System Progressive Protection trojaner

ComboFix 12-12-04.01 - Philipp 06.12.2012  18:17:54.2.2 - x86
Microsoft Windows 7 Home Premium   6.1.7601.1.1252.49.1031.18.3071.1816 [GMT 1:00]
ausgeführt von:: c:\users\Philipp\Desktop\ComboFix.exe
Benutzte Befehlsschalter :: c:\users\Philipp\Desktop\CFScript.txt
AV: AntiVir Desktop *Disabled/Outdated* {090F9C29-64CE-6C6F-379C-5901B49A85B7}
SP: AntiVir Desktop *Disabled/Outdated* {B26E7DCD-42F4-63E1-0D2C-6273CF1DCF0A}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((   Dateien erstellt von 2012-11-06 bis 2012-12-06  ))))))))))))))))))))))))))))))
.
.
2012-12-06 17:33 . 2012-12-06 17:33	--------	d-----w-	c:\users\Default\AppData\Local\temp
2012-12-06 07:22 . 2012-12-06 07:22	12872	----a-w-	c:\windows\system32\bootdelete.exe
2012-12-06 07:12 . 2012-12-06 07:22	--------	d-----w-	c:\programdata\HitmanPro
2012-12-04 17:51 . 2012-12-04 17:51	--------	d-----w-	c:\users\Philipp\AppData\Roaming\Malwarebytes
2012-12-04 17:50 . 2012-12-04 17:50	--------	d-----w-	c:\programdata\Malwarebytes
2012-12-04 17:50 . 2012-12-04 17:50	--------	d-----w-	c:\program files\Malwarebytes' Anti-Malware
2012-12-04 17:50 . 2012-09-29 18:54	22856	----a-w-	c:\windows\system32\drivers\mbam.sys
2012-12-04 16:49 . 2012-12-04 20:17	--------	d-----w-	c:\programdata\58A302F456F27AC1000058A2AA5A8398
2012-11-16 21:30 . 2012-07-26 03:39	526952	----a-w-	c:\windows\system32\drivers\Wdf01000.sys
2012-11-16 21:30 . 2012-07-26 03:39	47720	----a-w-	c:\windows\system32\drivers\WdfLdr.sys
2012-11-16 21:30 . 2012-07-26 02:46	9728	----a-w-	c:\windows\system32\Wdfres.dll
2012-11-16 21:28 . 2012-07-26 02:33	66560	----a-w-	c:\windows\system32\drivers\WUDFPf.sys
2012-11-16 21:28 . 2012-07-26 02:32	155136	----a-w-	c:\windows\system32\drivers\WUDFRd.sys
2012-11-16 21:28 . 2012-07-26 03:20	73216	----a-w-	c:\windows\system32\WUDFSvc.dll
2012-11-16 21:28 . 2012-07-26 03:20	172032	----a-w-	c:\windows\system32\WUDFPlatform.dll
2012-11-16 21:28 . 2012-07-26 03:21	196608	----a-w-	c:\windows\system32\WUDFHost.exe
2012-11-16 21:28 . 2012-07-26 03:20	38912	----a-w-	c:\windows\system32\WUDFCoinstaller.dll
2012-11-16 21:28 . 2012-07-26 03:20	613888	----a-w-	c:\windows\system32\WUDFx.dll
2012-11-16 13:09 . 2012-10-03 16:58	1293680	----a-w-	c:\windows\system32\drivers\tcpip.sys
2012-11-16 13:09 . 2012-10-03 16:42	156672	----a-w-	c:\windows\system32\ncsi.dll
2012-11-16 13:09 . 2012-10-03 16:42	242176	----a-w-	c:\windows\system32\nlasvc.dll
2012-11-16 13:09 . 2012-10-03 16:42	175104	----a-w-	c:\windows\system32\netcorehc.dll
2012-11-16 13:09 . 2012-10-03 16:40	499712	----a-w-	c:\windows\system32\iphlpsvc.dll
2012-11-16 13:09 . 2012-10-03 16:42	52224	----a-w-	c:\windows\system32\nlaapi.dll
2012-11-16 13:09 . 2012-10-03 16:42	18944	----a-w-	c:\windows\system32\netevent.dll
2012-11-16 13:09 . 2012-10-03 15:21	35328	----a-w-	c:\windows\system32\drivers\tcpipreg.sys
2012-11-16 13:09 . 2012-09-25 22:47	78336	----a-w-	c:\windows\system32\synceng.dll
2012-11-16 13:09 . 2012-10-18 17:59	2345984	----a-w-	c:\windows\system32\win32k.sys
2012-11-16 13:09 . 2012-10-09 17:40	44032	----a-w-	c:\windows\system32\dhcpcsvc6.dll
2012-11-16 13:09 . 2012-10-09 17:40	193536	----a-w-	c:\windows\system32\dhcpcore6.dll
2012-11-08 17:02 . 2012-11-08 17:04	--------	d-----w-	c:\program files\Common Files\Merge Modules
2012-11-08 16:57 . 2012-11-08 17:15	--------	d-----w-	c:\program files\National Instruments
2012-11-08 16:57 . 2012-11-08 17:23	--------	d-----w-	c:\programdata\National Instruments
2012-11-08 09:17 . 2012-05-05 10:54	137000	----a-w-	c:\windows\system32\MSMAPI32.OCX
2012-11-08 09:17 . 2012-05-05 10:54	662288	----a-w-	c:\windows\system32\MSCOMCT2.OCX
2012-11-08 09:16 . 2012-10-12 06:34	86528	----a-w-	c:\windows\system32\pdfcmon.dll
2012-11-08 09:16 . 1998-07-06 17:55	158208	----a-w-	c:\windows\system32\MSCMCDE.DLL
2012-11-08 09:16 . 1998-07-06 17:55	64512	----a-w-	c:\windows\system32\MSCC2DE.DLL
2012-11-08 09:16 . 2012-11-08 09:17	--------	d-----w-	c:\program files\PDFCreator
2012-11-08 09:16 . 2012-05-05 10:54	23552	----a-w-	c:\windows\system32\MSMPIDE.DLL
2012-11-08 09:16 . 2012-11-08 09:16	--------	d-----w-	c:\users\Philipp\AppData\Local\Programs
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-12-04 16:48 . 2012-07-28 02:20	73656	----a-w-	c:\windows\system32\FlashPlayerCPLApp.cpl
2012-12-04 16:48 . 2012-07-28 02:20	697272	----a-w-	c:\windows\system32\FlashPlayerApp.exe
2012-10-22 11:11 . 2012-10-22 11:11	163056	----a-w-	c:\programdata\Microsoft\Windows\Sqm\Manifest\Sqm10142.bin
2012-10-16 07:39 . 2012-11-28 06:45	561664	----a-w-	c:\windows\apppatch\AcLayers.dll
2012-09-14 18:28 . 2012-10-11 16:13	2048	----a-w-	c:\windows\system32\tzres.dll
2012-10-28 11:05 . 2012-10-28 11:05	261600	----a-w-	c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((((((((((   Look   )))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
---- Directory of c:\programdata\58A302F456F27AC1000058A2AA5A8398 ----
.
2012-12-04 16:51 . 2012-12-04 17:41	2960	----a-w-	c:\programdata\58A302F456F27AC1000058A2AA5A8398\58A302F456F27AC1000058A2AA5A8398
2012-12-04 16:49 . 2012-12-04 16:49	4286	----a-w-	c:\programdata\58A302F456F27AC1000058A2AA5A8398\58A302F456F27AC1000058A2AA5A8398.ico
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12	94208	----a-w-	c:\users\Philipp\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12	94208	----a-w-	c:\users\Philipp\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12	94208	----a-w-	c:\users\Philipp\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RESTART_STICKY_NOTES"="c:\windows\System32\StikyNot.exe" [2009-07-14 354304]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AMD AVT"="start AMD Accelerated Video Transcoding device initialization" [X]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2009-06-04 186904]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2009-08-04 7703072]
"MGSysCtrl"="c:\program files\System Control Manager\MGSysCtrl.exe" [2009-09-01 2224128]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2011-01-10 281768]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2012-07-04 641704]
.
c:\users\Philipp\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dropbox.lnk - c:\users\Philipp\AppData\Roaming\Dropbox\bin\Dropbox.exe [2012-5-24 27112840]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\hitmanpro37]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\hitmanpro37.sys]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\HitmanPro37Crusader]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\HitmanPro37CrusaderBoot]
@=""
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-disabled]
"SynTPEnh"=%ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe
"YouCam Mirror Tray icon"="c:\program files\CyberLink\YouCam\YouCamTray.exe" /s
"UCam_Menu"="c:\program files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" "c:\program files\CyberLink\YouCam" UpdateWithCreateOnce "Software\CyberLink\YouCam\3.0"
"CanonMyPrinter"=c:\program files\Canon\MyPrinter\BJMyPrt.exe /logon
"tvjbmonitor"=c:\programme\MMEDIA\TV Jukebox 3.0\tvjbMonitor.exe
"DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
"DivX Download Manager"="c:\program files\DivX\DivX Plus Web Player\DDmService.exe" start
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe"
"CanonSolutionMenuEx"=c:\program files\Canon\Solution Menu EX\CNSEMAIN.EXE /logon
"PDVD9LanguageShortcut"="c:\program files\CyberLink\PowerDVD9\Language\Language.exe"
"MDS_Menu"="c:\program files\CyberLink\MediaShow4\MUITransfer\MUIStartMenu.exe" "c:\program files\CyberLink\MediaShow4" UpdateWithCreateOnce "Software\CyberLink\MediaShow\4.1"
"CLMLServer"="c:\program files\CyberLink\Power2Go\CLMLSvc.exe"
"UpdateP2GoShortCut"="c:\program files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" "c:\program files\CyberLink\Power2Go" UpdateWithCreateOnce "SOFTWARE\CyberLink\Power2Go\6.0"
"UpdatePDRShortCut"="c:\program files\CyberLink\PowerDirector\MUITransfer\MUIStartMenu.exe" "c:\program files\CyberLink\PowerDirector" UpdateWithCreateOnce "Software\CyberLink\PowerDirector\7.0"
"UpdatePPShortCut"="c:\program files\CyberLink\PowerProducer\MUITransfer\MUIStartMenu.exe" "c:\program files\CyberLink\PowerProducer" UpdateWithCreateOnce "Software\CyberLink\PowerProducer\5.0"
"Guard.Mail.ru.gui"="c:\program files\Guard-ICQ\GuardICQ.exe" /gui
.
R3 lvalarmk;lvalarmk;c:\windows\system32\drivers\lvalarmk.sys [x]
R3 ni1006k;NI PXI-1006 Chassis Pilot;c:\windows\system32\drivers\ni1006k.sys [x]
R3 ni1045k;NI PXI-1045 Chassis Pilot;c:\windows\system32\drivers\ni1045kl.sys [x]
R3 ni1065k;NI PXIe-1065 Chassis Pilot;c:\windows\system32\drivers\ni1065k.sys [x]
R3 nicdcck;nicdcck;c:\windows\system32\drivers\nicdcckl.sys [x]
R3 nicdrk;nicdrk;c:\windows\system32\drivers\nicdrkl.sys [x]
R3 nicmrk;nicmrk;c:\windows\system32\drivers\nicmrkl.sys [x]
R3 nicondrk;nicondrk;c:\windows\system32\drivers\nicondrkl.sys [x]
R3 nicsrk;nicsrk;c:\windows\system32\drivers\nicsrkl.sys [x]
R3 nidmxfk;nidmxfk;c:\windows\system32\drivers\nidmxfkl.sys [x]
R3 nidsark;nidsark;c:\windows\system32\drivers\nidsarkl.sys [x]
R3 niemrk;niemrk;c:\windows\system32\drivers\niemrkl.sys [x]
R3 niemrkw;niemrkw;c:\windows\system32\DRIVERS\niemrkw.sys [x]
R3 niesrk;niesrk;c:\windows\system32\drivers\niesrkl.sys [x]
R3 nifslk;nifslk;c:\windows\system32\drivers\nifslkl.sys [x]
R3 nimsdrk;nimsdrk;c:\windows\system32\drivers\nimsdrkl.sys [x]
R3 nimslk;nimslk;c:\windows\system32\drivers\nimslk.dll [x]
R3 nimsrlk;nimsrlk;c:\windows\system32\drivers\nimsrlk.dll [x]
R3 nimxpk;nimxpk;c:\windows\system32\drivers\nimxpkl.sys [x]
R3 ninshsdk;ninshsdk;c:\windows\system32\drivers\ninshsdkl.sys [x]
R3 nipalfwedl;nipalfwedl;c:\windows\system32\drivers\nipalfwedl.sys [x]
R3 nipalusbedl;nipalusbedl;c:\windows\system32\drivers\nipalusbedl.sys [x]
R3 nipxigpk;NI PXI Generic Chassis Pilot;c:\windows\system32\drivers\nipxigpk.sys [x]
R3 niraptrk;niraptrk;c:\windows\system32\drivers\niraptrkl.sys [x]
R3 niscdk;niscdk;c:\windows\system32\drivers\niscdkl.sys [x]
R3 nisdigk;nisdigk;c:\windows\system32\drivers\nisdigkl.sys [x]
R3 nisftk;nisftk;c:\windows\system32\drivers\nisftkl.sys [x]
R3 nispdk;nispdk;c:\windows\system32\drivers\nispdkl.sys [x]
R3 nissrk;nissrk;c:\windows\system32\drivers\nissrkl.sys [x]
R3 nistc2k;nistc2k;c:\windows\system32\drivers\nistc2kl.sys [x]
R3 nistc3rk;nistc3rk;c:\windows\system32\drivers\nistc3rkl.sys [x]
R3 nistcrk;nistcrk;c:\windows\system32\drivers\nistcrkl.sys [x]
R3 niswdk;niswdk;c:\windows\system32\drivers\niswdkl.sys [x]
R3 nitiork;nitiork;c:\windows\system32\drivers\nitiorkl.sys [x]
R3 niufurk;niufurk;c:\windows\system32\drivers\niufurkl.sys [x]
R3 niwfrk;niwfrk;c:\windows\system32\drivers\niwfrkl.sys [x]
R3 nixsrk;nixsrk;c:\windows\system32\drivers\nixsrkl.sys [x]
R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys [x]
R3 RtsUIR;Realtek IR Driver;c:\windows\system32\DRIVERS\Rts516xIR.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 usb6xxxk;usb6xxxk;c:\windows\system32\drivers\usb6xxxkl.sys [x]
R3 usb6xxxkw;usb6xxxkw;c:\windows\system32\DRIVERS\usb6xxxkw.sys [x]
R3 VBoxNetAdp;VirtualBox Host-Only Ethernet Adapter;c:\windows\system32\DRIVERS\VBoxNetAdp.sys [x]
R3 WatAdminSvc;Windows-Aktivierungstechnologieservice;c:\windows\system32\Wat\WatAdminSvc.exe [x]
R4 msvsmon80;Visual Studio 2005 Remote Debugger;c:\program files\Microsoft Visual Studio 8\Common7\IDE\Remote Debugger\x86\msvsmon.exe [x]
S0 nipbcfk;National Instruments Class Upper Filter Driver;c:\windows\System32\drivers\nipbcfk.sys [x]
S0 nipxibaf;National Instruments PXI Bridge Access Driver;c:\windows\System32\drivers\nipxibaf.sys [x]
S0 nipxibrc;National Instruments PXI Bridge Configuration Driver;c:\windows\System32\drivers\nipxibrc.sys [x]
S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [x]
S1 VBoxDrv;VirtualBox Service;c:\windows\system32\DRIVERS\VBoxDrv.sys [x]
S1 VBoxUSBMon;VirtualBox USB Monitor Driver;c:\windows\system32\DRIVERS\VBoxUSBMon.sys [x]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x]
S2 AntiVirSchedulerService;Avira AntiVir Planer;c:\program files\Avira\AntiVir Desktop\sched.exe [x]
S2 Guard.Mail.ru;Guard.Mail.ru;c:\program files\Guard-ICQ\GuardICQ.exe [x]
S2 Micro Star SCM;Micro Star SCM;c:\program files\System Control Manager\MSIService.exe [x]
S2 mitsijm2012;Autodesk Moldflow Inventor Tool Suite Integration 2012 Job-Manager;c:\program files\Autodesk\Inventor 2012\Moldflow\bin\mitsijm.exe [x]
S2 NIApplicationWebServer;NI Application Web Server;c:\program files\National Instruments\Shared\NI WebServer\ApplicationWebServer.exe [x]
S2 nidevldu;NI Device Loader;c:\windows\system32\nipalsm.exe [x]
S2 nimDNSResponder;NI mDNS Responder Service;c:\program files\National Instruments\Shared\mDNS Responder\nimdnsResponder.exe [x]
S2 NINetworkDiscovery;NI Network Discovery;c:\program files\National Instruments\Shared\NI Network Discovery\niDiscSvc.exe [x]
S2 nipxirmk;nipxirmk;c:\windows\system32\drivers\nipxirmkl.sys [x]
S3 acpials;ALS-Sensorfilter;c:\windows\system32\DRIVERS\acpials.sys [x]
S3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW73.sys [x]
S3 nidimk;nidimk;c:\windows\system32\drivers\nidimkl.sys [x]
S3 NIEthernetDeviceEnumerator;NI Ethernet Device Enumerator Driver;c:\windows\system32\DRIVERS\niede.sys [x]
S3 nimru2k;nimru2k;c:\windows\system32\drivers\nimru2kl.sys [x]
S3 nimstsk;nimstsk;c:\windows\system32\drivers\nimstskl.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt86win7.sys [x]
S3 rtl8192se;Realtek Wireless LAN 802.11n PCI-E NIC NT Driver;c:\windows\system32\DRIVERS\rtl8192se.sys [x]
S3 VBoxNetFlt;VBoxNetFlt Service;c:\windows\system32\DRIVERS\VBoxNetFlt.sys [x]
.
.
Inhalt des "geplante Tasks" Ordners
.
2012-12-06 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-07-28 16:48]
.
2012-12-06 c:\windows\Tasks\MATLAB R2012b Startup Accelerator.job
- c:\program files\MATLAB\R2012b\bin\win32\MATLABStartupAccelerator.exe [2012-11-05 17:50]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.medion.com
IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
IE: {{0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - hxxp://rover.ebay.com/rover/1/707-37276-17534-31/4
IE: {{781B39EC-2E18-41FC-9B00-B84E4FFCA85F} - c:\program files\ICQ7M\ICQ.exe
TCP: DhcpNameServer = 192.168.0.1
FF - ProfilePath - c:\users\Philipp\AppData\Roaming\Mozilla\Firefox\Profiles\u4dd18t4.default\
FF - prefs.js: network.proxy.http - 95.215.48.132
FF - prefs.js: network.proxy.http_port - 8080
FF - prefs.js: network.proxy.type - 0
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------
.
- - - - - - - > 'Explorer.exe'(1352)
c:\users\Philipp\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
Zeit der Fertigstellung: 2012-12-06  18:38:03
ComboFix-quarantined-files.txt  2012-12-06 17:38
ComboFix2.txt  2012-12-06 09:59
.
Vor Suchlauf: 15 Verzeichnis(se), 280.807.321.600 Bytes frei
Nach Suchlauf: 17 Verzeichnis(se), 280.504.614.912 Bytes frei
.
- - End Of File - - 827C3E92769219CE3FED6CFCD667A19B