Internet Speed halbiert nach teilweiser entfernung von TrojanDownloader:Win32/Small.gen!I

ComboFix 11-11-11.06 - xxx 11.11.2011  23:20:09.2.1 - x86
Microsoft Windows 7 Ultimate   6.1.7601.1.1252.49.1031.18.3071.2024 [GMT 1:00]
ausgeführt von:: c:\users\xxx\Desktop\ComboFix.exe
Benutzte Befehlsschalter :: c:\users\xxx\Desktop\CFScript.txt
AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
FW: FireWall *Disabled* {CE40CCC0-8ADB-6D67-25A0-C5B6438E4B57}
SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((   Dateien erstellt von 2011-10-11 bis 2011-11-11  ))))))))))))))))))))))))))))))
.
.
2011-11-11 22:29 . 2011-11-11 22:29	--------	d-----w-	c:\users\UpdatusUser\AppData\Local\temp
2011-11-11 22:29 . 2011-11-11 22:29	--------	d-----w-	c:\users\Default\AppData\Local\temp
2011-11-11 21:15 . 2011-11-11 21:15	56200	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{9B0CC4C8-53FC-40A4-B5F1-0E9C92E1C51B}\offreg.dll
2011-11-11 19:52 . 2011-11-11 22:29	--------	d-----w-	c:\users\xxx\AppData\Local\temp
2011-11-11 17:15 . 2011-10-07 03:48	6668624	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{9B0CC4C8-53FC-40A4-B5F1-0E9C92E1C51B}\mpengine.dll
2011-11-11 02:22 . 2011-11-11 02:22	--------	d-----w-	c:\program files\ZDF
2011-11-11 02:11 . 2011-11-11 02:11	--------	d-----w-	c:\program files\maxdome - Online Videothek
2011-11-11 02:03 . 2011-11-11 02:03	--------	d-----w-	c:\program files\BMWi
2011-11-11 01:32 . 2011-11-11 01:32	--------	d-----w-	c:\program files\n-tv
2011-11-11 01:32 . 2011-11-11 01:32	--------	d-----w-	c:\program files\BILD
2011-11-10 20:48 . 2011-11-10 20:48	--------	d-----w-	C:\_OTL
2011-11-10 12:23 . 2011-11-10 12:23	--------	d-----w-	c:\users\Public\Transcode360
2011-11-10 12:14 . 2011-11-11 21:30	--------	d-----w-	c:\programdata\MediaBrowser
2011-11-10 11:43 . 2011-11-10 11:43	--------	d-----w-	c:\users\Mcx1-xxx-PC
2011-11-10 10:50 . 2011-11-10 10:50	--------	d-----w-	c:\users\xxx\AppData\Roaming\BID
2011-11-10 07:34 . 2011-11-10 07:35	--------	d-----w-	c:\program files\Jtag Tool
2011-11-10 01:09 . 2011-11-10 01:09	1092400	----a-w-	c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight-2\SpotlightResources.dll
2011-11-09 16:27 . 2011-11-09 16:28	--------	d-----w-	c:\program files\Gavotte RamDisk
2011-11-09 07:19 . 2011-10-01 04:37	708608	----a-w-	c:\program files\Common Files\System\wab32.dll
2011-11-09 07:19 . 2011-09-29 16:03	1290608	----a-w-	c:\windows\system32\drivers\tcpip.sys
2011-11-09 07:18 . 2011-09-29 03:37	2341888	----a-w-	c:\windows\system32\win32k.sys
2011-11-08 15:37 . 2011-11-08 15:37	--------	d-----w-	c:\program files\ESET
2011-11-08 15:10 . 2011-11-08 15:10	--------	d-----w-	c:\users\xxx\AppData\Roaming\Malwarebytes
2011-11-08 15:09 . 2011-11-08 15:09	--------	d-----w-	c:\programdata\Malwarebytes
2011-11-08 15:09 . 2011-11-08 15:09	--------	d-----w-	c:\program files\Malwarebytes' Anti-Malware
2011-11-08 15:09 . 2011-08-31 16:00	22216	----a-w-	c:\windows\system32\drivers\mbam.sys
2011-11-07 17:47 . 2011-11-07 17:47	--------	d-----w-	c:\programdata\Gerhard Junker
2011-11-07 17:47 . 2011-11-07 17:47	--------	d-----w-	c:\users\xxx\AppData\Local\Gerhard_Junker
2011-11-07 17:43 . 2011-11-09 14:52	--------	d-----w-	c:\program files\ncid.Net
2011-11-07 17:43 . 2011-11-07 17:48	--------	d-----w-	c:\programdata\ncid.Net
2011-11-07 16:48 . 2011-11-07 16:55	--------	d-----w-	c:\program files\NET Traffic Meter
2011-11-07 16:38 . 2011-11-07 16:43	--------	d-----w-	c:\users\xxx\AppData\Roaming\NetMeter
2011-11-07 16:38 . 2011-11-07 16:44	--------	d-----w-	c:\program files\NetMeter
2011-11-07 16:26 . 2011-11-07 16:26	--------	d-----w-	c:\programdata\DeskSoft
2011-11-07 16:25 . 2011-11-07 16:25	24816	----a-w-	c:\windows\system32\drivers\dsnpfd.sys
2011-11-07 16:25 . 2011-11-07 16:25	--------	d-----w-	c:\users\xxx\AppData\Roaming\DeskSoft
2011-11-07 14:05 . 2011-11-07 14:05	--------	d-----w-	c:\program files\Axence
2011-11-07 07:56 . 2011-11-07 07:56	--------	d-----w-	c:\users\xxx\AppData\Roaming\gtk-2.0
2011-11-07 07:38 . 2011-11-07 08:16	--------	d-----w-	c:\programdata\Spybot - Search & Destroy
2011-11-07 07:36 . 2011-11-07 13:51	--------	d-----w-	c:\program files\Spybot - Search & Destroy 2
2011-11-07 06:42 . 2011-11-11 22:28	--------	d-----w-	c:\users\xxx\AppData\Roaming\.purple
2011-11-07 06:39 . 2011-11-07 06:39	--------	d-----w-	c:\program files\Pidgin
2011-11-07 02:54 . 2011-11-07 02:54	--------	d-----w-	c:\program files\MSECache
2011-11-07 02:52 . 2011-11-07 02:52	--------	d-----w-	C:\Program Settings
2011-11-05 23:08 . 2011-11-05 23:08	--------	d-----w-	c:\windows\W7SBC
2011-11-05 23:08 . 2011-02-25 05:30	2616320	----a-w-	c:\windows\explorer_edit_w7sbc.exe
2011-11-05 23:08 . 2011-02-25 05:30	2616320	----a-w-	c:\windows\explorer_backup_w7sbc.exe
2011-11-05 22:58 . 2011-11-05 22:59	--------	d-----w-	c:\program files\RocketDock
2011-11-05 22:58 . 2011-11-05 22:58	--------	d-----w-	c:\program files\IconChanger
2011-11-05 22:57 . 2011-11-07 06:00	--------	d-----w-	c:\program files\Rainmeter
2011-11-05 17:34 . 2010-06-07 13:59	57904	----a-w-	c:\windows\system32\wbload.dll
2011-11-05 17:33 . 2008-04-26 14:14	42672	----a-w-	c:\windows\system32\wbsys.dll
2011-11-05 17:33 . 2011-11-05 17:33	--------	d-----w-	c:\program files\Stardock
2011-11-05 17:18 . 2011-11-05 17:18	--------	d-----w-	c:\users\xxx\AppData\Roaming\Auslogics
2011-11-05 17:18 . 2011-11-05 17:18	--------	d-----w-	c:\program files\Auslogics
2011-11-05 16:55 . 2011-11-05 16:55	--------	d-----w-	c:\program files\Setup Files
2011-11-05 14:27 . 2011-11-06 09:01	--------	d-----w-	c:\program files\Dr. Hardware 2011
2011-11-05 13:46 . 2011-11-05 13:52	--------	d-----w-	c:\program files\TweakMe!
2011-11-05 13:35 . 2011-11-05 13:35	--------	d-----w-	c:\users\xxx\AppData\Local\Frameworkx.com
2011-11-05 13:20 . 2011-11-05 13:20	--------	d-----w-	c:\users\xxx\AppData\Local\NeoSmart_Technologies
2011-11-05 13:17 . 2011-11-05 13:17	--------	d-----w-	c:\program files\NeoSmart Technologies
2011-11-05 12:43 . 2011-11-05 12:38	91096	----a-w-	c:\windows\system32\drivers\avfwim.sys
2011-11-05 12:43 . 2011-11-05 12:38	111160	----a-w-	c:\windows\system32\drivers\avfwot.sys
2011-11-05 05:01 . 2011-11-05 05:01	--------	d-----w-	c:\users\xxx\AppData\Roaming\Xilisoft
2011-11-05 00:32 . 2011-08-05 14:59	307200	----a-w-	c:\windows\system32\TubeFinder.exe
2011-11-05 00:32 . 2009-06-19 18:51	119568	----a-w-	c:\windows\system32\VB6FR.DLL
2011-11-05 00:32 . 2009-06-19 18:51	101888	----a-w-	c:\windows\system32\VB6STKIT.DLL
2011-11-05 00:32 . 2009-06-19 18:51	9728	----a-w-	c:\windows\system32\PCCLPFR.DLL
2011-11-05 00:32 . 2009-06-19 18:51	84512	----a-w-	c:\windows\system32\PICCLP32.OCX
2011-11-05 00:32 . 2009-06-19 18:51	364544	----a-w-	c:\windows\system32\PropertyGrid.ocx
2011-11-05 00:32 . 2009-06-19 18:51	141312	----a-w-	c:\windows\system32\MSCMCFR.DLL
2011-11-05 00:32 . 2011-11-05 02:22	--------	d-----w-	c:\users\xxx\AppData\Roaming\FreeFLVConverter
2011-11-05 00:32 . 2011-11-05 00:33	--------	d-----w-	c:\program files\Free FLV Converter
2011-11-05 00:32 . 2009-06-19 18:51	32768	----a-w-	c:\windows\system32\CMDLGFR.DLL
2011-11-05 00:32 . 2009-06-19 18:51	24576	----a-w-	c:\windows\system32\ControlSubX.ocx
2011-11-03 16:55 . 2011-11-03 16:55	--------	d-----w-	c:\program files\Microsoft CAPICOM 2.1.0.2
2011-11-03 15:22 . 2011-11-05 14:52	--------	d-----w-	c:\users\xxx\AppData\Roaming\BitComet
2011-11-03 15:22 . 2011-11-03 15:22	--------	d-----w-	c:\program files\BitComet
2011-11-03 09:34 . 2011-11-03 09:34	--------	d-----w-	c:\program files\Microsoft Silverlight
2011-11-02 16:46 . 2011-11-02 16:46	--------	d-----w-	c:\users\xxx\AppData\Local\Installer5804
2011-11-02 16:40 . 2011-11-02 16:40	--------	d-----w-	c:\users\xxx\AppData\Local\Installer5848
2011-11-01 08:05 . 2011-11-01 08:05	159744	----a-w-	c:\program files\Mozilla Firefox\plugins\npqtplugin7.dll
2011-11-01 08:05 . 2011-11-01 08:05	159744	----a-w-	c:\program files\Mozilla Firefox\plugins\npqtplugin6.dll
2011-11-01 08:05 . 2011-11-01 08:05	159744	----a-w-	c:\program files\Mozilla Firefox\plugins\npqtplugin5.dll
2011-11-01 08:05 . 2011-11-01 08:05	159744	----a-w-	c:\program files\Mozilla Firefox\plugins\npqtplugin4.dll
2011-11-01 08:05 . 2011-11-01 08:05	159744	----a-w-	c:\program files\Mozilla Firefox\plugins\npqtplugin3.dll
2011-11-01 08:05 . 2011-11-01 08:05	159744	----a-w-	c:\program files\Mozilla Firefox\plugins\npqtplugin2.dll
2011-11-01 08:05 . 2011-11-01 08:05	159744	----a-w-	c:\program files\Mozilla Firefox\plugins\npqtplugin.dll
2011-11-01 08:05 . 2011-11-01 08:05	--------	d-----w-	c:\program files\QuickTime
2011-11-01 08:02 . 2011-11-01 08:02	--------	d-----w-	c:\program files\iPod
2011-10-31 08:36 . 2011-10-31 08:36	9925160	----a-w-	c:\program files\Common Files\lpuninstall.exe
2011-10-31 08:36 . 2011-10-31 08:36	--------	d-----w-	c:\program files\LastPass
2011-10-28 06:18 . 2011-10-28 06:18	--------	d-----w-	c:\users\xxx\AppData\Local\MicroVision Applications
2011-10-28 06:17 . 2011-10-28 06:17	--------	d-----w-	c:\program files\Common Files\SureThing Shared
2011-10-28 06:17 . 2011-10-28 06:17	--------	d-----w-	c:\program files\SureThing
2011-10-28 06:17 . 2011-10-28 06:17	--------	d-----w-	c:\windows\MVUNINST
2011-10-28 06:17 . 2002-01-05 01:37	344064	----a-w-	c:\windows\system32\msvcr70.dll
2011-10-28 06:17 . 1996-08-24 10:11	289552	----a-w-	c:\windows\system32\temp.001
2011-10-28 06:17 . 1993-10-14 16:51	28672	----a-w-	c:\windows\system32\temp.000
2011-10-25 13:42 . 2011-10-03 03:06	476904	----a-w-	c:\program files\Mozilla Firefox\plugins\npdeployJava1.dll
2011-10-24 13:29 . 2011-10-24 13:29	94208	----a-w-	c:\windows\system32\QuickTimeVR.qtx
2011-10-24 13:29 . 2011-10-24 13:29	69632	----a-w-	c:\windows\system32\QuickTime.qts
2011-10-22 22:53 . 2011-10-22 22:54	--------	dc-h--w-	c:\programdata\{E26B3878-7CEC-469C-B449-5CAA336DF8CD}
2011-10-22 22:49 . 2011-10-22 22:49	--------	dc-h--w-	c:\programdata\{C78336EC-F2EB-4640-99A4-DFE96581B90B}
2011-10-18 10:35 . 2011-10-18 10:35	--------	d-----w-	c:\users\xxx\AppData\Roaming\Avira
2011-10-18 10:35 . 2011-10-11 13:00	74640	----a-w-	c:\windows\system32\drivers\avgntflt.sys
2011-10-18 10:35 . 2011-10-11 13:00	36000	----a-w-	c:\windows\system32\drivers\avkmgr.sys
2011-10-18 10:35 . 2011-10-11 13:00	134344	----a-w-	c:\windows\system32\drivers\avipbb.sys
2011-10-18 10:34 . 2011-11-05 12:43	--------	d-----w-	c:\programdata\Avira
2011-10-18 10:34 . 2011-10-18 10:34	--------	d-----w-	c:\program files\Avira
2011-10-16 17:55 . 2011-10-16 17:55	18139008	----a-w-	c:\program files\Common Files\Microsoft Shared\OFFICE14\MSO.DLL
2011-10-14 00:01 . 2010-11-20 12:17	941568	----a-w-	c:\windows\system32\mblctr.exe
2011-10-14 00:00 . 2010-11-20 12:21	750080	----a-w-	c:\windows\system32\sdcpl.dll
2011-10-13 23:59 . 2009-07-14 01:16	379904	----a-w-	c:\windows\system32\pnpui.dll
2011-10-13 23:59 . 2010-11-20 12:20	2494464	----a-w-	c:\windows\system32\netshell.dll
2011-10-13 23:59 . 2009-07-14 01:06	9053696	----a-w-	c:\windows\system32\mmres.dll
2011-10-13 23:59 . 2009-07-14 01:06	705536	----a-w-	c:\windows\system32\imagesp1.dll
2011-10-13 23:59 . 2009-07-14 01:15	56320	----a-w-	c:\windows\system32\hotplug.dll
2011-10-13 23:59 . 2010-11-20 12:18	744448	----a-w-	c:\windows\system32\ActionCenter.dll
2011-10-13 22:59 . 2011-10-13 23:01	--------	d-----w-	c:\program files\plexydesk
2011-10-13 22:51 . 2011-10-13 22:51	--------	d-----w-	c:\users\xxx\AppData\Local\Bump Technologies, Inc
2011-10-13 20:51 . 2011-11-03 09:58	--------	d-----w-	c:\users\xxx\AppData\Local\MediaMonkey
2011-10-13 20:51 . 2011-11-03 09:58	--------	d-----w-	c:\program files\MediaMonkey
2011-10-13 20:37 . 2011-10-13 20:37	--------	d-----w-	C:\$WINDOWS.~BT
2011-10-13 20:13 . 2011-07-29 11:54	19840	----a-w-	c:\windows\system32\EuEpmGdi.dll
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-10-23 12:09 . 2011-08-09 04:43	414368	----a-w-	c:\windows\system32\FlashPlayerCPLApp.cpl
2011-10-03 03:06 . 2011-06-20 16:19	472808	----a-w-	c:\windows\system32\deployJava1.dll
2011-09-25 22:24 . 2011-09-25 22:24	0	---ha-w-	c:\users\xxx\AppData\Roaming\.51BEE852859F7D89.sys
2011-09-25 22:12 . 2011-09-25 22:12	49152	----a-r-	c:\users\xxx\AppData\Roaming\Microsoft\Installer\{2D314071-26CD-47EA-A01E-82FADDE951C5}\LiquidInstrument.exe_2D31407126CD47EAA01E82FADDE951C5.exe
2011-08-30 22:05 . 2011-08-30 22:05	83816	----a-w-	c:\windows\system32\dns-sd.exe
2011-08-30 22:05 . 2011-08-30 22:05	73064	----a-w-	c:\windows\system32\dnssd.dll
2011-08-30 22:05 . 2011-08-30 22:05	50536	----a-w-	c:\windows\system32\jdns_sd.dll
2011-08-30 22:05 . 2011-08-30 22:05	178536	----a-w-	c:\windows\system32\dnssdX.dll
2011-11-09 20:22 . 2011-08-09 03:18	134104	----a-w-	c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((((((((((   Look   )))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
---- Directory of c:\users\xxx\AppData\Roaming\BID ----
.
2011-11-10 10:51 . 2011-11-10 10:53	4422	----a-w-	c:\users\xxx\AppData\Roaming\BID\Log\BID.LOG
2011-11-10 10:50 . 2011-11-10 11:36	29786	----a-w-	c:\users\xxx\AppData\Roaming\BID\bim.ini
.
---- Directory of c:\windows\W7SBC ----
.
2011-11-05 23:08 . 2011-11-05 23:08	35046	----a-w-	c:\windows\W7SBC\cur.bmp
2011-11-05 23:08 . 2011-11-05 23:08	65	----a-w-	c:\windows\W7SBC\res.ini
2011-11-05 23:08 . 2011-11-05 23:08	160	----a-w-	c:\windows\W7SBC\res.log
2011-11-05 23:08 . 2011-11-05 23:08	238	----a-w-	c:\windows\W7SBC\restore.bat
2011-11-05 23:08 . 2011-11-05 23:08	218	----a-w-	c:\windows\W7SBC\change.bat
2011-11-05 23:08 . 2011-11-05 23:08	755	----a-w-	c:\windows\W7SBC\scr
2011-11-05 23:08 . 2011-11-05 23:08	822272	----a-w-	c:\windows\W7SBC\res.exe
.
.
(((((((((((((((((((((((((((((   SnapShot@2011-11-11_19.48.47   )))))))))))))))))))))))))))))))))))))))))
.
+ 2011-06-20 15:27 . 2011-11-11 21:19	52158              c:\windows\System32\wdi\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2009-07-14 04:55 . 2011-11-11 21:19	43594              c:\windows\System32\wdi\BootPerformanceDiagnostics_SystemData.bin
+ 2011-06-20 14:16 . 2011-11-11 21:19	15512              c:\windows\System32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-3208466087-60621075-3746657911-1002_UserData.bin
- 2011-06-20 13:48 . 2011-11-11 19:28	16384              c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2011-06-20 13:48 . 2011-11-11 21:15	16384              c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2011-06-20 13:48 . 2011-11-11 19:28	32768              c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2011-06-20 13:48 . 2011-11-11 21:15	32768              c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2009-07-14 04:41 . 2011-11-11 21:15	16384              c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2009-07-14 04:41 . 2011-11-11 19:28	16384              c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2011-06-20 14:09 . 2011-11-11 21:17	16384              c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2011-06-20 14:09 . 2011-11-11 17:12	16384              c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2009-07-14 04:34 . 2011-11-11 21:19	81216              c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform\Cache\cache.dat
+ 2011-06-20 14:09 . 2011-11-11 21:17	32768              c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2011-06-20 14:09 . 2011-11-11 17:12	32768              c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2011-06-20 14:09 . 2011-11-11 17:12	16384              c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2011-06-20 14:09 . 2011-11-11 21:17	16384              c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2011-06-20 14:15 . 2011-11-11 22:04	16384              c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2011-06-20 14:15 . 2011-11-11 19:03	16384              c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2011-06-20 14:15 . 2011-11-11 19:03	16384              c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2011-06-20 14:15 . 2011-11-11 22:04	16384              c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2011-11-11 21:15 . 2011-11-11 21:15	2048              c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
- 2011-11-11 17:10 . 2011-11-11 17:10	2048              c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2011-11-11 21:15 . 2011-11-11 21:15	2048              c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
- 2011-11-11 17:10 . 2011-11-11 17:10	2048              c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2009-07-14 04:47 . 2011-11-11 21:09	835280              c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
- 2009-07-14 04:47 . 2011-11-11 03:38	835280              c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
+ 2009-07-14 04:34 . 2011-11-11 21:18	5981801              c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform\tokens.dat
- 2009-07-14 04:34 . 2011-11-09 16:50	5981801              c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform\tokens.dat
+ 2011-11-10 12:48 . 2011-11-11 21:09	1052544              c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache3.0.0.0.dat
- 2011-11-10 12:48 . 2011-11-11 03:38	1052544              c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache3.0.0.0.dat
+ 2011-11-09 16:43 . 2011-11-11 21:09	7230372              c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-3208466087-60621075-3746657911-1002-8192.dat
+ 2011-07-28 03:10 . 2011-11-11 21:09	8649220              c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-3208466087-60621075-3746657911-1002-12288.dat
- 2011-07-28 03:10 . 2011-11-09 15:03	8649220              c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-3208466087-60621075-3746657911-1002-12288.dat
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Pidgin"="c:\program files\Pidgin\pidgin.exe" [2011-08-20 48618]
"ncid.Net"="c:\program files\ncid.Net\ncid.Net.exe" [2011-11-03 984064]
"NVIDIA nTune"="c:\program files\NVIDIA Corporation\nTune\nTuneCmd.exe" [2008-09-29 106496]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"VirtualCloneDrive"="c:\program files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" [2009-06-17 85160]
"IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2011-08-01 1821576]
"M-Audio Taskbar Icon"="c:\windows\system32\M-AudioTaskBarIcon.exe" [2009-10-02 643592]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2011-11-05 258512]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696]
"BCSSync"="c:\program files\Microsoft Office\Office14\BCSSync.exe" [2010-03-13 91520]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"SynchronousMachineGroupPolicy"= 0 (0x0)
"SynchronousUserGroupPolicy"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute	REG_MULTI_SZ   	autocheck autochk *\0\0sdnclean.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NVIDIA nTune]
2008-09-29 11:14	106496	----a-w-	c:\program files\NVIDIA Corporation\nTune\nTuneCmd.exe
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"Google Update"="c:\users\xxx\AppData\Local\Google\Update\GoogleUpdate.exe" /c
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe"
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" -atboottime
"LexwareInfoService"=c:\program files\Common Files\Lexware\Update Manager\LxUpdateManager.exe /autostart
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe"
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 gupdate;Google Update-Dienst (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2011-07-10 136176]
R3 BITCOMET_HELPER_SERVICE;BitComet Disk Boost Service;c:\program files\BitComet\tools\BitCometService.exe [2010-12-28 1296728]
R3 epmntdrv;epmntdrv;c:\windows\system32\epmntdrv.sys [2011-07-29 14216]
R3 EuGdiDrv;EuGdiDrv;c:\windows\system32\EuGdiDrv.sys [2011-07-29 8456]
R3 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance;c:\program files\Common Files\MAGIX Services\Database\bin\fbserver.exe [2008-08-07 3276800]
R3 gupdatem;Google Update-Dienst (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2011-07-10 136176]
R3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [x]
R3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files\Microsoft Office\Office14\GROOVE.EXE [2011-06-12 31125880]
R3 MSI_MSIBIOS_010507;MSI_MSIBIOS_010507;c:\program files\MSI\Live Update 5\msibios32_100507.sys [x]
R3 MSSQL$JTLWAWI;SQL Server (JTLWAWI);c:\program files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2010-12-10 29293408]
R3 NTIOLib_1_0_4;NTIOLib_1_0_4;c:\program files\MSI\Live Update 5\NTIOLib.sys [x]
R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4640000]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2010-11-20 15872]
R3 SCL01132;SCL011 Contactless Reader;c:\windows\system32\DRIVERS\SCL01132.sys [2010-05-07 61824]
R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224]
R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys [x]
R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys [x]
S1 avfwot;avfwot;c:\windows\system32\DRIVERS\avfwot.sys [2011-11-05 111160]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys [2011-10-11 36000]
S2 AntiVirFirewallService;Avira FireWall;c:\program files\Avira\AntiVir Desktop\avfwsvc.exe [2011-11-05 616400]
S2 AntiVirMailService;Avira Email Schutz;c:\program files\Avira\AntiVir Desktop\avmailc.exe [2011-11-05 342480]
S2 AntiVirSchedulerService;Avira Planer;c:\program files\Avira\AntiVir Desktop\sched.exe [2011-11-05 86224]
S2 AntiVirWebService;Avira Browser Schutz;c:\program files\Avira\AntiVir Desktop\AVWEBGRD.EXE [2011-11-05 463824]
S2 Fabs;FABS - Helping agent for MAGIX media database;c:\program files\Common Files\MAGIX Services\Database\bin\FABS.exe [2009-08-27 1253376]
S2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [2011-08-03 2255464]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2011-08-03 379496]
S2 TeamViewer6;TeamViewer 6;c:\program files\TeamViewer\Version6\TeamViewer_Service.exe [2011-08-30 2358656]
S3 avfwim;AvFw Packet Filter Miniport;c:\windows\system32\DRIVERS\avfwim.sys [2011-11-05 91096]
S3 dc3d;Microsoft-Hardware – Geräteerkennungstreiber;c:\windows\system32\DRIVERS\dc3d.sys [2011-05-18 40320]
S3 MADFUCONECTIV;Service for M-Audio Conectiv DFU;c:\windows\system32\DRIVERS\MAudioConectiv_DFU.sys [2009-10-02 42248]
S3 MAUSBCONECTIV;Service for M-Audio Conectiv;c:\windows\system32\DRIVERS\MAudioConectiv.sys [2009-10-02 158344]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt86win7.sys [2009-03-01 139776]
.
.
Inhalt des "geplante Tasks" Ordners
.
2011-11-11 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-07-10 13:15]
.
2011-11-11 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-07-10 13:15]
.
.
------- Zusätzlicher Suchlauf -------
.
uDefault_Search_URL = hxxp://www.google.com/ie
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: &Alles mit BitComet herunterladen - c:\program files\BitComet\BitComet.exe/AddAllLink.htm
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: An OneNote s&enden - c:\progra~1\MICROS~4\Office14\ONBttnIE.dll/105
IE: BID Link Explorer: Öffne aktuelle Seite - file://c:\program files\Bulk Image Downloader\iemenu\iebidlinkexplorer.htm
IE: BID: Link in Queue einreihen - file://c:\program files\Bulk Image Downloader\iemenu\iebidlinkqueue.htm
IE: BID: Seite in &Queue einreihen - file://c:\program files\Bulk Image Downloader\iemenu\iebidqueue.htm
IE: BID: Öffne aktuelle Seite - file://c:\program files\Bulk Image Downloader\iemenu\iebid.htm
IE: BID: Öffne diesen &Link - file://c:\program files\Bulk Image Downloader\iemenu\iebidlink.htm
IE: Mit BitComet herunter&laden - c:\program files\BitComet\BitComet.exe/AddLink.htm
IE: Nach Microsoft E&xcel exportieren - c:\progra~1\MICROS~4\Office14\EXCEL.EXE/3000
LSP: c:\program files\Avira\AntiVir Desktop\avsda.dll
TCP: DhcpNameServer = 192.168.2.1
FF - ProfilePath - c:\users\xxx\AppData\Roaming\Mozilla\Firefox\Profiles\nxh9q5dv.default\
FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: nglayout.initialpaint.delay - 600
FF - user.js: content.notify.interval - 600000
FF - user.js: content.max.tokenizing.time - 1800000
FF - user.js: content.switch.threshold - 600000
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\S-1-5-21-3208466087-60621075-3746657911-1002\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{721F34D6-177E-0B5A-100D-6F2E2FB2D6A9}*]
"hagdjmlmbgfojoff"=hex:6a,61,61,63,69,67,69,6a,6e,65,6d,64,63,6b,6d,68,6f,64,
   6f,65,00,d4
"iamcdoknakfgojhdhg"=hex:6a,61,61,63,6e,61,6a,6a,67,6f,66,67,6e,62,6f,6f,61,6d,
   6c,6d,00,00
.
[HKEY_USERS\S-1-5-21-3208466087-60621075-3746657911-1002\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{A225EC91-5397-517E-C9B1-973E71617067}*]
"iaecmhkjhjfchkkjhp"=hex:6b,61,69,64,6e,69,6d,67,6a,61,62,65,6e,67,6d,68,66,63,
   6b,61,66,65,00,00
"hakbgomlhamfaklm"=hex:6b,61,69,64,6e,69,6d,67,6a,61,62,65,6e,67,6d,68,66,63,
   6b,61,66,65,00,00
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Xanthic\{1246792F-C12E-81AE-FE96-35D2FC917677}*_]
"fr"="078D534A595D51"
"lr"="078D4C40445D51"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2011-11-11  23:31:53
ComboFix-quarantined-files.txt  2011-11-11 22:31
ComboFix2.txt  2011-11-11 19:54
.
Vor Suchlauf: 14 Verzeichnis(se), 13.989.175.296 Bytes frei
Nach Suchlauf: 15 Verzeichnis(se), 13.909.458.944 Bytes frei
.
- - End Of File - - 006F126DF472882EE38027C88E150C85