197-53F5-4F46-A882-2CFFFE2EEDCB}" = Logitech Desktop Messenger

"{981029E0-7FC9-4CF3-AB39-6F133621921A}" = Skype Toolbars

"{a0fe116e-9a8a-466f-aee0-625cb7c207e3}" = Microsoft Visual C++ 2005 Redistributable - KB2467175

"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper

"{AADEA55D-C834-4BCB-98A3-4B8D1C18F4EE}" = Apple Mobile Device Support

"{AC76BA86-7AD7-1031-7B44-A81200000003}" = Adobe Reader 8.1.2 - Deutsch

"{AC76BA86-7AD7-2447-0000-800000000003}" = Chinese Simplified Fonts Support For Adobe Reader 8

"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy

"{BABA6734-23CF-42AC-9E4C-EA2C7C80AA4E}" = AVG 2011

"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1

"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.2

"{DA34FE93-5DC5-48E0-ACC8-A5389E05BB51}" = iTunes

"{DD5B65F7-7CA5-4DE4-AEE7-7E8F26BF78F5}" = OpenOffice.org 2.3

"{E38C00D0-A68B-4318-A8A6-F7D4B5B1DF0E}" = Windows Media Encoder 9-Reihe

"{E5809572-2ADC-11D7-81AC-00D009DAF871}" = GrafStat Ausgabe 2006

"{ED9C5D25-55DF-48D8-9328-2AC0D75DE5D8}" = System Control Manager

"{EE6097DD-05F4-4178-9719-D3170BF098E8}" = Apple Application Support

"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver

"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack

"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022

"Adobe Flash Player ActiveX" = Adobe Flash Player ActiveX

"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin

"Agere Systems Soft Modem" = Agere Systems HDA Modem

"Amazon MP3-Downloader" = Amazon MP3-Downloader 1.0.5

"Audacity_is1" = Audacity 1.2.6

"Audiograbber" = Audiograbber 1.83 SE 

"AVG" = AVG 2011

"CCleaner" = CCleaner

"Combined Community Codec Pack_is1" = Combined Community Codec Pack 2009-09-09

"HDMI" = Intel(R) Graphics Media Accelerator Driver

"ICQToolbar" = ICQ Toolbar

"InstallShield_{3562A082-CF01-419B-8A02-233E31B8A83C}" = O2Micro Flash Memory Card Windows Driver V3.00

"InstallShield_{E5809572-2ADC-11D7-81AC-00D009DAF871}" = GrafStat Ausgabe 2006

"king.com" = king.com (remove only)

"LAME for Audacity_is1" = LAME v3.98.2 for Audacity

"lvdrivers_11.70" = Logitech QuickCam-Treiberpaket

"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware

"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU

"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1

"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile

"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack

"Mozilla Firefox 4.0.1 (x86 de)" = Mozilla Firefox 4.0.1 (x86 de)

"Soulseek2" = SoulSeek 157 NS 13e

"SynTPDeinstKey" = Synaptics Pointing Device Driver

"Videoload Manager" = Videoload Manager 2.0.2200

"Windows Media Encoder 9" = Windows Media Encoder 9-Reihe

"WinRAR archiver" = WinRAR

 
 ========== HKEY_CURRENT_USER Uninstall List ==========

 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"Facebook Plug-In" = Facebook Plug-In

 
 ========== Last 10 Event Log Errors ==========

 

[ Application Events ]

Error - 24.04.2011 05:08:25 | Computer Name = ***-Notebook | Source = Windows Search Service | ID = 3013

Description = 

 

Error - 25.04.2011 05:09:04 | Computer Name = ***-Notebook | Source = Windows Search Service | ID = 3013

Description = 

 

Error - 25.04.2011 05:09:04 | Computer Name = ***-Notebook | Source = Windows Search Service | ID = 3013

Description = 

 

Error - 26.04.2011 16:52:01 | Computer Name = ***-Notebook | Source = Microsoft-Windows-CAPI2 | ID = 131083

Description = 

 

Error - 28.04.2011 16:00:07 | Computer Name = ***-Notebook | Source = Windows Search Service | ID = 3013

Description = 

 

Error - 28.04.2011 16:00:17 | Computer Name = ***-Notebook | Source = Windows Search Service | ID = 3013

Description = 

 

Error - 28.04.2011 16:00:17 | Computer Name = ***-Notebook | Source = Windows Search Service | ID = 3013

Description = 

 

Error - 28.04.2011 16:00:17 | Computer Name = ***-Notebook | Source = Windows Search Service | ID = 3013

Description = 

 

Error - 01.05.2011 05:29:42 | Computer Name = ***-Notebook | Source = Application Error | ID = 1000

Description = Fehlerhafte Anwendung RIMBBLaunchAgent.exe, Version 4.2.0.9, Zeitstempel

 0x4d5e9443, fehlerhaftes Modul kernel32.dll, Version 6.0.6001.18215, Zeitstempel

 0x49953395, Ausnahmecode 0xe06d7363, Fehleroffset 0x000442eb,  Prozess-ID 0x884, 

Anwendungsstartzeit 01cc07e23cfd31ee.

 

Error - 02.05.2011 12:22:27 | Computer Name = ***-Notebook | Source = Application Error | ID = 1000

Description = Fehlerhafte Anwendung AcroRd32.exe, Version 8.1.0.137, Zeitstempel

 0x46444e37, fehlerhaftes Modul unknown, Version 0.0.0.0, Zeitstempel 0x00000000,

 Ausnahmecode 0xc0000005, Fehleroffset 0x24003f75,  Prozess-ID 0x2590, Anwendungsstartzeit

 01cc08e4ef4c6c2e.

 

[ System Events ]

Error - 27.05.2011 07:14:11 | Computer Name = ***-Notebook | Source = HTTP | ID = 15016

Description = 

 

Error - 27.05.2011 07:15:10 | Computer Name = ***-Notebook | Source = Service Control Manager | ID = 7000

Description = 

 

Error - 27.05.2011 17:43:24 | Computer Name = ***-Notebook | Source = HTTP | ID = 15021

Description = 

 

Error - 27.05.2011 17:43:24 | Computer Name = ***-Notebook | Source = HTTP | ID = 15016

Description = 

 

Error - 27.05.2011 17:44:09 | Computer Name = ***-Notebook | Source = Service Control Manager | ID = 7000

Description = 

 

Error - 27.05.2011 19:57:29 | Computer Name = ***-Notebook | Source = HTTP | ID = 15021

Description = 

 

Error - 27.05.2011 19:58:14 | Computer Name = ***-Notebook | Source = Service Control Manager | ID = 7000

Description = 

 

Error - 27.05.2011 20:03:58 | Computer Name = ***-Notebook | Source = DCOM | ID = 10010

Description = 

 

Error - 28.05.2011 04:59:13 | Computer Name = ***-Notebook | Source = HTTP | ID = 15021

Description = 

 

Error - 28.05.2011 04:59:26 | Computer Name = ***-Notebook | Source = Service Control Manager | ID = 7000

Description = 

 

 

< End of report >

--- --- ---

[/CODE]

Wär super, wenn ihr mir helfen könntet! :daumenhoc

Lieben Dank vorab!
sporty33

Hallo und :hallo:

Bitte routinemäßig einen Vollscan mit malwarebytes machen und Log posten.
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss!

Falls Logs aus älteren Scans mit Malwarebytes vorhanden sind, bitte auch davon alle posten!

Trojaner WIN32.Katusha.o lässt sich nicht entfernen

Hallo Arne,

vielen Dank für Deine Antwort. Habe den Vollscan mit Malwarebytes durchgeführt, dieser findet jedoch keinen Virus... Gehe aber davon aus, dass der Trojaner noch da ist, denn mit dem Spybot habe ich ihn gestern ja noch gefunden...

Anbei schonmal der Logfile, hoffe, Du kanst mir da weiterhelfen.

Vielen Dank vorab!

sporty33

Code:

Malwarebytes' Anti-Malware 1.50.1.1100

www.malwarebytes.org

 

Datenbank Version: 6711

 

Windows 6.0.6002 Service Pack 2

Internet Explorer 8.0.6001.19048

 

29.05.2011 14:53:28

mbam-log-2011-05-29 (14-53-28).txt

 

Art des Suchlaufs: Vollständiger Suchlauf (C:\|E:\|)

Durchsuchte Objekte: 266483

Laufzeit: 1 Stunde(n), 51 Minute(n), 7 Sekunde(n)

 

Infizierte Speicherprozesse: 0

Infizierte Speichermodule: 0

Infizierte Registrierungsschlüssel: 0

Infizierte Registrierungswerte: 0

Infizierte Dateiobjekte der Registrierung: 0

Infizierte Verzeichnisse: 0

Infizierte Dateien: 0

 

Infizierte Speicherprozesse:

(Keine bösartigen Objekte gefunden)

 

Infizierte Speichermodule:

(Keine bösartigen Objekte gefunden)

 

Infizierte Registrierungsschlüssel:

(Keine bösartigen Objekte gefunden)

 

Infizierte Registrierungswerte:

(Keine bösartigen Objekte gefunden)

 

Infizierte Dateiobjekte der Registrierung:

(Keine bösartigen Objekte gefunden)

 

Infizierte Verzeichnisse:

(Keine bösartigen Objekte gefunden)

 

Infizierte Dateien:

(Keine bösartigen Objekte gefunden)

Sorry, hab vorgestern auch noch einen Logfile über Malwarebytes gemacht. Die Iren habe ich natürlich bereits entfernt... :-)

Anbei:

Code:

Malwarebytes' Anti-Malware 1.50.1.1100

www.malwarebytes.org

 

Datenbank Version: 6694

 

Windows 6.0.6001 Service Pack 1

Internet Explorer 8.0.6001.19048

 

27.05.2011 23:33:41

mbam-log-2011-05-27 (23-33-41).txt

 

Art des Suchlaufs: Vollständiger Suchlauf (C:\|E:\|)

Durchsuchte Objekte: 262054

Laufzeit: 1 Stunde(n), 42 Minute(n), 38 Sekunde(n)

 

Infizierte Speicherprozesse: 0

Infizierte Speichermodule: 0

Infizierte Registrierungsschlüssel: 7

Infizierte Registrierungswerte: 0

Infizierte Dateiobjekte der Registrierung: 0

Infizierte Verzeichnisse: 0

Infizierte Dateien: 2

 

Infizierte Speicherprozesse:

(Keine bösartigen Objekte gefunden)

 

Infizierte Speichermodule:

(Keine bösartigen Objekte gefunden)

 

Infizierte Registrierungsschlüssel:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{055FD26D-3A88-4e15-963D-DC8493744B1D} (Trojan.BHO) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\CLSID\{055FD26D-3A88-4e15-963D-DC8493744B1D} (Trojan.BHO) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\TypeLib\{77D6DDFA-7834-4541-B2B3-A8B0FB0E3924} (Trojan.BHO) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\ToolBand.XTTBPos00.1 (Trojan.BHO) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\ToolBand.XTTBPos00 (Trojan.BHO) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{055FD26D-3A88-4E15-963D-DC8493744B1D} (Trojan.BHO) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{055FD26D-3A88-4E15-963D-DC8493744B1D} (Trojan.BHO) -> Quarantined and deleted successfully.

 

Infizierte Registrierungswerte:

(Keine bösartigen Objekte gefunden)

 

Infizierte Dateiobjekte der Registrierung:

(Keine bösartigen Objekte gefunden)

 

Infizierte Verzeichnisse:

(Keine bösartigen Objekte gefunden)

 

Infizierte Dateien:

c:\Users\Dani\downloads\xvidsetup.exe (Adware.Hotbar) -> Quarantined and deleted successfully.

c:\program files\icqtoolbar\toolbaru.dll (Trojan.BHO) -> Quarantined and deleted successfully.

Dann bitte jetzt CF ausführen. AVG musst du vorher vorübergehend deinstalllieren, da es sich nicht mit CF verträgt.

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix

Lade dir ComboFix hier herunter auf deinen Desktop. Benenne es beim Runterladen um in cofi.exe.

http://saved.im/mtm0nzyzmzd5/cofi.jpg

Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.

Starte cofi.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.

Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.

Wichtiger Hinweis:

Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

So anbei der Logfile von Combofix:

Code:

Combofix Logfile:
 

        Code:


        
ComboFix 11-05-28.01 - *** 29.05.2011  21:08:18.1.2 - x86

Microsoft® Windows Vista™ Home Premium   6.0.6002.2.1252.49.1031.18.1015.245 [GMT 2:00]

ausgeführt von:: c:\users\***\Desktop\cofi.exe

SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

c:\***\***.exe

c:\windows\TEMP\logishrd\LVPrcInj01.dll

.

.

(((((((((((((((((((((((   Dateien erstellt von 2011-04-28 bis 2011-05-29  ))))))))))))))))))))))))))))))

.

.

2011-05-29 19:30 . 2011-05-29 19:30        0        ---ha-w-        c:\users\***\AppData\Local\BITAA37.tmp

2011-05-29 19:24 . 2011-05-29 19:29        --------        d-----w-        c:\users\***\AppData\Local\temp

2011-05-29 19:24 . 2011-05-29 19:24        --------        d-----w-        c:\users\Default\AppData\Local\temp

2011-05-29 19:03 . 2011-05-29 19:03        --------        d-----w-        C:\32788R22FWJFW

2011-05-29 02:08 . 2011-05-29 02:08        --------        d-----w-        c:\program files\Windows Portable Devices

2011-05-29 02:04 . 2009-09-10 02:00        92672        ----a-w-        c:\windows\system32\UIAnimation.dll

2011-05-29 02:04 . 2009-09-10 02:01        3023360        ----a-w-        c:\windows\system32\UIRibbon.dll

2011-05-29 02:04 . 2009-09-10 02:00        1164800        ----a-w-        c:\windows\system32\UIRibbonRes.dll

2011-05-29 02:03 . 2009-09-25 01:33        369664        ----a-w-        c:\windows\system32\WMPhoto.dll

2011-05-29 02:03 . 2009-09-25 02:07        189440        ----a-w-        c:\windows\system32\WindowsCodecsExt.dll

2011-05-29 02:03 . 2009-09-25 02:10        974848        ----a-w-        c:\windows\system32\WindowsCodecs.dll

2011-05-29 02:03 . 2009-09-25 02:04        321024        ----a-w-        c:\windows\system32\PhotoMetadataHandler.dll

2011-05-29 02:03 . 2009-09-25 01:33        195584        ----a-w-        c:\windows\system32\dxdiagn.dll

2011-05-29 02:03 . 2009-09-25 01:32        252928        ----a-w-        c:\windows\system32\dxdiag.exe

2011-05-29 02:03 . 2009-09-25 01:31        519680        ----a-w-        c:\windows\system32\d3d11.dll

2011-05-29 02:00 . 2009-10-08 21:07        4096        ----a-w-        c:\windows\system32\oleaccrc.dll

2011-05-29 02:00 . 2009-10-08 21:08        555520        ----a-w-        c:\windows\system32\UIAutomationCore.dll

2011-05-29 02:00 . 2009-10-08 21:08        234496        ----a-w-        c:\windows\system32\oleacc.dll

2011-05-28 14:55 . 2011-01-20 14:15        979456        ----a-w-        c:\windows\system32\MFH264Dec.dll

2011-05-28 14:55 . 2011-01-20 16:08        478720        ----a-w-        c:\windows\system32\dxgi.dll

2011-05-28 14:55 . 2011-01-20 14:27        876032        ----a-w-        c:\windows\system32\XpsPrint.dll

2011-05-28 14:55 . 2011-01-20 14:24        135680        ----a-w-        c:\windows\system32\XpsRasterService.dll

2011-05-28 14:55 . 2011-01-20 16:37        638336        ----a-w-        c:\windows\system32\drivers\dxgkrnl.sys

2011-05-28 14:55 . 2011-01-20 14:14        357376        ----a-w-        c:\windows\system32\MFHEAACdec.dll

2011-05-28 14:55 . 2011-01-20 14:14        261632        ----a-w-        c:\windows\system32\mfreadwrite.dll

2011-05-28 14:54 . 2011-01-20 14:14        302592        ----a-w-        c:\windows\system32\mfmp4src.dll

2011-05-28 14:54 . 2011-01-20 16:07        37376        ----a-w-        c:\windows\system32\cdd.dll

2011-05-28 14:54 . 2011-01-20 16:06        2873344        ----a-w-        c:\windows\system32\mf.dll

2011-05-28 14:54 . 2011-01-20 16:04        209920        ----a-w-        c:\windows\system32\mfplat.dll

2011-05-28 14:54 . 2011-01-20 14:26        667648        ----a-w-        c:\windows\system32\printfilterpipelinesvc.exe

2011-05-28 14:54 . 2011-01-20 16:07        586240        ----a-w-        c:\windows\system32\stobject.dll

2011-05-28 14:54 . 2011-01-20 16:07        258048        ----a-w-        c:\windows\system32\winspool.drv

2011-05-28 14:54 . 2011-01-20 16:06        26112        ----a-w-        c:\windows\system32\printfilterpipelineprxy.dll

2011-05-28 14:54 . 2011-01-20 16:04        98816        ----a-w-        c:\windows\system32\mfps.dll

2011-05-28 14:53 . 2011-01-20 16:08        160768        ----a-w-        c:\windows\system32\d3d10_1.dll

2011-05-28 14:53 . 2011-01-20 14:12        1172480        ----a-w-        c:\windows\system32\d3d10warp.dll

2011-05-28 14:53 . 2011-01-20 13:47        683008        ----a-w-        c:\windows\system32\d2d1.dll

2011-05-28 14:53 . 2011-02-22 13:33        1068544        ----a-w-        c:\windows\system32\DWrite.dll

2011-05-28 14:53 . 2011-02-22 13:33        797696        ----a-w-        c:\windows\system32\FntCache.dll

2011-05-28 14:53 . 2011-01-20 16:08        1029120        ----a-w-        c:\windows\system32\d3d10.dll

2011-05-28 14:53 . 2011-01-20 16:08        219648        ----a-w-        c:\windows\system32\d3d10_1core.dll

2011-05-28 14:53 . 2011-01-20 16:08        189952        ----a-w-        c:\windows\system32\d3d10core.dll

2011-05-28 14:53 . 2011-01-20 14:28        1554432        ----a-w-        c:\windows\system32\xpsservices.dll

2011-05-28 14:53 . 2011-01-20 14:11        486400        ----a-w-        c:\windows\system32\d3d10level9.dll

2011-05-28 14:53 . 2011-02-22 14:13        288768        ----a-w-        c:\windows\system32\XpsGdiConverter.dll

2011-05-28 14:53 . 2011-01-20 14:25        847360        ----a-w-        c:\windows\system32\OpcServices.dll

2011-05-28 14:37 . 2010-05-04 19:13        231424        ----a-w-        c:\windows\system32\msshsq.dll

2011-05-28 12:17 . 2011-05-28 12:17        --------        d-----w-        c:\program files\CCleaner

2011-05-27 23:49 . 2011-05-27 23:50        --------        d-----w-        c:\windows\system32\ca-ES

2011-05-27 23:49 . 2011-05-27 23:50        --------        d-----w-        c:\windows\system32\eu-ES

2011-05-27 23:49 . 2011-05-27 23:50        --------        d-----w-        c:\windows\system32\vi-VN

2011-05-27 21:54 . 2011-05-27 21:54        --------        d-----w-        c:\windows\system32\EventProviders

2011-05-27 19:43 . 2011-05-27 19:43        --------        d-----w-        c:\users\***\AppData\Roaming\Malwarebytes

2011-05-27 19:43 . 2010-12-20 16:09        38224        ----a-w-        c:\windows\system32\drivers\mbamswissarmy.sys

2011-05-27 19:43 . 2011-05-27 19:43        --------        d-----w-        c:\programdata\Malwarebytes

2011-05-27 19:43 . 2011-05-27 19:43        --------        d-----w-        c:\program files\Malwarebytes' Anti-Malware

2011-05-27 19:43 . 2010-12-20 16:08        20952        ----a-w-        c:\windows\system32\drivers\mbam.sys

2011-05-27 11:59 . 2011-04-14 16:40        142296        ----a-w-        c:\program files\Mozilla Firefox\components\browsercomps.dll

2011-05-27 11:59 . 2011-04-14 16:40        16856        ----a-w-        c:\program files\Mozilla Firefox\plugin-container.exe

2011-05-27 11:59 . 2011-04-14 16:40        89048        ----a-w-        c:\program files\Mozilla Firefox\libEGL.dll

2011-05-27 11:59 . 2011-04-14 16:40        781272        ----a-w-        c:\program files\Mozilla Firefox\mozsqlite3.dll

2011-05-27 11:59 . 2011-04-14 16:40        719832        ----a-w-        c:\program files\Mozilla Firefox\mozcpp19.dll

2011-05-27 11:59 . 2011-04-14 16:40        465880        ----a-w-        c:\program files\Mozilla Firefox\libGLESv2.dll

2011-05-27 11:59 . 2011-04-14 16:40        1874904        ----a-w-        c:\program files\Mozilla Firefox\mozjs.dll

2011-05-27 11:59 . 2011-04-14 16:40        15832        ----a-w-        c:\program files\Mozilla Firefox\mozalloc.dll

2011-05-27 11:59 . 2010-01-01 08:00        1974616        ----a-w-        c:\program files\Mozilla Firefox\D3DCompiler_42.dll

2011-05-27 11:59 . 2010-01-01 08:00        1892184        ----a-w-        c:\program files\Mozilla Firefox\d3dx9_42.dll

2011-05-26 16:35 . 2011-05-26 16:35        1138440        ----a-w-        c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll

2011-05-11 15:14 . 2011-05-11 15:14        30720        ----a-w-        c:\windows\system32\npmpsoxy.dll

2011-05-11 15:03 . 2011-05-11 15:03        --------        d-----w-        c:\program files\Common Files\Java

2011-05-11 14:18 . 2011-04-07 12:01        2409784        ----a-w-        c:\program files\Windows Mail\OESpamFilter.dat

2011-05-02 12:09 . 2011-05-02 12:09        --------        d-----w-        c:\users\***\AppData\Roaming\AVG10

.

.

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2011-05-29 19:30 . 2011-05-29 19:30        0        ---ha-w-        c:\users\***\AppData\Local\BITF3F4.tmp

2011-04-14 03:07 . 2010-06-19 15:44        472808        ----a-w-        c:\windows\system32\deployJava1.dll

2011-04-11 07:04 . 2011-04-29 18:07        7071056        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{9795B267-A553-4A5D-BF2C-5801A5955E81}\mpengine.dll

2011-03-10 17:03 . 2011-04-13 19:54        1162240        ----a-w-        c:\windows\system32\mfc42u.dll

2011-03-10 17:03 . 2011-04-13 19:54        1136640        ----a-w-        c:\windows\system32\mfc42.dll

2011-03-03 15:42 . 2011-04-13 19:53        739328        ----a-w-        c:\windows\system32\inetcomm.dll

2011-03-03 15:40 . 2011-04-26 20:50        28672        ----a-w-        c:\windows\system32\Apphlpdm.dll

2011-03-03 15:40 . 2011-04-26 20:50        173056        ----a-w-        c:\windows\apppatch\AcXtrnal.dll

2011-03-03 15:40 . 2011-04-26 20:50        542720        ----a-w-        c:\windows\apppatch\AcLayers.dll

2011-03-03 15:40 . 2011-04-26 20:50        458752        ----a-w-        c:\windows\apppatch\AcSpecfc.dll

2011-03-03 15:40 . 2011-04-26 20:50        2159616        ----a-w-        c:\windows\apppatch\AcGenral.dll

2011-03-03 13:35 . 2011-04-26 20:50        4240384        ----a-w-        c:\windows\system32\GameUXLegacyGDFs.dll

2011-03-03 13:25 . 2011-04-13 19:53        2041856        ----a-w-        c:\windows\system32\win32k.sys

2011-03-02 15:44 . 2011-04-13 19:54        86528        ----a-w-        c:\windows\system32\dnsrslvr.dll

2011-04-14 16:40 . 2011-05-27 11:59        142296        ----a-w-        c:\program files\mozilla firefox\components\browsercomps.dll

.

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]

"WindowsWelcomeCenter"="oobefldr.dll" [2009-04-11 2153472]

"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]

"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-07-15 39408]

"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"RtHDVCpl"="RtHDVCpl.exe" [2007-01-11 4321280]

"LG Intelligent Update"="c:\program files\lg_swupdate\giljabistart.exe" [2007-02-06 228456]

"IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-01-31 131072]

"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-01-31 151552]

"Persistence"="c:\windows\system32\igfxpers.exe" [2007-01-31 126976]

"MGSysCtrl"="c:\program files\LG Software\System Control Manager\MGSysCtrl.exe" [2007-01-23 565248]

"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-11-22 815104]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]

"LogitechCommunicationsManager"="c:\program files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe" [2008-02-13 564496]

"LogitechQuickCamRibbon"="c:\program files\Logitech\QuickCam\Quickcam.exe" [2008-02-13 2196240]

"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-09-21 305440]

"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-11-29 421888]

"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-01-07 253672]

"Malwarebytes' Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2010-12-20 963976]

.

c:\users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

OpenOffice.org 2.3.lnk - c:\program files\OpenOffice.org 2.3\program\quickstart.exe [2007-8-17 393216]

.

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

Logitech Desktop Messenger.lnk - c:\program files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe [2009-7-29 66864]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]

"AntiVirusOverride"=dword:00000001

.

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]

R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-03-21 135664]

R3 gupdatem;Google Update-Dienst (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2010-03-21 135664]

R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]

S0 O2MDRDR;O2MDRDR;c:\windows\system32\DRIVERS\o2media.sys [2006-11-20 38400]

S0 O2SDRDR;O2SDRDR;c:\windows\system32\DRIVERS\o2sd.sys [2006-11-17 31360]

S2 NishService;Evil Driver Daemon;c:\program files\LG Software\System Control Manager\edd.exe [2006-03-02 40960]

S2 SBSDWSCService;SBSD Security Center Service;c:\program files\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368]

S3 MGHwCtrl;MGHwCtrl;c:\windows\system32\drivers\MGHwCtrl.sys [2006-07-03 9088]

S3 netr73;RT73 USB Wireless LAN Card Driver for Vista;c:\windows\system32\DRIVERS\netr73.sys [2006-09-28 247808]

.

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

LocalServiceAndNoImpersonation        REG_MULTI_SZ           FontCache

.

Inhalt des "geplante Tasks" Ordners

.

2011-05-29 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files\Google\Update\GoogleUpdate.exe [2010-03-21 10:44]

.

2011-05-29 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files\Google\Update\GoogleUpdate.exe [2010-03-21 10:44]

.

.

------- Zusätzlicher Suchlauf -------

.

uStart Page = hxxp://www.google.de/

IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_950DF09FAB501E03.dll/cmsidewiki.html

TCP: Interfaces\{7438D09B-C767-4D83-A264-3BA385E7A7DC}: NameServer = 195.50.140.248 195.50.140.246

Handler: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - c:\program files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll

FF - ProfilePath - c:\users\***\AppData\Roaming\Mozilla\Firefox\Profiles\qbp86wnc.default\

FF - prefs.js: browser.search.selectedEngine - Google

FF - prefs.js: browser.startup.homepage - hxxp://www.google.de/

FF - prefs.js: keyword.URL - hxxp://search.icq.com/search/afe_results.php?ch_id=afex&q=

.

- - - - Entfernte verwaiste Registrierungseinträge - - - -

.

Toolbar-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)

HKLM-Run-WinampAgent - c:\program files\Winamp\winampa.exe

AddRemove-ICQToolbar - c:\program files\ICQ6Toolbar\ICQUnToolbar.exe

.

.

.

**************************************************************************

Scanne versteckte Prozesse... 

.

Scanne versteckte Autostarteinträge... 

.

Scanne versteckte Dateien... 

.

Scan erfolgreich abgeschlossen

versteckte Dateien: 

.

**************************************************************************

.

--------------------- Gesperrte Registrierungsschluessel ---------------------

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

"MSCurrentCountry"=dword:000000b5

.

--------------------- Durch laufende Prozesse gestartete DLLs ---------------------

.

- - - - - - - > 'Explorer.exe'(9836)

c:\windows\TEMP\logishrd\LVPrcInj01.dll

.

------------------------ Weitere laufende Prozesse ------------------------

.

c:\windows\system32\agrsmsvc.exe

c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

c:\program files\Bonjour\mDNSResponder.exe

c:\program files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe

c:\program files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe

c:\program files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe

c:\program files\CDBurnerXP\NMSAccessU.exe

c:\windows\system32\o2flash.exe

c:\windows\system32\conime.exe

c:\windows\servicing\TrustedInstaller.exe

.

**************************************************************************

.

Zeit der Fertigstellung: 2011-05-29  21:36:58 - PC wurde neu gestartet

ComboFix-quarantined-files.txt  2011-05-29 19:36

.

Vor Suchlauf: 10 Verzeichnis(se), 105.661.661.184 Bytes frei

Nach Suchlauf: 16 Verzeichnis(se), 105.510.154.240 Bytes frei

.

- - End Of File - - 4037597B5F678EA4265B6877A8B8EB7C

 
--- --- ---

Zitat:

c:\***\***.exe

Was hast du da zensiert?

Das ist ein Programm von einem früheren Arbeitgeber von mir. Sollte nicht jeder wissen, was es für eines ist. Ich kenne es aber und es ist ungefährlich! :-)

Wie geht es jetzt weiter? Spybot meldet den Virus immer noch.... :heulen:
Wie gefährlich ist dieser WIN32.Katusha eigentlich?

Danke und Grüße
sporty33

Dann bitte unzensiert per PN posten :pfeiff:

Habe dir eine Email geschrieben, PN ging leider nicht...
Viele Grüße
sporty33

Ok, schau ich nachher mal rein

Zitat:

Das ist ein Programm von einem früheren Arbeitgeber von mir. Sollte nicht jeder wissen, was es für eines ist. Ich kenne es aber und es ist ungefährlich! :-)

CF hat das Teil aber gelöscht. Es legt ein Back in C:\Qoobox an.

Ok. Bitte nun Logs mit GMER und OSAM erstellen und posten.
GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus - die Online-Abfrage durch OSAM bitte überspringen.
Bei OSAM bitte darauf auch achten, dass Du das Log auch als *.log und nicht *.html oder so abspeicherst.

Downloade Dir danach bitte MBRCheck (by a_d_13) und speichere die Datei auf dem Desktop.

Doppelklick auf die MBRCheck.exe.
Vista und Win7 User mit Rechtsklick "als Administrator starten"
Das Tool braucht nur wenige Sekunden.
Danach solltest du eine MBRCheck_<Datum>_<Uhrzeit>.txt auf dem Desktop finden.

Poste mir bitte den Inhalt des .txt Dokumentes

So, habe nun GMER und OSAM ausgeführt.
Anbei die beiden Logs:

GMER:
[CODE]

GMER Logfile:

Code:

GMER 1.0.15.15640 - hxxp://www.gmer.net

Rootkit scan 2011-05-31 13:38:02

Windows 6.0.6002 Service Pack 2 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 ST9160821AS rev.3.ALC

Running: pr2co8ui.exe; Driver: C:\Users\***\AppData\Local\Temp\pxtoqpoc.sys
 
 

---- User IAT/EAT - GMER 1.0.15 ----
 

IAT             C:\Windows\Explorer.EXE[432] @ C:\Windows\system32\kernel32.dll [ntdll.dll!NtCreateFile]                                                  [03192F30] C:\Windows\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)

IAT             C:\Windows\Explorer.EXE[432] @ C:\Windows\system32\kernel32.dll [ntdll.dll!NtClose]                                                       [03192D00] C:\Windows\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)

IAT             C:\Windows\Explorer.EXE[432] @ C:\Windows\system32\kernel32.dll [ntdll.dll!NtDeviceIoControlFile]                                         [03192CA0] C:\Windows\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)

IAT             C:\Windows\Explorer.EXE[432] @ C:\Windows\system32\kernel32.dll [ntdll.dll!NtDuplicateObject]                                             [03192CD0] C:\Windows\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)

IAT             C:\Program Files\Logitech\QuickCam\Quickcam.exe[480] @ C:\Windows\system32\kernel32.dll [ntdll.dll!NtCreateFile]                          [021B2F30] C:\Windows\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)

IAT             C:\Program Files\Logitech\QuickCam\Quickcam.exe[480] @ C:\Windows\system32\kernel32.dll [ntdll.dll!NtClose]                               [021B2D00] C:\Windows\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)

IAT             C:\Program Files\Logitech\QuickCam\Quickcam.exe[480] @ C:\Windows\system32\kernel32.dll [ntdll.dll!NtDeviceIoControlFile]                 [021B2CA0] C:\Windows\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)

IAT             C:\Program Files\Logitech\QuickCam\Quickcam.exe[480] @ C:\Windows\system32\kernel32.dll [ntdll.dll!NtDuplicateObject]                     [021B2CD0] C:\Windows\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)

IAT             C:\Program Files\Common Files\Logishrd\LQCVFX\COCIManager.exe[1256] @ C:\Windows\system32\kernel32.dll [ntdll.dll!NtCreateFile]           [01902F30] C:\Windows\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)

IAT             C:\Program Files\Common Files\Logishrd\LQCVFX\COCIManager.exe[1256] @ C:\Windows\system32\kernel32.dll [ntdll.dll!NtClose]                [01902D00] C:\Windows\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)

IAT             C:\Program Files\Common Files\Logishrd\LQCVFX\COCIManager.exe[1256] @ C:\Windows\system32\kernel32.dll [ntdll.dll!NtDeviceIoControlFile]  [01902CA0] C:\Windows\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)

IAT             C:\Program Files\Common Files\Logishrd\LQCVFX\COCIManager.exe[1256] @ C:\Windows\system32\kernel32.dll [ntdll.dll!NtDuplicateObject]      [01902CD0] C:\Windows\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)

IAT             C:\Users\***\Desktop\pr2co8ui.exe[4076] @ C:\Windows\system32\kernel32.dll [ntdll.dll!NtCreateFile]                                      [00242F30] C:\Windows\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)

IAT             C:\Users\***\Desktop\pr2co8ui.exe[4076] @ C:\Windows\system32\kernel32.dll [ntdll.dll!NtClose]                                           [00242D00] C:\Windows\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)

IAT             C:\Users\***\Desktop\pr2co8ui.exe[4076] @ C:\Windows\system32\kernel32.dll [ntdll.dll!NtDeviceIoControlFile]                             [00242CA0] C:\Windows\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)

IAT             C:\Users\***\Desktop\pr2co8ui.exe[4076] @ C:\Windows\system32\kernel32.dll [ntdll.dll!NtDuplicateObject]                                 [00242CD0] C:\Windows\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)

IAT             C:\Windows\system32\wuauclt.exe[4664] @ C:\Windows\system32\kernel32.dll [ntdll.dll!NtCreateFile]                                         [000C2F30] C:\Windows\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)

IAT             C:\Windows\system32\wuauclt.exe[4664] @ C:\Windows\system32\kernel32.dll [ntdll.dll!NtClose]                                              [000C2D00] C:\Windows\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)

IAT             C:\Windows\system32\wuauclt.exe[4664] @ C:\Windows\system32\kernel32.dll [ntdll.dll!NtDeviceIoControlFile]                                [000C2CA0] C:\Windows\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)

IAT             C:\Windows\system32\wuauclt.exe[4664] @ C:\Windows\system32\kernel32.dll [ntdll.dll!NtDuplicateObject]                                    [000C2CD0] C:\Windows\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
 

---- Devices - GMER 1.0.15 ----
 

AttachedDevice  \Driver\kbdclass \Device\KeyboardClass0                                                                                                   Wdf01000.sys (Kernelmodustreiber-Frameworklaufzeit/Microsoft Corporation)

AttachedDevice  \Driver\kbdclass \Device\KeyboardClass1                                                                                                   Wdf01000.sys (Kernelmodustreiber-Frameworklaufzeit/Microsoft Corporation)
 

---- EOF - GMER 1.0.15 ----

--- --- ---

Und OSAM:

Code:

OSAM Logfile:
 

        Code:


        
Report of OSAM: Autorun Manager v5.0.11926.0

hxxp://www.online-solutions.ru/en/

Saved at 12:16:16 on 31.05.2011
 

OS: Windows Vista Home Premium Edition Service Pack 2 (Build 6002), 32-bit

Default Browser: Mozilla Corporation Firefox 4.0.1
 

Scanner Settings

[x] Rootkits detection (hidden registry)

[x] Rootkits detection (hidden files)

[x] Retrieve files information

[x] Check Microsoft signatures
 

Filters

[ ] Trusted entries

[ ] Empty entries

[x] Hidden registry entries (rootkit activity)

[x] Exclusively opened files

[x] Not found files

[x] Files without detailed information

[x] Existing files

[ ] Non-startable services

[ ] Non-startable drivers

[x] Active entries

[x] Disabled entries
 
 

[Common]

-----( %SystemRoot%\Tasks )-----

"GoogleUpdateTaskMachineCore.job" - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe

"GoogleUpdateTaskMachineUA.job" - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe
 

[Control Panel Objects]

-----( %SystemRoot%\system32 )-----

"bdeadmin.cpl" - ? - C:\Windows\system32\bdeadmin.cpl

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )-----

"QuickTime" - "Apple Inc." - C:\Program Files\QuickTime\QTSystem\QuickTime.cpl
 

[Drivers]

-----( HKLM\SYSTEM\CurrentControlSet\Services )-----

"catchme" (catchme) - ? - C:\Users\***\AppData\Local\Temp\catchme.sys  (File not found)

"IP in IP Tunnel Driver" (IpInIp) - ? - C:\Windows\System32\DRIVERS\ipinip.sys  (File not found)

"IPX Traffic Filter Driver" (NwlnkFlt) - ? - C:\Windows\System32\DRIVERS\nwlnkflt.sys  (File not found)

"IPX Traffic Forwarder Driver" (NwlnkFwd) - ? - C:\Windows\System32\DRIVERS\nwlnkfwd.sys  (File not found)

"MGHwCtrl" (MGHwCtrl) - "Windows (R) 2000 DDK provider" - C:\Windows\system32\drivers\MGHwCtrl.sys

"StarOpen" (StarOpen) - ? - C:\Windows\system32\drivers\StarOpen.sys  (File found, but it contains no detailed information)
 

[Explorer]

-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----

{F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll

{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396} "{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396}" - ? - C:\Program Files\OpenOffice.org 2.3\program\shlxthdl.dll

-----( HKLM\Software\Classes\Protocols\Handler )-----

{9462A756-7B47-47BC-8C80-C34B9B80B32B} "BackWeb GA Pluggable Protocol" - "Logitech Inc." - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll

{FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} "IEProtocolHandler Class" - "Skype Technologies" - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL

{8E2D00A0-82C6-4821-90BC-07F290841BB6} "XEB Navigation Filter" - ? - C:\Program Files\Common Files\fluxDVD\Lib\XEB\xebnavigation.ax

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----

{911051fa-c21c-4246-b470-070cd8df6dc4} ".cab or .zip files" - ? -   (File not found | COM-object registry key not found)

{1b24a030-9b20-49bc-97ac-1be4426f9e59} "ActiveDirectory Folder" - ? -   (File not found | COM-object registry key not found)

{34449847-FD14-4fc8-A75A-7432F5181EFB} "ActiveDirectory Folder" - ? -   (File not found | COM-object registry key not found)

{0F8604A5-4ECE-4DE1-BA7D-CF10F8AA4F48} "Contacts folder" - ? -   (File not found | COM-object registry key not found)

{2C2577C2-63A7-40e3-9B7F-586602617ECB} "Explorer Query Band" - ? -   (File not found | COM-object registry key not found)

{C9CF278C-460E-4917-BC43-3F75E6E47D3D} "fluxDVD Shell Information Extractor" - "ACE GmbH" - C:\PROGRA~1\COMMON~1\fluxDVD\Lib\XEB\XEBShell.dll

{FAC3CBF6-8697-43d0-BAB9-DCD1FCE19D75} "IE User Assist" - ? -   (File not found | COM-object registry key not found)

{B9E1D2CB-CCFF-4AA6-9579-D7A4754030EF} "iTunes" - "Apple Inc." - C:\Program Files\iTunes\iTunesMiniPlayer.dll

{00020d75-0000-0000-c000-000000000046} "lnkfile" - ? -   (File not found | COM-object registry key not found)

{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396} "OpenOffice.org Column Handler" - ? - C:\Program Files\OpenOffice.org 2.3\program\shlxthdl.dll

{087B3AE3-E237-4467-B8DB-5A38AB959AC9} "OpenOffice.org Infotip Handler" - ? - C:\Program Files\OpenOffice.org 2.3\program\shlxthdl.dll

{63542C48-9552-494A-84F7-73AA6A7C99C1} "OpenOffice.org Property Sheet Handler" - ? - C:\Program Files\OpenOffice.org 2.3\program\shlxthdl.dll

{3B092F0C-7696-40E3-A80F-68D74DA84210} "OpenOffice.org Thumbnail Viewer" - ? - C:\Program Files\OpenOffice.org 2.3\program\shlxthdl.dll

{C8494E42-ACDD-4739-B0FB-217361E4894F} "Sam Account Folder" - ? -   (File not found | COM-object registry key not found)

{E29F9716-5C08-4FCD-955A-119FDB5A522D} "Sam Account Folder" - ? -   (File not found | COM-object registry key not found)

{da67b8ad-e81b-4c70-9b91b417b5e33527} "Windows Search Shell Service" - ? -   (File not found | COM-object registry key not found)

{B41DB860-8EE4-11D2-9906-E49FADC173CA} "WinRAR" - ? - C:\Program Files\WinRAR\rarext.dll  (File found, but it contains no detailed information)
 

[Internet Explorer]

-----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )-----

<binary data> "Google Toolbar" - "Google Inc." - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll

<binary data> "ICQToolBar" - ? - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll  (File not found)

ITBar7Height "ITBar7Height" - ? -   (File not found | COM-object registry key not found)

<binary data> "ITBar7Layout" - ? -   (File not found | COM-object registry key not found)

-----( HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks )-----

{855F3B16-6D32-4fe6-8A56-BBB695989046} "ICQToolBar" - ? - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll  (File not found)

 "{855F3B16-6D32-4fe6-8A56-BBB695989046}" - ? -   (File not found | COM-object registry key not found)

-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----

{8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.6.0_25" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab

{CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA} "Java Plug-in 1.6.0_25" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab

{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_25" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\npjpi160_25.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab

{D27CDB6E-AE6D-11CF-96B8-444553540000} "Shockwave Flash Object" - "Adobe Systems, Inc." - C:\Windows\system32\Macromed\Flash\Flash9e.ocx / hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----

{53707962-6F74-2D53-2644-206D7942484F} "ClsidExtension" - "Safer Networking Limited" - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll

-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar )-----

<binary data> "Google Toolbar" - "Google Inc." - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll

{855F3B16-6D32-4fe6-8A56-BBB695989046} "ICQToolBar" - ? - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll  (File not found)

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----

{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} "Adobe PDF Reader" - "Adobe Systems Incorporated" - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

{AA58ED58-01DD-4d91-8333-CF10577473F7} "Google Toolbar Helper" - "Google Inc." - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll

{AF69DE43-7D58-4638-B6FA-CE66B5AD205D} "Google Toolbar Notifier BHO" - "Google Inc." - C:\Program Files\Google\GoogleToolbarNotifier\5.6.5805.1910\swg.dll

{DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2ssv.dll

{53707962-6F74-2D53-2644-206D7942484F} "Spybot-S&D IE Protection" - "Safer Networking Limited" - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
 

[Logon]

-----( %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup )-----

"desktop.ini" - ? - C:\Users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini

"OpenOffice.org 2.3.lnk" - ? - C:\Program Files\OpenOffice.org 2.3\program\quickstart.exe  (Shortcut exists | File found, but it contains no detailed information | File exists)

-----( %AllUsersProfile%\Microsoft\Windows\Start Menu\Programs\Startup )-----

"desktop.ini" - ? - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini

"Logitech Desktop Messenger.lnk" - "Logitech Inc." - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe  (Shortcut exists | File exists)

-----( HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run )-----

"SpybotSD TeaTimer" - "Safer-Networking Ltd." - C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

"swg" - "Google Inc." - "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"

-----( HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\Wds\rdpwd )-----

"StartupPrograms" - ? - rdpclip  (File not found)

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----

"Adobe Reader Speed Launcher" - "Adobe Systems Incorporated" - "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"

"iTunesHelper" - "Apple Inc." - "C:\Program Files\iTunes\iTunesHelper.exe"

"LG Intelligent Update" - "BIT LEADER" - "C:\Program Files\lg_swupdate\giljabistart.exe" Gilautouc

"LogitechCommunicationsManager" - "Logitech Inc." - "C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe"

"LogitechQuickCamRibbon" - "Logitech Inc." - "C:\Program Files\Logitech\QuickCam\Quickcam.exe" /hide

"Malwarebytes' Anti-Malware (reboot)" - "Malwarebytes Corporation" - "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript

"MGSysCtrl" - "MSI" - C:\Program Files\LG Software\System Control Manager\MGSysCtrl.exe

"QuickTime Task" - "Apple Inc." - "C:\Program Files\QuickTime\QTTask.exe" -atboottime

"SunJavaUpdateSched" - "Sun Microsystems, Inc." - "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
 

[Print Monitors]

-----( HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors )-----

"PDFCreator" - ? - C:\Windows\system32\pdfcmnnt.dll  (File found, but it contains no detailed information)
 

[Services]

-----( HKLM\SYSTEM\CurrentControlSet\Services )-----

"@c:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe,-100" (WPFFontCache_v0400) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe

"Apple Mobile Device" (Apple Mobile Device) - "Apple Inc." - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

"Bonjour-Dienst" (Bonjour Service) - "Apple Inc." - C:\Program Files\Bonjour\mDNSResponder.exe

"Evil Driver Daemon" (NishService) - ? - C:\Program Files\LG Software\System Control Manager\edd.exe  (File found, but it contains no detailed information)

"Google Software Updater" (gusvc) - "Google" - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

"Google Update Service (gupdate)" (gupdate) - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe

"Google Update-Dienst (gupdatem)" (gupdatem) - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe

"iPod-Dienst" (iPod Service) - "Apple Inc." - C:\Program Files\iPod\bin\iPodService.exe

"LVCOMSer" (LVCOMSer) - "Logitech Inc." - C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe

"LVSrvLauncher" (LVSrvLauncher) - "Logitech Inc." - C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe

"Microsoft .NET Framework NGEN v4.0.30319_X86" (clr_optimization_v4.0.30319_32) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

"NMSAccessU" (NMSAccessU) - ? - C:\Program Files\CDBurnerXP\NMSAccessU.exe  (File found, but it contains no detailed information)

"O2Micro Flash Memory" (O2Flash) - "O2Micro International" - C:\Windows\system32\o2flash.exe

"Process Monitor" (LVPrcSrv) - "Logitech Inc." - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe

"SBSD Security Center Service" (SBSDWSCService) - "Safer Networking Ltd." - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
 

[Winsock Providers]

-----( HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries )-----

"mdnsNSP" - "Apple Inc." - C:\Program Files\Bonjour\mdnsNSP.dll
 

===[ Logfile end ]=========================================[ Logfile end ]===

 
--- --- ---
 

If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru

Viele Grüße
sporty33 :glaskugel:

Und hier auch noch MBRCheck:

Code:



MBRCheck, version 1.2.3

(c) 2010, AD
 

Command-line:                        

Windows Version:                Windows Vista Home Premium Edition

Windows Information:                Service Pack 2 (build 6002), 32-bit

Base Board Manufacturer:        MICRO-STAR INT'L CO.,LTD.

BIOS Manufacturer:                American Megatrends Inc.

System Manufacturer:                LG Electronics

System Product Name:                FS-2.AACBG

Logical Drives Mask:                0x00000014
 

Kernel Drivers (total 143):

  0x8204D000 \SystemRoot\system32\ntkrnlpa.exe

  0x8201A000 \SystemRoot\system32\hal.dll

  0x80403000 \SystemRoot\system32\kdcom.dll

  0x8040A000 \SystemRoot\system32\mcupdate_GenuineIntel.dll

  0x8047A000 \SystemRoot\system32\PSHED.dll

  0x8048B000 \SystemRoot\system32\BOOTVID.dll

  0x80493000 \SystemRoot\system32\CLFS.SYS

  0x804D4000 \SystemRoot\system32\CI.dll

  0x80608000 \SystemRoot\system32\drivers\Wdf01000.sys

  0x80679000 \SystemRoot\system32\drivers\WDFLDR.SYS

  0x80687000 \SystemRoot\system32\drivers\acpi.sys

  0x806CD000 \SystemRoot\system32\drivers\WMILIB.SYS

  0x806D6000 \SystemRoot\system32\drivers\msisadrv.sys

  0x806DE000 \SystemRoot\system32\drivers\pci.sys

  0x80705000 \SystemRoot\System32\drivers\partmgr.sys

  0x80714000 \SystemRoot\system32\DRIVERS\compbatt.sys

  0x80717000 \SystemRoot\system32\DRIVERS\BATTC.SYS

  0x80721000 \SystemRoot\system32\drivers\volmgr.sys

  0x80730000 \SystemRoot\System32\drivers\volmgrx.sys

  0x8077A000 \SystemRoot\system32\DRIVERS\pcmcia.sys

  0x807A7000 \SystemRoot\system32\DRIVERS\pciide.sys

  0x807AE000 \SystemRoot\system32\DRIVERS\PCIIDEX.SYS

  0x807BC000 \SystemRoot\System32\drivers\mountmgr.sys

  0x807CC000 \SystemRoot\system32\drivers\atapi.sys

  0x807D4000 \SystemRoot\system32\drivers\ataport.SYS

  0x807F2000 \SystemRoot\system32\DRIVERS\o2sd.sys

  0x805B4000 \SystemRoot\system32\DRIVERS\SCSIPORT.SYS

  0x805DA000 \SystemRoot\system32\DRIVERS\o2media.sys

  0x82605000 \SystemRoot\system32\drivers\fltmgr.sys

  0x82637000 \SystemRoot\system32\drivers\fileinfo.sys

  0x82647000 \SystemRoot\System32\Drivers\ksecdd.sys

  0x826B8000 \SystemRoot\system32\drivers\ndis.sys

  0x827C3000 \SystemRoot\system32\drivers\msrpc.sys

  0x82C0E000 \SystemRoot\system32\drivers\NETIO.SYS

  0x82C49000 \SystemRoot\System32\drivers\tcpip.sys

  0x82D33000 \SystemRoot\System32\drivers\fwpkclnt.sys

  0x82E09000 \SystemRoot\System32\Drivers\Ntfs.sys

  0x82F19000 \SystemRoot\system32\drivers\volsnap.sys

  0x82F52000 \SystemRoot\System32\Drivers\spldr.sys

  0x82F5A000 \SystemRoot\System32\Drivers\mup.sys

  0x82F69000 \SystemRoot\System32\drivers\ecache.sys

  0x82F90000 \SystemRoot\system32\drivers\disk.sys

  0x82FA1000 \SystemRoot\system32\drivers\CLASSPNP.SYS

  0x82FC2000 \SystemRoot\system32\drivers\crcdisk.sys

  0x82FEB000 \SystemRoot\system32\DRIVERS\tunnel.sys

  0x82FF6000 \SystemRoot\system32\DRIVERS\tunmp.sys

  0x82D4E000 \SystemRoot\system32\DRIVERS\intelppm.sys

  0x8A201000 \SystemRoot\system32\DRIVERS\igdkmd32.sys

  0x82D5D000 \SystemRoot\System32\drivers\dxgkrnl.sys

  0x8A7D8000 \SystemRoot\System32\drivers\watchdog.sys

  0x8AA0E000 \SystemRoot\system32\DRIVERS\HDAudBus.sys

  0x8AA9B000 \SystemRoot\system32\DRIVERS\Rtlh86.sys

  0x8AAAE000 \SystemRoot\system32\DRIVERS\usbuhci.sys

  0x8AAB9000 \SystemRoot\system32\DRIVERS\USBPORT.SYS

  0x8AAF7000 \SystemRoot\system32\DRIVERS\usbehci.sys

  0x8AB06000 \SystemRoot\system32\DRIVERS\ohci1394.sys

  0x8AB16000 \SystemRoot\system32\DRIVERS\1394BUS.SYS

  0x8AB24000 \SystemRoot\system32\DRIVERS\i8042prt.sys

  0x8AB37000 \SystemRoot\system32\DRIVERS\kbdclass.sys

  0x8AB42000 \SystemRoot\system32\DRIVERS\SynTP.sys

  0x8AB6D000 \SystemRoot\system32\DRIVERS\USBD.SYS

  0x8AB6F000 \SystemRoot\system32\DRIVERS\mouclass.sys

  0x8AB7A000 \SystemRoot\system32\DRIVERS\CmBatt.sys

  0x8AB7E000 \SystemRoot\system32\DRIVERS\cdrom.sys

  0x8AB96000 \SystemRoot\system32\DRIVERS\GEARAspiWDM.sys

  0x8AB9C000 \SystemRoot\system32\DRIVERS\msiscsi.sys

  0x8AE0D000 \SystemRoot\system32\DRIVERS\storport.sys

  0x8AE4E000 \SystemRoot\system32\DRIVERS\TDI.SYS

  0x8AE59000 \SystemRoot\system32\DRIVERS\rasl2tp.sys

  0x8AE70000 \SystemRoot\system32\DRIVERS\ndistapi.sys

  0x8AE7B000 \SystemRoot\system32\DRIVERS\ndiswan.sys

  0x8AE9E000 \SystemRoot\system32\DRIVERS\raspppoe.sys

  0x8AEAD000 \SystemRoot\system32\DRIVERS\raspptp.sys

  0x8AEC1000 \SystemRoot\system32\DRIVERS\rassstp.sys

  0x8AED6000 \SystemRoot\system32\DRIVERS\termdd.sys

  0x8AEE6000 \SystemRoot\system32\DRIVERS\swenum.sys

  0x8AEE8000 \SystemRoot\system32\DRIVERS\ks.sys

  0x8AF12000 \SystemRoot\system32\DRIVERS\mssmbios.sys

  0x8AF1C000 \SystemRoot\system32\DRIVERS\umbus.sys

  0x8AF29000 \SystemRoot\system32\DRIVERS\usbhub.sys

  0x8AF5E000 \SystemRoot\System32\Drivers\NDProxy.SYS

  0x89E06000 \SystemRoot\system32\drivers\RTKVHDA.sys

  0x89F9E000 \SystemRoot\system32\drivers\portcls.sys

  0x89FCB000 \SystemRoot\system32\drivers\drmk.sys

  0x8B00D000 \SystemRoot\system32\DRIVERS\AGRSM.sys

  0x8B129000 \SystemRoot\system32\drivers\modem.sys

  0x8B136000 \SystemRoot\System32\Drivers\Fs_Rec.SYS

  0x8B13F000 \SystemRoot\System32\Drivers\Null.SYS

  0x8B146000 \SystemRoot\System32\Drivers\Beep.SYS

  0x8B14D000 \SystemRoot\System32\drivers\vga.sys

  0x8B159000 \SystemRoot\System32\drivers\VIDEOPRT.SYS

  0x8B17A000 \SystemRoot\System32\DRIVERS\RDPCDD.sys

  0x8B182000 \SystemRoot\system32\drivers\rdpencdd.sys

  0x8B18A000 \SystemRoot\System32\Drivers\Msfs.SYS

  0x8B195000 \SystemRoot\System32\Drivers\Npfs.SYS

  0x8B1A3000 \SystemRoot\System32\DRIVERS\rasacd.sys

  0x8B1AC000 \SystemRoot\system32\DRIVERS\tdx.sys

  0x8B1C2000 \SystemRoot\system32\DRIVERS\smb.sys

  0x8AF78000 \SystemRoot\System32\DRIVERS\netbt.sys

  0x8AFAA000 \SystemRoot\system32\drivers\afd.sys

  0x8B1D6000 \SystemRoot\system32\DRIVERS\pacer.sys

  0x8B1EC000 \SystemRoot\system32\DRIVERS\netbios.sys

  0x8ABCB000 \SystemRoot\system32\DRIVERS\wanarp.sys

  0x8B405000 \SystemRoot\system32\DRIVERS\rdbss.sys

  0x8B441000 \SystemRoot\system32\drivers\nsiproxy.sys

  0x8B44B000 \SystemRoot\System32\Drivers\dfsc.sys

  0x8B462000 \SystemRoot\system32\DRIVERS\hidusb.sys

  0x8B46B000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS

  0x8B47B000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS

  0x8B482000 \SystemRoot\system32\DRIVERS\mouhid.sys

  0x8B48A000 \SystemRoot\System32\Drivers\crashdmp.sys

  0x8B497000 \SystemRoot\System32\Drivers\dump_dumpata.sys

  0x8B4A2000 \SystemRoot\System32\Drivers\dump_atapi.sys

  0x8B4AA000 \SystemRoot\system32\DRIVERS\netr73.sys

  0x928F0000 \SystemRoot\System32\win32k.sys

  0x8B4EB000 \SystemRoot\System32\drivers\Dxapi.sys

  0x8B4F5000 \SystemRoot\system32\DRIVERS\monitor.sys

  0x92B10000 \SystemRoot\System32\TSDDD.dll

  0x92B30000 \SystemRoot\System32\cdd.dll

  0x8B504000 \SystemRoot\system32\drivers\luafv.sys

  0x8B530000 \SystemRoot\system32\drivers\spsys.sys

  0x8B5E0000 \SystemRoot\system32\DRIVERS\lltdio.sys

  0xA5E0A000 \SystemRoot\system32\DRIVERS\nwifi.sys

  0xA5E34000 \SystemRoot\system32\DRIVERS\ndisuio.sys

  0xA5E3E000 \SystemRoot\system32\DRIVERS\rspndr.sys

  0xA5E51000 \SystemRoot\system32\drivers\HTTP.sys

  0xA5EBE000 \SystemRoot\System32\DRIVERS\srvnet.sys

  0xA5EDB000 \SystemRoot\system32\DRIVERS\bowser.sys

  0xA5EF4000 \SystemRoot\System32\drivers\mpsdrv.sys

  0xA5F09000 \SystemRoot\system32\drivers\mrxdav.sys

  0xA5F2A000 \SystemRoot\system32\DRIVERS\mrxsmb.sys

  0xA5F49000 \SystemRoot\system32\DRIVERS\mrxsmb10.sys

  0xA5F82000 \SystemRoot\system32\DRIVERS\mrxsmb20.sys

  0xA5F9A000 \SystemRoot\System32\DRIVERS\srv2.sys

  0xA680A000 \SystemRoot\System32\DRIVERS\srv.sys

  0xA6871000 \SystemRoot\system32\drivers\peauth.sys

  0xA694F000 \SystemRoot\System32\Drivers\secdrv.SYS

  0xA6959000 \SystemRoot\System32\drivers\tcpipreg.sys

  0xA6965000 \SystemRoot\system32\DRIVERS\LVPr2Mon.sys

  0xA696A000 \??\C:\Windows\system32\drivers\MGHwCtrl.sys

  0xA696D000 \SystemRoot\system32\DRIVERS\cdfs.sys

  0xA6983000 \??\C:\Users\Dani\AppData\Local\Temp\pxtoqpoc.sys

  0x77A80000 \Windows\System32\ntdll.dll
 

Processes (total 69):

       0 System Idle Process

       4 System

     488 C:\Windows\System32\smss.exe

     556 csrss.exe

     600 C:\Windows\System32\wininit.exe

     612 csrss.exe

     644 C:\Windows\System32\services.exe

     656 C:\Windows\System32\lsass.exe

     664 C:\Windows\System32\lsm.exe

     720 C:\Windows\System32\winlogon.exe

     868 C:\Windows\System32\svchost.exe

     928 C:\Windows\System32\svchost.exe

     968 C:\Windows\System32\svchost.exe

    1060 C:\Windows\System32\svchost.exe

    1088 C:\Windows\System32\svchost.exe

    1120 C:\Windows\System32\svchost.exe

    1236 C:\Windows\System32\audiodg.exe

    1260 C:\Windows\System32\svchost.exe

    1280 C:\Windows\System32\SLsvc.exe

    1336 C:\Windows\System32\svchost.exe

    1536 C:\Windows\System32\svchost.exe

    1724 C:\Windows\System32\spoolsv.exe

    1752 C:\Windows\System32\svchost.exe

     340 C:\Windows\System32\dwm.exe

     368 C:\Windows\System32\taskeng.exe

     432 C:\Windows\explorer.exe

    1228 C:\Windows\System32\taskeng.exe

    1620 C:\Windows\RtHDVCpl.exe

    1532 C:\Windows\System32\igfxtray.exe

    1464 C:\Windows\System32\hkcmd.exe

     924 C:\Windows\System32\igfxpers.exe

    1028 C:\Program Files\LG Software\System Control Manager\MGSysCtrl.exe

    1940 C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

    2028 C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe

     480 C:\Program Files\Logitech\QuickCam\Quickcam.exe

     876 C:\Program Files\iTunes\iTunesHelper.exe

    1172 C:\Program Files\Common Files\Java\Java Update\jusched.exe

    2084 C:\Program Files\Windows Sidebar\sidebar.exe

    2104 C:\Windows\ehome\ehtray.exe

    2116 C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

    2128 C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

    2184 C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe

    2308 C:\Program Files\OpenOffice.org 2.3\program\soffice.exe

    2328 C:\Windows\ehome\ehmsas.exe

    2368 C:\Program Files\OpenOffice.org 2.3\program\soffice.bin

    2792 C:\Windows\System32\agrsmsvc.exe

    2824 C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

    2836 C:\Program Files\Bonjour\mDNSResponder.exe

    2876 C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe

    2892 C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe

    3008 C:\Program Files\LG Software\System Control Manager\edd.exe

    3032 C:\Program Files\CDBurnerXP\NMSAccessU.exe

    3100 C:\Windows\System32\o2flash.exe

    3108 C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe

    3180 C:\Windows\System32\svchost.exe

    3204 C:\Windows\System32\svchost.exe

    3312 C:\Windows\System32\svchost.exe

    3340 C:\Windows\System32\SearchIndexer.exe

    3468 C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe

    3756 C:\Program Files\iPod\bin\iPodService.exe

    1256 C:\Program Files\Common Files\LogiShrd\LQCVFX\COCIManager.exe

    3476 C:\Windows\System32\svchost.exe

    4664 C:\Windows\System32\wuauclt.exe

    5496 C:\Program Files\Mozilla Firefox\firefox.exe

    4856 C:\Windows\System32\SearchProtocolHost.exe

    3252 C:\Windows\System32\SearchFilterHost.exe

    4564 C:\Users\***\Desktop\MBRCheck.exe

    1616 C:\Windows\System32\conime.exe

    4696 <unknown>
 

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`40398600  (NTFS)
 

PhysicalDrive0 Model Number: ST9160821AS, Rev: 3.ALC   
 

      Size  Device Name          MBR Status

  --------------------------------------------

    149 GB  \\.\PhysicalDrive0   Unknown MBR code

            SHA1: 16FACB29D75458833E397367B1DA17929157C2B3
 
 

Found non-standard or infected MBR.

Enter 'Y' and hit ENTER for more options, or 'N' to exit: 

Options:

  [1] Dump the MBR of a physical disk to file.

  [2] Restore the MBR of a physical disk with a standard boot code.

  [3] Exit.
 

Enter your choice:

Zitat:

149 GB \\.\PhysicalDrive0 Unknown MBR code
SHA1: 16FACB29D75458833E397367B1DA17929157C2B3

Wir sollten den MBR manuell fixen. Sichere für den Fall der Fälle alle wichtigen Daten.

Hast Du noch andere Betriebssysteme außer Vista installiert?
Wenn nicht: Schau mal hier => Vista Notfall/Recovery-CD 32-Bit - Dr. Windows

Lad das iso runter, brenn es zB mit ImgBurn per Imagebrennfunktion auf eine CD und starte damit den Rechner (von dieser CD booten).

Falls Du eine normale Vista-Installations-DVD hast, brauchst Du das o.g. Image nicht sondern kannst einfach von der Vista-DVD booten.

Klick auf Computerreparaturoptionen, weiter, Eingabeaufforderung - die Konsole öffnet sich. Da bitte bootrec.exe /fixboot eintippen (mit enter bestätigen), dann bootrec.exe /fixmbr eintippen (mit enter bestätigen) - Rechner neustarten, CD vorher rausnehmen. Erstell danach wieder neue Logs mit MBRCheck und wenn es geht GMER.

Habe da noch eine Frage zu:
die viste recover Datei ist als rar gepackt, muss ich die vorher entpacken, oder kann ich die auch so auf eine CD brennen und dann davon booten? (wahrscheinlich nicht, aber von sowas hab ich keine Ahnung und gemacht hab ich sowas auch noch nie...).

Danke für Deine Hilfe!
Grüße sporty33