Code:
Alles auswählen Aufklappen ATTFilter
ComboFix 08-09-13.05 - Meatbug 2008-09-14 14:49:09.2 - NTFSx86 NETWORK
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1031.18.1730 [GMT 2:00]
ausgeführt von:: C:\Dokumente und Einstellungen\Meatbug\Desktop\ComboFix.exe
Achtung - Auf diesem PC ist keine Wiederherstellungskonsole installiert !! 0 0000001\NTUSER.DAT
+ 2008-09-14 11:42:58 8,970,240 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\0 0000001\NTUSER.DAT
- 2008-09-14 10:08:42 421,888 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\0 0000002\UsrClass.dat
+ 2008-09-14 11:42:59 421,888 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\0 0000002\UsrClass.dat
.
(((((((((((((((((((((((((((( Autostart Punkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Eintrage & legitime Standardeintrage werden nicht angezeigt.
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{5e2402a0-5f99-4188-b30d-d8743996b340}]
2008-05-30 00:42 188416 --a------ C:\Programme\LuckyTender\1.3.0\LuckyTender.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\1TortoiseSVN]
@="{30351346-7B7D-4FCC-81B4-1E394CA267EB}"
[HKEY_CLASSES_ROOT\CLSID\{30351346-7B7D-4FCC-81B4-1E394CA267EB}]
2008-02-16 12:35 536576 --a------ C:\Programme\TortoiseSVN\bin\tortoisesvn.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\2TortoiseSVN]
@="{30351347-7B7D-4FCC-81B4-1E394CA267EB}"
[HKEY_CLASSES_ROOT\CLSID\{30351347-7B7D-4FCC-81B4-1E394CA267EB}]
2008-02-16 12:35 536576 --a------ C:\Programme\TortoiseSVN\bin\tortoisesvn.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\3TortoiseSVN]
@="{30351348-7B7D-4FCC-81B4-1E394CA267EB}"
[HKEY_CLASSES_ROOT\CLSID\{30351348-7B7D-4FCC-81B4-1E394CA267EB}]
2008-02-16 12:35 536576 --a------ C:\Programme\TortoiseSVN\bin\tortoisesvn.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\4TortoiseSVN]
@="{3035134B-7B7D-4FCC-81B4-1E394CA267EB}"
[HKEY_CLASSES_ROOT\CLSID\{3035134B-7B7D-4FCC-81B4-1E394CA267EB}]
2008-02-16 12:35 536576 --a------ C:\Programme\TortoiseSVN\bin\tortoisesvn.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\5TortoiseSVN]
@="{3035134C-7B7D-4FCC-81B4-1E394CA267EB}"
[HKEY_CLASSES_ROOT\CLSID\{3035134C-7B7D-4FCC-81B4-1E394CA267EB}]
2008-02-16 12:35 536576 --a------ C:\Programme\TortoiseSVN\bin\tortoisesvn.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\6TortoiseSVN]
@="{3035134D-7B7D-4FCC-81B4-1E394CA267EB}"
[HKEY_CLASSES_ROOT\CLSID\{3035134D-7B7D-4FCC-81B4-1E394CA267EB}]
2008-02-16 12:35 536576 --a------ C:\Programme\TortoiseSVN\bin\tortoisesvn.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\7TortoiseSVN]
@="{3035134E-7B7D-4FCC-81B4-1E394CA267EB}"
[HKEY_CLASSES_ROOT\CLSID\{3035134E-7B7D-4FCC-81B4-1E394CA267EB}]
2008-02-16 12:35 536576 --a------ C:\Programme\TortoiseSVN\bin\tortoisesvn.dll
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 15360]
"MsnMsgr"="C:\Programme\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]
"Steam"="c:\programme\steam\steam.exe" [2008-03-28 1271032]
"MSMSGS"="C:\Programme\Messenger\msmsgs.exe" [2004-10-13 1694208]
"swg"="C:\Programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-07-23 68856]
"RocketDock"="C:\Programme\RocketDock\RocketDock.exe" [2007-09-02 495616]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"kis"="C:\Programme\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe" [2006-03-24 139367]
"amd_dc_opt"="C:\Programme\AMD\Dual-Core Optimizer\amd_dc_opt.exe" [2007-07-23 77824]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-04-12 8429568]
"ISUSPM"="C:\Programme\Gemeinsame Dateien\InstallShield\UpdateService\ISUSPM.exe" [2006-03-20 213936]
"Lexmark X1100 Series"="C:\Programme\Lexmark X1100 Series\lxbkbmgr.exe" [2003-03-28 57344]
"VX1000"="C:\WINDOWS\vVX1000.exe" [2007-04-10 709992]
"QuickTime Task"="C:\Programme\QuickTime\qttask.exe" [2006-09-01 282624]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-04-12 81920]
"SDFix"="C:\SDFix\RunThis.bat" [2008-09-14 784613]
"RTHDCPL"="RTHDCPL.EXE" [2008-02-13 C:\WINDOWS\RTHDCPL.EXE]
"nwiz"="nwiz.exe" [2007-04-12 C:\WINDOWS\system32\nwiz.exe]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 15360]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"MSVideo"= CSvidcap.dll
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\3dsmax7\\3dsmax.exe"=
"C:\\Programme\\backburner 2\\monitor.exe"=
"C:\\Programme\\backburner 2\\manager.exe"=
"C:\\Programme\\backburner 2\\server.exe"=
"C:\\Programme\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Programme\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Programme\\Messenger\\msmsgs.exe"=
"C:\\Programme\\Microsoft LifeCam\\LifeCam.exe"=
"C:\\Programme\\Microsoft LifeCam\\LifeExp.exe"=
"C:\\Programme\\uTorrent\\uTorrent.exe"=
"C:\\Programme\\Reality Pump\\Two Worlds\\TwoWorlds.exe"=
"C:\\Programme\\EA GAMES\\Battlefield 2\\BF2.exe"=
"C:\\Programme\\THQ\\S.T.A.L.K.E.R. - Shadow of Chernobyl\\bin\\XR_3DA.exe"=
"C:\\Programme\\THQ\\S.T.A.L.K.E.R. - Shadow of Chernobyl\\bin\\dedicated\\XR_3DA.exe"=
"C:\\Programme\\Bonjour\\mDNSResponder.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"85:TCP"= 85:TCP:BroadWave Web Server
S1 installer32;installer32;C:\WINDOWS\system32\installer32.sys [2008-09-14 67934]
S2 MSCamSvc;MSCamSvc;c:\Programme\Microsoft LifeCam\MSCamS32.exe [2007-05-17 271720]
S2 psi_svc_2;Protexis Licensing V2;C:\Programme\Gemeinsame Dateien\Protexis\License Service\PsiService_2.exe [2007-07-24 185632]
S2 regi;regi;C:\WINDOWS\system32\drivers\regi.sys [2007-04-17 11032]
S2 SVKP;SVKP;C:\WINDOWS\system32\SVKP.sys [2008-03-18 2368]
S3 3DRipDriver;3D Ripper monitoring driver;C:\Programme\3DRipperDX\3DRipDriver.sys [2007-10-21 6656]
S3 AVMUNET;AVM FRITZ!Box;C:\WINDOWS\system32\DRIVERS\avmunet.sys [2005-04-18 15104]
S3 gtermddo;gtermddo;C:\DOKUME~1\Meatbug\LOKALE~1\Temp\gtermddo.sys [ ]
S3 MBAMSwissArmy;MBAMSwissArmy;C:\WINDOWS\system32\drivers\mbamswissarmy.sys [2008-07-30 38472]
S3 VX1000;VX-1000;C:\WINDOWS\system32\DRIVERS\VX1000.sys [2007-04-10 1966312]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a066ff06-f10a-11dc-92d4-001e8c828fed}]
\Shell\AutoRun\command - E:\preinst.exe
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{p9aaa3ab-b707-11d2-j0bd-kcomf87a369e}]
C:\Dokumente und Einstellungen\Meatbug\Desktop\avkill.exe
.
Inhalt des "geplante Tasks" Ordners
.
.
------- Zusätzlicher Scan -------
.
FireFox -: Profile - C:\Dokumente und Einstellungen\Meatbug\Anwendungsdaten\Mozilla\Firefox\Profiles\u8m2frdh.default\
FireFox -: prefs.js - SEARCH.DEFAULTURL - hxxp://www.yodl.de/href.php?hrefname=FF-splug_google&q=
FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.google.de
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-09-14 14:52:55
Windows 5.1.2600 Service Pack 2 NTFS
Scanne versteckte Prozesse...
Scanne versteckte Autostart Einträge...
Scanne versteckte Dateien...
Scan erfolgreich abgeschlossen
versteckte Dateien: 0
**************************************************************************
.
Zeit der Fertigstellung: 2008-09-14 14:58:51
ComboFix-quarantined-files.txt 2008-09-14 12:58:40
Pre-Run: 21 Verzeichnis(se), 73,482,088,448 Bytes frei
Post-Run: 25 Verzeichnis(se), 73,463,947,264 Bytes frei
309 --- E O F --- 2008-09-10 21:00:52
Kann mir jetzt jemand helfen, ich muss das so unbedingt so schnell wie möglich in den Griff bekommen!!
14.09.2008, 14:12
Baum-Darstellung