FakeAlert!fakealert-REP in C:\Windows\Downloaded Program Files\FP_AX_CAB_INSTALLER.exe

ComboFix 11-08-23.01 - Familie Pichler 23.08.2011  13:59:09.1.4 - x86
Microsoft Windows 7 Home Premium   6.1.7600.0.1252.43.1031.18.3071.2251 [GMT 2:00]
ausgeführt von:: c:\users\Familie Pichler\Desktop\ComboFix.exe
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Familie Pichler\AppData\Roaming\aicon
c:\users\Familie Pichler\AppData\Roaming\aicon\aicon.ini
c:\users\Wallpaper\10.jpg
c:\users\Wallpaper\11.jpg
c:\windows\system32\Cache
c:\windows\system32\logs
F:\autorun.inf
.
.
(((((((((((((((((((((((   Dateien erstellt von 2011-07-23 bis 2011-08-23  ))))))))))))))))))))))))))))))
.
.
2011-08-23 12:12 . 2011-08-23 12:13	--------	d-----w-	c:\users\Familie Pichler\AppData\Local\temp
2011-08-23 12:12 . 2011-08-23 12:12	--------	d-----w-	c:\users\Default\AppData\Local\temp
2011-08-23 10:08 . 2011-08-12 02:44	7152464	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{0F85841D-093A-4691-825D-3336F5016214}\mpengine.dll
2011-08-22 10:26 . 2009-06-30 08:37	28552	----a-w-	c:\windows\system32\drivers\pavboot.sys
2011-08-22 10:26 . 2011-08-22 10:26	--------	d-----w-	c:\program files\Panda Security
2011-08-20 14:26 . 2011-08-20 14:26	--------	d-----w-	c:\program files\Alex Feinman
2011-08-19 13:59 . 2011-08-19 13:59	--------	d-----w-	c:\users\Familie Pichler\AppData\Roaming\bizarre creations
2011-08-19 13:58 . 2008-10-15 04:22	452440	----a-w-	c:\windows\system32\d3dx10_40.dll
2011-08-19 13:58 . 2008-10-15 04:22	2036576	----a-w-	c:\windows\system32\D3DCompiler_40.dll
2011-08-19 13:58 . 2008-10-15 04:22	4379984	----a-w-	c:\windows\system32\D3DX9_40.dll
2011-08-19 13:47 . 2011-08-19 13:47	--------	d-----w-	c:\program files\Activision
2011-08-18 16:03 . 2011-08-18 16:03	--------	d-----w-	c:\users\Familie Pichler\AppData\Local\SKIDROW
2011-08-18 15:43 . 2011-08-18 15:43	--------	d-----w-	c:\program files\Sandboxie
2011-08-18 15:35 . 2011-08-18 15:35	--------	d-----w-	C:\_OTL
2011-08-18 10:55 . 2011-08-18 15:34	--------	d-----w-	c:\users\Familie Pichler\AppData\Local\Spoon
2011-08-18 10:55 . 2011-08-18 10:55	--------	d-----w-	c:\users\Familie Pichler\AppData\Local\Xenocode
2011-08-17 10:50 . 2011-08-17 10:50	--------	d-----w-	c:\program files\ESET
2011-08-16 17:12 . 2011-08-16 17:12	--------	d-----w-	c:\users\Familie Pichler\AppData\Roaming\Malwarebytes
2011-08-16 17:12 . 2011-07-06 17:52	41272	----a-w-	c:\windows\system32\drivers\mbamswissarmy.sys
2011-08-16 17:12 . 2011-08-16 17:12	--------	d-----w-	c:\programdata\Malwarebytes
2011-08-16 17:12 . 2011-07-06 17:52	22712	----a-w-	c:\windows\system32\drivers\mbam.sys
2011-08-16 17:12 . 2011-08-16 17:12	--------	d-----w-	c:\program files\Malwarebytes' Anti-Malware
2011-08-14 11:29 . 2011-08-14 11:29	--------	d-----w-	c:\users\Familie Pichler\Pavark
2011-08-14 10:37 . 2011-08-14 10:37	--------	d-----w-	c:\program files\Sophos
2011-08-13 17:49 . 2011-02-23 14:50	29008	----a-w-	c:\windows\system32\SmartDefragBootTime.exe
2011-08-13 17:49 . 2011-02-23 14:50	16184	----a-w-	c:\windows\system32\drivers\SmartDefragDriver.sys
2011-08-13 13:09 . 2011-08-13 13:09	--------	d-----w-	c:\program files\Elaborate Bytes
2011-08-10 15:24 . 2008-09-29 06:07	22576	----a-w-	c:\program files\Mozilla Firefox\components\Scriptff.dll
2011-08-10 15:24 . 2008-09-29 06:07	90360	----a-w-	c:\windows\system32\drivers\mfeavfk.sys
2011-08-10 15:24 . 2008-09-29 06:07	74648	----a-w-	c:\windows\system32\drivers\mfeapfk.sys
2011-08-10 15:24 . 2008-09-29 06:07	67904	----a-w-	c:\windows\system32\mfevtps.exe
2011-08-10 15:24 . 2008-09-29 06:07	64432	----a-w-	c:\windows\system32\drivers\mferkdet.sys
2011-08-10 15:24 . 2008-09-29 06:07	62704	----a-w-	c:\windows\system32\drivers\mfetdik.sys
2011-08-10 15:24 . 2008-09-29 06:07	42424	----a-w-	c:\windows\system32\drivers\mfebopk.sys
2011-08-10 15:24 . 2008-09-29 06:07	340592	----a-w-	c:\windows\system32\drivers\mfehidk.sys
2011-08-10 15:23 . 2011-08-10 15:23	--------	d-----w-	c:\program files\Common Files\McAfee
2011-07-31 09:24 . 2011-07-31 16:37	--------	d-----w-	c:\users\Familie Pichler\Mali Losinj 2.0
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-06-11 02:37 . 2011-07-14 17:28	2332672	----a-w-	c:\windows\system32\win32k.sys
2011-04-14 16:40 . 2011-05-11 12:25	142296	----a-w-	c:\program files\mozilla firefox\components\browsercomps.dll
2008-09-29 06:07 . 2011-08-10 15:24	22576	----a-w-	c:\program files\mozilla firefox\components\Scriptff.dll
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NokiaOviSuite2"="c:\program files\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe" [2009-12-01 401728]
"SandboxieControl"="c:\program files\Sandboxie\SbieCtrl.exe" [2011-06-17 412432]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ThreatFire"="c:\program files\ThreatFire\TFTray.exe" [2010-01-14 378128]
"ShStatEXE"="c:\program files\McAfee\VirusScan Enterprise\SHSTAT.EXE" [2008-09-29 124240]
"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2011-07-06 449584]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux4"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\McAfeeEngineService]
@="Service"
.
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
backup=c:\windows\pss\HP Digital Imaging Monitor.lnk.CommonStartup
backupExtension=.CommonStartup
.
[HKLM\~\startupfolder\C:^Users^Familie Pichler^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk]
path=c:\users\Familie Pichler\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk
backup=c:\windows\pss\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk.Startup
backupExtension=.Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2011-03-30 04:59	937920	----a-r-	c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2011-06-08 04:02	37296	----a-w-	c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BCSSync]
2010-03-13 12:54	91520	----a-w-	c:\program files\Microsoft Office\Office14\BCSSync.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BDAgent]
2007-03-26 13:49	69632	----a-w-	c:\program files\Softwin\BitDefender10\bdagent.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BDMCon]
2007-04-02 14:48	290816	----a-w-	c:\program files\Softwin\BitDefender10\bdmcon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2011-01-25 14:08	421160	----a-w-	c:\program files\iTunes\iTunesHelper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2010-11-29 16:38	421888	----a-w-	c:\program files\QuickTime\QTTask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VirtualCloneDrive]
2011-03-07 13:33	89456	----a-w-	c:\program files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"Sidebar"=c:\program files\Windows Sidebar\sidebar.exe /autoRun
"Google Update"="c:\users\Familie Pichler\AppData\Local\Google\Update\GoogleUpdate.exe" /c
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" -atboottime
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe"
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
"PDFPrint"=c:\program files\PDF24\pdf24.exe
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R3 dsiarhwprog;dsiarhwprog;c:\windows\system32\Drivers\dsiarhwprog.sys [2007-02-08 29184]
R3 FSORSPClient;F-Secure ORSP Client;c:\program files\F-Secure\ORSP Client\fsorsp.exe [2010-07-31 57008]
R3 MEMSWEEP2;MEMSWEEP2;c:\windows\system32\6DA2.tmp [x]
R3 mferkdet;McAfee Inc. mferkdet;c:\windows\system32\drivers\mferkdet.sys [2008-09-29 64432]
R3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files\Microsoft Office\Office14\GROOVE.EXE [2010-03-25 30969208]
R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4640000]
R3 WatAdminSvc;Windows-Aktivierungstechnologieservice;c:\windows\system32\Wat\WatAdminSvc.exe [2010-06-26 1343400]
S0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [2009-06-30 28552]
S0 SmartDefragDriver;SmartDefragDriver;c:\windows\System32\Drivers\SmartDefragDriver.sys [2011-02-23 16184]
S0 TfFsMon;TfFsMon;c:\windows\system32\drivers\TfFsMon.sys [2010-01-14 51984]
S0 TfSysMon;TfSysMon;c:\windows\system32\drivers\TfSysMon.sys [2010-01-14 59664]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-13 48128]
S2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [2011-07-06 366640]
S2 McAfeeEngineService;McAfee Engine Service;c:\program files\McAfee\VirusScan Enterprise\EngineServer.exe [2008-09-29 19456]
S2 mfevtp;McAfee Validation Trust Protection Service;c:\windows\system32\mfevtps.exe [2008-09-29 67904]
S2 ThreatFire;ThreatFire;c:\program files\ThreatFire\TFService.exe service [x]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2011-07-06 22712]
S3 netr28u;RT2870-USB-Drahtlos-LAN-Kartentreiber für Vista;c:\windows\system32\DRIVERS\netr28u.sys [2009-07-13 657408]
S3 TfNetMon;TfNetMon;c:\windows\system32\drivers\TfNetMon.sys [2010-01-14 33552]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - PAVBOOT
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12	REG_MULTI_SZ   	Pml Driver HPZ12 Net Driver HPZ12
iissvcs	REG_MULTI_SZ   	w3svc was
apphost	REG_MULTI_SZ   	apphostsvc
HPService	REG_MULTI_SZ   	HPSLPSVC
hpdevmgmt	REG_MULTI_SZ   	hpqcxs08 hpqddsvc
.
Inhalt des "geplante Tasks" Ordners
.
2011-08-18 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3068468112-1341261719-3374128048-1000Core.job
- c:\users\Familie Pichler\AppData\Local\Google\Update\GoogleUpdate.exe [2010-07-03 17:41]
.
2011-08-23 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3068468112-1341261719-3374128048-1000UA.job
- c:\users\Familie Pichler\AppData\Local\Google\Update\GoogleUpdate.exe [2010-07-03 17:41]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.google.at/
uInternet Settings,ProxyOverride = *.local
IE: An OneNote s&enden - c:\progra~1\MICROS~2\Office14\ONBttnIE.dll/105
IE: Free YouTube to MP3 Converter - c:\users\Familie Pichler\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm
IE: Nach Microsoft E&xcel exportieren - c:\progra~1\MICROS~2\Office14\EXCEL.EXE/3000
IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.1.1
FF - ProfilePath - c:\users\Familie Pichler\AppData\Roaming\Mozilla\Firefox\Profiles\vk3estud.default\
FF - prefs.js: browser.search.selectedEngine - foxsearch
FF - prefs.js: browser.startup.homepage - hxxp://www.google.at/
FF - prefs.js: keyword.URL - hxxp://www.finduny.com?client=mozilla-firefox&cd=UTF-8&search=1&q=
FF - prefs.js: network.proxy.type - 0
FF - user.js: browser.search.selectedEngine - foxsearch
FF - user.js: browser.search.order.1 - foxsearch
FF - user.js: browser.search.defaultenginename - foxsearch
FF - user.js: keyword.URL - hxxp://www.finduny.com?client=mozilla-firefox&cd=UTF-8&search=1&q=
FF - user.js: privacy.item.cookies - false
FF - user.js: privacy.sanitize.promptOnSanitize - false
FF - user.js: network.http.max-connections-per-server - 6
FF - user.js: network.http.max-persistent-connections-per-server - 3
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
MSConfigStartUp-dvd43 - c:\program files\dvd43\dvd43_tray.exe
MSConfigStartUp-GrooveMonitor - c:\program files\Microsoft Office\Office12\GrooveMonitor.exe
MSConfigStartUp-PrintDisp - c:\windows\system32\PrintDisp.exe
.
.
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\MEMSWEEP2]
"ImagePath"="\??\c:\windows\system32\6DA2.tmp"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\ThreatFire]
"AlternateImagePath"=""
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\Approved Extensions]
@Denied: (2) (LocalSystem)
"{10EDB994-47F8-43F7-AE96-F2EA63E9F90F}"=hex:51,66,7a,6c,4c,1d,38,12,fa,ba,fe,
   14,ca,09,99,06,d1,80,b1,aa,66,b7,bd,1b
"{265EEE8E-3228-44D3-AEA5-F7FDF5860049}"=hex:51,66,7a,6c,4c,1d,38,12,e0,ed,4d,
   22,1a,7c,bd,01,d1,b3,b4,bd,f0,d8,44,5d
"{0347C33E-8762-4905-BF09-768834316C61}"=hex:51,66,7a,6c,4c,1d,38,12,50,c0,54,
   07,50,c9,6b,0c,c0,1f,35,c8,31,6f,28,75
"{18DF081C-E8AD-4283-A596-FA578C2EBDC3}"=hex:51,66,7a,6c,4c,1d,38,12,72,0b,cc,
   1c,9f,a6,ed,07,da,80,b9,17,89,70,f9,d7
"{72853161-30C5-4D22-B7F9-0BBC1D38A37E}"=hex:51,66,7a,6c,4c,1d,38,12,0f,32,96,
   76,f7,7e,4c,08,c8,ef,48,fc,18,66,e7,6a
"{7DB2D5A0-7241-4E79-B68D-6309F01C5231}"=hex:51,66,7a,6c,4c,1d,38,12,ce,d6,a1,
   79,73,3c,17,0b,c9,9b,20,49,f5,42,16,25
"{9030D464-4C02-4ABF-8ECC-5164760863C6}"=hex:51,66,7a,6c,4c,1d,38,12,0a,d7,23,
   94,30,02,d1,0f,f1,da,12,24,73,56,27,d2
"{B4F3A835-0E21-4959-BA22-42B3008E02FF}"=hex:51,66,7a,6c,4c,1d,38,12,5b,ab,e0,
   b0,13,40,37,0c,c5,34,01,f3,05,d0,46,eb
"{C6867EB7-8350-4856-877F-93CF8AE3DC9C}"=hex:51,66,7a,6c,4c,1d,38,12,d9,7d,95,
   c2,62,cd,38,0d,f8,69,d0,8f,8f,bd,98,88
"{DBC80044-A445-435B-BC74-9C25C1C588A9}"=hex:51,66,7a,6c,4c,1d,38,12,2a,03,db,
   df,77,ea,35,06,c3,62,df,65,c4,9b,cc,bd
"{FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856}"=hex:51,66,7a,6c,4c,1d,38,12,91,fc,ec,
   fb,7c,81,45,0a,c2,d4,4d,32,e4,48,ec,42
"{2A541AE1-5BF6-4665-A8A3-CFA9672E4291}"=hex:51,66,7a,6c,4c,1d,38,12,8f,19,47,
   2e,c4,15,0b,03,d7,b5,8c,e9,62,70,06,85
"{555D4D79-4BD2-4094-A395-CFC534424A05}"=hex:51,66,7a,6c,4c,1d,38,12,17,4e,4e,
   51,e0,05,fa,05,dc,83,8c,85,31,1c,0e,11
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration]
@Denied: (2) (LocalSystem)
"Timestamp"=hex:00,56,ab,27,45,5f,cc,01
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------
.
- - - - - - - > 'winlogon.exe'(608)
c:\program files\ThreatFire\TFWAH.dll
.
- - - - - - - > 'lsass.exe'(568)
c:\program files\ThreatFire\TFWAH.dll
.
Zeit der Fertigstellung: 2011-08-23  14:20:23
ComboFix-quarantined-files.txt  2011-08-23 12:20
.
Vor Suchlauf: 17 Verzeichnis(se), 541.222.436.864 Bytes frei
Nach Suchlauf: 22 Verzeichnis(se), 540.902.621.184 Bytes frei
.
- - End Of File - - EF782FC276ACE4A9CCC3C53BA0BFD6E4