Trojaner-Board - Ständig Fehlermeldung im IE bei Google Abfrage

Trojaner-Board (https://www.trojaner-board.de/)

- Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)

- - Ständig Fehlermeldung im IE bei Google Abfrage (https://www.trojaner-board.de/99707-staendig-fehlermeldung-ie-google-abfrage.html)

hier das Ergebnis von MBR-Check:

MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:
Windows Version: Windows XP Professional
Windows Information: Service Pack 3 (build 2600)
Logical Drives Mask: 0x0000005d

Kernel Drivers (total 146):
0x80800000 \WINDOWS\system32\ntkrnlpa.exe
0x80A0F000 \WINDOWS\system32\hal.dll
0xB85A8000 \WINDOWS\system32\KDCOM.DLL
0xB84B8000 \WINDOWS\system32\BOOTVID.dll
0xB7F78000 ACPI.sys
0xB85AA000 \WINDOWS\system32\DRIVERS\WMILIB.SYS
0xB7F67000 pci.sys
0xB80A8000 isapnp.sys
0xB8670000 pciide.sys
0xB8328000 \WINDOWS\system32\DRIVERS\PCIIDEX.SYS
0xB80B8000 MountMgr.sys
0xB7F48000 ftdisk.sys
0xB85AC000 dmload.sys
0xB7F22000 dmio.sys
0xB8671000 amdide.sys
0xB8330000 PartMgr.sys
0xB80C8000 VolSnap.sys
0xB7F0A000 atapi.sys
0xB80D8000 disk.sys
0xB80E8000 \WINDOWS\system32\DRIVERS\CLASSPNP.SYS
0xB7EEA000 fltmgr.sys
0xB7ED8000 sr.sys
0xB7EC1000 KSecDD.sys
0xB7EAE000 WudfPf.sys
0xB85AE000 TwkMs.sys
0xB7E21000 Ntfs.sys
0xB7DF4000 NDIS.sys
0xB7D62000 timntr.sys
0xB7CAC000 tdrpm273.sys
0xB7C84000 snapman.sys
0xB80F8000 ohci1394.sys
0xB8108000 \WINDOWS\system32\DRIVERS\1394BUS.SYS
0xB7C6A000 Mup.sys
0xB8338000 hotcore3.sys
0xB8228000 \SystemRoot\system32\DRIVERS\AmdPPM.sys
0xB341B000 \SystemRoot\system32\DRIVERS\wmiacpi.sys
0xB2941000 \SystemRoot\system32\DRIVERS\nv4_mini.sys
0xB292D000 \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS
0xB290B000 \SystemRoot\system32\DRIVERS\nusb3xhc.sys
0xB85E8000 \SystemRoot\system32\DRIVERS\USBD.SYS
0xB28D4000 \SystemRoot\system32\DRIVERS\Rtenicxp.sys
0xB8238000 \SystemRoot\system32\DRIVERS\imapi.sys
0xB8248000 \SystemRoot\system32\DRIVERS\cdrom.sys
0xB8258000 \SystemRoot\system32\DRIVERS\redbook.sys
0xB28B1000 \SystemRoot\system32\DRIVERS\ks.sys
0xB83E8000 \SystemRoot\system32\DRIVERS\GEARAspiWDM.sys
0xB83F0000 \SystemRoot\system32\DRIVERS\usbohci.sys
0xB288D000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
0xB8268000 \SystemRoot\System32\Drivers\ousbehci.sys
0xB2865000 \SystemRoot\system32\DRIVERS\HDAudBus.sys
0xB2852000 \SystemRoot\system32\DRIVERS\ubohci.sys
0xB283C000 \SystemRoot\system32\DRIVERS\UB1394.SYS
0xB83F8000 \SystemRoot\system32\DRIVERS\fdc.sys
0xB8278000 \SystemRoot\system32\DRIVERS\serial.sys
0xB3413000 \SystemRoot\system32\DRIVERS\serenum.sys
0xB2828000 \SystemRoot\system32\DRIVERS\parport.sys
0xB8288000 \SystemRoot\system32\DRIVERS\i8042prt.sys
0xB8400000 \SystemRoot\system32\DRIVERS\kbdclass.sys
0xB280F000 \SystemRoot\system32\DRIVERS\avmaudio.sys
0xB8408000 \SystemRoot\system32\DRIVERS\TDI.SYS
0xB27F6000 \SystemRoot\system32\DRIVERS\avmaura.sys
0xB873D000 \SystemRoot\system32\DRIVERS\audstub.sys
0xB8410000 \SystemRoot\system32\DRIVERS\rasirda.sys
0xB8298000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
0xB3BDA000 \SystemRoot\system32\DRIVERS\ndistapi.sys
0xB27B7000 \SystemRoot\system32\DRIVERS\ndiswan.sys
0xB82A8000 \SystemRoot\system32\DRIVERS\raspppoe.sys
0xB82B8000 \SystemRoot\system32\DRIVERS\raspptp.sys
0xB27A6000 \SystemRoot\system32\DRIVERS\psched.sys
0xB82C8000 \SystemRoot\system32\DRIVERS\msgpc.sys
0xB8418000 \SystemRoot\system32\DRIVERS\ptilink.sys
0xB8420000 \SystemRoot\system32\DRIVERS\raspti.sys
0xB2776000 \SystemRoot\system32\DRIVERS\rdpdr.sys
0xB82D8000 \SystemRoot\system32\DRIVERS\termdd.sys
0xB8428000 \SystemRoot\system32\DRIVERS\mouclass.sys
0xB85EA000 \SystemRoot\system32\DRIVERS\swenum.sys
0xB2718000 \SystemRoot\system32\DRIVERS\update.sys
0xB3BC2000 \SystemRoot\system32\DRIVERS\mssmbios.sys
0xB26EA000 \SystemRoot\system32\DRIVERS\MarvinBus.sys
0xB33EE000 \SystemRoot\System32\Drivers\NDProxy.SYS
0xB33AE000 \SystemRoot\system32\DRIVERS\nusb3hub.sys
0xB8158000 \SystemRoot\system32\DRIVERS\usbhub.sys
0xB8188000 \SystemRoot\system32\DRIVERS\ousb2hub.sys
0xAF007000 \SystemRoot\system32\drivers\RtkHDAud.sys
0xAEFE3000 \SystemRoot\system32\drivers\portcls.sys
0xB8218000 \SystemRoot\system32\drivers\drmk.sys
0xB84B0000 \SystemRoot\system32\DRIVERS\flpydisk.sys
0xAEF7F000 \SystemRoot\system32\DRIVERS\MpFilter.sys
0xB8388000 \SystemRoot\system32\DRIVERS\usbprint.sys
0xAEDB0000 \??\C:\WINDOWS\system32\drivers\SSHDRV84.sys
0xB8634000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
0xB878C000 \SystemRoot\System32\Drivers\Null.SYS
0xB8636000 \SystemRoot\System32\Drivers\Beep.SYS
0xB83B8000 \SystemRoot\System32\drivers\vga.sys
0xB8638000 \SystemRoot\System32\Drivers\mnmdd.SYS
0xB863A000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0xB83C0000 \SystemRoot\System32\Drivers\Msfs.SYS
0xB83C8000 \SystemRoot\System32\Drivers\Npfs.SYS
0xAF926000 \SystemRoot\system32\DRIVERS\rasacd.sys
0xAED56000 \SystemRoot\system32\DRIVERS\ipsec.sys
0xAECFD000 \SystemRoot\system32\DRIVERS\tcpip.sys
0xAF922000 \SystemRoot\system32\DRIVERS\hidusb.sys
0xAFD8F000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
0xB83D0000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
0xAECD5000 \SystemRoot\system32\DRIVERS\netbt.sys
0xAECAF000 \SystemRoot\system32\DRIVERS\ipnat.sys
0xAFD7F000 \SystemRoot\system32\DRIVERS\wanarp.sys
0xAF645000 \SystemRoot\system32\drivers\[verify-U]-driver.sys
0xAEC8D000 \SystemRoot\System32\drivers\afd.sys
0xAFD6F000 \SystemRoot\system32\DRIVERS\netbios.sys
0xB83E0000 \SystemRoot\System32\Drivers\StarOpen.SYS
0xAEC62000 \SystemRoot\system32\DRIVERS\rdbss.sys
0xAF635000 \??\C:\WINDOWS\system32\drivers\pclepci.sys
0xAEBF2000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
0xAF629000 \SystemRoot\system32\DRIVERS\mouhid.sys
0xAF7E4000 \SystemRoot\System32\Drivers\Fips.SYS
0xAE849000 \SystemRoot\system32\DRIVERS\TWKSER2K.sys
0xB27D6000 \SystemRoot\system32\DRIVERS\SMCLIB.SYS
0xAE825000 \SystemRoot\System32\Drivers\Fastfat.SYS
0xAE7E5000 \SystemRoot\System32\Drivers\dump_atapi.sys
0xB8648000 \SystemRoot\System32\Drivers\dump_WMILIB.SYS
0xBF800000 \SystemRoot\System32\win32k.sys
0xAEA4F000 \SystemRoot\System32\drivers\Dxapi.sys
0xB1594000 \SystemRoot\System32\watchdog.sys
0xBD000000 \SystemRoot\System32\drivers\dxg.sys
0xB87FA000 \SystemRoot\System32\drivers\dxgthk.sys
0xBD012000 \SystemRoot\System32\nv4_disp.dll
0xBD61F000 \SystemRoot\System32\ATMFD.DLL
0xAE4E2000 \??\C:\WINDOWS\system32\drivers\ACEDRV09.sys
0xAE454000 \SystemRoot\system32\DRIVERS\irda.sys
0xAE21F000 \SystemRoot\system32\DRIVERS\mrxdav.sys
0xB85B8000 \SystemRoot\System32\Drivers\ParVdm.SYS
0xAE1B4000 \??\C:\WINDOWS\system32\drivers\acedrv11.sys
0xAE05B000 \SystemRoot\System32\Drivers\HTTP.sys
0xADE9B000 \SystemRoot\system32\DRIVERS\srv.sys
0xB8478000 \SystemRoot\System32\Drivers\TDTCP.SYS
0xADE28000 \SystemRoot\System32\Drivers\RDPWD.SYS
0xAD987000 \SystemRoot\system32\DRIVERS\afcdp.sys
0xAD9CB000 \SystemRoot\system32\DRIVERS\ubsbm.sys
0xAE16C000 \SystemRoot\system32\DRIVERS\ubumapi.sys
0xADE24000 \??\C:\WINDOWS\system32\Drivers\uphcleanhlp.sys
0xB157C000 \??\c:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Microsoft\Microsoft Antimalware\Definition Updates\{F2E4D055-34BF-4FE9-ACE7-61476D7D7D87}\MpKslce7cfe31.sys
0xAD8B7000 \SystemRoot\System32\Drivers\Cdfs.SYS
0xAD58A000 \SystemRoot\system32\drivers\wdmaud.sys
0xAD7AF000 \SystemRoot\system32\drivers\sysaudio.sys
0x7C910000 \WINDOWS\system32\ntdll.dll

Processes (total 41):
0 System Idle Process
4 System
1052 C:\WINDOWS\system32\smss.exe
1176 csrss.exe
1216 C:\WINDOWS\system32\winlogon.exe
1260 C:\WINDOWS\system32\services.exe
1272 C:\WINDOWS\system32\lsass.exe
1444 C:\WINDOWS\system32\nvsvc32.exe
1476 C:\WINDOWS\system32\svchost.exe
1560 svchost.exe
1676 C:\Programme\Microsoft Security Client\Antimalware\MsMpEng.exe
1712 C:\WINDOWS\system32\svchost.exe
1756 C:\WINDOWS\system32\svchost.exe
1832 svchost.exe
1956 svchost.exe
416 C:\WINDOWS\system32\spoolsv.exe
500 scardsvr.exe
608 svchost.exe
740 C:\Programme\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe
752 C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedul2.exe
772 C:\Programme\Gemeinsame Dateien\Acronis\CDP\afcdpsrv.exe
804 C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe
928 C:\Programme\Bonjour\mDNSResponder.exe
1124 C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\EPSON\EPW!3 SSRP\E_S30RP1.EXE
1236 C:\WINDOWS\system32\svchost.exe
324 C:\Programme\Java\jre6\bin\jqs.exe
1664 C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7Debug\mdm.exe
2988 C:\WINDOWS\system32\svchost.exe
3020 C:\Programme\UPHClean\uphclean.exe
3064 C:\Programme\[verify-U] AVS\[verify-U]-Service.exe
3128 wmpnetwk.exe
3804 alg.exe
4004 C:\WINDOWS\explorer.exe
1764 C:\WINDOWS\RTHDCPL.EXE
2120 C:\Programme\Microsoft Security Client\msseces.exe
3124 C:\Programme\Microsoft ActiveSync\wcescomm.exe
3276 C:\PROGRA~1\Microsoft ActiveSync\rapimgr.exe
3268 C:\WINDOWS\system32\ctfmon.exe
3656 C:\Programme\[verify-U] AVS\[verify-U]-Software.exe
992 wmiprvse.exe
4068 C:\Dokumente und Einstellungen\XXXXX\Desktop\MBRCheck.exe

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`00007e00 (NTFS)
\\.\D: --> \\.\PhysicalDrive0 at offset 0x0000003d`8ea00000 (NTFS)
\\.\E: --> \\.\PhysicalDrive1 at offset 0x00000000`00007e00 (NTFS)

PhysicalDrive0 Model Number: WDCWD5000AAVS-00ZTB0, Rev: 01.01B01
PhysicalDrive1 Model Number: SAMSUNGHD400LD, Rev: WQ100-14

Size Device Name MBR Status
--------------------------------------------
465 GB \\.\PhysicalDrive0 Windows XP MBR code detected
SHA1: DA38B874B7713D1B51CBC449F4EF809B0DEC644A
372 GB \\.\PhysicalDrive1 Windows 7 MBR code detected
SHA1: 4379A3D43019B46FA357F7DD6A53B45A3CA8FB79

Done!

Die MBRs sehen schon ok aus. Postest die anderen Logs ja auch noch oder? ;)

hier schon mal das Log vom GMER:
GMER Logfile:

Code:

GMER 1.0.15.15640 - hxxp://www.gmer.net

Rootkit scan 2011-06-03 14:33:56

Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3 WDC_WD5000AAVS-00ZTB0 rev.01.01B01

Running: srn154ot.exe; Driver: C:\DOKUME~1\XXXX\LOKALE~1\Temp\kwtdypod.sys
 
 

---- System - GMER 1.0.15 ----
 

SSDT            \??\C:\WINDOWS\system32\Drivers\uphcleanhlp.sys                                                                     ZwUnloadKey [0xAD8916D0]
 

---- Kernel code sections - GMER 1.0.15 ----
 

.text           C:\WINDOWS\system32\DRIVERS\nv4_mini.sys                                                                            section is writeable [0xB2ABA3A0, 0x59FFE5, 0xE8000020]

.text           C:\WINDOWS\system32\drivers\SSHDRV84.sys                                                                            section is writeable [0xAEE5C000, 0x233D4, 0xE8000020]

.pklstb         C:\WINDOWS\system32\drivers\SSHDRV84.sys                                                                            entry point in ".pklstb" section [0xAEE8E000]

.relo2          C:\WINDOWS\system32\drivers\SSHDRV84.sys                                                                            unknown last section [0xAEEA4000, 0x8E, 0x42000040]

.text           C:\WINDOWS\system32\drivers\ACEDRV09.sys                                                                            section is writeable [0xAE798000, 0x3326E, 0xE8000020]

.pklstb         C:\WINDOWS\system32\drivers\ACEDRV09.sys                                                                            entry point in ".pklstb" section [0xAE7DD000]

.relo2          C:\WINDOWS\system32\drivers\ACEDRV09.sys                                                                            unknown last section [0xAE7F9000, 0x8E, 0x42000040]

.reloc          C:\WINDOWS\system32\drivers\acedrv11.sys                                                                            section is executable [0xAE2FA300, 0x25D4C, 0xE0000060]

?               C:\WINDOWS\system32\Drivers\uphcleanhlp.sys                                                                         Das System kann die angegebene Datei nicht finden. !
 

---- Devices - GMER 1.0.15 ----
 

AttachedDevice  \FileSystem\Ntfs \Ntfs                                                                                              tdrpm273.sys (Acronis Try&Decide Volume Filter Driver/Acronis)

AttachedDevice  \Driver\Tcpip \Device\Ip                                                                                            [verify-U]-driver.sys ([verify-U]-Driver Component/Cybits AG)
 

Device          \Driver\ubohci \Device\UBOHCI0                                                                                      UB1394.SYS (FireAPI® 1394 Class Driver (XP)/Unibrain S.A.)
 

AttachedDevice  \Driver\Tcpip \Device\Tcp                                                                                           [verify-U]-driver.sys ([verify-U]-Driver Component/Cybits AG)

AttachedDevice  \Driver\Ftdisk \Device\HarddiskVolume1                                                                              tdrpm273.sys (Acronis Try&Decide Volume Filter Driver/Acronis)

AttachedDevice  \Driver\Ftdisk \Device\HarddiskVolume1                                                                              fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)

AttachedDevice  \Driver\Ftdisk \Device\HarddiskVolume1                                                                              hotcore3.sys (A part of Paragon System Utilities/Paragon Software Group)

AttachedDevice  \Driver\Ftdisk \Device\HarddiskVolume2                                                                              tdrpm273.sys (Acronis Try&Decide Volume Filter Driver/Acronis)

AttachedDevice  \Driver\Ftdisk \Device\HarddiskVolume2                                                                              fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)

AttachedDevice  \Driver\Ftdisk \Device\HarddiskVolume2                                                                              hotcore3.sys (A part of Paragon System Utilities/Paragon Software Group)

AttachedDevice  \Driver\Ftdisk \Device\HarddiskVolume3                                                                              tdrpm273.sys (Acronis Try&Decide Volume Filter Driver/Acronis)

AttachedDevice  \Driver\Ftdisk \Device\HarddiskVolume3                                                                              fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)

AttachedDevice  \Driver\Ftdisk \Device\HarddiskVolume3                                                                              hotcore3.sys (A part of Paragon System Utilities/Paragon Software Group)
 

Device          \Driver\ubohci \Device\C1394                                                                                        UB1394.SYS (FireAPI® 1394 Class Driver (XP)/Unibrain S.A.)
 

AttachedDevice  \Driver\Tcpip \Device\Udp                                                                                           [verify-U]-driver.sys ([verify-U]-Driver Component/Cybits AG)

AttachedDevice  \Driver\Tcpip \Device\RawIp                                                                                         [verify-U]-driver.sys ([verify-U]-Driver Component/Cybits AG)

AttachedDevice  \FileSystem\Fastfat \Fat                                                                                            tdrpm273.sys (Acronis Try&Decide Volume Filter Driver/Acronis)

AttachedDevice  \FileSystem\Fastfat \Fat                                                                                            fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
 

---- Registry - GMER 1.0.15 ----
 

Reg             HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\System                                                               

Reg             HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\System@OODEFRAG11.00.00.01WORKSTATION                                F092E9D6FE25D69E8AAAEC1ADC06820244A583B96C4AA1FD5CDCF6DB3182413F700E31D6F379082452FDDCFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA6A0AC4980AC79335D575E7D6A3B9808A6A0AC4980AC79338EDD5E5BE2F6E667259D5A05B746AA094B96CEAE1EE1E8084BA461F888D3D6FEA4F7096B1CFB590F752C077CBDCBC462514D60A85105FAC96866A619C61F59EC76A98EDA71A800060E1C5AA3BCC75935A5DD93A91FC203D803FA0D886E9AF97E6B4A433A7A341AE52768811C75167287DCADD804B42F62392DCE6A693D340BDAAE73821C9E0811922B70F8861E382CA0BC06F38AB50688B52B35E8E16200F2EAA29F78963930603A39FA940DDD53398BC2957D973723FC5B75E4841AFD34AD5E5D2EA7449B5B984A222FFA5B54AEDE9B1C6BDF07C20AD97AB7F88C40A9ABCAA6A66266C5095FDD756D99271F10397461AD7FDB39D75F4D2852EDA7076F65EDF9FE62DCBA39B268B455AAE60E9703E9B710A8059467EE9A3FDB28CDA34F04CD5115BC0ACCD970054249B65FDE63C0BEB90CA6C37F5725165B1B6C4C4F3B4FB46D505E40A4095A139CEA76844DE04B88C6A319D2E60314AB5D8C66C2C71A3103CEC89B24F0DAD3088791852218EF2070840A86C1BDB6F0596B612428CE47B82CBACC2B306558E4EA0B47E4D784E

Reg             HKLM\SOFTWARE\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32                                   

Reg             HKLM\SOFTWARE\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32@ThreadingModel                    Apartment

Reg             HKLM\SOFTWARE\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32@                                  C:\WINDOWS\system32\OLE32.DLL

Reg             HKLM\SOFTWARE\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32@cd042efbbd7f7af1647644e76e06692b  0xC8 0x28 0x51 0xAF ...

Reg             HKLM\SOFTWARE\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32                                   

Reg             HKLM\SOFTWARE\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32@ThreadingModel                    Apartment

Reg             HKLM\SOFTWARE\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32@                                  C:\WINDOWS\system32\OLE32.DLL

Reg             HKLM\SOFTWARE\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32@bca643cdc5c2726b20d2ecedcc62c59b  0x6A 0x9C 0xD6 0x61 ...

Reg             HKLM\SOFTWARE\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32                                   

Reg             HKLM\SOFTWARE\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32@ThreadingModel                    Apartment

Reg             HKLM\SOFTWARE\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32@                                  C:\WINDOWS\system32\OLE32.DLL

Reg             HKLM\SOFTWARE\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32@2c81e34222e8052573023a60d06dd016  0x7A 0x45 0x05 0xFD ...

Reg             HKLM\SOFTWARE\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32                                   

Reg             HKLM\SOFTWARE\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32@ThreadingModel                    Apartment

Reg             HKLM\SOFTWARE\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32@                                  C:\WINDOWS\system32\OLE32.DLL

Reg             HKLM\SOFTWARE\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32@2582ae41fb52324423be06337561aa48  0x86 0x8C 0x21 0x01 ...

Reg             HKLM\SOFTWARE\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32                                   

Reg             HKLM\SOFTWARE\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32@ThreadingModel                    Apartment

Reg             HKLM\SOFTWARE\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32@                                  C:\WINDOWS\system32\OLE32.DLL

Reg             HKLM\SOFTWARE\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32@caaeda5fd7a9ed7697d9686d4b818472  0xCD 0x44 0xCD 0xB9 ...

Reg             HKLM\SOFTWARE\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32                                   

Reg             HKLM\SOFTWARE\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32@ThreadingModel                    Apartment

Reg             HKLM\SOFTWARE\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32@                                  C:\WINDOWS\system32\OLE32.DLL

Reg             HKLM\SOFTWARE\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32@a4a1bcf2cc2b8bc3716b74b2b4522f5d  0xDF 0x20 0x58 0x62 ...

Reg             HKLM\SOFTWARE\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32                                   

Reg             HKLM\SOFTWARE\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32@ThreadingModel                    Apartment

Reg             HKLM\SOFTWARE\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32@                                  C:\WINDOWS\system32\OLE32.DLL

Reg             HKLM\SOFTWARE\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32@4d370831d2c43cd13623e232fed27b7b  0xFB 0xA7 0x78 0xE6 ...

Reg             HKLM\SOFTWARE\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32                                   

Reg             HKLM\SOFTWARE\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32@ThreadingModel                    Apartment

Reg             HKLM\SOFTWARE\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32@                                  C:\WINDOWS\system32\OLE32.DLL

Reg             HKLM\SOFTWARE\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32@1d68fe701cdea33e477eb204b76f993d  0xAA 0x52 0xC6 0x00 ...

Reg             HKLM\SOFTWARE\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32                                   

Reg             HKLM\SOFTWARE\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32@ThreadingModel                    Apartment

Reg             HKLM\SOFTWARE\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32@                                  C:\WINDOWS\system32\OLE32.DLL

Reg             HKLM\SOFTWARE\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32@1fac81b91d8e3c5aa4b0a51804d844a3  0xB2 0x46 0x9A 0xE2 ...

Reg             HKLM\SOFTWARE\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32                                   

Reg             HKLM\SOFTWARE\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32@ThreadingModel                    Apartment

Reg             HKLM\SOFTWARE\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32@                                  C:\WINDOWS\system32\OLE32.DLL

Reg             HKLM\SOFTWARE\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32@f5f62a6129303efb32fbe080bb27835b  0xB1 0xCD 0x45 0x5A ...

Reg             HKLM\SOFTWARE\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32                                   

Reg             HKLM\SOFTWARE\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32@ThreadingModel                    Apartment

Reg             HKLM\SOFTWARE\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32@                                  C:\WINDOWS\system32\OLE32.DLL

Reg             HKLM\SOFTWARE\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32@fd4e2e1a3940b94dceb5a6a021f2e3c6  0xE3 0x0E 0x66 0xD5 ...

Reg             HKLM\SOFTWARE\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32                                   

Reg             HKLM\SOFTWARE\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32@ThreadingModel                    Apartment

Reg             HKLM\SOFTWARE\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32@                                  C:\WINDOWS\system32\OLE32.DLL

Reg             HKLM\SOFTWARE\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32@8a8aec57dd6508a385616fbc86791ec2  0x6C 0x43 0x2D 0x1E ...
 

---- Disk sectors - GMER 1.0.15 ----
 

Disk            \Device\Harddisk0\DR0                                                                                               malicious Win32:MBRoot code @ sector 976768068

Disk            \Device\Harddisk0\DR0                                                                                               PE file @ sector 976768090
 

---- EOF - GMER 1.0.15 ----

--- --- ---

und das OSAM:
OSAM Logfile:

Code:

Report of OSAM: Autorun Manager v5.0.11926.0

hxxp://www.online-solutions.ru/en/

Saved at 14:42:45 on 03.06.2011
 

OS: Windows XP Professional Service Pack 3 (Build 2600)

Default Browser: Microsoft Corporation Internet Explorer 8.00.6001.18702
 

Scanner Settings

[x] Rootkits detection (hidden registry)

[x] Rootkits detection (hidden files)

[x] Retrieve files information

[x] Check Microsoft signatures
 

Filters

[ ] Trusted entries

[ ] Empty entries

[x] Hidden registry entries (rootkit activity)

[x] Exclusively opened files

[x] Not found files

[x] Files without detailed information

[x] Existing files

[ ] Non-startable services

[ ] Non-startable drivers

[x] Active entries

[x] Disabled entries
 
 

[Common]

-----( %SystemRoot%\Tasks )-----

"AppleSoftwareUpdate.job" - "Apple Inc." - C:\Programme\Apple Software Update\SoftwareUpdate.exe

"GlaryInitialize.job" - "Glarysoft Ltd" - C:\Programme\Glary Utilities\initialize.exe

"WGASetup.job" - "Microsoft Corporation" - C:\WINDOWS\system32\KB905474\wgasetup.exe
 

[Control Panel Objects]

-----( %SystemRoot%\system32 )-----

"infocardcpl.cpl" - "Microsoft Corporation" - C:\WINDOWS\system32\infocardcpl.cpl

"javacpl.cpl" - "Sun Microsystems, Inc." - C:\WINDOWS\system32\javacpl.cpl

"nvcpl.cpl" - "NVIDIA Corporation" - C:\WINDOWS\system32\nvcpl.cpl

"PhysX.cpl" - "NVIDIA Corporation" - C:\WINDOWS\system32\PhysX.cpl

"viahdcpl.cpl" - "VIA Technologies, Inc" - C:\WINDOWS\system32\viahdcpl.cpl

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )-----

"Nero BurnRights" - "Nero AG" - C:\Programme\Nero\Nero 7\Nero Toolkit\NeroBurnRights.cpl

"QuickTime" - "Apple Inc." - C:\Programme\QuickTime\QTSystem\QuickTime.cpl
 

[Drivers]

-----( HKLM\SYSTEM\CurrentControlSet\Services )-----

"ACEDRV09" (ACEDRV09) - "Protect Software GmbH" - C:\WINDOWS\system32\drivers\ACEDRV09.sys

"acedrv11" (acedrv11) - "Protect Software GmbH" - C:\WINDOWS\system32\drivers\acedrv11.sys

"Acronis Snapshots Manager" (snapman) - "Acronis" - C:\WINDOWS\System32\DRIVERS\snapman.sys

"Acronis Try&Decide and Restore Points filter (build 273)" (tdrpman273) - "Acronis" - C:\WINDOWS\System32\DRIVERS\tdrpm273.sys

"afcdp" (afcdp) - "Acronis" - C:\WINDOWS\System32\DRIVERS\afcdp.sys

"AVM Audio" (avmaudio) - "AVM Berlin" - C:\WINDOWS\System32\DRIVERS\avmaudio.sys

"AVM USB-Fernanschluss" (avmaura) - "AVM Berlin" - C:\WINDOWS\System32\DRIVERS\avmaura.sys

"catchme" (catchme) - ? - C:\ComboFix\catchme.sys  (File not found)

"Changer" (Changer) - ? - C:\WINDOWS\system32\drivers\Changer.sys  (File not found)

"CHIPDRIVE Plug and Play driver" (TWKPNP) - ? - C:\WINDOWS\System32\DRIVERS\TWKPNP.SYS  (File not found)

"CHIPDRIVE Serial SmartCardReader" (TWKSER2K) - "SCM Microsystems Inc." - C:\WINDOWS\System32\DRIVERS\TWKSER2K.sys

"CHIPDRIVE USB Serial Port Emulation" (Serport) - ? - C:\WINDOWS\System32\DRIVERS\SERPORT.SYS  (File not found)

"CHIPDRIVE USB SmartCardReader" (CHIPDRIVE USB SmartCardReader) - ? - C:\WINDOWS\System32\DRIVERS\TwkUsb2K.sys  (File not found)

"gdrv" (gdrv) - "Windows (R) 2000 DDK provider" - C:\WINDOWS\gdrv.sys

"giveio" (giveio) - ? - C:\WINDOWS\system32\giveio.sys  (File found, but it contains no detailed information)

"hc3ServiceName" (hotcore3) - "Paragon Software Group" - C:\WINDOWS\System32\DRIVERS\hotcore3.sys

"i2omgmt" (i2omgmt) - ? - C:\WINDOWS\system32\drivers\i2omgmt.sys  (File not found)

"IPSEC-Treiber" (xpsec) - ? - C:\WINDOWS\system32\drivers\xpsec.sys  (File not found)

"kwtdypod" (kwtdypod) - ? - C:\DOKUME~1\XXXX~1\LOKALE~1\Temp\kwtdypod.sys  (Hidden registry entry, rootkit activity | File not found)

"lbrtfdc" (lbrtfdc) - ? - C:\WINDOWS\system32\drivers\lbrtfdc.sys  (File not found)

"Microsoft serieller Infrarottreiber" (irsir) - ? - C:\WINDOWS\System32\DRIVERS\irsir.sys  (File not found)

"MpKsl8293f020" (MpKsl8293f020) - ? - c:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Microsoft\Microsoft Antimalware\Definition Updates\{D7286375-9FB7-4A82-99AB-07FA95EE68D7}\MpKsl8293f020.sys  (File not found)

"MpKslf3203388" (MpKslf3203388) - ? - c:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Microsoft\Microsoft Antimalware\Definition Updates\{0988F5B2-BC50-48C9-91A0-A9425D51E14F}\MpKslf3203388.sys  (File not found)

"OrangeWare USB 2.0 Root Hub Support" (ousb2hub) - "OrangeWare Corporation" - C:\WINDOWS\System32\DRIVERS\ousb2hub.sys

"OrangeWare USB Enhanced Host Controller Service" (ousbehci) - "OrangeWare Corporation" - C:\WINDOWS\System32\Drivers\ousbehci.sys

"PCIDump" (PCIDump) - ? - C:\WINDOWS\system32\drivers\PCIDump.sys  (File not found)

"PCLEPCI" (PCLEPCI) - "Pinnacle Systems GmbH" - C:\WINDOWS\system32\drivers\pclepci.sys

"PDCOMP" (PDCOMP) - ? - C:\WINDOWS\system32\drivers\PDCOMP.sys  (File not found)

"PDFRAME" (PDFRAME) - ? - C:\WINDOWS\system32\drivers\PDFRAME.sys  (File not found)

"PDRELI" (PDRELI) - ? - C:\WINDOWS\system32\drivers\PDRELI.sys  (File not found)

"PDRFRAME" (PDRFRAME) - ? - C:\WINDOWS\system32\drivers\PDRFRAME.sys  (File not found)

"Pinnacle Marvin Bus" (MarvinBus) - "Pinnacle Systems GmbH" - C:\WINDOWS\System32\DRIVERS\MarvinBus.sys

"Prolific Serial port driver" (Ser2pl) - "Prolific Technology Inc." - C:\WINDOWS\System32\DRIVERS\ser2pl.sys

"SSHDRV84" (SSHDRV84) - ? - C:\WINDOWS\system32\drivers\SSHDRV84.sys

"StarOpen" (StarOpen) - ? - C:\WINDOWS\system32\drivers\StarOpen.sys  (File found, but it contains no detailed information)

"TCP/IP-Protokolltreiber" (xcpip) - ? - C:\WINDOWS\system32\drivers\xcpip.sys  (File not found)

"Tunebite High-Speed Dubbing" (tbhsd) - "RapidSolution Software AG" - C:\WINDOWS\System32\drivers\tbhsd.sys

"TwkMs" (TwkMs) - "Towitoko AG" - C:\WINDOWS\system32\drivers\TwkMs.sys

"Unibrain 1394 FireAPI Driver" (ubumapi) - "Unibrain S.A." - C:\WINDOWS\System32\DRIVERS\ubumapi.sys

"Unibrain 1394 OHCI Driver" (ubohci) - "Unibrain S.A." - C:\WINDOWS\System32\DRIVERS\ubohci.sys

"Unibrain 1394 SBM Driver" (ubsbm) - "Unibrain S.A." - C:\WINDOWS\System32\DRIVERS\ubsbm.sys

"WDICA" (WDICA) - ? - C:\WINDOWS\system32\drivers\WDICA.sys  (File not found)

"[verify-U]_System" ([verify-U]_System) - "Cybits AG" - C:\WINDOWS\System32\drivers\[verify-U]-driver.sys
 

[Explorer]

-----( HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components )-----

{B2C3BB6B-E005-4246-B8E5-DF0A4D073CDC} "PixiePack Codec Pack 1.0.100.0" - ? - C:\Programme\PixiePack Codec Pack\InstallerHelper.exe

{89B4C1CD-B018-4511-B0A1-5476DBF70820} "StubPath" - "Microsoft Corporation" - C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\mscories.dll,Install

-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----

{F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\PDFShell.dll

{7D4D6379-F301-4311-BEBA-E26EB0561882} "{7D4D6379-F301-4311-BEBA-E26EB0561882}" - ? -   (File not found | COM-object registry key not found)

{9E96C1F5-0EFA-4348-9460-15D6802C70AA} "{9E96C1F5-0EFA-4348-9460-15D6802C70AA}" - ? -   (File not found | COM-object registry key not found)

-----( HKLM\Software\Classes\Protocols\Filter )-----

{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll

{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll

{1E66F26B-79EE-11D2-8710-00C04F79ED0D} "Cor MIME Filter, CorFltr, CorFltr 1" - "Microsoft Corporation" - C:\WINDOWS\system32\mscoree.dll

-----( HKLM\Software\Classes\Protocols\Handler )-----

{3D9F03FA-7A94-11D3-BE81-0050048385D1} "Data Page Pluggable Protocol mso-offdap Handler" - "Microsoft Corporation" - C:\PROGRA~1\GEMEIN~1\MICROS~1\WEBCOM~1\10\OWC10.DLL

{0A9007C0-4076-11D3-8789-0000F8105754} "Microsoft Infotech Storage Protocol for IE 4.0" - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Information Retrieval\MSITSS.DLL

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----

{C539A15B-3AF9-4c92-B771-50CB78F5C751} "Acronis Secure Zone" - "Acronis" - C:\Programme\Acronis\TrueImageHome\tishell.dll

{C539A15A-3AF9-4c92-B771-50CB78F5C751} "Acronis True Image Shell Context Menu Extension" - "Acronis" - C:\Programme\Acronis\TrueImageHome\tishell.dll

 "CorelDRAW Shell Extension Component" - ? -   (File not found | COM-object registry key not found)

{42071714-76d4-11d1-8b24-00a0c9068ff3} "CPL-Erweiterung für Anzeigeverschiebung" - ? - deskpan.dll  (File not found)

{1CDB2949-8F65-4355-8456-263E7C208A5D} "Desktop Explorer" - "NVIDIA Corporation" - C:\Programme\NVIDIA Corporation\nView\nvshell.dll

{1E9B04FB-F9E5-4718-997B-B8DA88302A47} "Desktop Explorer Menu" - "NVIDIA Corporation" - C:\Programme\NVIDIA Corporation\nView\nvshell.dll

{A70C977A-BF00-412C-90B7-034C51DA2439} "DesktopContext Class" - "NVIDIA Corporation" - C:\WINDOWS\system32\nvcpl.dll

{09A47860-11B0-4DA5-AFA5-26D86198A780} "EPP" - "Microsoft Corporation" - c:\PROGRA~1\Microsoft Security Client\shellext.dll

{72923739-5A47-40A3-9895-25AF0DFBB9E4} "Glary Utilities Context Menu Shell Extension" - "Glarysoft Ltd" - C:\PROGRA~1\GLARYU~1\CONTEX~1.DLL

{B9E1D2CB-CCFF-4AA6-9579-D7A4754030EF} "iTunes" - "Apple Inc." - C:\Programme\iTunes\iTunesMiniPlayer.dll

{853FE2B1-B769-11d0-9C4E-00C04FB6C6FA} "Kontextmenü für die Verschlüsselung" - ? -   (File not found | COM-object registry key not found)

{42042206-2D85-11D3-8CFF-005004838597} "Microsoft Office HTML Icon Handler" - "Microsoft Corporation" - C:\Programme\Microsoft Office\Office10\msohev.dll

{993BE281-6695-4BA5-8A2A-7AACBFAAB69E} "Microsoft Office Metadata Handler" - "Microsoft Corporation" - C:\PROGRA~1\GEMEIN~1\MICROS~1\OFFICE12\msoshext.dll

{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97} "Microsoft Office Thumbnail Handler" - "Microsoft Corporation" - C:\PROGRA~1\GEMEIN~1\MICROS~1\OFFICE12\msoshext.dll

{49BF5420-FA7F-11cf-8011-00A0C90A8F78} "Mobiles Gerät" - "Microsoft Corporation" - C:\PROGRA~1\Microsoft ActiveSync\Wcesview.dll

{B327765E-D724-4347-8B16-78AE18552FC3} "NeroDigitalIconHandler" - ? -   (File not found | COM-object registry key not found)

{7F1CF152-04F8-453A-B34C-E609530A9DC8} "NeroDigitalPropSheetHandler" - ? -   (File not found | COM-object registry key not found)

{FFB699E0-306A-11d3-8BD1-00104B6F7516} "NVIDIA CPL Extension" - "NVIDIA Corporation" - C:\WINDOWS\system32\nvcpl.dll

{1E9B04FB-F9E5-4718-997B-B8DA88302A48} "nView Desktop Context Menu" - "NVIDIA Corporation" - C:\Programme\NVIDIA Corporation\nView\nvshell.dll

{0006F045-0000-0000-C000-000000000046} "Outlook-Dateisymbolerweiterung" - "Microsoft Corporation" - C:\Programme\Microsoft Office\Office10\OLKFSTUB.DLL

{45AC2688-0253-4ED8-97DE-B5370FA7D48A} "Shell Extension for Malware scanning" - ? -   (File not found | COM-object registry key not found)

{E37E2028-CE1A-4f42-AF05-6CEABC4E5D75} "Shell Icon Handler for Application References" - "Microsoft Corporation" - C:\WINDOWS\system32\dfshim.dll

{764BF0E1-F219-11ce-972D-00AA00A14F56} "Shellerweiterungen für die Dateikomprimierung" - ? -   (File not found | COM-object registry key not found)

{e82a2d71-5b2f-43a0-97b8-81be15854de8} "ShellLink for Application References" - "Microsoft Corporation" - C:\WINDOWS\system32\dfshim.dll

{79BC0345-1015-11D2-A299-006008312725} "Studio.Project" - ? - C:\Programme\Pinnacle\Studio 10\programs\BlueShellExt.dll  (File found, but it contains no detailed information)

{BDEADF00-C265-11D0-BCED-00A0C90AB50F} "Webordner" - "Microsoft Corporation" - C:\PROGRA~1\GEMEIN~1\MICROS~1\WEBFOL~1\MSONSEXT.DLL

{45670FA8-ED97-4F44-BC93-305082590BFB} "Windows XPS Document Metadata Handler" - "Microsoft Corporation" - C:\WINDOWS\System32\XPSSHHDR.DLL

{44121072-A222-48f2-A58A-6D9AD51EBBE9} "Windows XPS Document Thumbnail Handler" - "Microsoft Corporation" - C:\WINDOWS\System32\XPSSHHDR.DLL

{B41DB860-8EE4-11D2-9906-E49FADC173CA} "WinRAR" - ? - C:\Programme\WinRAR\rarext.dll
 

[Internet Explorer]

-----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )-----

ITBar7Height "ITBar7Height" - ? -   (File not found | COM-object registry key not found)

<binary data> "ITBar7Layout" - ? -   (File not found | COM-object registry key not found)

<binary data> "ITBarLayout" - ? -   (File not found | COM-object registry key not found)

-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----

{17492023-C23A-453E-A040-C7C580BBF700} "Windows Genuine Advantage Validation Tool" - "Microsoft Corporation" - C:\WINDOWS\system32\LegitCheckControl.DLL / hxxp://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab

{8FFBE65D-2C9C-4669-84BD-5829DC0B603C} "{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}" - ? -   (File not found | COM-object registry key not found) / hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab

{E2883E8F-472F-4FB0-9522-AC9BF37916A7} "{E2883E8F-472F-4FB0-9522-AC9BF37916A7}" - ? -   (File not found | COM-object registry key not found) / hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----

{17A84966-F1E9-4645-AA9E-5E771EE1C859} "Add to VideoGet" - "Nuclear Coffee Software" - C:\PROGRA~1\Nuclear Coffee\VideoGet\Plugins\VideoGet_IE.dll

{2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} "ClsidExtension" - "Microsoft Corporation" - C:\PROGRA~1\Microsoft ActiveSync\INetRepl.dll

{2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} "Create Mobile Favorite" - "Microsoft Corporation" - C:\PROGRA~1\Microsoft ActiveSync\INetRepl.dll

"Exec" - ? - C:\WINDOWS\bdoscandel.exe  (File not found)

-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar )-----

{98889811-442D-49dd-99D7-DC866BE87DBC} "Babylon Toolbar" - "Babylon Ltd." - C:\Programme\BabylonToolbar\BabylonToolbar\1.4.23.10\BabylonToolbarTlbr.dll

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----

{18DF081C-E8AD-4283-A596-FA578C2EBDC3} "Adobe PDF Link Helper" - "Adobe Systems Incorporated" - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

{2EECD738-5844-4a99-B4B6-146BF802613B} "CescrtHlpr Object" - "Babylon BHO" - C:\Programme\BabylonToolbar\BabylonToolbar\1.4.23.10\bh\BabylonToolbar.dll

{DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\jp2ssv.dll

{E7E6F031-17CE-4C07-BC86-EABFE594F69C} "JQSIEStartDetectorImpl Class" - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

{AA102584-3B97-47e7-B9BC-75D54C110A7D} "Tunebite_WebRipPlugin Class" - "RapidSolution Software" - C:\Programme\RapidSolution\Tunebite\plugins\IE\TB_WebRipIePlugin.dll

{9030D464-4C02-4ABF-8ECC-5164760863C6} "Windows Live Anmelde-Hilfsprogramm" - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

{F4552A56-119C-478E-AB3F-2C850F78B72E} "[verify-U]_Add-on" - "Cybits AG" - C:\Programme\[verify-U]_AVS_IE_Add-on\[verify-U]_AVS.dll

{02478D38-C3F9-4efb-9B51-7695ECA05670} "{02478D38-C3F9-4efb-9B51-7695ECA05670}" - ? -   (File not found | COM-object registry key not found)
 

[Logon]

-----( %AllUsersProfile%\Startmenü\Programme\Autostart )-----

"desktop.ini" - ? - C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\desktop.ini

"[verify-U]-Software.lnk" - ? - C:\Programme\[verify-U] AVS\[verify-U]-Software.exe  (Shortcut exists | File exists)

-----( %UserProfile%\Startmenü\Programme\Autostart )-----

"desktop.ini" - ? - C:\Dokumente und Einstellungen\XXXX\Startmenü\Programme\Autostart\desktop.ini

-----( HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run )-----

"1&1 SMS-Manager" - "1&1 Internet AG" - C:\Programme\1&1\SMS-Manager\SMSMngr.exe

"H/PC Connection Agent" - "Microsoft Corporation" - "C:\Programme\Microsoft ActiveSync\wcescomm.exe"

-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----

"BabylonToolbar" - "Babylon Ltd." - "C:\Programme\BabylonToolbar\BabylonToolbar\1.4.23.10\BabylonToolbarsrv.exe" /md I

"MSC" - "Microsoft Corporation" - "c:\Programme\Microsoft Security Client\msseces.exe" -hide -runkey

"NvCplDaemon" - "NVIDIA Corporation" - RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

"nwiz" - "NVIDIA Corporation" - C:\Programme\NVIDIA Corporation\nView\nwiz.exe /installquiet

"QuickTime Task" - "Apple Inc." - "C:\Programme\QuickTime\qttask.exe" -atboottime
 

[Print Monitors]

-----( HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors )-----

"FRITZ!fax Color Monitor" - "AVM Berlin" - C:\WINDOWS\system32\FritzVistaColorMon.dll

"FRITZ!fax Port Monitor" - "AVM Berlin" - C:\WINDOWS\system32\FritzVistaMon.dll

"GEngine Port Monitor" - ? - C:\WINDOWS\system32\gengpmon.dll  (File found, but it contains no detailed information)
 

[Services]

-----( HKLM\SYSTEM\CurrentControlSet\Services )-----

".NET Runtime Optimization Service v2.0.50727_X86" (clr_optimization_v2.0.50727_32) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

"AAV UpdateService" (AAV UpdateService) - ? - C:\Programme\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe

"Acronis Nonstop Backup-Dienst" (afcdpsrv) - "Acronis" - C:\Programme\Gemeinsame Dateien\Acronis\CDP\afcdpsrv.exe

"Acronis Scheduler2 Service" (AcrSch2Svc) - "Acronis" - C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedul2.exe

"Apple Mobile Device" (Apple Mobile Device) - "Apple Inc." - C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe

"ASP.NET-Zustandsdienst" (aspnet_state) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe

"Dienst "Bonjour"" (Bonjour Service) - "Apple Inc." - C:\Programme\Bonjour\mDNSResponder.exe

"InstallDriver Table Manager" (IDriverT) - "Macrovision Corporation" - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe

"iPod-Dienst" (iPod Service) - "Apple Inc." - C:\Programme\iPod\bin\iPodService.exe

"Java Quick Starter" (JavaQuickStarterService) - "Sun Microsystems, Inc." - C:\Programme\Java\jre6\bin\jqs.exe

"Machine Debug Manager" (MDM) - "Microsoft Corporation" - C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7Debug\mdm.exe

"Microsoft Antimalware Service" (MsMpSvc) - "Microsoft Corporation" - c:\Programme\Microsoft Security Client\Antimalware\MsMpEng.exe

"NBService" (NBService) - "Nero AG" - C:\Programme\Nero\Nero 7\Nero BackItUp\NBService.exe

"NVIDIA Display Driver Service" (NVSvc) - "NVIDIA Corporation" - C:\WINDOWS\system32\nvsvc32.exe

"ServiceLayer" (ServiceLayer) - "Nokia" - C:\Programme\PC Connectivity Solution\ServiceLayer.exe

"StarMoney 7.0 OnlineUpdate" (StarMoney 7.0 OnlineUpdate) - "Star Finanz - Software Entwicklung und Vertriebs GmbH" - C:\Programme\StarMoney 7.0 S-Edition-neu\ouservice\StarMoneyOnlineUpdate.exe

"User Profile Hive Cleanup" (UPHClean) - "Microsoft Corporation" - C:\Programme\UPHClean\uphclean.exe

"Windows Presentation Foundation Font Cache 3.0.0.0" (FontCache3.0.0.0) - "Microsoft Corporation" - c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe

"[verify-U]-Service" ([verify-U]) - "Cybit AG" - C:\Programme\[verify-U] AVS\[verify-U]-Service.exe
 

[Winlogon]

-----( HKCU\Control Panel\IOProcs )-----

"MVB" - ? - mvfs32.dll  (File not found)

-----( HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify )-----

"WgaLogon" - "Microsoft Corporation" - C:\WINDOWS\system32\WgaLogon.dll
 

[Winsock Providers]

-----( HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries )-----

"mdnsNSP" - "Apple Inc." - C:\Programme\Bonjour\mdnsNSP.dll
 

===[ Logfile end ]=========================================[ Logfile end ]===

--- --- ---

If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru

Sieht ok aus. Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SASW und poste die Logs.
Denk dran beide Tools zu updaten vor dem Scan!!

Anschließend über den OnlineScanner von ESET eine zusätzliche Meinung zu holen ist auch nicht verkehrt:

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Malwarebytes' Anti-Malware 1.51.0.1200
www.malwarebytes.org

Datenbank Version: 6768

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

04.06.2011 12:15:14
mbam-log-2011-06-04 (12-15-14).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|)
Durchsuchte Objekte: 416126
Laufzeit: 48 Minute(n), 14 Sekunde(n)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)

SUPERAntiSpyware Scann-Protokoll
hxxp://www.superantispyware.com

Generiert 06/04/2011 bei 09:41 AM

Version der Applikation : 4.53.1000

Version der Kern-Datenbank : 7200
Version der Spur-Datenbank : 5012

Scan Art : Schneller Scann
Totale Scann-Zeit : 01:03:00

Gescannte Speicherelemente : 461
Erfasste Speicher-Bedrohungen : 0
Gescannte Register-Elemente : 1673
Erfasste Register-Bedrohungen : 0
Gescannte Datei-Elemente : 117965
Erfasste Datei-Elemente : 0

Zitat:

Scan Art : Schneller Scann

Du solltest einen vollen Scan machen...

ESETSmartInstaller@High as CAB hook log:
OnlineScanner.ocx - registred OK
# version=7
# IEXPLORE.EXE=8.00.6001.18702 (longhorn_ie8_rtm(wmbla).090308-0339)
# OnlineScanner.ocx=1.0.0.6522
# api_version=3.0.2
# EOSSerial=e2da482cc6b7694bb236a7d7064c82d3
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2011-06-04 12:09:36
# local_time=2011-06-04 02:09:36 (+0100, Westeuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=5.1.2600 NT Service Pack 3
# compatibility_mode=512 16777215 100 0 33587521 33587521 0 0
# compatibility_mode=5891 16776869 42 87 12424 19231837 0 0
# compatibility_mode=8192 67108863 100 0 74 74 0 0
# scanned=204459
# found=0
# cleaned=0
# scan_time=5601

Sorry, hatte nicht die Pro-Version geladen.
hier nun der Log vom Fullscan:
SUPERAntiSpyware Scan Log
hxxp://www.superantispyware.com

Generated 06/04/2011 at 05:21 PM

Application Version : 4.53.1000

Core Rules Database Version : 7200
Trace Rules Database Version: 5012

Scan type : Complete Scan
Total Scan Time : 00:47:22

Memory items scanned : 494
Memory threats detected : 0
Registry items scanned : 9714
Registry threats detected : 0
File items scanned : 49920
File threats detected : 3

Adware.Tracking Cookie
C:\Dokumente und Einstellungen\xxxx\Cookies\xxxx@adtech[1].txt
C:\Dokumente und Einstellungen\xxxx\Cookies\xxxx@adfarm1.adition[2].txt
C:\Dokumente und Einstellungen\xxxx\Cookies\xxxx@ad2.adfarm1.adition[2].txt

Das Problem mit dem Google-Fenster ist scheinbar behoben. Kann es mit dem vom Combofix gefundendenen Bootkit Sinowal zusammen gehangen haben? - Ansonsten scheint der Rechner jetzt doch wieder sauber zu sein - oder?

Zitat:

Kann es mit dem vom Combofix gefundendenen Bootkit Sinowal zusammen gehangen haben? - Ansonsten scheint der Rechner jetzt doch wieder sauber zu sein - oder?

Ja, der Sinowal kann sehr wahrscheinlich der Grund gewesen sein.
Rechner ist wieder im Lot? SASW hat auch nur noch Cookies gefunden und ESET garnichts mehr.

Ich werde den Rechner mal weiter beobachten und melde mich dann mit dem Ergebnis. Als Virenschutz habe ich ja die Microsoft Security Essentials. Sollte doch eigentlich ausreichen - oder?

Vorerst danke ich für die hilfreiche Unterstützung.

Viele Grüße
Realbiker

Zitat:

Als Virenschutz habe ich ja die Microsoft Security Essentials. Sollte doch eigentlich ausreichen - oder?

Ja reicht dicke.

Die Frage - welcher Virenscanner oder ob der installierte reicht - taucht ständig auf.
Der Virenscanner - egal welcher - kann und wird niemals 100% Schutz bieten können. Neue/unbekannte Schädlinge können immer durch die Lappen gehen.
Abgesehen davon nutzen verschiedene Virenscanner unterschiedliche Signaturen und Techniken, das führt dazu, dass zB Scanner1 Schädling X entdeckt, aber Schädling Y übersieht. Scanner2 erkennt Schädling Y, dafür aber Schädling X nicht...
Wichtiger ist, dass du dich an Regeln hälst. Der beste Virenscanner bringt nichts, wenn du dich falsch verhälst und fahrlässig/unvorsichtig bist. Airbag und Sicherheitsgurt im Auto sind ja auch keine Gründe dafür auf die Verkehrsregeln zu pfeifen.

Halte Dich am besten grob an diese Regeln:

1) Sei misstrauisch im Internet und v.a. bei unbekannten E-Mails, sei vorsichtig bei der Herausgabe persönlicher Daten!!
2) Halte Windows und alle verwendeten Programme immer aktuell
3) Führe regelmäßig Backups auf externe Medien durch
4) Arbeite mit eingeschränkten Rechten
5) Nutze sichere Programme wie zB Opera oder Firefox zum Surfen statt den IE, zum Mailen Thunderbird statt Outlook Express - E-Mails nur als reinen text anzeigen lassen
6) automatische Wiedergabe von allen Laufwerken komplett deaktivieren, denn das ist ein unnötiges Sicherheitsrisiko

Alles noch genauer erklärt steht hier => Kompromittierung unvermeidbar?