Babylon-Toolbar, BProtect-D und andere Schädlinge werde ich nicht los

Combofix Logfile:

	
Code: 

Alles auswählenAufklappen 
ATTFilter

  
	
ComboFix 14-07-16.01 - Cas 16.07.2014  11:36:46.1.4 - x86
Microsoft® Windows Vista™ Ultimate   6.0.6000.0.1252.49.1031.18.3326.1737 [GMT 2:00]
ausgeführt von:: c:\users\Cas\Desktop\ComboFix.exe
 * Neuer Wiederherstellungspunkt wurde erstellt
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Cas\AppData\Local\lame_enc.dll
c:\users\Cas\AppData\Local\no23xwrapper.dll
c:\users\Cas\AppData\Local\ogg.dll
c:\users\Cas\AppData\Local\vorbis.dll
c:\users\Cas\AppData\Local\vorbisenc.dll
c:\users\Cas\AppData\Local\vorbisfile.dll
c:\users\Cas\mozjs.dll
c:\users\Cas\nsldap32v60.dll
c:\users\Cas\nsldappr32v60.dll
c:\users\Cas\nsldif32v60.dll
c:\users\Cas\plugin-container.exe
.
.
(((((((((((((((((((((((   Dateien erstellt von 2014-06-16 bis 2014-07-16  ))))))))))))))))))))))))))))))
.
.
2014-07-16 09:43 . 2014-07-16 09:43	--------	d-----w-	c:\users\Default\AppData\Local\temp
2014-07-16 08:28 . 2014-07-16 08:30	--------	d-----w-	C:\FRST
2014-07-16 07:12 . 2014-07-16 07:12	--------	d-----w-	c:\users\Cas\AppData\Roaming\AVAST Software
2014-07-16 07:12 . 2014-07-16 07:11	57800	----a-w-	c:\windows\system32\drivers\aswTdi.sys
2014-07-16 07:12 . 2014-07-16 07:11	192352	----a-w-	c:\windows\system32\drivers\aswVmm.sys
2014-07-16 07:12 . 2014-07-16 07:11	779536	----a-w-	c:\windows\system32\drivers\aswSnx.sys
2014-07-16 07:12 . 2014-07-16 07:12	414520	----a-w-	c:\windows\system32\drivers\aswsp.sys
2014-07-16 07:12 . 2014-07-16 07:11	67824	----a-w-	c:\windows\system32\drivers\aswMonFlt.sys
2014-07-16 07:12 . 2014-07-16 07:11	49944	----a-w-	c:\windows\system32\drivers\aswRvrt.sys
2014-07-16 07:12 . 2014-07-16 07:11	24184	----a-w-	c:\windows\system32\drivers\aswHwid.sys
2014-07-16 07:12 . 2014-07-16 07:11	55112	----a-w-	c:\windows\system32\drivers\aswRdr.sys
2014-07-16 07:12 . 2014-07-16 07:11	276432	----a-w-	c:\windows\system32\aswBoot.exe
2014-07-16 07:11 . 2014-07-16 07:11	43152	----a-w-	c:\windows\avastSS.scr
2014-07-16 07:11 . 2014-07-16 07:11	--------	d-----w-	c:\program files\AVAST Software
2014-07-16 07:09 . 2014-07-16 07:11	--------	d-----w-	c:\programdata\AVAST Software
2014-07-16 06:43 . 2014-07-16 06:43	10594416	----a-w-	c:\program files\Mozilla Firefox\icudt52.dll
2014-07-16 06:43 . 2014-07-16 06:43	822384	----a-w-	c:\program files\Mozilla Firefox\icuuc52.dll
2014-07-16 06:43 . 2014-07-16 06:43	1022576	----a-w-	c:\program files\Mozilla Firefox\icuin52.dll
2014-07-09 11:16 . 2014-07-09 11:16	--------	d-----w-	c:\users\Cas\AppData\Local\Apple Computer
2014-07-09 11:13 . 2014-07-16 06:33	--------	d-----w-	c:\users\Cas\AppData\Roaming\Apple Computer
2014-07-09 09:45 . 2014-07-09 09:45	159744	----a-w-	c:\program files\Mozilla Firefox\plugins\npqtplugin5.dll
2014-07-09 09:45 . 2014-07-09 09:45	159744	----a-w-	c:\program files\Internet Explorer\Plugins\npqtplugin5.dll
2014-07-09 09:45 . 2014-07-09 09:45	159744	----a-w-	c:\program files\Mozilla Firefox\plugins\npqtplugin4.dll
2014-07-09 09:45 . 2014-07-09 09:45	159744	----a-w-	c:\program files\Internet Explorer\Plugins\npqtplugin4.dll
2014-07-09 09:45 . 2014-07-09 09:45	159744	----a-w-	c:\program files\Mozilla Firefox\plugins\npqtplugin3.dll
2014-07-09 09:45 . 2014-07-09 09:45	159744	----a-w-	c:\program files\Mozilla Firefox\plugins\npqtplugin2.dll
2014-07-09 09:45 . 2014-07-09 09:45	159744	----a-w-	c:\program files\Internet Explorer\Plugins\npqtplugin3.dll
2014-07-09 09:45 . 2014-07-09 09:45	159744	----a-w-	c:\program files\Internet Explorer\Plugins\npqtplugin2.dll
2014-07-09 09:45 . 2014-07-09 09:45	159744	----a-w-	c:\program files\Mozilla Firefox\plugins\npqtplugin.dll
2014-07-09 09:45 . 2014-07-09 09:45	159744	----a-w-	c:\program files\Internet Explorer\Plugins\npqtplugin.dll
2014-07-09 09:44 . 2014-07-09 09:45	--------	d-----w-	c:\program files\QuickTime
2014-07-09 09:44 . 2014-07-09 09:44	--------	d-----w-	c:\programdata\Apple Computer
2014-07-09 09:43 . 2014-07-09 09:43	--------	d-----w-	c:\program files\Common Files\Apple
2014-07-09 09:43 . 2014-07-09 09:43	--------	d-----w-	c:\users\Cas\AppData\Local\Apple
2014-07-09 09:43 . 2014-07-09 09:43	--------	d-----w-	c:\programdata\Apple
2014-07-09 09:43 . 2014-07-09 09:43	--------	d-----w-	c:\program files\Apple Software Update
2014-07-09 08:47 . 2014-07-09 08:47	--------	d-----w-	c:\programdata\Package Cache
2014-07-09 08:40 . 2014-07-16 09:32	--------	d-----w-	c:\users\Cas\AppData\Roaming\DropboxMaster
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-07-16 06:37 . 2012-09-23 15:39	71344	----a-w-	c:\windows\system32\FlashPlayerCPLApp.cpl
2014-07-16 06:37 . 2012-09-23 15:39	699056	----a-w-	c:\windows\system32\FlashPlayerApp.exe
2006-05-03 11:06	163328	--sha-r-	c:\windows\System32\flvDX.dll
2007-02-21 12:47	31232	--sha-r-	c:\windows\System32\msfDX.dll
2008-03-16 14:30	216064	--sha-r-	c:\windows\System32\nbDX.dll
2010-01-06 23:00	107520	--sha-r-	c:\windows\System32\TAKDSDecoder.dll
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2014-07-16 07:11	578240	----a-w-	c:\program files\AVAST Software\Avast\ashShell.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-11 02:09	131248	----a-w-	c:\users\Cas\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-11 02:09	131248	----a-w-	c:\users\Cas\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-11 02:09	131248	----a-w-	c:\users\Cas\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2012-09-14 1232896]
"Steam"="d:\programme\Steam\steam.exe" [2014-07-12 1753280]
"Spotify Web Helper"="c:\users\Cas\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe" [2014-07-16 1178168]
"Spotify"="c:\users\Cas\AppData\Roaming\Spotify\spotify.exe" [2014-07-16 6162488]
"DAEMON Tools Lite"="d:\programme\DAEMON Tools Lite\DTLite.exe" [2012-04-11 3672384]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-12-03 946352]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2011-10-12 343168]
"WinampAgent"="c:\program files\Winamp\winampa.exe" [2012-06-20 74752]
"CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2007-04-03 1603152]
"TrayServer"="c:\program files\MAGIX\Video_deluxe_MX_Plus_Sonderedition\TrayServer_de.exe" [2008-08-07 90112]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-26 31016]
"Ocs_SM"="c:\users\Cas\AppData\Roaming\OCS\SM\SearchAnonymizer.exe" [2012-11-17 106496]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-07-03 252848]
"TkBellExe"="c:\program files\Real\RealPlayer\Update\realsched.exe" [2013-03-21 295512]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2013-07-29 345144]
"Cisco AnyConnect Secure Mobility Agent for Windows"="c:\program files\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe" [2013-06-19 703888]
"Avira Systray"="c:\program files\Avira\My Avira\Avira.OE.Systray.exe" [2014-07-07 189520]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2013-09-13 59720]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2014-01-17 421888]
"MRT"="c:\windows\system32\MRT.exe" [2014-06-26 93585272]
"AvastUI.exe"="c:\program files\AVAST Software\Avast\AvastUI.exe" [2014-07-16 4086432]
.
c:\users\Cas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dropbox.lnk - c:\users\Cas\AppData\Roaming\Dropbox\bin\Dropbox.exe /systemstartup [2014-5-20 33322312]
.
R3 acsint;acsint;c:\windows\system32\DRIVERS\acsint.sys [2013-06-19 39888]
R3 acsmux;acsmux;c:\windows\system32\DRIVERS\acsmux.sys [2013-06-19 58320]
.
.
Inhalt des "geplante Tasks" Ordners
.
2014-07-16 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-09-23 06:37]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://search.babylon.com/?affID=109727&tt=4612_8&babsrc=HP_ss&mntrId=e49a2a8e000000000000002215a12c88
IE: &Citavi Picker... - file://c:\programdata\Swiss Academic Software\Citavi Picker\Internet Explorer\ShowContextMenu.html
IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
LSP: c:\program files\Avira\AntiVir Desktop\avsda.dll
TCP: DhcpNameServer = 192.168.178.1
FF - ProfilePath - c:\users\Cas\AppData\Roaming\Mozilla\Firefox\Profiles\8ka7i0u3.default\
FF - prefs.js: browser.startup.homepage - hxxp://search.babylon.com/?affID=109727&tt=4612_8&babsrc=HP_ss&mntrId=e49a2a8e000000000000002215a12c88
FF - ExtSQL: !HIDDEN! 2012-11-17 11:07; extension@preispilot.com; c:\users\Cas\AppData\Roaming\Mozilla\Firefox\Profiles\8ka7i0u3.default\extensions\extension@preispilot.com
FF - ExtSQL: !HIDDEN! 2012-11-17 11:07; firejump@firejump.net; c:\users\Cas\AppData\Roaming\Mozilla\Firefox\Profiles\8ka7i0u3.default\extensions\firejump@firejump.net
FF - user.js: extensions.BabylonToolbar.tlbrSrchUrl - hxxp://search.babylon.com/?babsrc=TB_def&mntrId=e49a2a8e000000000000002215a12c88&q=
FF - user.js: extensions.BabylonToolbar.id - e49a2a8e000000000000002215a12c88
FF - user.js: extensions.BabylonToolbar.appId - {BDB69379-802F-4eaf-B541-F8DE92DD98DB}
FF - user.js: extensions.BabylonToolbar.instlDay - 15661
FF - user.js: extensions.BabylonToolbar.vrsn - 1.8.3.8
FF - user.js: extensions.BabylonToolbar.vrsni - 1.8.3.8
FF - user.js: extensions.BabylonToolbar_i.vrsnTs - 1.8.3.811:08
FF - user.js: extensions.BabylonToolbar.prtnrId - babylon
FF - user.js: extensions.BabylonToolbar.prdct - BabylonToolbar
FF - user.js: extensions.BabylonToolbar.aflt - babsst
FF - user.js: extensions.BabylonToolbar_i.smplGrp - none
FF - user.js: extensions.BabylonToolbar.tlbrId - base
FF - user.js: extensions.BabylonToolbar.instlRef - sst
FF - user.js: extensions.BabylonToolbar.dfltLng - en
FF - user.js: extensions.BabylonToolbar.excTlbr - false
FF - user.js: extensions.BabylonToolbar.admin - false
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
AddRemove-loadtbs-3.0 - c:\users\Cas\AppData\Roaming\loadtbs\uninstall.exe
AddRemove-_{0C180787-F8C8-42FD-A9D3-689BA44BEAAF} - c:\program files\Corel\Corel Painter Essentials 3\MSILauncher {0C180787-F8C8-42FD-A9D3-689BA44BEAAF}
AddRemove-{E280923D-C5D9-4728-8C79-AC9A0DC75875} - c:\program files\InstallShield Installation Information\{E280923D-C5D9-4728-8C79-AC9A0DC75875}\setup.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2014-07-16 11:44
Windows 6.0.6000  NTFS
.
Scanne versteckte Prozesse... 
.
Scanne versteckte Autostarteinträge... 
.
Scanne versteckte Dateien... 
.
Scan erfolgreich abgeschlossen
versteckte Dateien: 0
.
**************************************************************************
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\S-1-5-21-1399156017-4130152259-970843329-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*7*T%W%]
@Class="Shell"
.
[HKEY_USERS\S-1-5-21-1399156017-4130152259-970843329-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*7*T%W%\OpenWithList]
@Class="Shell"
.
[HKEY_USERS\S-1-5-21-1399156017-4130152259-970843329-1000\Software\SecuROM\License information*]
@Allowed: (Read) (RestrictedCode)
"datasecu"=hex:ab,f7,d9,5d,8c,c8,21,74,26,2d,5e,50,68,ed,6c,72,4a,00,5f,0f,d3,
   72,52,43,32,86,cd,b0,77,15,7a,e6,7c,91,3a,e0,02,4d,8c,2a,da,2e,30,94,39,6e,\
"rkeysecu"=hex:89,60,8a,ec,50,f9,31,e4,ec,de,98,a8,ed,2b,fe,d3
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin.*1*]
@="?????????????????? v1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin.*1*\CLSID]
@="{E23FE9C6-778E-49D4-B537-38FCDE4887D8}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin.*2*]
@="?????????????????? v2"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin.*2*\CLSID]
@="{9BE31822-FDAD-461B-AD51-BE1D1C159921}"
.
Zeit der Fertigstellung: 2014-07-16  11:46:03
ComboFix-quarantined-files.txt  2014-07-16 09:46
.
Vor Suchlauf: 4.396.916.736 Bytes frei
Nach Suchlauf: 6.596.091.904 Bytes frei
.
- - End Of File - - 4C7F7D6EE6BD6B2C8B450F00BCA25820
         
 
--- --- ---
5C616939100B85E558DA92B899A0FC36