Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   Trojaner WIN32.Katusha.o lässt sich nicht entfernen (https://www.trojaner-board.de/99672-trojaner-win32-katusha-o-laesst-entfernen.html)

sporty33 28.05.2011 14:55
Trojaner WIN32.Katusha.o lässt sich nicht entfernen
 
Hallo Zusammen,

seit gestern meldet der Spybot S&D das Vorhandensein eines Viruses mit dem Namen WIN32.Katusha.o. Der Viraus lässt sich leider mit Hilfe des Programms sowie auch manuell nicht entfernen. Das System meldet, es könnte keine Winini-Datei erstellen. Wie knn ich diesen tückischen Virus bei mir entfernen?

anbei hier der Scan über OTL:
OTL.Txt:

OTL Logfile:
Code:
OTL logfile created on: 28.05.2011 15:08:58 - Run 1
OTL by OldTimer - Version 3.2.23.0    Folder = C:\Users\***\Downloads
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.19048)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
1014,64 Mb Total Physical Memory | 202,95 Mb Available Physical Memory | 20,00% Memory free
2,24 Gb Paging File | 1,05 Gb Available in Paging File | 46,92% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 148,04 Gb Total Space | 101,66 Gb Free Space | 68,67% Space Free | Partition Type: NTFS
 
Computer Name: DANI-NOTEBOOK | User Name: *** | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2011.05.28 15:03:29 | 000,580,096 | ---- | M] (OldTimer Tools) -- C:\Users\***\Downloads\OTL.exe
PRC - [2011.04.18 17:40:08 | 002,334,560 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Programme\AVG\AVG10\avgtray.exe
PRC - [2011.04.18 17:39:42 | 007,398,752 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Programme\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe
PRC - [2011.04.14 05:36:42 | 001,080,672 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Programme\AVG\AVG10\avgnsx.exe
PRC - [2011.03.28 03:00:52 | 000,351,072 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Programme\AVG\AVG10\avgcsrvx.exe
PRC - [2011.03.16 16:05:20 | 001,025,888 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Programme\AVG\AVG10\avgemcx.exe
PRC - [2011.03.16 16:05:14 | 000,656,736 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Programme\AVG\AVG10\avgchsvx.exe
PRC - [2011.02.10 07:55:18 | 001,148,256 | ---- | M] () -- C:\Programme\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSMonitor.exe
PRC - [2011.02.09 05:35:14 | 001,265,504 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Programme\AVG\AVG10\avgsrmax.exe
PRC - [2011.02.08 05:33:42 | 000,269,520 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Programme\AVG\AVG10\avgwdsvc.exe
PRC - [2011.02.08 05:33:20 | 000,658,784 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Programme\AVG\AVG10\avgrsx.exe
PRC - [2009.11.12 14:48:56 | 000,071,096 | ---- | M] () -- C:\Programme\CDBurnerXP\NMSAccessU.exe
PRC - [2009.07.29 20:32:46 | 000,066,864 | ---- | M] (Logitech Inc.) -- C:\Programme\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
PRC - [2009.04.11 08:28:03 | 001,233,920 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Sidebar\sidebar.exe
PRC - [2009.04.11 08:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2009.04.11 08:27:28 | 000,069,120 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\conime.exe
PRC - [2009.03.05 17:07:20 | 002,260,480 | RHS- | M] (Safer-Networking Ltd.) -- C:\Programme\Spybot - Search & Destroy\TeaTimer.exe
PRC - [2009.01.26 15:31:10 | 001,153,368 | ---- | M] (Safer Networking Ltd.) -- C:\Programme\Spybot - Search & Destroy\SDWinSec.exe
PRC - [2008.02.13 13:06:58 | 002,196,240 | ---- | M] () -- C:\Programme\Logitech\QuickCam\Quickcam.exe
PRC - [2008.02.13 13:02:46 | 000,564,496 | ---- | M] () -- C:\Programme\Common Files\LogiShrd\LComMgr\Communications_Helper.exe
PRC - [2008.02.13 13:02:24 | 000,405,776 | ---- | M] (Logitech Inc.) -- C:\Programme\Common Files\LogiShrd\LQCVFX\COCIManager.exe
PRC - [2008.02.05 18:20:42 | 000,150,040 | ---- | M] (Logitech Inc.) -- C:\Programme\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
PRC - [2008.02.05 18:18:48 | 000,186,904 | ---- | M] (Logitech Inc.) -- C:\Programme\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
PRC - [2007.11.13 19:38:28 | 002,510,848 | ---- | M] (OpenOffice.org) -- C:\Programme\OpenOffice.org 2.3\program\soffice.bin
PRC - [2007.11.13 19:38:26 | 002,359,296 | ---- | M] (OpenOffice.org) -- C:\Programme\OpenOffice.org 2.3\program\soffice.exe
PRC - [2007.01.23 11:53:34 | 000,565,248 | ---- | M] (MSI) -- C:\Programme\LG Software\System Control Manager\MGSysCtrl.exe
PRC - [2007.01.11 17:24:56 | 004,321,280 | ---- | M] (Realtek Semiconductor) -- C:\Windows\RtHDVCpl.exe
PRC - [2006.10.19 14:42:00 | 000,065,536 | ---- | M] (O2Micro International) -- C:\Windows\System32\o2flash.exe
PRC - [2006.10.05 12:10:12 | 000,009,216 | ---- | M] (Agere Systems) -- C:\Windows\System32\agrsmsvc.exe
PRC - [2006.03.02 16:43:24 | 000,040,960 | ---- | M] () -- C:\Programme\LG Software\System Control Manager\edd.exe
 
 
========== Modules (SafeList) ==========
 
MOD - [2011.05.28 15:03:29 | 000,580,096 | ---- | M] (OldTimer Tools) -- C:\Users\***\Downloads\OTL.exe
MOD - [2010.08.31 17:43:52 | 001,686,016 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_5cb72f2a088b0ed3\comctl32.dll
MOD - [2008.02.05 18:20:30 | 000,109,080 | ---- | M] (Logitech Inc.) -- C:\Windows\Temp\logishrd\LVPrcInj01.dll
 
 
========== Win32 Services (SafeList) ==========
 
SRV - [2011.04.18 17:39:42 | 007,398,752 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe -- (AVGIDSAgent)
SRV - [2011.02.08 05:33:42 | 000,269,520 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files\AVG\AVG10\avgwdsvc.exe -- (avgwd)
SRV - [2009.11.12 14:48:56 | 000,071,096 | ---- | M] () [Auto | Running] -- C:\Programme\CDBurnerXP\NMSAccessU.exe -- (NMSAccessU)
SRV - [2009.01.26 15:31:10 | 001,153,368 | ---- | M] (Safer Networking Ltd.) [Auto | Running] -- C:\Programme\Spybot - Search & Destroy\SDWinSec.exe -- (SBSDWSCService)
SRV - [2008.02.05 18:22:36 | 000,141,848 | ---- | M] (Logitech Inc.) [Auto | Stopped] -- C:\Programme\Common Files\LogiShrd\SrvLnch\SrvLnch.exe -- (LVSrvLauncher)
SRV - [2008.02.05 18:20:42 | 000,150,040 | ---- | M] (Logitech Inc.) [Auto | Running] -- C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe -- (LVPrcSrv)
SRV - [2008.02.05 18:18:48 | 000,186,904 | ---- | M] (Logitech Inc.) [Auto | Running] -- C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe -- (LVCOMSer)
SRV - [2008.01.19 09:38:24 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2006.10.19 14:42:00 | 000,065,536 | ---- | M] (O2Micro International) [Auto | Running] -- C:\Windows\System32\o2flash.exe -- (O2Flash)
SRV - [2006.10.05 12:10:12 | 000,009,216 | ---- | M] (Agere Systems) [Auto | Running] -- C:\Windows\System32\agrsmsvc.exe -- (AgereModemAudio)
SRV - [2006.03.02 16:43:24 | 000,040,960 | ---- | M] () [Auto | Running] -- C:\Programme\LG Software\System Control Manager\edd.exe -- (NishService)
SRV - [2004.08.18 19:36:44 | 000,450,560 | ---- | M] (Lexmark International, Inc.) [On_Demand | Stopped] -- C:\Windows\System32\lxbucoms.exe -- (lxbu_device)
 
 
========== Driver Services (SafeList) ==========
 
DRV - [2011.04.14 21:28:18 | 000,134,480 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\AVGIDSDriver.sys -- (AVGIDSDriver)
DRV - [2011.04.05 00:59:56 | 000,297,168 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\Windows\System32\drivers\avgtdix.sys -- (Avgtdix)
DRV - [2011.03.16 16:03:20 | 000,032,592 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | Boot | Running] -- C:\Windows\system32\DRIVERS\avgrkx86.sys -- (Avgrkx86)
DRV - [2011.03.01 14:25:18 | 000,034,896 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | System | Running] -- C:\Windows\System32\drivers\avgmfx86.sys -- (Avgmfx86)
DRV - [2011.02.22 08:12:38 | 000,022,992 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | Boot | Running] -- C:\Windows\system32\DRIVERS\AVGIDSEH.Sys -- (AVGIDSEH)
DRV - [2011.02.10 07:53:30 | 000,028,624 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\AVGIDSShim.sys -- (AVGIDSShim)
DRV - [2011.02.10 07:53:28 | 000,024,144 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\AVGIDSFilter.sys -- (AVGIDSFilter)
DRV - [2011.01.07 06:41:46 | 000,248,656 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\Windows\System32\drivers\avgldx86.sys -- (Avgldx86)
DRV - [2010.12.20 18:09:00 | 000,038,224 | ---- | M] (Malwarebytes Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\mbamswissarmy.sys -- (MBAMSwissArmy)
DRV - [2009.11.12 14:48:56 | 000,007,168 | ---- | M] () [File_System | On_Demand | Stopped] -- C:\Windows\System32\drivers\StarOpen.sys -- (StarOpen)
DRV - [2008.02.06 04:21:37 | 004,658,456 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\lvuvc.sys -- (LVUVC) Logitech QuickCam S5500(UVC)
DRV - [2008.02.06 04:21:25 | 000,041,752 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\LVUSBSta.sys -- (LVUSBSta)
DRV - [2008.02.06 04:20:40 | 000,628,760 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\lvrs.sys -- (LVRS)
DRV - [2008.02.05 18:20:08 | 000,025,624 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\LVPr2Mon.sys -- (LVPr2Mon)
DRV - [2008.02.05 18:18:12 | 000,689,176 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\Lvckap.sys -- (LVcKap)
DRV - [2006.11.20 15:14:08 | 000,038,400 | ---- | M] (O2Micro ) [Kernel | Boot | Running] -- C:\Windows\system32\DRIVERS\o2media.sys -- (O2MDRDR)
DRV - [2006.11.17 13:58:32 | 000,031,360 | ---- | M] (O2Micro ) [Kernel | Boot | Running] -- C:\Windows\system32\DRIVERS\o2sd.sys -- (O2SDRDR)
DRV - [2006.11.08 16:29:44 | 001,161,888 | ---- | M] (Agere Systems) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\AGRSM.sys -- (AgereSoftModem)
DRV - [2006.11.04 09:35:50 | 000,059,392 | ---- | M] (Realtek Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Rtlh86.sys -- (RTL8169)
DRV - [2006.10.30 09:42:28 | 001,786,880 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\NETw3v32.sys -- (NETw3v32) Intel(R)
DRV - [2006.09.28 22:41:46 | 000,247,808 | ---- | M] (Ralink Technology Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\netr73.sys -- (netr73)
DRV - [2006.07.03 10:31:26 | 000,009,088 | ---- | M] (Windows (R) 2000 DDK provider) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\MGHwCtrl.sys -- (MGHwCtrl)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.lge.com
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.lge.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\..\URLSearchHook:  - Reg Error: Key error. File not found
IE - HKCU\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} -  File not found
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: "ICQ Search"
FF - prefs.js..browser.search.param.yahoo-fr: "chr-greentree_ff&type=971163"
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de/"
FF - prefs.js..extensions.enabledItems: {800b5000-a755-47e1-992b-48a1c1357f07}:1.1.5
FF - prefs.js..extensions.enabledItems: moveplayer@movenetworks.com:1.0.0.071303000004
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {AB2CE124-6272-4b12-94A9-7303C7397BD1}:4.2.0.5198
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23
FF - prefs.js..extensions.enabledItems: {1E73965B-8B48-48be-9C8D-68B920ABC1C4}:10.0.0.1374
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA}:6.0.25
FF - prefs.js..keyword.URL: "hxxp://search.icq.com/search/afe_results.php?ch_id=afex&q="
 
FF - HKLM\software\mozilla\Firefox\Extensions\\{1E73965B-8B48-48be-9C8D-68B920ABC1C4}: C:\Program Files\AVG\AVG10\Firefox4\ [2011.05.11 16:10:55 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011.05.27 13:59:27 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011.05.27 13:59:24 | 000,000,000 | ---D | M]
 
[2009.01.07 21:47:11 | 000,000,000 | ---D | M] (No name found) -- C:\Users\***\AppData\Roaming\mozilla\Extensions
[2011.05.27 21:06:02 | 000,000,000 | ---D | M] (No name found) -- C:\Users\***\AppData\Roaming\mozilla\Firefox\Profiles\qbp86wnc.default\extensions
[2010.06.20 17:25:07 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\***\AppData\Roaming\mozilla\Firefox\Profiles\qbp86wnc.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2011.05.27 21:05:57 | 000,000,000 | ---D | M] (softonic-de3 Community Toolbar) -- C:\Users\***\AppData\Roaming\mozilla\Firefox\Profiles\qbp86wnc.default\extensions\{cc05a3e3-64c3-4af2-bfc1-af0d66b69065}
[2011.05.27 21:05:53 | 000,000,000 | ---D | M] (Conduit Engine) -- C:\Users\***\AppData\Roaming\mozilla\Firefox\Profiles\qbp86wnc.default\extensions\engine@conduit.com
[2009.11.25 22:05:31 | 000,000,000 | ---D | M] (Move Media Player) -- C:\Users\***\AppData\Roaming\mozilla\Firefox\Profiles\qbp86wnc.default\extensions\moveplayer@movenetworks.com
[2011.05.26 18:21:47 | 000,000,950 | ---- | M] () -- C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\qbp86wnc.default\searchplugins\icqplugin-1.xml
[2011.02.16 22:00:07 | 000,000,950 | ---- | M] () -- C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\qbp86wnc.default\searchplugins\icqplugin-10.xml
[2009.08.11 15:32:54 | 000,000,950 | ---- | M] () -- C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\qbp86wnc.default\searchplugins\icqplugin-2.xml
[2009.08.12 15:16:19 | 000,000,950 | ---- | M] () -- C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\qbp86wnc.default\searchplugins\icqplugin-3.xml
[2009.09.13 22:49:10 | 000,000,950 | ---- | M] () -- C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\qbp86wnc.default\searchplugins\icqplugin-4.xml
[2009.10.31 00:08:22 | 000,000,950 | ---- | M] () -- C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\qbp86wnc.default\searchplugins\icqplugin-5.xml
[2009.12.21 09:56:12 | 000,000,950 | ---- | M] () -- C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\qbp86wnc.default\searchplugins\icqplugin-6.xml
[2010.01.13 19:28:55 | 000,000,950 | ---- | M] () -- C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\qbp86wnc.default\searchplugins\icqplugin-7.xml
[2010.02.20 17:35:43 | 000,000,950 | ---- | M] () -- C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\qbp86wnc.default\searchplugins\icqplugin-8.xml
[2010.03.31 07:06:42 | 000,000,950 | ---- | M] () -- C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\qbp86wnc.default\searchplugins\icqplugin-9.xml
[2009.07.25 14:22:11 | 000,000,944 | ---- | M] () -- C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\qbp86wnc.default\searchplugins\icqplugin.xml
[2011.05.27 13:59:27 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2009.07.15 20:49:18 | 000,000,000 | ---D | M] ("ICQ Toolbar") -- C:\Programme\Mozilla Firefox\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}
[2010.07.18 22:50:17 | 000,000,000 | ---D | M] (Skype extension for Firefox) -- C:\Programme\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}
[2010.06.19 17:44:38 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2010.12.04 00:21:55 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
[2011.01.27 00:03:58 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}
[2011.05.11 16:58:36 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA}
File not found (No name found) --
[2011.05.11 16:10:55 | 000,000,000 | ---D | M] (AVG Safe Search) -- C:\PROGRAM FILES\AVG\AVG10\FIREFOX4
[2009.07.25 16:39:27 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}
[2009.09.01 23:12:01 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}
[2010.04.11 13:06:05 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA}
[2010.06.19 17:44:38 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2010.12.04 00:21:55 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
[2011.01.27 00:03:58 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}
[2011.05.11 16:58:36 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA}
[2011.04.14 18:40:03 | 000,142,296 | ---- | M] (Mozilla Foundation) -- C:\Programme\Mozilla Firefox\components\browsercomps.dll
[2011.04.14 05:08:00 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Programme\Mozilla Firefox\plugins\npdeployJava1.dll
[2010.03.08 12:24:04 | 000,103,168 | ---- | M] (Midasplayer Ltd) -- C:\Programme\Mozilla Firefox\plugins\npmidas.dll
[2010.01.01 10:00:00 | 000,001,392 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\amazondotcom-de.xml
[2010.01.01 10:00:00 | 000,002,252 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\bing.xml
[2010.01.01 10:00:00 | 000,001,153 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\eBay-de.xml
[2010.01.01 10:00:00 | 000,006,805 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\leo_ende_de.xml
[2010.01.01 10:00:00 | 000,001,178 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\wikipedia-de.xml
[2010.01.01 10:00:00 | 000,001,105 | ---- | M] () -- C:\Programme\Mozilla Firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2006.09.18 23:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1      localhost
O1 - Hosts: ::1            localhost
O2 - BHO: (Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Programme\AVG\AVG10\avgssie.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programme\Google\GoogleToolbarNotifier\5.6.5805.1910\swg.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (ICQToolBar) - {855F3B16-6D32-4fe6-8A56-BBB695989046} -  File not found
O3 - HKLM\..\Toolbar: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (ICQToolBar) - {855F3B16-6D32-4FE6-8A56-BBB695989046} -  File not found
O4 - HKLM..\Run: [AVG_TRAY] C:\Programme\AVG\AVG10\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [LG Intelligent Update] C:\Program Files\lg_swupdate\giljabistart.exe (BIT LEADER)
O4 - HKLM..\Run: [LogitechCommunicationsManager] C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe ()
O4 - HKLM..\Run: [LogitechQuickCamRibbon] C:\Program Files\Logitech\QuickCam\Quickcam.exe ()
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware (reboot)] C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [MGSysCtrl] C:\Programme\LG Software\System Control Manager\MGSysCtrl.exe (MSI)
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [WinampAgent]  File not found
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKCU..\Run: [SpybotSD TeaTimer] C:\Programme\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
O4 - HKCU..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O4 - Startup: C:\Users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 2.3.lnk = C:\Programme\OpenOffice.org 2.3\program\quickstart.exe ()
O8 - Extra context menu item: Google Sidewiki... - C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_950DF09FAB501E03.dll (Google Inc.)
O9 - Extra 'Tools' menuitem : Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab (Java Plug-in 1.6.0_25)
O16 - DPF: {CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab (Java Plug-in 1.6.0_25)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab (Java Plug-in 1.6.0_25)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O18 - Protocol\Handler\bwfile-8876480 {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Programme\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll (Logitech Inc.)
O18 - Protocol\Handler\fluxhttp {8E2D00A0-82C6-4821-90BC-07F290841BB6} - C:\Programme\Common Files\fluxDVD\Lib\XEB\xebnavigation.ax ()
O18 - Protocol\Handler\fluxhttp\0x00000007 {8E2D00A0-82C6-4821-90BC-07F290841BB6} - C:\Programme\Common Files\fluxDVD\Lib\XEB\xebnavigation.ax ()
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Programme\AVG\AVG10\avgpp.dll (AVG Technologies CZ, s.r.o.)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\img34.jpg
O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\img34.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O34 - HKLM BootExecute: (C:\PROGRA~1\AVG\AVG10\avgchsvx.exe /sync) - C:\Programme\AVG\AVG10\avgchsvx.exe (AVG Technologies CZ, s.r.o.)
O34 - HKLM BootExecute: (C:\PROGRA~1\AVG\AVG10\avgrsx.exe /sync /restart) - C:\Programme\AVG\AVG10\avgrsx.exe (AVG Technologies CZ, s.r.o.)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} -
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 11.0
ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} -
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\system32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\Windows\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\system32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
 
NetSvcs: FastUserSwitchingCompatibility -  File not found
NetSvcs: Ias -  File not found
NetSvcs: Nla -  File not found
NetSvcs: Ntmssvc -  File not found
NetSvcs: NWCWorkstation -  File not found
NetSvcs: Nwsapagent -  File not found
NetSvcs: SRService -  File not found
NetSvcs: WmdmPmSp -  File not found
NetSvcs: LogonHours -  File not found
NetSvcs: PCAudit -  File not found
NetSvcs: helpsvc -  File not found
NetSvcs: uploadmgr -  File not found
 
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
 
========== Files/Folders - Created Within 30 Days ==========
 
[2011.05.28 14:17:18 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
[2011.05.28 14:17:13 | 000,000,000 | ---D | C] -- C:\Programme\CCleaner
[2011.05.28 01:49:36 | 000,000,000 | ---D | C] -- C:\Windows\System32\eu-ES
[2011.05.28 01:49:36 | 000,000,000 | ---D | C] -- C:\Windows\System32\ca-ES
[2011.05.28 01:49:35 | 000,000,000 | ---D | C] -- C:\Windows\System32\vi-VN
[2011.05.27 23:54:03 | 000,000,000 | ---D | C] -- C:\Windows\System32\EventProviders
[2011.05.27 21:43:44 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\Malwarebytes
[2011.05.27 21:43:20 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys
[2011.05.27 21:43:20 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2011.05.27 21:43:19 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2011.05.27 21:43:13 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2011.05.27 21:43:13 | 000,000,000 | ---D | C] -- C:\Programme\Malwarebytes' Anti-Malware
[2011.05.27 14:05:15 | 000,000,000 | -HSD | C] -- C:\Config.Msi
[2011.05.11 17:03:53 | 000,000,000 | ---D | C] -- C:\Programme\Common Files\Java
[2011.05.02 14:09:32 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\AVG10
[2011.05.02 14:04:23 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG 2011
[2011.05.02 14:00:19 | 000,000,000 | ---D | C] -- C:\Windows\System32\drivers\AVG
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2011.05.28 15:06:39 | 116,341,506 | ---- | M] () -- C:\Windows\System32\drivers\AVG\incavi.avm
[2011.05.28 14:59:11 | 000,003,168 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2011.05.28 14:59:11 | 000,003,168 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2011.05.28 14:21:08 | 000,001,098 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2011.05.28 14:17:18 | 000,000,804 | ---- | M] () -- C:\Users\Public\Desktop\CCleaner.lnk
[2011.05.28 11:07:09 | 000,595,996 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2011.05.28 11:07:08 | 000,628,742 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2011.05.28 11:07:08 | 000,126,260 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2011.05.28 11:07:08 | 000,104,070 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2011.05.28 10:59:48 | 000,001,094 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2011.05.28 10:59:20 | 000,016,384 | ---- | M] () -- C:\Windows\System32\Ikeext.etl
[2011.05.28 10:59:03 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2011.05.28 10:58:27 | 1064,689,664 | -HS- | M] () -- C:\hiberfil.sys
[2011.05.28 01:56:59 | 000,308,360 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2011.05.27 21:43:24 | 000,000,906 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011.05.27 13:59:37 | 000,000,846 | ---- | M] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2011.05.26 19:36:59 | 000,044,544 | ---- | M] () -- C:\Users\***\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011.05.11 17:14:48 | 000,030,720 | ---- | M] () -- C:\Windows\System32\npmpsoxy.dll
[2011.05.11 16:13:54 | 000,000,846 | ---- | M] () -- C:\Users\Public\Desktop\AVG 2011.lnk
[2011.05.02 19:04:32 | 000,119,374 | ---- | M] () -- C:\Users\***\Documents\Email Fuerte Ventura.pdf
[2011.05.02 18:29:46 | 000,175,403 | ---- | M] () -- C:\Users\***\Documents\Ryanair-Fuerte Ventura.pdf
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2011.05.28 15:06:39 | 116,341,506 | ---- | C] () -- C:\Windows\System32\drivers\AVG\incavi.avm
[2011.05.28 14:17:18 | 000,000,804 | ---- | C] () -- C:\Users\Public\Desktop\CCleaner.lnk
[2011.05.27 21:43:24 | 000,000,906 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011.05.27 13:59:36 | 000,000,858 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
[2011.05.11 17:14:48 | 000,030,720 | ---- | C] () -- C:\Windows\System32\npmpsoxy.dll
[2011.05.02 19:04:28 | 000,119,374 | ---- | C] () -- C:\Users\***\Documents\Email Fuerte Ventura.pdf
[2011.05.02 18:29:39 | 000,175,403 | ---- | C] () -- C:\Users\***\Documents\Ryanair-Fuerte Ventura.pdf
[2011.05.02 14:04:29 | 000,000,846 | ---- | C] () -- C:\Users\Public\Desktop\AVG 2011.lnk
[2011.01.02 14:50:36 | 000,032,608 | ---- | C] () -- C:\Windows\king-uninstall.exe
[2010.12.07 23:13:01 | 000,018,904 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin
[2010.12.05 18:57:17 | 000,107,612 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin
[2010.12.05 18:57:16 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll
[2010.06.13 23:17:37 | 000,005,000 | ---- | C] () -- C:\Users\***\AppData\Local\d3d9caps.dat
[2010.03.06 04:16:53 | 000,007,168 | ---- | C] () -- C:\Windows\System32\drivers\StarOpen.sys
[2010.03.05 20:41:48 | 000,000,034 | ---- | C] () -- C:\Windows\cdplayer.ini
[2009.09.01 00:06:57 | 000,116,224 | ---- | C] () -- C:\Windows\System32\pdfcmnnt.dll
[2009.07.29 20:31:39 | 000,066,482 | ---- | C] () -- C:\Windows\System32\lvcoinst.ini
[2009.07.15 20:13:03 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2008.05.08 18:05:10 | 000,000,890 | ---- | C] () -- C:\Windows\ccinst.ini
[2008.04.27 19:52:56 | 000,044,544 | ---- | C] () -- C:\Users\***\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2008.02.05 18:20:08 | 000,025,624 | ---- | C] () -- C:\Windows\System32\drivers\LVPr2Mon.sys
[2007.10.19 21:23:50 | 000,098,304 | ---- | C] () -- C:\Windows\System32\MGHwCtrl.dll
[2007.10.19 21:23:50 | 000,032,768 | ---- | C] () -- C:\Windows\System32\MGFPCtrl.dll
[2007.10.19 21:23:50 | 000,024,576 | ---- | C] () -- C:\Windows\System32\MGPwrShm.dll
[2007.07.03 04:52:13 | 000,009,589 | ---- | C] () -- C:\Windows\lg_up.ini
[2007.07.03 04:40:03 | 000,000,896 | ---- | C] () -- C:\Windows\lgcenter.ini
[2007.07.02 11:30:53 | 001,060,424 | ---- | C] () -- C:\Windows\System32\WdfCoInstaller01000.dll
[2007.07.02 11:30:45 | 000,204,800 | ---- | C] () -- C:\Windows\System32\igfxCoIn_v1187.dll
[2007.07.02 11:23:59 | 000,000,181 | ---- | C] () -- C:\Windows\lgps.ini
[2006.11.02 17:33:31 | 000,628,742 | ---- | C] () -- C:\Windows\System32\perfh007.dat
[2006.11.02 17:33:31 | 000,290,748 | ---- | C] () -- C:\Windows\System32\perfi007.dat
[2006.11.02 17:33:31 | 000,126,260 | ---- | C] () -- C:\Windows\System32\perfc007.dat
[2006.11.02 17:33:31 | 000,036,916 | ---- | C] () -- C:\Windows\System32\perfd007.dat
[2006.11.02 14:57:28 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2006.11.02 14:47:37 | 000,308,360 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT
[2006.11.02 14:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll
[2006.11.02 12:33:01 | 000,595,996 | ---- | C] () -- C:\Windows\System32\perfh009.dat
[2006.11.02 12:33:01 | 000,287,440 | ---- | C] () -- C:\Windows\System32\perfi009.dat
[2006.11.02 12:33:01 | 000,104,070 | ---- | C] () -- C:\Windows\System32\perfc009.dat
[2006.11.02 12:33:01 | 000,030,674 | ---- | C] () -- C:\Windows\System32\perfd009.dat
[2006.11.02 12:25:21 | 000,180,224 | ---- | C] () -- C:\Windows\System32\igfxTMM.dll
[2006.11.02 12:23:21 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat
[2006.11.02 10:58:30 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2006.11.02 10:19:00 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT
[2006.11.02 09:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini
[2006.11.02 09:25:31 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat
[2005.01.21 12:02:28 | 000,013,312 | ---- | C] () -- C:\Windows\System32\RMDevice.dll
[2004.08.19 18:47:32 | 000,098,304 | ---- | C] () -- C:\Windows\System32\lxbuinsr.dll
[2004.08.19 18:47:24 | 000,032,768 | ---- | C] () -- C:\Windows\System32\lxbucur.dll
[2004.08.19 18:46:54 | 000,131,072 | ---- | C] () -- C:\Windows\System32\lxbujswr.dll
[2003.07.11 15:55:28 | 000,040,960 | ---- | C] () -- C:\Windows\System32\lxbuvs.dll
 
========== LOP Check ==========
 
[2009.08.21 23:20:52 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Amazon
[2011.05.02 14:09:32 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\AVG10
[2010.03.06 04:17:31 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Canneverbe Limited
[2010.06.19 13:11:00 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Facebook
[2008.05.12 13:50:22 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\ICQ Toolbar
[2009.07.29 20:32:09 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Leadertech
[2010.05.02 15:57:12 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\uTorrent
[2011.05.28 03:47:12 | 000,032,514 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
 
< %SYSTEMDRIVE%\*. >
[2011.02.16 00:27:50 | 000,000,000 | -H-D | M] -- C:\$AVG
[2008.02.15 18:25:05 | 000,000,000 | -HSD | M] -- C:\$Recycle.Bin
[2011.05.28 02:03:45 | 000,000,000 | -HSD | M] -- C:\Boot
[2011.05.27 23:43:06 | 000,000,000 | -HSD | M] -- C:\Config.Msi
[2008.05.16 00:41:57 | 000,000,000 | ---D | M] -- C:\ContentComposer
[2006.11.02 15:02:03 | 000,000,000 | -HSD | M] -- C:\Documents and Settings
[2008.02.15 18:23:46 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen
[2010.08.15 17:00:31 | 000,000,000 | ---D | M] -- C:\drivers
[2007.10.19 21:17:22 | 000,000,000 | ---D | M] -- C:\Intel
[2009.08.16 10:37:16 | 000,000,000 | ---D | M] -- C:\My documents
[2010.12.04 18:07:24 | 000,000,000 | ---D | M] -- C:\PerfLogs
[2011.05.28 14:17:13 | 000,000,000 | R--D | M] -- C:\Programme
[2011.05.27 21:43:19 | 000,000,000 | -H-D | M] -- C:\ProgramData
[2008.02.15 18:23:46 | 000,000,000 | -HSD | M] -- C:\Programme
[2011.05.28 15:13:02 | 000,000,000 | -HSD | M] -- C:\System Volume Information
[2009.06.29 20:16:18 | 000,000,000 | ---D | M] -- C:\Temp
[2008.02.15 18:24:41 | 000,000,000 | R--D | M] -- C:\Users
[2011.05.28 14:28:03 | 000,000,000 | ---D | M] -- C:\Windows
 
< %PROGRAMFILES%\*.exe >
 
< %LOCALAPPDATA%\*.exe >
 
< %systemroot%\*. /mp /s >
 
 
< MD5 for: EXPLORER.EXE  >
[2008.10.29 08:20:29 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=37440D09DEAE0B672A04DCCF7ABF06BE -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16771_none_4f83bb287ccdb7e3\explorer.exe
[2008.10.29 08:29:41 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=4F554999D7D5F05DAAEBBA7B5BA1089D -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18164_none_5177ca9879e978e8\explorer.exe
[2008.10.30 05:59:17 | 002,927,616 | ---- | M] (Microsoft Corporation) MD5=50BA5850147410CDE89C523AD3BC606E -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.22298_none_51e4f8c7931bd1e1\explorer.exe
[2008.03.08 12:17:36 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=6D06CD98D954FE87FB2DB8108793B399 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16549_none_4fac29707cae347a\explorer.exe
[2008.03.08 12:17:35 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=BD06F0BF753BC704B653C3A50F89D362 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.20668_none_501f261995dcf2cf\explorer.exe
[2009.04.11 08:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 -- C:\Windows\explorer.exe
[2009.04.11 08:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6002.18005_none_53a0201e76de3a0b\explorer.exe
[2008.10.28 04:15:02 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=E7156B0B74762D9DE0E66BDCDE06E5FB -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.20947_none_5033cb5995cd990b\explorer.exe
[2006.11.02 11:45:07 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=FD8C53FB002217F6F888BCF6F5D7084D -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16386_none_4f7de5167cd15deb\explorer.exe
[2008.01.19 09:33:10 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=FFA764631CB70A30065C12EF8E174F9F -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18000_none_51b4a71279bc6ebf\explorer.exe
 
< MD5 for: REGEDIT.EXE  >
[2008.01.19 09:33:24 | 000,134,656 | ---- | M] (Microsoft Corporation) MD5=467A3B03E924B7B7EDD16D34740574B0 -- C:\Windows\regedit.exe
[2008.01.19 09:33:24 | 000,134,656 | ---- | M] (Microsoft Corporation) MD5=467A3B03E924B7B7EDD16D34740574B0 -- C:\Windows\winsxs\x86_microsoft-windows-registry-editor_31bf3856ad364e35_6.0.6001.18000_none_f42eb564dbd8a697\regedit.exe
[2006.11.02 11:45:35 | 000,134,656 | ---- | M] (Microsoft Corporation) MD5=F13123E76FDA33E55F11E0EB832E832A -- C:\Windows\winsxs\x86_microsoft-windows-registry-editor_31bf3856ad364e35_6.0.6000.16386_none_f1f7f368deed95c3\regedit.exe
 
< MD5 for: USERINIT.EXE  >
[2008.01.19 09:33:33 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\System32\userinit.exe
[2008.01.19 09:33:33 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6001.18000_none_dc28ba15d1aff80b\userinit.exe
[2006.11.02 11:45:50 | 000,024,576 | ---- | M] (Microsoft Corporation) MD5=22027835939F86C3E47AD8E3FBDE3D11 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6000.16386_none_d9f1f819d4c4e737\userinit.exe
 
< MD5 for: WININIT.EXE  >
[2008.01.19 09:33:37 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=101BA3EA053480BB5D957EF37C06B5ED -- C:\Windows\System32\wininit.exe
[2008.01.19 09:33:37 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=101BA3EA053480BB5D957EF37C06B5ED -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.0.6001.18000_none_30f2b8cf0450a6a2\wininit.exe
[2006.11.02 11:45:57 | 000,095,744 | ---- | M] (Microsoft Corporation) MD5=D4385B03E8CCCEE6F0EE249F827C1F3E -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.0.6000.16386_none_2ebbf6d3076595ce\wininit.exe
 
< MD5 for: WINLOGON.EXE  >
[2009.04.11 08:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\System32\winlogon.exe
[2009.04.11 08:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6002.18005_none_71ae7a22d2134741\winlogon.exe
[2006.11.02 11:45:57 | 000,308,224 | ---- | M] (Microsoft Corporation) MD5=9F75392B9128A91ABAFB044EA350BAAD -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6000.16386_none_6d8c3f1ad8066b21\winlogon.exe
[2008.01.19 09:33:37 | 000,314,880 | ---- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6001.18000_none_6fc30116d4f17bf5\winlogon.exe
 
< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >
 
< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2011-05-27 23:32:16

< End of report >
--- --- ---


Extras.TxT:

OTL Logfile:
Code:
OTL Extras logfile created on: 28.05.2011 15:08:58 - Run 1
OTL by OldTimer - Version 3.2.23.0    Folder = C:\Users\***\Downloads
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.19048)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
1014,64 Mb Total Physical Memory | 202,95 Mb Available Physical Memory | 20,00% Memory free
2,24 Gb Paging File | 1,05 Gb Available in Paging File | 46,92% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 148,04 Gb Total Space | 101,66 Gb Free Space | 68,67% Space Free | Partition Type: NTFS
 
Computer Name: DANI-NOTEBOOK | User Name: Dani | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 1
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"VistaSp2" = Reg Error: Unknown registry data type -- File not found
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
========== System Restore Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore]
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
========== Authorized Applications List ==========
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{18F4C66F-1BAF-47CE-B437-5DE4064AAEA7}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{228AF9AF-B893-48F0-9144-B411BB07C653}" = protocol=6 | dir=in | app=c:\program files\logitech\desktop messenger\8876480\program\logitechdesktopmessenger.exe |
"{363A099D-37E1-43EA-895A-969A8C705297}" = protocol=17 | dir=in | app=c:\program files\logitech\desktop messenger\8876480\program\logitechdesktopmessenger.exe |
"{3906340B-B1F2-446A-9D24-099B6B92E7C1}" = protocol=17 | dir=in | app=c:\program files\avg\avg10\avgdiagex.exe |
"{57AB2FF6-A9F2-4F06-A206-716B9FA99E31}" = protocol=6 | dir=in | app=c:\program files\avg\avg10\avgdiagex.exe |
"{5D4C0393-696D-48C4-BD94-C15B5EA07304}" = protocol=6 | dir=in | app=c:\program files\avg\avg10\avgnsx.exe |
"{61281235-C1ED-4B2B-ADAB-2876214A34CB}" = protocol=6 | dir=in | app=c:\program files\avg\avg10\avgmfapx.exe |
"{78EF0061-0B61-4C29-B3D3-202253D14623}" = protocol=6 | dir=in | app=c:\program files\avg\avg10\avgemcx.exe |
"{805A3E77-9F9C-46BE-BE29-A03BA2C76704}" = protocol=6 | dir=in | app=c:\program files\itunes\itunes.exe |
"{976B86E0-7F8C-4897-86C7-5628ED24DFD9}" = protocol=17 | dir=in | app=c:\program files\avg\avg10\avgnsx.exe |
"{978AEB42-6F95-41D1-90BC-9D31693E554C}" = protocol=17 | dir=in | app=c:\program files\avg\avg10\avgemcx.exe |
"{9E88F43C-352F-4813-B19F-2048C27C7665}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{A1EC9F9A-0619-426C-B9C5-DC67E31C0F98}" = protocol=17 | dir=in | app=c:\program files\logitech\desktop messenger\8876480\program\logitechdesktopmessenger.exe |
"{AB0E9769-9FA4-4033-9847-61BC219F6002}" = protocol=6 | dir=in | app=c:\program files\logitech\desktop messenger\8876480\program\logitechdesktopmessenger.exe |
"{AB56AB07-5214-4AF4-BF5E-D044DDE9BB31}" = protocol=17 | dir=in | app=c:\program files\avg\avg10\avgmfapx.exe |
"{C244C80F-49C6-4628-95F3-FD1D8FC9FA89}" = protocol=17 | dir=in | app=c:\program files\logitech\desktop messenger\8876480\program\logitechdesktopmessenger.exe |
"{CF60E9D7-3BBE-4329-8207-D5874B366EC1}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{D2E2D3E9-2291-4138-9F56-C0B7A5A72FAF}" = protocol=6 | dir=in | app=c:\program files\logitech\desktop messenger\8876480\program\logitechdesktopmessenger.exe |
"{E4C0AD93-BD10-487D-97FB-AD36A6D5DC7D}" = protocol=17 | dir=in | app=c:\program files\itunes\itunes.exe |
"TCP Query User{78E2D04B-E7BD-48B3-898C-2DE8224DFC2A}C:\program files\soulseekns\slsk.exe" = protocol=6 | dir=in | app=c:\program files\soulseekns\slsk.exe |
"TCP Query User{965C2BA2-A6D1-4D17-B94D-5F9D4941CB14}C:\program files\mozilla firefox\firefox.exe" = protocol=6 | dir=in | app=c:\program files\mozilla firefox\firefox.exe |
"TCP Query User{C4E48F61-184B-46AB-B753-93DF302E65F9}C:\program files\ea games\mohaa\mohaa.exe" = protocol=6 | dir=in | app=c:\program files\ea games\mohaa\mohaa.exe |
"TCP Query User{C8C0E0A0-A2FE-40E8-8112-E93ACDE3E6CB}C:\program files\icq6.5\icq.exe" = protocol=6 | dir=in | app=c:\program files\icq6.5\icq.exe |
"TCP Query User{CF1B17F2-42E9-4017-AE8F-37765E853161}C:\users\***\desktop\utorrent_2.0.exe" = protocol=6 | dir=in | app=c:\users\***\desktop\utorrent_2.0.exe |
"TCP Query User{D5ACD48A-253A-4131-8D14-82D40F4BCA94}C:\program files\internet explorer\iexplore.exe" = protocol=6 | dir=in | app=c:\program files\internet explorer\iexplore.exe |
"TCP Query User{DC322422-4704-4650-B8A3-8B14651D00CC}C:\program files\icq6\icq.exe" = protocol=6 | dir=in | app=c:\program files\icq6\icq.exe |
"UDP Query User{23D7AE1C-F02A-44D1-950D-E502A476E9BB}C:\users\***\desktop\utorrent_2.0.exe" = protocol=17 | dir=in | app=c:\users\***\desktop\utorrent_2.0.exe |
"UDP Query User{40021DA0-BA4E-4C63-B5A4-A06FB7C35219}C:\program files\icq6.5\icq.exe" = protocol=17 | dir=in | app=c:\program files\icq6.5\icq.exe |
"UDP Query User{6B65D546-41B4-42BD-917B-A929D860D040}C:\program files\internet explorer\iexplore.exe" = protocol=17 | dir=in | app=c:\program files\internet explorer\iexplore.exe |
"UDP Query User{A17C1EFC-6759-41B3-A617-0BF4E7885C92}C:\program files\icq6\icq.exe" = protocol=17 | dir=in | app=c:\program files\icq6\icq.exe |
"UDP Query User{A9FB1B05-D1D7-4E41-BBA7-15D974C5944E}C:\program files\soulseekns\slsk.exe" = protocol=17 | dir=in | app=c:\program files\soulseekns\slsk.exe |
"UDP Query User{C4AAB6BC-29F0-479C-92FB-2E951C2884BA}C:\program files\ea games\mohaa\mohaa.exe" = protocol=17 | dir=in | app=c:\program files\ea games\mohaa\mohaa.exe |
"UDP Query User{D66576F5-BFFF-4864-B17F-57F0D38BCB94}C:\program files\mozilla firefox\firefox.exe" = protocol=17 | dir=in | app=c:\program files\mozilla firefox\firefox.exe |
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}" = PDFCreator
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{07287123-B8AC-41CE-8346-3D777245C35B}" = Bonjour
"{0DEA94ED-915A-4834-A87E-388D012C8E02}" = Medal of Honor Allied Assault
"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{230E8DDC-FB78-4F9F-8461-22ED20DBC3BA}" = AVG 2011
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{26A24AE4-039D-4CA4-87B4-2F83216019FF}" = Java(TM) 6 Update 25
"{3562A082-CF01-419B-8A02-233E31B8A83C}" = O2Micro Flash Memory Card Windows Driver V3.00
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{447E63B1-507A-45FF-A6FE-E8A5B960E7FD}" = Druckstudio FotoKalender
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{53735ECE-E461-4FD0-B742-23A352436D3A}" = Logitech Updater
"{57752979-A1C9-4C02-856B-FBB27AC4E02C}" = QuickTime
"{6444D9D9-CD6C-4464-B970-55C606C944DC}" = Logitech QuickCam
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{7E265513-8CDA-4631-B696-F40D983F3B07}_is1" = CDBurnerXP
"{81717D01-32F6-449C-85E1-41AFD678E545}" = LG Intelligent Update
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek 8169 PCI, 8168 and 8101E PCIe Ethernet Network Card Driver for Windows Vista
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{900B1197-53F5-4F46-A882-2CFFFE2EEDCB}" = Logitech Desktop Messenger
"{981029E0-7FC9-4CF3-AB39-6F133621921A}" = Skype Toolbars
"{a0fe116e-9a8a-466f-aee0-625cb7c207e3}" = Microsoft Visual C++ 2005 Redistributable - KB2467175
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AADEA55D-C834-4BCB-98A3-4B8D1C18F4EE}" = Apple Mobile Device Support
"{AC76BA86-7AD7-1031-7B44-A81200000003}" = Adobe Reader 8.1.2 - Deutsch
"{AC76BA86-7AD7-2447-0000-800000000003}" = Chinese Simplified Fonts Support For Adobe Reader 8
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{BABA6734-23CF-42AC-9E4C-EA2C7C80AA4E}" = AVG 2011
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.2
"{DA34FE93-5DC5-48E0-ACC8-A5389E05BB51}" = iTunes
"{DD5B65F7-7CA5-4DE4-AEE7-7E8F26BF78F5}" = OpenOffice.org 2.3
"{E38C00D0-A68B-4318-A8A6-F7D4B5B1DF0E}" = Windows Media Encoder 9-Reihe
"{E5809572-2ADC-11D7-81AC-00D009DAF871}" = GrafStat Ausgabe 2006
"{ED9C5D25-55DF-48D8-9328-2AC0D75DE5D8}" = System Control Manager
"{EE6097DD-05F4-4178-9719-D3170BF098E8}" = Apple Application Support
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"Adobe Flash Player ActiveX" = Adobe Flash Player ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Agere Systems Soft Modem" = Agere Systems HDA Modem
"Amazon MP3-Downloader" = Amazon MP3-Downloader 1.0.5
"Audacity_is1" = Audacity 1.2.6
"Audiograbber" = Audiograbber 1.83 SE
"AVG" = AVG 2011
"CCleaner" = CCleaner
"Combined Community Codec Pack_is1" = Combined Community Codec Pack 2009-09-09
"HDMI" = Intel(R) Graphics Media Accelerator Driver
"ICQToolbar" = ICQ Toolbar
"InstallShield_{3562A082-CF01-419B-8A02-233E31B8A83C}" = O2Micro Flash Memory Card Windows Driver V3.00
"InstallShield_{E5809572-2ADC-11D7-81AC-00D009DAF871}" = GrafStat Ausgabe 2006
"king.com" = king.com (remove only)
"LAME for Audacity_is1" = LAME v3.98.2 for Audacity
"lvdrivers_11.70" = Logitech QuickCam-Treiberpaket
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Mozilla Firefox 4.0.1 (x86 de)" = Mozilla Firefox 4.0.1 (x86 de)
"Soulseek2" = SoulSeek 157 NS 13e
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"Videoload Manager" = Videoload Manager 2.0.2200
"Windows Media Encoder 9" = Windows Media Encoder 9-Reihe
"WinRAR archiver" = WinRAR
 
========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Facebook Plug-In" = Facebook Plug-In
 
========== Last 10 Event Log Errors ==========
 
[ Application Events ]
Error - 24.04.2011 05:08:25 | Computer Name = ***-Notebook | Source = Windows Search Service | ID = 3013
Description =
 
Error - 25.04.2011 05:09:04 | Computer Name = ***-Notebook | Source = Windows Search Service | ID = 3013
Description =
 
Error - 25.04.2011 05:09:04 | Computer Name = ***-Notebook | Source = Windows Search Service | ID = 3013
Description =
 
Error - 26.04.2011 16:52:01 | Computer Name = ***-Notebook | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description =
 
Error - 28.04.2011 16:00:07 | Computer Name = ***-Notebook | Source = Windows Search Service | ID = 3013
Description =
 
Error - 28.04.2011 16:00:17 | Computer Name = ***-Notebook | Source = Windows Search Service | ID = 3013
Description =
 
Error - 28.04.2011 16:00:17 | Computer Name = ***-Notebook | Source = Windows Search Service | ID = 3013
Description =
 
Error - 28.04.2011 16:00:17 | Computer Name = ***-Notebook | Source = Windows Search Service | ID = 3013
Description =
 
Error - 01.05.2011 05:29:42 | Computer Name = ***-Notebook | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung RIMBBLaunchAgent.exe, Version 4.2.0.9, Zeitstempel
 0x4d5e9443, fehlerhaftes Modul kernel32.dll, Version 6.0.6001.18215, Zeitstempel
 0x49953395, Ausnahmecode 0xe06d7363, Fehleroffset 0x000442eb,  Prozess-ID 0x884,
Anwendungsstartzeit 01cc07e23cfd31ee.
 
Error - 02.05.2011 12:22:27 | Computer Name = ***-Notebook | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung AcroRd32.exe, Version 8.1.0.137, Zeitstempel
 0x46444e37, fehlerhaftes Modul unknown, Version 0.0.0.0, Zeitstempel 0x00000000,
 Ausnahmecode 0xc0000005, Fehleroffset 0x24003f75,  Prozess-ID 0x2590, Anwendungsstartzeit
 01cc08e4ef4c6c2e.
 
[ System Events ]
Error - 27.05.2011 07:14:11 | Computer Name = ***-Notebook | Source = HTTP | ID = 15016
Description =
 
Error - 27.05.2011 07:15:10 | Computer Name = ***-Notebook | Source = Service Control Manager | ID = 7000
Description =
 
Error - 27.05.2011 17:43:24 | Computer Name = ***-Notebook | Source = HTTP | ID = 15021
Description =
 
Error - 27.05.2011 17:43:24 | Computer Name = ***-Notebook | Source = HTTP | ID = 15016
Description =
 
Error - 27.05.2011 17:44:09 | Computer Name = ***-Notebook | Source = Service Control Manager | ID = 7000
Description =
 
Error - 27.05.2011 19:57:29 | Computer Name = ***-Notebook | Source = HTTP | ID = 15021
Description =
 
Error - 27.05.2011 19:58:14 | Computer Name = ***-Notebook | Source = Service Control Manager | ID = 7000
Description =
 
Error - 27.05.2011 20:03:58 | Computer Name = ***-Notebook | Source = DCOM | ID = 10010
Description =
 
Error - 28.05.2011 04:59:13 | Computer Name = ***-Notebook | Source = HTTP | ID = 15021
Description =
 
Error - 28.05.2011 04:59:26 | Computer Name = ***-Notebook | Source = Service Control Manager | ID = 7000
Description =
 
 
< End of report >
--- --- ---

[/CODE]

Wär super, wenn ihr mir helfen könntet! :daumenhoc

Lieben Dank vorab!
sporty33

cosinus 29.05.2011 11:04
Hallo und :hallo:

Bitte routinemäßig einen Vollscan mit malwarebytes machen und Log posten.
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss!

Falls Logs aus älteren Scans mit Malwarebytes vorhanden sind, bitte auch davon alle posten!

sporty33 29.05.2011 14:02
Trojaner WIN32.Katusha.o lässt sich nicht entfernen
 
Hallo Arne,

vielen Dank für Deine Antwort. Habe den Vollscan mit Malwarebytes durchgeführt, dieser findet jedoch keinen Virus... Gehe aber davon aus, dass der Trojaner noch da ist, denn mit dem Spybot habe ich ihn gestern ja noch gefunden...

Anbei schonmal der Logfile, hoffe, Du kanst mir da weiterhelfen.

Vielen Dank vorab!

sporty33
Code:
Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org
 
Datenbank Version: 6711
 
Windows 6.0.6002 Service Pack 2
Internet Explorer 8.0.6001.19048
 
29.05.2011 14:53:28
mbam-log-2011-05-29 (14-53-28).txt
 
Art des Suchlaufs: Vollständiger Suchlauf (C:\|E:\|)
Durchsuchte Objekte: 266483
Laufzeit: 1 Stunde(n), 51 Minute(n), 7 Sekunde(n)
 
Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0
 
Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)
 
Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)
 
Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)
 
Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)
 
Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)
 
Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)
 
Infizierte Dateien:
(Keine bösartigen Objekte gefunden)
Sorry, hab vorgestern auch noch einen Logfile über Malwarebytes gemacht. Die Iren habe ich natürlich bereits entfernt... :-)

Anbei:

Code:
Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org
 
Datenbank Version: 6694
 
Windows 6.0.6001 Service Pack 1
Internet Explorer 8.0.6001.19048
 
27.05.2011 23:33:41
mbam-log-2011-05-27 (23-33-41).txt
 
Art des Suchlaufs: Vollständiger Suchlauf (C:\|E:\|)
Durchsuchte Objekte: 262054
Laufzeit: 1 Stunde(n), 42 Minute(n), 38 Sekunde(n)
 
Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 7
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 2
 
Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)
 
Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)
 
Infizierte Registrierungsschlüssel:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{055FD26D-3A88-4e15-963D-DC8493744B1D} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{055FD26D-3A88-4e15-963D-DC8493744B1D} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\TypeLib\{77D6DDFA-7834-4541-B2B3-A8B0FB0E3924} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\ToolBand.XTTBPos00.1 (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\ToolBand.XTTBPos00 (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{055FD26D-3A88-4E15-963D-DC8493744B1D} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{055FD26D-3A88-4E15-963D-DC8493744B1D} (Trojan.BHO) -> Quarantined and deleted successfully.
 
Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)
 
Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)
 
Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)
 
Infizierte Dateien:
c:\Users\Dani\downloads\xvidsetup.exe (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\program files\icqtoolbar\toolbaru.dll (Trojan.BHO) -> Quarantined and deleted successfully.

cosinus 29.05.2011 14:56
Dann bitte jetzt CF ausführen. AVG musst du vorher vorübergehend deinstalllieren, da es sich nicht mit CF verträgt.

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix
  • Lade dir ComboFix hier herunter auf deinen Desktop. Benenne es beim Runterladen um in cofi.exe.
http://saved.im/mtm0nzyzmzd5/cofi.jpg
  • Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.
  • Starte cofi.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
    Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.
  • Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.
Wichtiger Hinweis:
Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

sporty33 29.05.2011 21:03
So anbei der Logfile von Combofix:

Code:
Combofix Logfile:

       
Code:

       
ComboFix 11-05-28.01 - *** 29.05.2011  21:08:18.1.2 - x86
Microsoft® Windows Vista™ Home Premium   6.0.6002.2.1252.49.1031.18.1015.245 [GMT 2:00]
ausgeführt von:: c:\users\***\Desktop\cofi.exe
SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\***\***.exe
c:\windows\TEMP\logishrd\LVPrcInj01.dll
.
.
(((((((((((((((((((((((   Dateien erstellt von 2011-04-28 bis 2011-05-29  ))))))))))))))))))))))))))))))
.
.
2011-05-29 19:30 . 2011-05-29 19:30        0        ---ha-w-        c:\users\***\AppData\Local\BITAA37.tmp
2011-05-29 19:24 . 2011-05-29 19:29        --------        d-----w-        c:\users\***\AppData\Local\temp
2011-05-29 19:24 . 2011-05-29 19:24        --------        d-----w-        c:\users\Default\AppData\Local\temp
2011-05-29 19:03 . 2011-05-29 19:03        --------        d-----w-        C:\32788R22FWJFW
2011-05-29 02:08 . 2011-05-29 02:08        --------        d-----w-        c:\program files\Windows Portable Devices
2011-05-29 02:04 . 2009-09-10 02:00        92672        ----a-w-        c:\windows\system32\UIAnimation.dll
2011-05-29 02:04 . 2009-09-10 02:01        3023360        ----a-w-        c:\windows\system32\UIRibbon.dll
2011-05-29 02:04 . 2009-09-10 02:00        1164800        ----a-w-        c:\windows\system32\UIRibbonRes.dll
2011-05-29 02:03 . 2009-09-25 01:33        369664        ----a-w-        c:\windows\system32\WMPhoto.dll
2011-05-29 02:03 . 2009-09-25 02:07        189440        ----a-w-        c:\windows\system32\WindowsCodecsExt.dll
2011-05-29 02:03 . 2009-09-25 02:10        974848        ----a-w-        c:\windows\system32\WindowsCodecs.dll
2011-05-29 02:03 . 2009-09-25 02:04        321024        ----a-w-        c:\windows\system32\PhotoMetadataHandler.dll
2011-05-29 02:03 . 2009-09-25 01:33        195584        ----a-w-        c:\windows\system32\dxdiagn.dll
2011-05-29 02:03 . 2009-09-25 01:32        252928        ----a-w-        c:\windows\system32\dxdiag.exe
2011-05-29 02:03 . 2009-09-25 01:31        519680        ----a-w-        c:\windows\system32\d3d11.dll
2011-05-29 02:00 . 2009-10-08 21:07        4096        ----a-w-        c:\windows\system32\oleaccrc.dll
2011-05-29 02:00 . 2009-10-08 21:08        555520        ----a-w-        c:\windows\system32\UIAutomationCore.dll
2011-05-29 02:00 . 2009-10-08 21:08        234496        ----a-w-        c:\windows\system32\oleacc.dll
2011-05-28 14:55 . 2011-01-20 14:15        979456        ----a-w-        c:\windows\system32\MFH264Dec.dll
2011-05-28 14:55 . 2011-01-20 16:08        478720        ----a-w-        c:\windows\system32\dxgi.dll
2011-05-28 14:55 . 2011-01-20 14:27        876032        ----a-w-        c:\windows\system32\XpsPrint.dll
2011-05-28 14:55 . 2011-01-20 14:24        135680        ----a-w-        c:\windows\system32\XpsRasterService.dll
2011-05-28 14:55 . 2011-01-20 16:37        638336        ----a-w-        c:\windows\system32\drivers\dxgkrnl.sys
2011-05-28 14:55 . 2011-01-20 14:14        357376        ----a-w-        c:\windows\system32\MFHEAACdec.dll
2011-05-28 14:55 . 2011-01-20 14:14        261632        ----a-w-        c:\windows\system32\mfreadwrite.dll
2011-05-28 14:54 . 2011-01-20 14:14        302592        ----a-w-        c:\windows\system32\mfmp4src.dll
2011-05-28 14:54 . 2011-01-20 16:07        37376        ----a-w-        c:\windows\system32\cdd.dll
2011-05-28 14:54 . 2011-01-20 16:06        2873344        ----a-w-        c:\windows\system32\mf.dll
2011-05-28 14:54 . 2011-01-20 16:04        209920        ----a-w-        c:\windows\system32\mfplat.dll
2011-05-28 14:54 . 2011-01-20 14:26        667648        ----a-w-        c:\windows\system32\printfilterpipelinesvc.exe
2011-05-28 14:54 . 2011-01-20 16:07        586240        ----a-w-        c:\windows\system32\stobject.dll
2011-05-28 14:54 . 2011-01-20 16:07        258048        ----a-w-        c:\windows\system32\winspool.drv
2011-05-28 14:54 . 2011-01-20 16:06        26112        ----a-w-        c:\windows\system32\printfilterpipelineprxy.dll
2011-05-28 14:54 . 2011-01-20 16:04        98816        ----a-w-        c:\windows\system32\mfps.dll
2011-05-28 14:53 . 2011-01-20 16:08        160768        ----a-w-        c:\windows\system32\d3d10_1.dll
2011-05-28 14:53 . 2011-01-20 14:12        1172480        ----a-w-        c:\windows\system32\d3d10warp.dll
2011-05-28 14:53 . 2011-01-20 13:47        683008        ----a-w-        c:\windows\system32\d2d1.dll
2011-05-28 14:53 . 2011-02-22 13:33        1068544        ----a-w-        c:\windows\system32\DWrite.dll
2011-05-28 14:53 . 2011-02-22 13:33        797696        ----a-w-        c:\windows\system32\FntCache.dll
2011-05-28 14:53 . 2011-01-20 16:08        1029120        ----a-w-        c:\windows\system32\d3d10.dll
2011-05-28 14:53 . 2011-01-20 16:08        219648        ----a-w-        c:\windows\system32\d3d10_1core.dll
2011-05-28 14:53 . 2011-01-20 16:08        189952        ----a-w-        c:\windows\system32\d3d10core.dll
2011-05-28 14:53 . 2011-01-20 14:28        1554432        ----a-w-        c:\windows\system32\xpsservices.dll
2011-05-28 14:53 . 2011-01-20 14:11        486400        ----a-w-        c:\windows\system32\d3d10level9.dll
2011-05-28 14:53 . 2011-02-22 14:13        288768        ----a-w-        c:\windows\system32\XpsGdiConverter.dll
2011-05-28 14:53 . 2011-01-20 14:25        847360        ----a-w-        c:\windows\system32\OpcServices.dll
2011-05-28 14:37 . 2010-05-04 19:13        231424        ----a-w-        c:\windows\system32\msshsq.dll
2011-05-28 12:17 . 2011-05-28 12:17        --------        d-----w-        c:\program files\CCleaner
2011-05-27 23:49 . 2011-05-27 23:50        --------        d-----w-        c:\windows\system32\ca-ES
2011-05-27 23:49 . 2011-05-27 23:50        --------        d-----w-        c:\windows\system32\eu-ES
2011-05-27 23:49 . 2011-05-27 23:50        --------        d-----w-        c:\windows\system32\vi-VN
2011-05-27 21:54 . 2011-05-27 21:54        --------        d-----w-        c:\windows\system32\EventProviders
2011-05-27 19:43 . 2011-05-27 19:43        --------        d-----w-        c:\users\***\AppData\Roaming\Malwarebytes
2011-05-27 19:43 . 2010-12-20 16:09        38224        ----a-w-        c:\windows\system32\drivers\mbamswissarmy.sys
2011-05-27 19:43 . 2011-05-27 19:43        --------        d-----w-        c:\programdata\Malwarebytes
2011-05-27 19:43 . 2011-05-27 19:43        --------        d-----w-        c:\program files\Malwarebytes' Anti-Malware
2011-05-27 19:43 . 2010-12-20 16:08        20952        ----a-w-        c:\windows\system32\drivers\mbam.sys
2011-05-27 11:59 . 2011-04-14 16:40        142296        ----a-w-        c:\program files\Mozilla Firefox\components\browsercomps.dll
2011-05-27 11:59 . 2011-04-14 16:40        16856        ----a-w-        c:\program files\Mozilla Firefox\plugin-container.exe
2011-05-27 11:59 . 2011-04-14 16:40        89048        ----a-w-        c:\program files\Mozilla Firefox\libEGL.dll
2011-05-27 11:59 . 2011-04-14 16:40        781272        ----a-w-        c:\program files\Mozilla Firefox\mozsqlite3.dll
2011-05-27 11:59 . 2011-04-14 16:40        719832        ----a-w-        c:\program files\Mozilla Firefox\mozcpp19.dll
2011-05-27 11:59 . 2011-04-14 16:40        465880        ----a-w-        c:\program files\Mozilla Firefox\libGLESv2.dll
2011-05-27 11:59 . 2011-04-14 16:40        1874904        ----a-w-        c:\program files\Mozilla Firefox\mozjs.dll
2011-05-27 11:59 . 2011-04-14 16:40        15832        ----a-w-        c:\program files\Mozilla Firefox\mozalloc.dll
2011-05-27 11:59 . 2010-01-01 08:00        1974616        ----a-w-        c:\program files\Mozilla Firefox\D3DCompiler_42.dll
2011-05-27 11:59 . 2010-01-01 08:00        1892184        ----a-w-        c:\program files\Mozilla Firefox\d3dx9_42.dll
2011-05-26 16:35 . 2011-05-26 16:35        1138440        ----a-w-        c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll
2011-05-11 15:14 . 2011-05-11 15:14        30720        ----a-w-        c:\windows\system32\npmpsoxy.dll
2011-05-11 15:03 . 2011-05-11 15:03        --------        d-----w-        c:\program files\Common Files\Java
2011-05-11 14:18 . 2011-04-07 12:01        2409784        ----a-w-        c:\program files\Windows Mail\OESpamFilter.dat
2011-05-02 12:09 . 2011-05-02 12:09        --------        d-----w-        c:\users\***\AppData\Roaming\AVG10
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-05-29 19:30 . 2011-05-29 19:30        0        ---ha-w-        c:\users\***\AppData\Local\BITF3F4.tmp
2011-04-14 03:07 . 2010-06-19 15:44        472808        ----a-w-        c:\windows\system32\deployJava1.dll
2011-04-11 07:04 . 2011-04-29 18:07        7071056        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{9795B267-A553-4A5D-BF2C-5801A5955E81}\mpengine.dll
2011-03-10 17:03 . 2011-04-13 19:54        1162240        ----a-w-        c:\windows\system32\mfc42u.dll
2011-03-10 17:03 . 2011-04-13 19:54        1136640        ----a-w-        c:\windows\system32\mfc42.dll
2011-03-03 15:42 . 2011-04-13 19:53        739328        ----a-w-        c:\windows\system32\inetcomm.dll
2011-03-03 15:40 . 2011-04-26 20:50        28672        ----a-w-        c:\windows\system32\Apphlpdm.dll
2011-03-03 15:40 . 2011-04-26 20:50        173056        ----a-w-        c:\windows\apppatch\AcXtrnal.dll
2011-03-03 15:40 . 2011-04-26 20:50        542720        ----a-w-        c:\windows\apppatch\AcLayers.dll
2011-03-03 15:40 . 2011-04-26 20:50        458752        ----a-w-        c:\windows\apppatch\AcSpecfc.dll
2011-03-03 15:40 . 2011-04-26 20:50        2159616        ----a-w-        c:\windows\apppatch\AcGenral.dll
2011-03-03 13:35 . 2011-04-26 20:50        4240384        ----a-w-        c:\windows\system32\GameUXLegacyGDFs.dll
2011-03-03 13:25 . 2011-04-13 19:53        2041856        ----a-w-        c:\windows\system32\win32k.sys
2011-03-02 15:44 . 2011-04-13 19:54        86528        ----a-w-        c:\windows\system32\dnsrslvr.dll
2011-04-14 16:40 . 2011-05-27 11:59        142296        ----a-w-        c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]
"WindowsWelcomeCenter"="oobefldr.dll" [2009-04-11 2153472]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-07-15 39408]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="RtHDVCpl.exe" [2007-01-11 4321280]
"LG Intelligent Update"="c:\program files\lg_swupdate\giljabistart.exe" [2007-02-06 228456]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-01-31 131072]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-01-31 151552]
"Persistence"="c:\windows\system32\igfxpers.exe" [2007-01-31 126976]
"MGSysCtrl"="c:\program files\LG Software\System Control Manager\MGSysCtrl.exe" [2007-01-23 565248]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-11-22 815104]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"LogitechCommunicationsManager"="c:\program files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe" [2008-02-13 564496]
"LogitechQuickCamRibbon"="c:\program files\Logitech\QuickCam\Quickcam.exe" [2008-02-13 2196240]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-09-21 305440]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-11-29 421888]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-01-07 253672]
"Malwarebytes' Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2010-12-20 963976]
.
c:\users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OpenOffice.org 2.3.lnk - c:\program files\OpenOffice.org 2.3\program\quickstart.exe [2007-8-17 393216]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Logitech Desktop Messenger.lnk - c:\program files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe [2009-7-29 66864]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"AntiVirusOverride"=dword:00000001
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-03-21 135664]
R3 gupdatem;Google Update-Dienst (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2010-03-21 135664]
R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
S0 O2MDRDR;O2MDRDR;c:\windows\system32\DRIVERS\o2media.sys [2006-11-20 38400]
S0 O2SDRDR;O2SDRDR;c:\windows\system32\DRIVERS\o2sd.sys [2006-11-17 31360]
S2 NishService;Evil Driver Daemon;c:\program files\LG Software\System Control Manager\edd.exe [2006-03-02 40960]
S2 SBSDWSCService;SBSD Security Center Service;c:\program files\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368]
S3 MGHwCtrl;MGHwCtrl;c:\windows\system32\drivers\MGHwCtrl.sys [2006-07-03 9088]
S3 netr73;RT73 USB Wireless LAN Card Driver for Vista;c:\windows\system32\DRIVERS\netr73.sys [2006-09-28 247808]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation        REG_MULTI_SZ           FontCache
.
Inhalt des "geplante Tasks" Ordners
.
2011-05-29 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-03-21 10:44]
.
2011-05-29 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-03-21 10:44]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.google.de/
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_950DF09FAB501E03.dll/cmsidewiki.html
TCP: Interfaces\{7438D09B-C767-4D83-A264-3BA385E7A7DC}: NameServer = 195.50.140.248 195.50.140.246
Handler: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - c:\program files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
FF - ProfilePath - c:\users\***\AppData\Roaming\Mozilla\Firefox\Profiles\qbp86wnc.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.google.de/
FF - prefs.js: keyword.URL - hxxp://search.icq.com/search/afe_results.php?ch_id=afex&q=
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Toolbar-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
HKLM-Run-WinampAgent - c:\program files\Winamp\winampa.exe
AddRemove-ICQToolbar - c:\program files\ICQ6Toolbar\ICQUnToolbar.exe
.
.
.
**************************************************************************
Scanne versteckte Prozesse...
.
Scanne versteckte Autostarteinträge...
.
Scanne versteckte Dateien...
.
Scan erfolgreich abgeschlossen
versteckte Dateien:
.
**************************************************************************
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------
.
- - - - - - - > 'Explorer.exe'(9836)
c:\windows\TEMP\logishrd\LVPrcInj01.dll
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\windows\system32\agrsmsvc.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
c:\program files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
c:\program files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
c:\program files\CDBurnerXP\NMSAccessU.exe
c:\windows\system32\o2flash.exe
c:\windows\system32\conime.exe
c:\windows\servicing\TrustedInstaller.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2011-05-29  21:36:58 - PC wurde neu gestartet
ComboFix-quarantined-files.txt  2011-05-29 19:36
.
Vor Suchlauf: 10 Verzeichnis(se), 105.661.661.184 Bytes frei
Nach Suchlauf: 16 Verzeichnis(se), 105.510.154.240 Bytes frei
.
- - End Of File - - 4037597B5F678EA4265B6877A8B8EB7C

--- --- ---

cosinus 30.05.2011 10:56
Zitat:
c:\***\***.exe
Was hast du da zensiert?

sporty33 30.05.2011 12:30
Das ist ein Programm von einem früheren Arbeitgeber von mir. Sollte nicht jeder wissen, was es für eines ist. Ich kenne es aber und es ist ungefährlich! :-)

Wie geht es jetzt weiter? Spybot meldet den Virus immer noch.... :heulen:
Wie gefährlich ist dieser WIN32.Katusha eigentlich?

Danke und Grüße
sporty33

cosinus 30.05.2011 14:33
Dann bitte unzensiert per PN posten :pfeiff:

sporty33 30.05.2011 15:04
Habe dir eine Email geschrieben, PN ging leider nicht...
Viele Grüße
sporty33

cosinus 30.05.2011 15:54
Ok, schau ich nachher mal rein

cosinus 30.05.2011 17:37
Zitat:
Das ist ein Programm von einem früheren Arbeitgeber von mir. Sollte nicht jeder wissen, was es für eines ist. Ich kenne es aber und es ist ungefährlich! :-)
CF hat das Teil aber gelöscht. Es legt ein Back in C:\Qoobox an.


Ok. Bitte nun Logs mit GMER und OSAM erstellen und posten.
GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus - die Online-Abfrage durch OSAM bitte überspringen.
Bei OSAM bitte darauf auch achten, dass Du das Log auch als *.log und nicht *.html oder so abspeicherst.


Downloade Dir danach bitte MBRCheck (by a_d_13) und speichere die Datei auf dem Desktop.
  • Doppelklick auf die MBRCheck.exe.
    Vista und Win7 User mit Rechtsklick "als Administrator starten"
  • Das Tool braucht nur wenige Sekunden.
  • Danach solltest du eine MBRCheck_<Datum>_<Uhrzeit>.txt auf dem Desktop finden.
Poste mir bitte den Inhalt des .txt Dokumentes

sporty33 31.05.2011 12:44
So, habe nun GMER und OSAM ausgeführt.
Anbei die beiden Logs:

GMER:
[CODE]

GMER Logfile:
Code:
GMER 1.0.15.15640 - hxxp://www.gmer.net
Rootkit scan 2011-05-31 13:38:02
Windows 6.0.6002 Service Pack 2 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 ST9160821AS rev.3.ALC
Running: pr2co8ui.exe; Driver: C:\Users\***\AppData\Local\Temp\pxtoqpoc.sys


---- User IAT/EAT - GMER 1.0.15 ----

IAT            C:\Windows\Explorer.EXE[432] @ C:\Windows\system32\kernel32.dll [ntdll.dll!NtCreateFile]                                                  [03192F30] C:\Windows\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT            C:\Windows\Explorer.EXE[432] @ C:\Windows\system32\kernel32.dll [ntdll.dll!NtClose]                                                      [03192D00] C:\Windows\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT            C:\Windows\Explorer.EXE[432] @ C:\Windows\system32\kernel32.dll [ntdll.dll!NtDeviceIoControlFile]                                        [03192CA0] C:\Windows\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT            C:\Windows\Explorer.EXE[432] @ C:\Windows\system32\kernel32.dll [ntdll.dll!NtDuplicateObject]                                            [03192CD0] C:\Windows\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT            C:\Program Files\Logitech\QuickCam\Quickcam.exe[480] @ C:\Windows\system32\kernel32.dll [ntdll.dll!NtCreateFile]                          [021B2F30] C:\Windows\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT            C:\Program Files\Logitech\QuickCam\Quickcam.exe[480] @ C:\Windows\system32\kernel32.dll [ntdll.dll!NtClose]                              [021B2D00] C:\Windows\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT            C:\Program Files\Logitech\QuickCam\Quickcam.exe[480] @ C:\Windows\system32\kernel32.dll [ntdll.dll!NtDeviceIoControlFile]                [021B2CA0] C:\Windows\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT            C:\Program Files\Logitech\QuickCam\Quickcam.exe[480] @ C:\Windows\system32\kernel32.dll [ntdll.dll!NtDuplicateObject]                    [021B2CD0] C:\Windows\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT            C:\Program Files\Common Files\Logishrd\LQCVFX\COCIManager.exe[1256] @ C:\Windows\system32\kernel32.dll [ntdll.dll!NtCreateFile]          [01902F30] C:\Windows\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT            C:\Program Files\Common Files\Logishrd\LQCVFX\COCIManager.exe[1256] @ C:\Windows\system32\kernel32.dll [ntdll.dll!NtClose]                [01902D00] C:\Windows\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT            C:\Program Files\Common Files\Logishrd\LQCVFX\COCIManager.exe[1256] @ C:\Windows\system32\kernel32.dll [ntdll.dll!NtDeviceIoControlFile]  [01902CA0] C:\Windows\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT            C:\Program Files\Common Files\Logishrd\LQCVFX\COCIManager.exe[1256] @ C:\Windows\system32\kernel32.dll [ntdll.dll!NtDuplicateObject]      [01902CD0] C:\Windows\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT            C:\Users\***\Desktop\pr2co8ui.exe[4076] @ C:\Windows\system32\kernel32.dll [ntdll.dll!NtCreateFile]                                      [00242F30] C:\Windows\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT            C:\Users\***\Desktop\pr2co8ui.exe[4076] @ C:\Windows\system32\kernel32.dll [ntdll.dll!NtClose]                                          [00242D00] C:\Windows\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT            C:\Users\***\Desktop\pr2co8ui.exe[4076] @ C:\Windows\system32\kernel32.dll [ntdll.dll!NtDeviceIoControlFile]                            [00242CA0] C:\Windows\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT            C:\Users\***\Desktop\pr2co8ui.exe[4076] @ C:\Windows\system32\kernel32.dll [ntdll.dll!NtDuplicateObject]                                [00242CD0] C:\Windows\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT            C:\Windows\system32\wuauclt.exe[4664] @ C:\Windows\system32\kernel32.dll [ntdll.dll!NtCreateFile]                                        [000C2F30] C:\Windows\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT            C:\Windows\system32\wuauclt.exe[4664] @ C:\Windows\system32\kernel32.dll [ntdll.dll!NtClose]                                              [000C2D00] C:\Windows\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT            C:\Windows\system32\wuauclt.exe[4664] @ C:\Windows\system32\kernel32.dll [ntdll.dll!NtDeviceIoControlFile]                                [000C2CA0] C:\Windows\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT            C:\Windows\system32\wuauclt.exe[4664] @ C:\Windows\system32\kernel32.dll [ntdll.dll!NtDuplicateObject]                                    [000C2CD0] C:\Windows\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)

---- Devices - GMER 1.0.15 ----

AttachedDevice  \Driver\kbdclass \Device\KeyboardClass0                                                                                                  Wdf01000.sys (Kernelmodustreiber-Frameworklaufzeit/Microsoft Corporation)
AttachedDevice  \Driver\kbdclass \Device\KeyboardClass1                                                                                                  Wdf01000.sys (Kernelmodustreiber-Frameworklaufzeit/Microsoft Corporation)

---- EOF - GMER 1.0.15 ----
--- --- ---


Und OSAM:

Code:
OSAM Logfile:

       
Code:

       
Report of OSAM: Autorun Manager v5.0.11926.0
hxxp://www.online-solutions.ru/en/
Saved at 12:16:16 on 31.05.2011

OS: Windows Vista Home Premium Edition Service Pack 2 (Build 6002), 32-bit
Default Browser: Mozilla Corporation Firefox 4.0.1

Scanner Settings
[x] Rootkits detection (hidden registry)
[x] Rootkits detection (hidden files)
[x] Retrieve files information
[x] Check Microsoft signatures

Filters
[ ] Trusted entries
[ ] Empty entries
[x] Hidden registry entries (rootkit activity)
[x] Exclusively opened files
[x] Not found files
[x] Files without detailed information
[x] Existing files
[ ] Non-startable services
[ ] Non-startable drivers
[x] Active entries
[x] Disabled entries


[Common]
-----( %SystemRoot%\Tasks )-----
"GoogleUpdateTaskMachineCore.job" - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe
"GoogleUpdateTaskMachineUA.job" - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe

[Control Panel Objects]
-----( %SystemRoot%\system32 )-----
"bdeadmin.cpl" - ? - C:\Windows\system32\bdeadmin.cpl
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )-----
"QuickTime" - "Apple Inc." - C:\Program Files\QuickTime\QTSystem\QuickTime.cpl

[Drivers]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"catchme" (catchme) - ? - C:\Users\***\AppData\Local\Temp\catchme.sys  (File not found)
"IP in IP Tunnel Driver" (IpInIp) - ? - C:\Windows\System32\DRIVERS\ipinip.sys  (File not found)
"IPX Traffic Filter Driver" (NwlnkFlt) - ? - C:\Windows\System32\DRIVERS\nwlnkflt.sys  (File not found)
"IPX Traffic Forwarder Driver" (NwlnkFwd) - ? - C:\Windows\System32\DRIVERS\nwlnkfwd.sys  (File not found)
"MGHwCtrl" (MGHwCtrl) - "Windows (R) 2000 DDK provider" - C:\Windows\system32\drivers\MGHwCtrl.sys
"StarOpen" (StarOpen) - ? - C:\Windows\system32\drivers\StarOpen.sys  (File found, but it contains no detailed information)

[Explorer]
-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----
{F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll
{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396} "{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396}" - ? - C:\Program Files\OpenOffice.org 2.3\program\shlxthdl.dll
-----( HKLM\Software\Classes\Protocols\Handler )-----
{9462A756-7B47-47BC-8C80-C34B9B80B32B} "BackWeb GA Pluggable Protocol" - "Logitech Inc." - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
{FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} "IEProtocolHandler Class" - "Skype Technologies" - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
{8E2D00A0-82C6-4821-90BC-07F290841BB6} "XEB Navigation Filter" - ? - C:\Program Files\Common Files\fluxDVD\Lib\XEB\xebnavigation.ax
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----
{911051fa-c21c-4246-b470-070cd8df6dc4} ".cab or .zip files" - ? -   (File not found | COM-object registry key not found)
{1b24a030-9b20-49bc-97ac-1be4426f9e59} "ActiveDirectory Folder" - ? -   (File not found | COM-object registry key not found)
{34449847-FD14-4fc8-A75A-7432F5181EFB} "ActiveDirectory Folder" - ? -   (File not found | COM-object registry key not found)
{0F8604A5-4ECE-4DE1-BA7D-CF10F8AA4F48} "Contacts folder" - ? -   (File not found | COM-object registry key not found)
{2C2577C2-63A7-40e3-9B7F-586602617ECB} "Explorer Query Band" - ? -   (File not found | COM-object registry key not found)
{C9CF278C-460E-4917-BC43-3F75E6E47D3D} "fluxDVD Shell Information Extractor" - "ACE GmbH" - C:\PROGRA~1\COMMON~1\fluxDVD\Lib\XEB\XEBShell.dll
{FAC3CBF6-8697-43d0-BAB9-DCD1FCE19D75} "IE User Assist" - ? -   (File not found | COM-object registry key not found)
{B9E1D2CB-CCFF-4AA6-9579-D7A4754030EF} "iTunes" - "Apple Inc." - C:\Program Files\iTunes\iTunesMiniPlayer.dll
{00020d75-0000-0000-c000-000000000046} "lnkfile" - ? -   (File not found | COM-object registry key not found)
{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396} "OpenOffice.org Column Handler" - ? - C:\Program Files\OpenOffice.org 2.3\program\shlxthdl.dll
{087B3AE3-E237-4467-B8DB-5A38AB959AC9} "OpenOffice.org Infotip Handler" - ? - C:\Program Files\OpenOffice.org 2.3\program\shlxthdl.dll
{63542C48-9552-494A-84F7-73AA6A7C99C1} "OpenOffice.org Property Sheet Handler" - ? - C:\Program Files\OpenOffice.org 2.3\program\shlxthdl.dll
{3B092F0C-7696-40E3-A80F-68D74DA84210} "OpenOffice.org Thumbnail Viewer" - ? - C:\Program Files\OpenOffice.org 2.3\program\shlxthdl.dll
{C8494E42-ACDD-4739-B0FB-217361E4894F} "Sam Account Folder" - ? -   (File not found | COM-object registry key not found)
{E29F9716-5C08-4FCD-955A-119FDB5A522D} "Sam Account Folder" - ? -   (File not found | COM-object registry key not found)
{da67b8ad-e81b-4c70-9b91b417b5e33527} "Windows Search Shell Service" - ? -   (File not found | COM-object registry key not found)
{B41DB860-8EE4-11D2-9906-E49FADC173CA} "WinRAR" - ? - C:\Program Files\WinRAR\rarext.dll  (File found, but it contains no detailed information)

[Internet Explorer]
-----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )-----
<binary data> "Google Toolbar" - "Google Inc." - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
<binary data> "ICQToolBar" - ? - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll  (File not found)
ITBar7Height "ITBar7Height" - ? -   (File not found | COM-object registry key not found)
<binary data> "ITBar7Layout" - ? -   (File not found | COM-object registry key not found)
-----( HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks )-----
{855F3B16-6D32-4fe6-8A56-BBB695989046} "ICQToolBar" - ? - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll  (File not found)
 "{855F3B16-6D32-4fe6-8A56-BBB695989046}" - ? -   (File not found | COM-object registry key not found)
-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----
{8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.6.0_25" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab
{CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA} "Java Plug-in 1.6.0_25" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab
{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_25" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\npjpi160_25.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_25-windows-i586.cab
{D27CDB6E-AE6D-11CF-96B8-444553540000} "Shockwave Flash Object" - "Adobe Systems, Inc." - C:\Windows\system32\Macromed\Flash\Flash9e.ocx / hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----
{53707962-6F74-2D53-2644-206D7942484F} "ClsidExtension" - "Safer Networking Limited" - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar )-----
<binary data> "Google Toolbar" - "Google Inc." - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
{855F3B16-6D32-4fe6-8A56-BBB695989046} "ICQToolBar" - ? - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll  (File not found)
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} "Adobe PDF Reader" - "Adobe Systems Incorporated" - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
{AA58ED58-01DD-4d91-8333-CF10577473F7} "Google Toolbar Helper" - "Google Inc." - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
{AF69DE43-7D58-4638-B6FA-CE66B5AD205D} "Google Toolbar Notifier BHO" - "Google Inc." - C:\Program Files\Google\GoogleToolbarNotifier\5.6.5805.1910\swg.dll
{DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2ssv.dll
{53707962-6F74-2D53-2644-206D7942484F} "Spybot-S&D IE Protection" - "Safer Networking Limited" - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll

[Logon]
-----( %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup )-----
"desktop.ini" - ? - C:\Users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
"OpenOffice.org 2.3.lnk" - ? - C:\Program Files\OpenOffice.org 2.3\program\quickstart.exe  (Shortcut exists | File found, but it contains no detailed information | File exists)
-----( %AllUsersProfile%\Microsoft\Windows\Start Menu\Programs\Startup )-----
"desktop.ini" - ? - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
"Logitech Desktop Messenger.lnk" - "Logitech Inc." - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe  (Shortcut exists | File exists)
-----( HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run )-----
"SpybotSD TeaTimer" - "Safer-Networking Ltd." - C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
"swg" - "Google Inc." - "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
-----( HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\Wds\rdpwd )-----
"StartupPrograms" - ? - rdpclip  (File not found)
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----
"Adobe Reader Speed Launcher" - "Adobe Systems Incorporated" - "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
"iTunesHelper" - "Apple Inc." - "C:\Program Files\iTunes\iTunesHelper.exe"
"LG Intelligent Update" - "BIT LEADER" - "C:\Program Files\lg_swupdate\giljabistart.exe" Gilautouc
"LogitechCommunicationsManager" - "Logitech Inc." - "C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe"
"LogitechQuickCamRibbon" - "Logitech Inc." - "C:\Program Files\Logitech\QuickCam\Quickcam.exe" /hide
"Malwarebytes' Anti-Malware (reboot)" - "Malwarebytes Corporation" - "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
"MGSysCtrl" - "MSI" - C:\Program Files\LG Software\System Control Manager\MGSysCtrl.exe
"QuickTime Task" - "Apple Inc." - "C:\Program Files\QuickTime\QTTask.exe" -atboottime
"SunJavaUpdateSched" - "Sun Microsystems, Inc." - "C:\Program Files\Common Files\Java\Java Update\jusched.exe"

[Print Monitors]
-----( HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors )-----
"PDFCreator" - ? - C:\Windows\system32\pdfcmnnt.dll  (File found, but it contains no detailed information)

[Services]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"@c:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe,-100" (WPFFontCache_v0400) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe
"Apple Mobile Device" (Apple Mobile Device) - "Apple Inc." - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
"Bonjour-Dienst" (Bonjour Service) - "Apple Inc." - C:\Program Files\Bonjour\mDNSResponder.exe
"Evil Driver Daemon" (NishService) - ? - C:\Program Files\LG Software\System Control Manager\edd.exe  (File found, but it contains no detailed information)
"Google Software Updater" (gusvc) - "Google" - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
"Google Update Service (gupdate)" (gupdate) - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe
"Google Update-Dienst (gupdatem)" (gupdatem) - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe
"iPod-Dienst" (iPod Service) - "Apple Inc." - C:\Program Files\iPod\bin\iPodService.exe
"LVCOMSer" (LVCOMSer) - "Logitech Inc." - C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
"LVSrvLauncher" (LVSrvLauncher) - "Logitech Inc." - C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe
"Microsoft .NET Framework NGEN v4.0.30319_X86" (clr_optimization_v4.0.30319_32) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
"NMSAccessU" (NMSAccessU) - ? - C:\Program Files\CDBurnerXP\NMSAccessU.exe  (File found, but it contains no detailed information)
"O2Micro Flash Memory" (O2Flash) - "O2Micro International" - C:\Windows\system32\o2flash.exe
"Process Monitor" (LVPrcSrv) - "Logitech Inc." - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
"SBSD Security Center Service" (SBSDWSCService) - "Safer Networking Ltd." - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe

[Winsock Providers]
-----( HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries )-----
"mdnsNSP" - "Apple Inc." - C:\Program Files\Bonjour\mdnsNSP.dll

===[ Logfile end ]=========================================[ Logfile end ]===

--- --- ---

If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru
Viele Grüße
sporty33 :glaskugel:

sporty33 31.05.2011 12:49
Und hier auch noch MBRCheck:

Code:

MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:                       
Windows Version:                Windows Vista Home Premium Edition
Windows Information:                Service Pack 2 (build 6002), 32-bit
Base Board Manufacturer:        MICRO-STAR INT'L CO.,LTD.
BIOS Manufacturer:                American Megatrends Inc.
System Manufacturer:                LG Electronics
System Product Name:                FS-2.AACBG
Logical Drives Mask:                0x00000014

Kernel Drivers (total 143):
  0x8204D000 \SystemRoot\system32\ntkrnlpa.exe
  0x8201A000 \SystemRoot\system32\hal.dll
  0x80403000 \SystemRoot\system32\kdcom.dll
  0x8040A000 \SystemRoot\system32\mcupdate_GenuineIntel.dll
  0x8047A000 \SystemRoot\system32\PSHED.dll
  0x8048B000 \SystemRoot\system32\BOOTVID.dll
  0x80493000 \SystemRoot\system32\CLFS.SYS
  0x804D4000 \SystemRoot\system32\CI.dll
  0x80608000 \SystemRoot\system32\drivers\Wdf01000.sys
  0x80679000 \SystemRoot\system32\drivers\WDFLDR.SYS
  0x80687000 \SystemRoot\system32\drivers\acpi.sys
  0x806CD000 \SystemRoot\system32\drivers\WMILIB.SYS
  0x806D6000 \SystemRoot\system32\drivers\msisadrv.sys
  0x806DE000 \SystemRoot\system32\drivers\pci.sys
  0x80705000 \SystemRoot\System32\drivers\partmgr.sys
  0x80714000 \SystemRoot\system32\DRIVERS\compbatt.sys
  0x80717000 \SystemRoot\system32\DRIVERS\BATTC.SYS
  0x80721000 \SystemRoot\system32\drivers\volmgr.sys
  0x80730000 \SystemRoot\System32\drivers\volmgrx.sys
  0x8077A000 \SystemRoot\system32\DRIVERS\pcmcia.sys
  0x807A7000 \SystemRoot\system32\DRIVERS\pciide.sys
  0x807AE000 \SystemRoot\system32\DRIVERS\PCIIDEX.SYS
  0x807BC000 \SystemRoot\System32\drivers\mountmgr.sys
  0x807CC000 \SystemRoot\system32\drivers\atapi.sys
  0x807D4000 \SystemRoot\system32\drivers\ataport.SYS
  0x807F2000 \SystemRoot\system32\DRIVERS\o2sd.sys
  0x805B4000 \SystemRoot\system32\DRIVERS\SCSIPORT.SYS
  0x805DA000 \SystemRoot\system32\DRIVERS\o2media.sys
  0x82605000 \SystemRoot\system32\drivers\fltmgr.sys
  0x82637000 \SystemRoot\system32\drivers\fileinfo.sys
  0x82647000 \SystemRoot\System32\Drivers\ksecdd.sys
  0x826B8000 \SystemRoot\system32\drivers\ndis.sys
  0x827C3000 \SystemRoot\system32\drivers\msrpc.sys
  0x82C0E000 \SystemRoot\system32\drivers\NETIO.SYS
  0x82C49000 \SystemRoot\System32\drivers\tcpip.sys
  0x82D33000 \SystemRoot\System32\drivers\fwpkclnt.sys
  0x82E09000 \SystemRoot\System32\Drivers\Ntfs.sys
  0x82F19000 \SystemRoot\system32\drivers\volsnap.sys
  0x82F52000 \SystemRoot\System32\Drivers\spldr.sys
  0x82F5A000 \SystemRoot\System32\Drivers\mup.sys
  0x82F69000 \SystemRoot\System32\drivers\ecache.sys
  0x82F90000 \SystemRoot\system32\drivers\disk.sys
  0x82FA1000 \SystemRoot\system32\drivers\CLASSPNP.SYS
  0x82FC2000 \SystemRoot\system32\drivers\crcdisk.sys
  0x82FEB000 \SystemRoot\system32\DRIVERS\tunnel.sys
  0x82FF6000 \SystemRoot\system32\DRIVERS\tunmp.sys
  0x82D4E000 \SystemRoot\system32\DRIVERS\intelppm.sys
  0x8A201000 \SystemRoot\system32\DRIVERS\igdkmd32.sys
  0x82D5D000 \SystemRoot\System32\drivers\dxgkrnl.sys
  0x8A7D8000 \SystemRoot\System32\drivers\watchdog.sys
  0x8AA0E000 \SystemRoot\system32\DRIVERS\HDAudBus.sys
  0x8AA9B000 \SystemRoot\system32\DRIVERS\Rtlh86.sys
  0x8AAAE000 \SystemRoot\system32\DRIVERS\usbuhci.sys
  0x8AAB9000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
  0x8AAF7000 \SystemRoot\system32\DRIVERS\usbehci.sys
  0x8AB06000 \SystemRoot\system32\DRIVERS\ohci1394.sys
  0x8AB16000 \SystemRoot\system32\DRIVERS\1394BUS.SYS
  0x8AB24000 \SystemRoot\system32\DRIVERS\i8042prt.sys
  0x8AB37000 \SystemRoot\system32\DRIVERS\kbdclass.sys
  0x8AB42000 \SystemRoot\system32\DRIVERS\SynTP.sys
  0x8AB6D000 \SystemRoot\system32\DRIVERS\USBD.SYS
  0x8AB6F000 \SystemRoot\system32\DRIVERS\mouclass.sys
  0x8AB7A000 \SystemRoot\system32\DRIVERS\CmBatt.sys
  0x8AB7E000 \SystemRoot\system32\DRIVERS\cdrom.sys
  0x8AB96000 \SystemRoot\system32\DRIVERS\GEARAspiWDM.sys
  0x8AB9C000 \SystemRoot\system32\DRIVERS\msiscsi.sys
  0x8AE0D000 \SystemRoot\system32\DRIVERS\storport.sys
  0x8AE4E000 \SystemRoot\system32\DRIVERS\TDI.SYS
  0x8AE59000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
  0x8AE70000 \SystemRoot\system32\DRIVERS\ndistapi.sys
  0x8AE7B000 \SystemRoot\system32\DRIVERS\ndiswan.sys
  0x8AE9E000 \SystemRoot\system32\DRIVERS\raspppoe.sys
  0x8AEAD000 \SystemRoot\system32\DRIVERS\raspptp.sys
  0x8AEC1000 \SystemRoot\system32\DRIVERS\rassstp.sys
  0x8AED6000 \SystemRoot\system32\DRIVERS\termdd.sys
  0x8AEE6000 \SystemRoot\system32\DRIVERS\swenum.sys
  0x8AEE8000 \SystemRoot\system32\DRIVERS\ks.sys
  0x8AF12000 \SystemRoot\system32\DRIVERS\mssmbios.sys
  0x8AF1C000 \SystemRoot\system32\DRIVERS\umbus.sys
  0x8AF29000 \SystemRoot\system32\DRIVERS\usbhub.sys
  0x8AF5E000 \SystemRoot\System32\Drivers\NDProxy.SYS
  0x89E06000 \SystemRoot\system32\drivers\RTKVHDA.sys
  0x89F9E000 \SystemRoot\system32\drivers\portcls.sys
  0x89FCB000 \SystemRoot\system32\drivers\drmk.sys
  0x8B00D000 \SystemRoot\system32\DRIVERS\AGRSM.sys
  0x8B129000 \SystemRoot\system32\drivers\modem.sys
  0x8B136000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
  0x8B13F000 \SystemRoot\System32\Drivers\Null.SYS
  0x8B146000 \SystemRoot\System32\Drivers\Beep.SYS
  0x8B14D000 \SystemRoot\System32\drivers\vga.sys
  0x8B159000 \SystemRoot\System32\drivers\VIDEOPRT.SYS
  0x8B17A000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
  0x8B182000 \SystemRoot\system32\drivers\rdpencdd.sys
  0x8B18A000 \SystemRoot\System32\Drivers\Msfs.SYS
  0x8B195000 \SystemRoot\System32\Drivers\Npfs.SYS
  0x8B1A3000 \SystemRoot\System32\DRIVERS\rasacd.sys
  0x8B1AC000 \SystemRoot\system32\DRIVERS\tdx.sys
  0x8B1C2000 \SystemRoot\system32\DRIVERS\smb.sys
  0x8AF78000 \SystemRoot\System32\DRIVERS\netbt.sys
  0x8AFAA000 \SystemRoot\system32\drivers\afd.sys
  0x8B1D6000 \SystemRoot\system32\DRIVERS\pacer.sys
  0x8B1EC000 \SystemRoot\system32\DRIVERS\netbios.sys
  0x8ABCB000 \SystemRoot\system32\DRIVERS\wanarp.sys
  0x8B405000 \SystemRoot\system32\DRIVERS\rdbss.sys
  0x8B441000 \SystemRoot\system32\drivers\nsiproxy.sys
  0x8B44B000 \SystemRoot\System32\Drivers\dfsc.sys
  0x8B462000 \SystemRoot\system32\DRIVERS\hidusb.sys
  0x8B46B000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
  0x8B47B000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
  0x8B482000 \SystemRoot\system32\DRIVERS\mouhid.sys
  0x8B48A000 \SystemRoot\System32\Drivers\crashdmp.sys
  0x8B497000 \SystemRoot\System32\Drivers\dump_dumpata.sys
  0x8B4A2000 \SystemRoot\System32\Drivers\dump_atapi.sys
  0x8B4AA000 \SystemRoot\system32\DRIVERS\netr73.sys
  0x928F0000 \SystemRoot\System32\win32k.sys
  0x8B4EB000 \SystemRoot\System32\drivers\Dxapi.sys
  0x8B4F5000 \SystemRoot\system32\DRIVERS\monitor.sys
  0x92B10000 \SystemRoot\System32\TSDDD.dll
  0x92B30000 \SystemRoot\System32\cdd.dll
  0x8B504000 \SystemRoot\system32\drivers\luafv.sys
  0x8B530000 \SystemRoot\system32\drivers\spsys.sys
  0x8B5E0000 \SystemRoot\system32\DRIVERS\lltdio.sys
  0xA5E0A000 \SystemRoot\system32\DRIVERS\nwifi.sys
  0xA5E34000 \SystemRoot\system32\DRIVERS\ndisuio.sys
  0xA5E3E000 \SystemRoot\system32\DRIVERS\rspndr.sys
  0xA5E51000 \SystemRoot\system32\drivers\HTTP.sys
  0xA5EBE000 \SystemRoot\System32\DRIVERS\srvnet.sys
  0xA5EDB000 \SystemRoot\system32\DRIVERS\bowser.sys
  0xA5EF4000 \SystemRoot\System32\drivers\mpsdrv.sys
  0xA5F09000 \SystemRoot\system32\drivers\mrxdav.sys
  0xA5F2A000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
  0xA5F49000 \SystemRoot\system32\DRIVERS\mrxsmb10.sys
  0xA5F82000 \SystemRoot\system32\DRIVERS\mrxsmb20.sys
  0xA5F9A000 \SystemRoot\System32\DRIVERS\srv2.sys
  0xA680A000 \SystemRoot\System32\DRIVERS\srv.sys
  0xA6871000 \SystemRoot\system32\drivers\peauth.sys
  0xA694F000 \SystemRoot\System32\Drivers\secdrv.SYS
  0xA6959000 \SystemRoot\System32\drivers\tcpipreg.sys
  0xA6965000 \SystemRoot\system32\DRIVERS\LVPr2Mon.sys
  0xA696A000 \??\C:\Windows\system32\drivers\MGHwCtrl.sys
  0xA696D000 \SystemRoot\system32\DRIVERS\cdfs.sys
  0xA6983000 \??\C:\Users\Dani\AppData\Local\Temp\pxtoqpoc.sys
  0x77A80000 \Windows\System32\ntdll.dll

Processes (total 69):
      0 System Idle Process
      4 System
    488 C:\Windows\System32\smss.exe
    556 csrss.exe
    600 C:\Windows\System32\wininit.exe
    612 csrss.exe
    644 C:\Windows\System32\services.exe
    656 C:\Windows\System32\lsass.exe
    664 C:\Windows\System32\lsm.exe
    720 C:\Windows\System32\winlogon.exe
    868 C:\Windows\System32\svchost.exe
    928 C:\Windows\System32\svchost.exe
    968 C:\Windows\System32\svchost.exe
    1060 C:\Windows\System32\svchost.exe
    1088 C:\Windows\System32\svchost.exe
    1120 C:\Windows\System32\svchost.exe
    1236 C:\Windows\System32\audiodg.exe
    1260 C:\Windows\System32\svchost.exe
    1280 C:\Windows\System32\SLsvc.exe
    1336 C:\Windows\System32\svchost.exe
    1536 C:\Windows\System32\svchost.exe
    1724 C:\Windows\System32\spoolsv.exe
    1752 C:\Windows\System32\svchost.exe
    340 C:\Windows\System32\dwm.exe
    368 C:\Windows\System32\taskeng.exe
    432 C:\Windows\explorer.exe
    1228 C:\Windows\System32\taskeng.exe
    1620 C:\Windows\RtHDVCpl.exe
    1532 C:\Windows\System32\igfxtray.exe
    1464 C:\Windows\System32\hkcmd.exe
    924 C:\Windows\System32\igfxpers.exe
    1028 C:\Program Files\LG Software\System Control Manager\MGSysCtrl.exe
    1940 C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    2028 C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe
    480 C:\Program Files\Logitech\QuickCam\Quickcam.exe
    876 C:\Program Files\iTunes\iTunesHelper.exe
    1172 C:\Program Files\Common Files\Java\Java Update\jusched.exe
    2084 C:\Program Files\Windows Sidebar\sidebar.exe
    2104 C:\Windows\ehome\ehtray.exe
    2116 C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    2128 C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    2184 C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
    2308 C:\Program Files\OpenOffice.org 2.3\program\soffice.exe
    2328 C:\Windows\ehome\ehmsas.exe
    2368 C:\Program Files\OpenOffice.org 2.3\program\soffice.bin
    2792 C:\Windows\System32\agrsmsvc.exe
    2824 C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    2836 C:\Program Files\Bonjour\mDNSResponder.exe
    2876 C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
    2892 C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
    3008 C:\Program Files\LG Software\System Control Manager\edd.exe
    3032 C:\Program Files\CDBurnerXP\NMSAccessU.exe
    3100 C:\Windows\System32\o2flash.exe
    3108 C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
    3180 C:\Windows\System32\svchost.exe
    3204 C:\Windows\System32\svchost.exe
    3312 C:\Windows\System32\svchost.exe
    3340 C:\Windows\System32\SearchIndexer.exe
    3468 C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
    3756 C:\Program Files\iPod\bin\iPodService.exe
    1256 C:\Program Files\Common Files\LogiShrd\LQCVFX\COCIManager.exe
    3476 C:\Windows\System32\svchost.exe
    4664 C:\Windows\System32\wuauclt.exe
    5496 C:\Program Files\Mozilla Firefox\firefox.exe
    4856 C:\Windows\System32\SearchProtocolHost.exe
    3252 C:\Windows\System32\SearchFilterHost.exe
    4564 C:\Users\***\Desktop\MBRCheck.exe
    1616 C:\Windows\System32\conime.exe
    4696 <unknown>

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`40398600  (NTFS)

PhysicalDrive0 Model Number: ST9160821AS, Rev: 3.ALC 

      Size  Device Name          MBR Status
  --------------------------------------------
    149 GB  \\.\PhysicalDrive0  Unknown MBR code
            SHA1: 16FACB29D75458833E397367B1DA17929157C2B3


Found non-standard or infected MBR.
Enter 'Y' and hit ENTER for more options, or 'N' to exit:
Options:
  [1] Dump the MBR of a physical disk to file.
  [2] Restore the MBR of a physical disk with a standard boot code.
  [3] Exit.

Enter your choice:

cosinus 31.05.2011 12:51
Zitat:
149 GB \\.\PhysicalDrive0 Unknown MBR code
SHA1: 16FACB29D75458833E397367B1DA17929157C2B3
Wir sollten den MBR manuell fixen. Sichere für den Fall der Fälle alle wichtigen Daten.

Hast Du noch andere Betriebssysteme außer Vista installiert?
Wenn nicht: Schau mal hier => Vista Notfall/Recovery-CD 32-Bit - Dr. Windows

Lad das iso runter, brenn es zB mit ImgBurn per Imagebrennfunktion auf eine CD und starte damit den Rechner (von dieser CD booten).

Falls Du eine normale Vista-Installations-DVD hast, brauchst Du das o.g. Image nicht sondern kannst einfach von der Vista-DVD booten.

Klick auf Computerreparaturoptionen, weiter, Eingabeaufforderung - die Konsole öffnet sich. Da bitte bootrec.exe /fixboot eintippen (mit enter bestätigen), dann bootrec.exe /fixmbr eintippen (mit enter bestätigen) - Rechner neustarten, CD vorher rausnehmen. Erstell danach wieder neue Logs mit MBRCheck und wenn es geht GMER.

sporty33 31.05.2011 13:05
Habe da noch eine Frage zu:
die viste recover Datei ist als rar gepackt, muss ich die vorher entpacken, oder kann ich die auch so auf eine CD brennen und dann davon booten? (wahrscheinlich nicht, aber von sowas hab ich keine Ahnung und gemacht hab ich sowas auch noch nie...).

Danke für Deine Hilfe!
Grüße sporty33

cosinus 31.05.2011 13:08
Das ist keine RAR-Datei, sondern eine ISO-Datei!!
Nur weil sie das WinRAR-Symbol trägt, macht sie das nicht automatisch zur einer RAR-Datei! Und nein, ISOs dürfen nicht ausgepackt werden! Man muss die ISO-Datei per Imagebrennfunktion brennen.

sporty33 31.05.2011 18:01
so, habe den MBR manuell gefixt.

Anbei die Logs:

GMER:
[CODE]

GMER Logfile:
Code:
GMER 1.0.15.15640 - hxxp://www.gmer.net
Rootkit scan 2011-05-31 18:55:39
Windows 6.0.6002 Service Pack 2 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 ST9160821AS rev.3.ALC
Running: pr2co8ui.exe; Driver: C:\Users\***\AppData\Local\Temp\pxtoqpoc.sys


---- User IAT/EAT - GMER 1.0.15 ----

IAT            C:\Program Files\Logitech\QuickCam\Quickcam.exe[1592] @ C:\Windows\system32\kernel32.dll [ntdll.dll!NtCreateFile]                        [024B2F30] C:\Windows\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT            C:\Program Files\Logitech\QuickCam\Quickcam.exe[1592] @ C:\Windows\system32\kernel32.dll [ntdll.dll!NtClose]                              [024B2D00] C:\Windows\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT            C:\Program Files\Logitech\QuickCam\Quickcam.exe[1592] @ C:\Windows\system32\kernel32.dll [ntdll.dll!NtDeviceIoControlFile]                [024B2CA0] C:\Windows\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT            C:\Program Files\Logitech\QuickCam\Quickcam.exe[1592] @ C:\Windows\system32\kernel32.dll [ntdll.dll!NtDuplicateObject]                    [024B2CD0] C:\Windows\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT            C:\Program Files\Common Files\Logishrd\LQCVFX\COCIManager.exe[2020] @ C:\Windows\system32\kernel32.dll [ntdll.dll!NtCreateFile]          [002B2F30] C:\Windows\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT            C:\Program Files\Common Files\Logishrd\LQCVFX\COCIManager.exe[2020] @ C:\Windows\system32\kernel32.dll [ntdll.dll!NtClose]                [002B2D00] C:\Windows\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT            C:\Program Files\Common Files\Logishrd\LQCVFX\COCIManager.exe[2020] @ C:\Windows\system32\kernel32.dll [ntdll.dll!NtDeviceIoControlFile]  [002B2CA0] C:\Windows\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT            C:\Program Files\Common Files\Logishrd\LQCVFX\COCIManager.exe[2020] @ C:\Windows\system32\kernel32.dll [ntdll.dll!NtDuplicateObject]      [002B2CD0] C:\Windows\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT            C:\Windows\Explorer.EXE[2036] @ C:\Windows\system32\kernel32.dll [ntdll.dll!NtCreateFile]                                                [03DB2F30] C:\Windows\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT            C:\Windows\Explorer.EXE[2036] @ C:\Windows\system32\kernel32.dll [ntdll.dll!NtClose]                                                      [03DB2D00] C:\Windows\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT            C:\Windows\Explorer.EXE[2036] @ C:\Windows\system32\kernel32.dll [ntdll.dll!NtDeviceIoControlFile]                                        [03DB2CA0] C:\Windows\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT            C:\Windows\Explorer.EXE[2036] @ C:\Windows\system32\kernel32.dll [ntdll.dll!NtDuplicateObject]                                            [03DB2CD0] C:\Windows\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT            C:\Users\***\Desktop\pr2co8ui.exe[3980] @ C:\Windows\system32\kernel32.dll [ntdll.dll!NtCreateFile]                                      [00242F30] C:\Windows\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT            C:\Users\***\Desktop\pr2co8ui.exe[3980] @ C:\Windows\system32\kernel32.dll [ntdll.dll!NtClose]                                          [00242D00] C:\Windows\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT            C:\Users\***\Desktop\pr2co8ui.exe[3980] @ C:\Windows\system32\kernel32.dll [ntdll.dll!NtDeviceIoControlFile]                            [00242CA0] C:\Windows\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT            C:\Users\***\Desktop\pr2co8ui.exe[3980] @ C:\Windows\system32\kernel32.dll [ntdll.dll!NtDuplicateObject]                                [00242CD0] C:\Windows\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT            C:\Windows\system32\wuauclt.exe[4968] @ C:\Windows\system32\kernel32.dll [ntdll.dll!NtCreateFile]                                        [000B2F30] C:\Windows\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT            C:\Windows\system32\wuauclt.exe[4968] @ C:\Windows\system32\kernel32.dll [ntdll.dll!NtClose]                                              [000B2D00] C:\Windows\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT            C:\Windows\system32\wuauclt.exe[4968] @ C:\Windows\system32\kernel32.dll [ntdll.dll!NtDeviceIoControlFile]                                [000B2CA0] C:\Windows\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT            C:\Windows\system32\wuauclt.exe[4968] @ C:\Windows\system32\kernel32.dll [ntdll.dll!NtDuplicateObject]                                    [000B2CD0] C:\Windows\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT            C:\Windows\system32\conime.exe[5688] @ C:\Windows\system32\kernel32.dll [ntdll.dll!NtCreateFile]                                          [001B2F30] C:\Windows\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT            C:\Windows\system32\conime.exe[5688] @ C:\Windows\system32\kernel32.dll [ntdll.dll!NtClose]                                              [001B2D00] C:\Windows\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT            C:\Windows\system32\conime.exe[5688] @ C:\Windows\system32\kernel32.dll [ntdll.dll!NtDeviceIoControlFile]                                [001B2CA0] C:\Windows\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)
IAT            C:\Windows\system32\conime.exe[5688] @ C:\Windows\system32\kernel32.dll [ntdll.dll!NtDuplicateObject]                                    [001B2CD0] C:\Windows\TEMP\logishrd\LVPrcInj01.dll (Camera Helper Library./Logitech Inc.)

---- Devices - GMER 1.0.15 ----

AttachedDevice  \Driver\kbdclass \Device\KeyboardClass0                                                                                                  Wdf01000.sys (Kernelmodustreiber-Frameworklaufzeit/Microsoft Corporation)
AttachedDevice  \Driver\kbdclass \Device\KeyboardClass1                                                                                                  Wdf01000.sys (Kernelmodustreiber-Frameworklaufzeit/Microsoft Corporation)
AttachedDevice  \FileSystem\fastfat \Fat                                                                                                                  fltmgr.sys (Microsoft Dateisystem-Filter-Manager/Microsoft Corporation)

---- Threads - GMER 1.0.15 ----

Thread          System [4:4092]                                                                                                                          A67D38C8
Thread          System [4:3352]                                                                                                                          A67D38C8

---- EOF - GMER 1.0.15 ----
--- --- ---


und MBR:

Code:

MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:                       
Windows Version:                Windows Vista Home Premium Edition
Windows Information:                Service Pack 2 (build 6002), 32-bit
Base Board Manufacturer:        MICRO-STAR INT'L CO.,LTD.
BIOS Manufacturer:                American Megatrends Inc.
System Manufacturer:                LG Electronics
System Product Name:                FS-2.AACBG
Logical Drives Mask:                0x0000001c

Kernel Drivers (total 146):
  0x82013000 \SystemRoot\system32\ntkrnlpa.exe
  0x823CD000 \SystemRoot\system32\hal.dll
  0x8040A000 \SystemRoot\system32\kdcom.dll
  0x80411000 \SystemRoot\system32\mcupdate_GenuineIntel.dll
  0x80481000 \SystemRoot\system32\PSHED.dll
  0x80492000 \SystemRoot\system32\BOOTVID.dll
  0x8049A000 \SystemRoot\system32\CLFS.SYS
  0x804DB000 \SystemRoot\system32\CI.dll
  0x8060D000 \SystemRoot\system32\drivers\Wdf01000.sys
  0x8067E000 \SystemRoot\system32\drivers\WDFLDR.SYS
  0x8068C000 \SystemRoot\system32\drivers\acpi.sys
  0x806D2000 \SystemRoot\system32\drivers\WMILIB.SYS
  0x806DB000 \SystemRoot\system32\drivers\msisadrv.sys
  0x806E3000 \SystemRoot\system32\drivers\pci.sys
  0x8070A000 \SystemRoot\System32\drivers\partmgr.sys
  0x80719000 \SystemRoot\system32\DRIVERS\compbatt.sys
  0x8071C000 \SystemRoot\system32\DRIVERS\BATTC.SYS
  0x80726000 \SystemRoot\system32\drivers\volmgr.sys
  0x80735000 \SystemRoot\System32\drivers\volmgrx.sys
  0x8077F000 \SystemRoot\system32\DRIVERS\pcmcia.sys
  0x807AC000 \SystemRoot\system32\DRIVERS\pciide.sys
  0x807B3000 \SystemRoot\system32\DRIVERS\PCIIDEX.SYS
  0x807C1000 \SystemRoot\System32\drivers\mountmgr.sys
  0x807D1000 \SystemRoot\system32\drivers\atapi.sys
  0x807D9000 \SystemRoot\system32\drivers\ataport.SYS
  0x807F7000 \SystemRoot\system32\DRIVERS\o2sd.sys
  0x805BB000 \SystemRoot\system32\DRIVERS\SCSIPORT.SYS
  0x80600000 \SystemRoot\system32\DRIVERS\o2media.sys
  0x82603000 \SystemRoot\system32\drivers\fltmgr.sys
  0x82635000 \SystemRoot\system32\drivers\fileinfo.sys
  0x82645000 \SystemRoot\System32\Drivers\ksecdd.sys
  0x826B6000 \SystemRoot\system32\drivers\ndis.sys
  0x827C1000 \SystemRoot\system32\drivers\msrpc.sys
  0x82C06000 \SystemRoot\system32\drivers\NETIO.SYS
  0x82C41000 \SystemRoot\System32\drivers\tcpip.sys
  0x82D2B000 \SystemRoot\System32\drivers\fwpkclnt.sys
  0x82E0F000 \SystemRoot\System32\Drivers\Ntfs.sys
  0x82F1F000 \SystemRoot\system32\drivers\volsnap.sys
  0x82F58000 \SystemRoot\System32\Drivers\spldr.sys
  0x82F60000 \SystemRoot\System32\Drivers\mup.sys
  0x82F6F000 \SystemRoot\System32\drivers\ecache.sys
  0x82F96000 \SystemRoot\system32\drivers\disk.sys
  0x82FA7000 \SystemRoot\system32\drivers\CLASSPNP.SYS
  0x82FC8000 \SystemRoot\system32\drivers\crcdisk.sys
  0x82FF1000 \SystemRoot\system32\DRIVERS\tunnel.sys
  0x82E00000 \SystemRoot\system32\DRIVERS\tunmp.sys
  0x82D46000 \SystemRoot\system32\DRIVERS\intelppm.sys
  0x89A00000 \SystemRoot\system32\DRIVERS\igdkmd32.sys
  0x82D55000 \SystemRoot\System32\drivers\dxgkrnl.sys
  0x89FD7000 \SystemRoot\System32\drivers\watchdog.sys
  0x8A00F000 \SystemRoot\system32\DRIVERS\HDAudBus.sys
  0x8A09C000 \SystemRoot\system32\DRIVERS\Rtlh86.sys
  0x8A0AF000 \SystemRoot\system32\DRIVERS\usbuhci.sys
  0x8A0BA000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
  0x8A0F8000 \SystemRoot\system32\DRIVERS\usbehci.sys
  0x8A107000 \SystemRoot\system32\DRIVERS\ohci1394.sys
  0x8A117000 \SystemRoot\system32\DRIVERS\1394BUS.SYS
  0x8A125000 \SystemRoot\system32\DRIVERS\i8042prt.sys
  0x8A138000 \SystemRoot\system32\DRIVERS\kbdclass.sys
  0x8A143000 \SystemRoot\system32\DRIVERS\SynTP.sys
  0x8A16E000 \SystemRoot\system32\DRIVERS\USBD.SYS
  0x8A170000 \SystemRoot\system32\DRIVERS\mouclass.sys
  0x8A17B000 \SystemRoot\system32\DRIVERS\CmBatt.sys
  0x8A17F000 \SystemRoot\system32\DRIVERS\cdrom.sys
  0x8A197000 \SystemRoot\system32\DRIVERS\GEARAspiWDM.sys
  0x8A19D000 \SystemRoot\system32\DRIVERS\msiscsi.sys
  0x8A40B000 \SystemRoot\system32\DRIVERS\storport.sys
  0x8A44C000 \SystemRoot\system32\DRIVERS\TDI.SYS
  0x8A457000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
  0x8A46E000 \SystemRoot\system32\DRIVERS\ndistapi.sys
  0x8A479000 \SystemRoot\system32\DRIVERS\ndiswan.sys
  0x8A49C000 \SystemRoot\system32\DRIVERS\raspppoe.sys
  0x8A4AB000 \SystemRoot\system32\DRIVERS\raspptp.sys
  0x8A4BF000 \SystemRoot\system32\DRIVERS\rassstp.sys
  0x8A4D4000 \SystemRoot\system32\DRIVERS\termdd.sys
  0x8A4E4000 \SystemRoot\system32\DRIVERS\swenum.sys
  0x8A4E6000 \SystemRoot\system32\DRIVERS\ks.sys
  0x8A510000 \SystemRoot\system32\DRIVERS\mssmbios.sys
  0x8A51A000 \SystemRoot\system32\DRIVERS\umbus.sys
  0x8A527000 \SystemRoot\system32\DRIVERS\usbhub.sys
  0x8A55C000 \SystemRoot\System32\Drivers\NDProxy.SYS
  0x8A809000 \SystemRoot\system32\drivers\RTKVHDA.sys
  0x8A9A1000 \SystemRoot\system32\drivers\portcls.sys
  0x8A9CE000 \SystemRoot\system32\drivers\drmk.sys
  0x8AA06000 \SystemRoot\system32\DRIVERS\AGRSM.sys
  0x8AB22000 \SystemRoot\system32\drivers\modem.sys
  0x8AB2F000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
  0x8AB38000 \SystemRoot\System32\Drivers\Null.SYS
  0x8AB3F000 \SystemRoot\System32\Drivers\Beep.SYS
  0x8AB46000 \SystemRoot\System32\drivers\vga.sys
  0x8AB52000 \SystemRoot\System32\drivers\VIDEOPRT.SYS
  0x8AB73000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
  0x8AB7B000 \SystemRoot\system32\drivers\rdpencdd.sys
  0x8AB83000 \SystemRoot\System32\Drivers\Msfs.SYS
  0x8AB8E000 \SystemRoot\System32\Drivers\Npfs.SYS
  0x8AB9C000 \SystemRoot\System32\DRIVERS\rasacd.sys
  0x8ABA5000 \SystemRoot\system32\DRIVERS\tdx.sys
  0x8ABBB000 \SystemRoot\system32\DRIVERS\smb.sys
  0x8A576000 \SystemRoot\System32\DRIVERS\netbt.sys
  0x8A5A8000 \SystemRoot\system32\drivers\afd.sys
  0x8ABCF000 \SystemRoot\system32\DRIVERS\pacer.sys
  0x8ABE5000 \SystemRoot\system32\DRIVERS\netbios.sys
  0x8A1CC000 \SystemRoot\system32\DRIVERS\wanarp.sys
  0x8AE0E000 \SystemRoot\system32\DRIVERS\rdbss.sys
  0x8AE4A000 \SystemRoot\system32\drivers\nsiproxy.sys
  0x8AE54000 \SystemRoot\System32\Drivers\dfsc.sys
  0x8AE6B000 \SystemRoot\system32\DRIVERS\hidusb.sys
  0x8AE74000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
  0x8AE84000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
  0x8AE8B000 \SystemRoot\system32\DRIVERS\mouhid.sys
  0x8AE93000 \SystemRoot\System32\Drivers\crashdmp.sys
  0x8AEA0000 \SystemRoot\System32\Drivers\dump_dumpata.sys
  0x8AEAB000 \SystemRoot\System32\Drivers\dump_atapi.sys
  0x8AEB3000 \SystemRoot\system32\DRIVERS\netr73.sys
  0x92A30000 \SystemRoot\System32\win32k.sys
  0x8AEF4000 \SystemRoot\System32\drivers\Dxapi.sys
  0x8AEFE000 \SystemRoot\system32\DRIVERS\monitor.sys
  0x92C50000 \SystemRoot\System32\TSDDD.dll
  0x92C70000 \SystemRoot\System32\cdd.dll
  0x8AF0D000 \SystemRoot\system32\drivers\luafv.sys
  0x8AF39000 \SystemRoot\system32\drivers\spsys.sys
  0x8AFE9000 \SystemRoot\system32\DRIVERS\lltdio.sys
  0xA5E06000 \SystemRoot\system32\DRIVERS\nwifi.sys
  0xA5E30000 \SystemRoot\system32\DRIVERS\ndisuio.sys
  0xA5E3A000 \SystemRoot\system32\DRIVERS\rspndr.sys
  0xA5E4D000 \SystemRoot\system32\drivers\HTTP.sys
  0xA5EBA000 \SystemRoot\System32\DRIVERS\srvnet.sys
  0xA5ED7000 \SystemRoot\system32\DRIVERS\bowser.sys
  0xA5EF0000 \SystemRoot\System32\drivers\mpsdrv.sys
  0xA5F05000 \SystemRoot\system32\drivers\mrxdav.sys
  0xA5F26000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
  0xA5F45000 \SystemRoot\system32\DRIVERS\mrxsmb10.sys
  0xA5F7E000 \SystemRoot\system32\DRIVERS\mrxsmb20.sys
  0xA5F96000 \SystemRoot\System32\DRIVERS\srv2.sys
  0xA6607000 \SystemRoot\System32\DRIVERS\srv.sys
  0xA666E000 \SystemRoot\system32\drivers\peauth.sys
  0xA674C000 \SystemRoot\System32\Drivers\secdrv.SYS
  0xA6756000 \SystemRoot\System32\drivers\tcpipreg.sys
  0xA6762000 \??\C:\Windows\system32\drivers\MGHwCtrl.sys
  0xA6765000 \SystemRoot\system32\DRIVERS\LVPr2Mon.sys
  0xA676A000 \SystemRoot\system32\DRIVERS\cdfs.sys
  0xA6780000 \SystemRoot\system32\DRIVERS\USBSTOR.SYS
  0xA6795000 \SystemRoot\System32\Drivers\fastfat.SYS
  0xA67BD000 \SystemRoot\system32\DRIVERS\WUDFRd.sys
  0xA67D2000 \SystemRoot\system32\DRIVERS\WUDFPf.sys
  0x77810000 \Windows\System32\ntdll.dll

Processes (total 70):
      0 System Idle Process
      4 System
    404 C:\Windows\System32\smss.exe
    472 csrss.exe
    516 C:\Windows\System32\wininit.exe
    528 csrss.exe
    560 C:\Windows\System32\services.exe
    572 C:\Windows\System32\lsass.exe
    580 C:\Windows\System32\lsm.exe
    636 C:\Windows\System32\winlogon.exe
    780 C:\Windows\System32\svchost.exe
    840 C:\Windows\System32\svchost.exe
    872 C:\Windows\System32\svchost.exe
    976 C:\Windows\System32\svchost.exe
    1004 C:\Windows\System32\svchost.exe
    1036 C:\Windows\System32\svchost.exe
    1152 C:\Windows\System32\audiodg.exe
    1180 C:\Windows\System32\svchost.exe
    1196 C:\Windows\System32\SLsvc.exe
    1240 C:\Windows\System32\svchost.exe
    1444 C:\Windows\System32\svchost.exe
    1668 C:\Windows\System32\spoolsv.exe
    1692 C:\Windows\System32\svchost.exe
    1960 C:\Windows\System32\dwm.exe
    1972 C:\Windows\System32\taskeng.exe
    2036 C:\Windows\explorer.exe
    200 C:\Windows\System32\taskeng.exe
    1848 C:\Windows\RtHDVCpl.exe
    1996 C:\Windows\System32\igfxtray.exe
    432 C:\Windows\System32\hkcmd.exe
    412 C:\Windows\System32\igfxpers.exe
    480 C:\Program Files\LG Software\System Control Manager\MGSysCtrl.exe
    1888 C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    1464 C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe
    1592 C:\Program Files\Logitech\QuickCam\Quickcam.exe
    1904 C:\Program Files\iTunes\iTunesHelper.exe
    736 C:\Program Files\Common Files\Java\Java Update\jusched.exe
    928 C:\Program Files\Windows Sidebar\sidebar.exe
    2116 C:\Windows\ehome\ehtray.exe
    2132 C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    2148 C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    2160 C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
    2236 C:\Windows\ehome\ehmsas.exe
    2264 C:\Program Files\OpenOffice.org 2.3\program\soffice.exe
    2396 C:\Program Files\OpenOffice.org 2.3\program\soffice.bin
    2676 C:\Windows\System32\agrsmsvc.exe
    2708 C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    2720 C:\Program Files\Bonjour\mDNSResponder.exe
    2764 C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
    2916 C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
    2924 C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
    3032 C:\Program Files\LG Software\System Control Manager\edd.exe
    3052 C:\Program Files\CDBurnerXP\NMSAccessU.exe
    3068 C:\Windows\System32\o2flash.exe
    3104 C:\Windows\System32\svchost.exe
    3156 C:\Windows\System32\svchost.exe
    3192 C:\Windows\System32\svchost.exe
    3224 C:\Windows\System32\SearchIndexer.exe
    3372 C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
    3692 C:\Program Files\iPod\bin\iPodService.exe
    2020 C:\Program Files\Common Files\LogiShrd\LQCVFX\COCIManager.exe
    1476 WUDFHost.exe
    1076 C:\Windows\System32\svchost.exe
    4624 C:\Windows\System32\wbem\WMIADAP.exe
    4676 WmiPrvSE.exe
    4832 <unknown>
    4968 C:\Windows\System32\wuauclt.exe
    5068 C:\Windows\servicing\TrustedInstaller.exe
    5648 C:\Users\***\Desktop\MBRCheck.exe
    5688 C:\Windows\System32\conime.exe

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`40398600  (NTFS)

PhysicalDrive0 Model Number: ST9160821AS, Rev: 3.ALC 

      Size  Device Name          MBR Status
  --------------------------------------------
    149 GB  \\.\PhysicalDrive0  Windows 2008 MBR code detected
            SHA1: 8DF43F2BDE2D9451948FA14B5279969C777A7979


Done!

cosinus 31.05.2011 18:31
Sieht ok aus. Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SASW und poste die Logs.
Denk dran beide Tools zu updaten vor dem Scan!!


Anschließend über den OnlineScanner von ESET eine zusätzliche Meinung zu holen ist auch nicht verkehrt:


ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset


sporty33 31.05.2011 20:11
Anbei der log von Malwarebytes:

Code:
Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Datenbank Version: 6734

Windows 6.0.6002 Service Pack 2
Internet Explorer 8.0.6001.19048

31.05.2011 21:06:14
mbam-log-2011-05-31 (21-06-14).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|E:\|)
Durchsuchte Objekte: 269289
Laufzeit: 1 Stunde(n), 18 Minute(n), 22 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)

sporty33 31.05.2011 21:04
Hier das Scan-Protokoll von SUPERAntispyware:

Code:

SUPERAntiSpyware Scan Log
hxxp://www.superantispyware.com

Generated 05/31/2011 at 09:58 PM

Application Version : 4.53.1000

Core Rules Database Version : 7170
Trace Rules Database Version: 4982

Scan type      : Quick Scan
Total Scan Time : 00:22:21

Memory items scanned      : 744
Memory threats detected  : 0
Registry items scanned    : 2361
Registry threats detected : 0
File items scanned        : 8378
File threats detected    : 1

Adware.Tracking Cookie
        .advertising.com [ C:\Users\Dani\AppData\Local\Google\Chrome\User Data\Default\Cookies ]

cosinus 31.05.2011 21:38
Nur ein Cookie. Das von ESET fehlt noch.

sporty33 31.05.2011 22:06
Ich weiß, bin noch dabei... Spybot meldet leider immer noch das gleiche, der Virus ist immernoch vorhanden... Hab dir mal den Auszug aus dem bericht angehangen...

Code:
--- Search result list ---
Win32.Katusha.o: [SBI $D40E955A]  Bibliothek (Datei, nothing done)
  C:\Windows\System32\npmpsoxy.dll
  Properties.size=30720
  Properties.md5=385D4066FC8C7314637B2CE79CED0233
  Properties.filedate=1305126888
  Properties.filedatetext=2011-05-11 17:14:48

Benutzer-Abbruch: Überprüfung wurde nicht vollständig durchgeführt! (Status)

sporty33 01.06.2011 06:16
Anbei der ESET Scan:

Code:

ESETSmartInstaller@High as downloader log:
all ok
ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6427
# api_version=3.0.2
# EOSSerial=f22b611804553e4d802822d58e0ff519
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2011-06-01 12:11:27
# local_time=2011-06-01 02:11:27 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.0.6002 NT Service Pack 2
# compatibility_mode=1024 16777215 100 0 8127877 8127877 0 0
# compatibility_mode=5892 16776573 100 100 0 144409220 0 0
# compatibility_mode=8192 67108863 100 0 309 309 0 0
# scanned=134153
# found=1
# cleaned=0
# scan_time=10593
C:\Windows\System32\npmpsoxy.dll        a variant of Win32/Spy.Agent.NTN trojan (unable to clean)        00000000000000000000000000000000        I
Wie gehts jetzt weiter? :crazy:

Viele Grüße
sporty33

cosinus 01.06.2011 10:01
Zitat:
C:\Windows\System32\npmpsoxy.dll
Bitte bei uns hochladen => http://www.trojaner-board.de/54791-a...ner-board.html

sporty33 01.06.2011 20:42
Habe ich gemacht... Wie geht es jetzt weiter? habe ich ne Chance, den Viruas irgendwann noch loszuwerden? :balla:

cosinus 01.06.2011 21:55
Entweder Fehlalarm oder ein völlig neuer Schädling, keine Funde bei Virustoal (40 Scanner haben die Datei geprüft, 0 Funde!)

Lösch die Datei erstmal.
Ist der Rechner sonst wider ok?

sporty33 01.06.2011 22:05
So, hab jetzt versucht, das Ding mit Spybot nochmals zu löschen, hat geklappt bzw. sieht jetzt so aus:

Code:


--- Search result list ---
Win32.Katusha.o: [SBI $D40E955A]  Bibliothek (Datei, fixed)
  C:\Windows\System32\npmpsoxy.dll
  Properties.size=0
  Properties.md5=D41D8CD98F00B204E9800998ECF8427E
Ich habs mir in System32 nochmal angeschaut, die datei wurde nur abgeändert in npmpsoxy.dll_old, reicht das?

Danke und Grüße
sporty33

cosinus 02.06.2011 00:16
Ja das sollte reichen. Du kannst sie auch löschen, für den Fall der Fälle haben wie sie im Upchannel


Alle Zeitangaben in WEZ +1. Es ist jetzt 02:50 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131