Win32Trojan.Tdss - wie entfernen - bitte um Hilfe!

Jennifer99

ComboFix 09-09-09.09 - BastianR 12.09.2009 15:56.3.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.49.1031.18.1023.638 [GMT 2:00]
ausgeführt von:: c:\dokumente und einstellungen\BastianR\Desktop\cofi.exe
Benutzte Befehlsschalter :: c:\dokumente und einstellungen\BastianR\Desktop\cfscript.txt
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
AV: AntiVir PersonalEdition Classic Virenschutz *On-access scanning enabled* (Outdated) {00000000-0000-0000-0000-000000000000}
AV: AntiVir PersonalEdition Classic Virenschutz *On-access scanning enabled* (Updated) {806ED0B3-FFA4-00DA-0D24-347CA8A3377C}
AV: AntiVir PersonalEdition Classic Virenschutz *On-access scanning enabled* (Updated) {806ED0B3-FFA4-00EB-0D24-347CA8A3377C}
* Neuer Wiederherstellungspunkt wurde erstellt

FILE ::
"c:\dokumente und einstellungen\Administrator\Lokale Einstellungen\Anwendungsdaten\GDIPFONTCACHEV1.DAT"
"c:\dokumente und einstellungen\All Users\Startmenü\Programme\Autostart\Microsoft Office.lnk"
"c:\windows\system32\notifyf2.dll"
"c:\windows\system32\perfc007.dat"
"c:\windows\system32\perfh007.dat"
"c:\windows\tasks\Ad-Aware Update (Weekly).job"
.

(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\dokumente und einstellungen\Administrator\Lokale Einstellungen\Anwendungsdaten\GDIPFONTCACHEV1.DAT
c:\dokumente und einstellungen\All Users\Startmenü\Programme\Autostart\Microsoft Office.lnk
C:\rsit
c:\rsit\info.txt
c:\rsit\log.txt
c:\windows\SxsCaPendDel
c:\windows\system32\.ini
c:\windows\system32\notifyf2.dll
c:\windows\system32\perfc007.dat
c:\windows\system32\perfh007.dat
c:\windows\tasks\Ad-Aware Update (Weekly).job

.
((((((((((((((((((((((( Dateien erstellt von 2009-08-12 bis 2009-09-12 ))))))))))))))))))))))))))))))
.

2009-09-10 19:00 . 2009-09-11 14:42 -------- d-----w- c:\programme\trend micro
2009-09-09 08:59 . 2009-06-21 21:45 153088 ------w- c:\windows\system32\dllcache\triedit.dll
2009-08-22 09:46 . 2009-08-22 09:46 -------- d-----w- c:\windows\system32\XPSViewer
2009-08-22 09:46 . 2009-08-22 09:46 -------- d-----w- c:\programme\MSBuild
2009-08-22 09:46 . 2009-08-22 09:46 -------- d-----w- c:\programme\Reference Assemblies
2009-08-22 09:45 . 2008-07-06 12:06 89088 ------w- c:\windows\system32\dllcache\filterpipelineprintproc.dll
2009-08-22 09:45 . 2008-07-06 12:06 117760 ------w- c:\windows\system32\prntvpt.dll
2009-08-22 09:45 . 2009-08-22 09:45 -------- d-----w- C:\9efaa42bd10eea49b711a1f11dfc98
2009-08-22 09:45 . 2008-07-06 12:06 575488 ------w- c:\windows\system32\xpsshhdr.dll
2009-08-22 09:45 . 2008-07-06 12:06 575488 ------w- c:\windows\system32\dllcache\xpsshhdr.dll
2009-08-22 09:45 . 2008-07-06 12:06 1676288 ------w- c:\windows\system32\xpssvcs.dll
2009-08-22 09:45 . 2008-07-06 12:06 1676288 ------w- c:\windows\system32\dllcache\xpssvcs.dll
2009-08-22 09:45 . 2008-07-06 10:50 597504 ------w- c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2009-08-14 20:12 . 2009-08-14 20:13 -------- d-----w- c:\dokumente und einstellungen\BastianR\Anwendungsdaten\Move Networks

.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-09-12 13:42 . 2005-02-08 03:22 -------- d---a-w- c:\programme\Skype
2009-09-12 13:17 . 2005-02-08 03:22 -------- d---a-w- c:\dokumente und einstellungen\BastianR\Anwendungsdaten\Skype
2009-09-12 13:16 . 2005-02-08 03:16 -------- d---a-w- c:\programme\Gemeinsame Dateien\Adobe
2009-09-12 13:14 . 2009-05-14 12:59 -------- d-----w- c:\programme\Lavasoft
2009-09-12 13:14 . 2009-05-14 12:59 -------- d-----w- c:\dokumente und einstellungen\All Users\Anwendungsdaten\Lavasoft
2009-09-12 12:07 . 2005-02-07 23:41 -------- d---a-w- c:\programme\Aukubik
2009-09-12 10:09 . 2008-03-16 16:20 -------- d-----w- c:\dokumente und einstellungen\BastianR\Anwendungsdaten\skypePM
2009-09-07 14:22 . 2006-09-18 01:41 -------- d---a-w- c:\programme\HVB eFIN 3.0
2009-08-09 18:53 . 2008-01-21 23:58 -------- d-----w- c:\dokumente und einstellungen\BastianR\Anwendungsdaten\Canon
2009-08-05 15:34 . 2009-05-14 14:33 55656 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2009-08-05 08:59 . 1980-01-01 08:00 206336 ------w- c:\windows\system32\mswebdvd.dll
2009-07-25 03:23 . 2008-12-07 08:57 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-07-18 15:48 . 2009-07-18 15:48 -------- d-----w- c:\programme\7-Zip
2009-07-17 19:01 . 1980-01-01 08:00 58880 ----a-w- c:\windows\system32\atl.dll
2009-07-13 21:43 . 2004-12-23 10:09 286208 ------w- c:\windows\system32\wmpdxm.dll
2009-06-29 15:55 . 1980-01-01 08:00 827392 ------w- c:\windows\system32\wininet.dll
2009-06-29 15:55 . 2004-12-23 10:09 78336 ------w- c:\windows\system32\ieencode.dll
2009-06-29 15:55 . 1980-01-01 08:00 17408 ------w- c:\windows\system32\corpol.dll
2009-06-16 14:36 . 1980-01-01 08:00 81920 ------w- c:\windows\system32\fontsub.dll
2009-06-16 14:36 . 1980-01-01 08:00 119808 ------w- c:\windows\system32\t2embed.dll
2009-06-15 10:43 . 1980-01-01 08:00 78848 ------w- c:\windows\system32\telnet.exe
2009-06-15 10:43 . 1980-01-01 08:00 82944 ------w- c:\windows\system32\tlntsess.exe
2005-03-05 02:48 . 2005-03-05 02:48 21 ------w- c:\programme\AVPersonalAVWIN.INI
.

(((((((((((((((((((((((((((((((((((((((((((( Look )))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
---- Directory of C:\9efaa42bd10eea49b711a1f11dfc98 ----

2009-08-22 09:45 . 2008-06-19 05:33 72 ------w- c:\9efaa42bd10eea49b711a1f11dfc98\amd64\msxpsinc.ppd
2009-08-22 09:45 . 2008-06-19 05:33 2204 ------w- c:\9efaa42bd10eea49b711a1f11dfc98\i386\msxpsdrv.inf
2009-08-22 09:45 . 2008-06-19 09:03 73 ------w- c:\9efaa42bd10eea49b711a1f11dfc98\i386\msxpsinc.gpd
2009-08-22 09:45 . 2008-06-19 05:33 72 ------w- c:\9efaa42bd10eea49b711a1f11dfc98\i386\msxpsinc.ppd
2009-08-22 09:45 . 2008-06-19 05:33 2204 ------w- c:\9efaa42bd10eea49b711a1f11dfc98\amd64\msxpsdrv.inf
2009-08-22 09:45 . 2008-07-06 12:06 10929 ------w- c:\9efaa42bd10eea49b711a1f11dfc98\amd64\msxpsdrv.cat
2009-08-22 09:45 . 2008-07-06 12:06 10929 ------w- c:\9efaa42bd10eea49b711a1f11dfc98\i386\msxpsdrv.cat
2009-08-22 09:45 . 2008-07-06 12:06 147456 ------w- c:\9efaa42bd10eea49b711a1f11dfc98\amd64\filterpipelineprintproc.dll
2009-08-22 09:45 . 2008-07-06 12:06 89088 ------w- c:\9efaa42bd10eea49b711a1f11dfc98\i386\filterpipelineprintproc.dll
2009-08-22 09:45 . 2008-07-06 12:06 765440 ------w- c:\9efaa42bd10eea49b711a1f11dfc98\i386\mxdwdrv.dll
2009-08-22 09:45 . 2008-07-06 12:06 1676288 ------w- c:\9efaa42bd10eea49b711a1f11dfc98\i386\xpssvcs.dll
2009-08-22 09:45 . 2008-07-06 12:06 748032 ------w- c:\9efaa42bd10eea49b711a1f11dfc98\amd64\mxdwdrv.dll
2008-07-06 15:36 . 2008-07-06 15:36 2936832 ------w- c:\9efaa42bd10eea49b711a1f11dfc98\amd64\xpssvcs.dll
2008-06-19 09:03 . 2008-06-19 09:03 73 ------w- c:\9efaa42bd10eea49b711a1f11dfc98\amd64\msxpsinc.gpd

---- Directory of c:\programme\HVB eFIN 3.0 ----

2008-12-19 23:25 . 2008-05-23 00:00 45056 ------w- c:\programme\HVB eFIN 3.0\BACKUP.$$$\vdesk.dll
2008-12-19 23:25 . 2008-05-23 00:00 4509696 ------w- c:\programme\HVB eFIN 3.0\BACKUP.$$$\hbkernel.dll
2008-12-19 23:25 . 2008-06-03 00:00 6293504 ------w- c:\programme\HVB eFIN 3.0\BACKUP.$$$\efix.exe
2008-12-19 23:25 . 2007-02-08 00:00 8772 ------w- c:\programme\HVB eFIN 3.0\BACKUP.$$$\countries.map
2008-12-19 23:25 . 2007-12-18 00:00 5342589 ------w- c:\programme\HVB eFIN 3.0\BACKUP.$$$\bic.map
2008-12-19 23:25 . 2007-02-08 00:00 7973 ------w- c:\programme\HVB eFIN 3.0\BACKUP.$$$\awvIdentifiers.map
2008-12-19 23:25 . 2007-12-18 00:00 184406 ------w- c:\programme\HVB eFIN 3.0\BACKUP.$$$\bankcodes.map
2008-12-19 23:25 . 2007-09-14 00:00 187212 ------w- c:\programme\HVB eFIN 3.0\BACKUP.$$$\LCA.caf
2008-12-19 23:25 . 2008-05-23 00:00 3854336 ------w- c:\programme\HVB eFIN 3.0\BACKUP.$$$\BdBHBCI.dll
2008-12-19 23:25 . 2008-12-19 23:25 16 ------w- c:\programme\HVB eFIN 3.0\BACKUP.$$$\efix2.bph
2008-04-10 22:27 . 2007-12-18 00:00 96918 ------w- c:\programme\HVB eFIN 3.0\img\SepaRemittance.bmp
2008-04-10 22:27 . 2007-12-18 00:00 266838 ------w- c:\programme\HVB eFIN 3.0\img\SepaDirectDebitTempl.bmp
2008-04-10 22:27 . 2007-12-18 00:00 266838 ------w- c:\programme\HVB eFIN 3.0\img\SepaDirectDebit.bmp
2008-04-10 22:27 . 2008-12-17 00:00 6046745 ------w- c:\programme\HVB eFIN 3.0\bic.map
2007-01-22 23:24 . 2006-11-16 00:00 61440 ------w- c:\programme\HVB eFIN 3.0\comreg.exe
2006-09-25 13:52 . 2009-09-02 17:28 864256 ----a-w- c:\programme\HVB eFIN 3.0\wpdata.mdb.bak
2006-09-18 01:56 . 2002-03-06 09:57 4 ------w- c:\programme\HVB eFIN 3.0\hbcidb.mfs.sav
2006-09-18 01:56 . 2006-09-18 01:56 52 ------w- c:\programme\HVB eFIN 3.0\data\categories.idx.sav
2006-09-18 01:56 . 2006-09-18 01:56 52 ------w- c:\programme\HVB eFIN 3.0\data\comments.idx.sav
2006-09-18 01:56 . 2006-09-18 01:56 52 ------w- c:\programme\HVB eFIN 3.0\data\postings.idx.sav
2006-09-18 01:56 . 2006-09-18 01:56 52 ------w- c:\programme\HVB eFIN 3.0\data\purpose.idx.sav
2006-09-18 01:56 . 2006-09-18 01:56 52 ------w- c:\programme\HVB eFIN 3.0\data\statements.idx.sav
2006-09-18 01:56 . 2006-09-18 01:56 733184 ------w- c:\programme\HVB eFIN 3.0\wpdata.mdb.sav
2006-09-18 01:55 . 2009-09-02 17:10 231 ----a-w- c:\programme\HVB eFIN 3.0\Update.ini
2006-09-18 01:54 . 2000-12-05 09:31 26614 ----a-w- c:\programme\HVB eFIN 3.0\_update.hlp
2006-09-18 01:54 . 2000-08-24 15:49 102400 ----a-w- c:\programme\HVB eFIN 3.0\_updutils.dll
2006-09-18 01:41 . 2005-11-28 00:00 699392 ------w- c:\programme\HVB eFIN 3.0\Update.exe
2006-09-18 01:41 . 2000-08-24 15:49 102400 ------w- c:\programme\HVB eFIN 3.0\updutils.dll
2006-09-18 01:41 . 2000-12-05 09:31 26614 ------w- c:\programme\HVB eFIN 3.0\UPDATE.HLP
2006-09-18 01:41 . 2000-03-28 10:24 283648 ------w- c:\programme\HVB eFIN 3.0\RunUpdate.exe
2006-09-18 01:41 . 2001-09-27 14:01 471040 ------w- c:\programme\HVB eFIN 3.0\ca.dll
2006-09-18 01:41 . 2003-06-04 15:07 821760 ------w- c:\programme\HVB eFIN 3.0\Migrate.exe
2006-09-18 01:41 . 2009-09-07 14:20 52 ----a-w- c:\programme\HVB eFIN 3.0\data\comments.idx
2006-09-18 01:41 . 2001-09-10 10:59 256 ------w- c:\programme\HVB eFIN 3.0\ZVLight Export\efix_adr.wvd
2006-09-18 01:41 . 2009-09-07 14:22 2337265 ----a-w- c:\programme\HVB eFIN 3.0\data\postings.idx
2006-09-18 01:41 . 2009-09-07 14:20 747236 ----a-w- c:\programme\HVB eFIN 3.0\data\purpose.idx
2006-09-18 01:41 . 2009-09-07 14:20 186586 ----a-w- c:\programme\HVB eFIN 3.0\data\statements.idx
2006-09-18 01:41 . 2009-09-07 14:20 52 ----a-w- c:\programme\HVB eFIN 3.0\data\unbooked.idx
2006-09-18 01:41 . 2009-09-07 14:20 25319 ----a-w- c:\programme\HVB eFIN 3.0\data\categories.idx
2006-09-18 01:41 . 2001-09-21 13:44 82 ------w- c:\programme\HVB eFIN 3.0\register.bat
2006-09-18 01:41 . 2001-09-21 13:44 134 ------w- c:\programme\HVB eFIN 3.0\register9x.bat
2006-09-18 01:41 . 2008-02-25 00:00 2633728 ------w- c:\programme\HVB eFIN 3.0\status.avi
2006-09-18 01:41 . 2007-12-18 00:00 2404 ------w- c:\programme\HVB eFIN 3.0\instid.cfg
2006-09-18 01:41 . 2003-05-21 07:45 88998 ------w- c:\programme\HVB eFIN 3.0\img\FPaymL.bmp
2006-09-18 01:41 . 2001-09-04 10:20 206376 ------w- c:\programme\HVB eFIN 3.0\img\EffectsOrder.bmp
2006-09-18 01:41 . 2001-09-17 13:59 34998 ------w- c:\programme\HVB eFIN 3.0\img\WDImage5.bmp
2006-09-18 01:41 . 2001-09-17 13:59 34998 ------w- c:\programme\HVB eFIN 3.0\img\WDImage4.bmp
2006-09-18 01:41 . 2002-09-05 10:21 32280 ------w- c:\programme\HVB eFIN 3.0\img\WDImage3.bmp
2006-09-18 01:41 . 2002-07-03 13:47 34996 ------w- c:\programme\HVB eFIN 3.0\img\WDImage1.bmp
2006-09-18 01:41 . 2001-09-17 13:59 32278 ------w- c:\programme\HVB eFIN 3.0\img\WDImage2.bmp
2006-09-18 01:41 . 2001-12-17 09:18 95894 ------w- c:\programme\HVB eFIN 3.0\img\StOrder.bmp
2006-09-18 01:41 . 2001-09-17 13:59 40678 ------w- c:\programme\HVB eFIN 3.0\img\update.bmp
2006-09-18 01:41 . 2001-12-17 09:18 72278 ------w- c:\programme\HVB eFIN 3.0\img\RemitTempl.bmp
2006-09-18 01:41 . 2001-09-20 13:38 23734 ------w- c:\programme\HVB eFIN 3.0\img\SOSuspen.bmp
2006-09-18 01:41 . 2008-02-25 00:00 211076 ------w- c:\programme\HVB eFIN 3.0\img\start.bmp
2006-09-18 01:41 . 2008-02-25 00:00 6320 ------w- c:\programme\HVB eFIN 3.0\img\InstLMedium.bmp
2006-09-18 01:41 . 2008-02-25 00:00 84020 ------w- c:\programme\HVB eFIN 3.0\img\InstLPrint.bmp
2006-09-18 01:41 . 2001-12-17 09:18 72278 ------w- c:\programme\HVB eFIN 3.0\img\Remit.bmp
2006-09-18 01:41 . 2003-01-31 08:38 51442 ------w- c:\programme\HVB eFIN 3.0\img\FPaymV.bmp
2006-09-18 01:41 . 2003-02-03 08:44 42230 ------w- c:\programme\HVB eFIN 3.0\img\FPaymW.bmp
2006-09-18 01:41 . 2008-02-25 00:00 131140 ------w- c:\programme\HVB eFIN 3.0\img\InstLBackg.bmp
2006-09-18 01:41 . 2003-02-05 12:10 170866 ------w- c:\programme\HVB eFIN 3.0\img\FPayment.bmp
2006-09-18 01:41 . 2001-12-17 09:18 72278 ------w- c:\programme\HVB eFIN 3.0\img\Debit.bmp
2006-09-18 01:41 . 2001-12-17 09:18 72278 ------w- c:\programme\HVB eFIN 3.0\img\DebitTempl.bmp
2006-09-18 01:41 . 2001-12-17 09:18 72278 ------w- c:\programme\HVB eFIN 3.0\img\DatedRem.bmp
2006-09-18 01:41 . 2007-12-17 00:00 381561 ------w- c:\programme\HVB eFIN 3.0\eFIX.chm
2006-09-18 01:41 . 2008-12-17 00:00 6294528 ------w- c:\programme\HVB eFIN 3.0\efix.exe
2006-09-18 01:41 . 2003-06-04 15:07 82944 ------w- c:\programme\HVB eFIN 3.0\qrpdflib.dll
2006-09-18 01:41 . 2001-09-10 10:59 312320 ------w- c:\programme\HVB eFIN 3.0\gzipio.dll
2006-09-18 01:41 . 2007-05-30 00:00 651264 ------w- c:\programme\HVB eFIN 3.0\SSLBase.dll
2006-09-18 01:41 . 2008-12-16 00:00 45056 ------w- c:\programme\HVB eFIN 3.0\vdesk.dll
2006-09-18 01:41 . 2005-01-11 09:00 94208 ------w- c:\programme\HVB eFIN 3.0\zlib.dll
2006-09-18 01:41 . 2008-12-17 00:00 186666 ------w- c:\programme\HVB eFIN 3.0\bankcodes.map
2006-09-18 01:41 . 2008-12-17 00:00 7479 ------w- c:\programme\HVB eFIN 3.0\awvIdentifiers.map
2006-09-18 01:41 . 2008-12-17 00:00 8776 ------w- c:\programme\HVB eFIN 3.0\countries.map
2006-09-18 01:41 . 2008-04-09 00:00 326873 ------w- c:\programme\HVB eFIN 3.0\hbcisd.mfs
2006-09-18 01:41 . 2009-09-01 19:30 7260 ----a-w- c:\programme\HVB eFIN 3.0\hbcidb.mfs
2006-09-18 01:41 . 2006-09-18 01:56 188 ------w- c:\programme\HVB eFIN 3.0\hbcidb.mfs$
2006-09-18 01:41 . 2009-09-07 14:20 864256 ----a-w- c:\programme\HVB eFIN 3.0\wpdata.mdb
2006-09-18 01:41 . 2008-12-09 00:00 249676 ------w- c:\programme\HVB eFIN 3.0\LCA.caf
2006-09-18 01:41 . 2008-12-16 00:00 4505600 ------w- c:\programme\HVB eFIN 3.0\hbkernel.dll
2006-09-18 01:41 . 2002-01-07 08:01 139264 ------w- c:\programme\HVB eFIN 3.0\Configuration.dll
2006-09-18 01:41 . 2008-12-17 00:00 3854336 ------w- c:\programme\HVB eFIN 3.0\BdBHBCI.dll
2006-09-18 01:41 . 2007-01-23 00:00 2014 ------w- c:\programme\HVB eFIN 3.0\chipcards.ini


(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TPKMAPMN"="c:\programme\ThinkPad\Utilities\TpKmapMn.exe" [2005-10-28 45056]
"H/PC Connection Agent"="c:\programme\Microsoft ActiveSync\wcescomm.exe" [2006-06-21 1211176]
"XSC SIP Client"="c:\programme\X-Lite\X-Lite.exe" [2004-06-01 3305472]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"FRYMXINS"="c:\programme\ATI Technologies\Fire GL 3D Studio Max\atiimxgl" [X]
"SynTPLpr"="c:\programme\Synaptics\SynTP\SynTPLpr.exe" [2006-02-14 110592]
"SynTPEnh"="c:\programme\Synaptics\SynTP\SynTPEnh.exe" [2006-02-14 512000]
"TPKMAPHELPER"="c:\programme\ThinkPad\Utilities\TpKmapAp.exe" [2005-10-28 864256]
"TPHOTKEY"="c:\progra~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe" [2006-10-02 94208]
"ATIPTA"="c:\programme\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2007-02-06 344064]
"UpdateManager"="c:\programme\Gemeinsame Dateien\Sonic\Update Manager\sgtray.exe" [2003-08-19 110592]
"dla"="c:\windows\system32\dla\tfswctrl.exe" [2004-09-02 127035]
"BMMLREF"="c:\programme\ThinkPad\Utilities\BMMLREF.EXE" [2004-07-29 20480]
"BMMMONWND"="c:\progra~1\ThinkPad\UTILIT~1\BatInfEx.dll" [2004-07-29 398848]
"SoundMAXPnP"="c:\programme\Analog Devices\SoundMAX\SMax4PNP.exe" [2004-10-14 1388544]
"PRONoMgrWired"="c:\programme\Intel\PROSetWired\NCS\PROSet\PRONoMgr.exe" [2003-08-06 86016]
"TPKBDLED"="c:\windows\system32\TpScrLk.exe" [2002-10-08 40960]
"cssauth"="c:\programme\IBM ThinkVantage\Client Security Solution\cssauth.exe" [2006-08-21 1997568]
"FreePDF Assistant"="c:\programme\FreePDF_XP\fpassist.exe" [2005-05-27 310272]
"Omnipage"="c:\programme\ScanSoft\OmniPageSE\opware32.exe" [2002-06-03 49152]
"BMMGAG"="c:\progra~1\ThinkPad\UTILIT~1\pwrmonit.dll" [2004-07-29 110592]
"TVT Scheduler Proxy"="c:\programme\Gemeinsame Dateien\Lenovo\Scheduler\scheduler_proxy.exe" [2008-03-04 487424]
"avgnt"="c:\programme\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"S3TRAY2"="S3Tray2.exe" - c:\windows\system32\S3Tray2.exe [2001-10-12 69632]
"TpShocks"="TpShocks.exe" - c:\windows\system32\TpShocks.exe [2008-06-06 181536]
"TP4EX"="tp4ex.exe" - c:\windows\system32\TP4EX.exe [2005-10-16 65536]
"BluetoothAuthenticationAgent"="bthprops.cpl" - c:\windows\system32\bthprops.cpl [2008-04-14 110592]
"TrackPointSrv"="tp4serv.exe" - c:\windows\system32\tp4serv.exe [2003-11-13 94208]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\dokumente und einstellungen\All Users\Startmen�\Programme\Autostart\
BTTray.lnk - c:\programme\IBM\Bluetooth Software\BTTray.exe [2004-1-20 507965]
Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2006-1-12 24576]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tphotkey]
2005-11-30 18:16 24576 ------w- c:\windows\system32\tphklock.dll

[HKLM\~\startupfolder\C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^Adobe Acrobat Speed Launcher.lnk]
path=c:\dokumente und einstellungen\All Users\Startmenü\Programme\Autostart\Adobe Acrobat Speed Launcher.lnk
backup=c:\windows\pss\Adobe Acrobat Speed Launcher.lnkCommon Startup

[HKLM\~\startupfolder\C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^Adobe Gamma Loader.lnk]
path=c:\dokumente und einstellungen\All Users\Startmenü\Programme\Autostart\Adobe Gamma Loader.lnk
backup=c:\windows\pss\Adobe Gamma Loader.lnkCommon Startup

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Programme\\Macromedia\\Dreamweaver MX\\Dreamweaver.exe"=
"c:\\Programme\\X-Lite\\X-Lite.exe"=
"c:\programme\Microsoft ActiveSync\rapimgr.exe"= c:\programme\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"c:\programme\Microsoft ActiveSync\wcescomm.exe"= c:\programme\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"c:\programme\Microsoft ActiveSync\WCESMgr.exe"= c:\programme\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Programme\\SFR\\1-2-Remote\\12RemoteServer.exe"=
"c:\\Programme\\1&1\\1&1 SoftPhone\\IPPHONEUI.EXE"=
"c:\\Programme\\Ateksoft\\WebCamera Plus\\camviewer.exe"=
"c:\\Programme\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Programme\\Windows Live\\Messenger\\msnmsgr.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service

R0 ANCSQ;ANCSQ;c:\windows\system32\drivers\ANCSQ.sys [02.08.2005 18:40 6912]
R0 Shockprf;Shockprf;c:\windows\system32\drivers\ApsX86.sys [14.05.2008 16:21 114728]
R0 TPDIGIMN;TPDIGIMN;c:\windows\system32\drivers\ApsHM86.sys [14.05.2008 16:21 19496]
R1 TPPWR;TPPWR;c:\windows\system32\drivers\TPPWR.SYS [23.12.2004 12:37 16384]
R2 AntiVirSchedulerService;Avira AntiVir Planer;c:\programme\Avira\AntiVir Desktop\sched.exe [14.05.2009 16:33 108289]
R2 ibmfilter;ibmfilter;c:\windows\system32\drivers\ibmfilter.sys [22.12.2005 00:14 12544]
R2 smi2;smi2;c:\programme\SMI2\smi2.sys [02.08.2005 18:47 3968]
S2 CTNT4SCR;CTNT4SCR;c:\windows\system32\drivers\ctnt4scr.sys --> c:\windows\system32\drivers\ctnt4scr.sys [?]
S3 LucentSoftModem;Lucent Technologies Soft Modem;c:\windows\system32\drivers\LTSM.sys [25.02.2003 01:36 802683]
S3 Tp4Track;IBM PS/2 TrackPoint Driver;c:\windows\system32\drivers\tp4track.sys [13.11.2003 13:12 13904]

--- Andere Dienste/Treiber im Speicher ---

*NewlyCreated* - WAM
*Deregistered* - WAM
.
Inhalt des "geplante Tasks" Ordners

2009-01-07 c:\windows\Tasks\BMMTask.job
- c:\progra~1\ThinkPad\UTILIT~1\BMMTASK.EXE [2004-12-23 09:37]
.
.
------- Zusätzlicher Suchlauf -------
.
IE: In 1&&1 SoftPhone wählen - c:\dokumente und einstellungen\All Users\Anwendungsdaten\1&1\1&1 SoftPhone\ContextMenuHandler.html
IE: Nach Microsoft &Excel exportieren - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
IE: Senden an &Bluetooth - c:\programme\IBM\Bluetooth Software\btsendto_ie_ctx.htm
FF - ProfilePath - c:\dokumente und einstellungen\BastianR\Anwendungsdaten\Mozilla\Firefox\Profiles\u8ntnltt.default\
FF - prefs.js: browser.search.selectedEngine - Google Deutschland
FF - prefs.js: browser.startup.homepage - about:blank
FF - component: c:\dokumente und einstellungen\BastianR\Anwendungsdaten\Mozilla\Firefox\Profiles\u8ntnltt.default\extensions\{a7c6cf7f-112c-4500-a7ea-39801a327e5f}\platform\WINNT_x86-msvc\components\ipc.dll
FF - plugin: c:\dokumente und einstellungen\BastianR\Anwendungsdaten\Mozilla\Firefox\Profiles\u8ntnltt.default\extensions\moveplayer@movenetworks.com\platform\WINNT_x86-msvc\plugins\npmnqmp071303000004.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -

Notify-tpfnf2 - notifyf2.dll



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-09-12 16:11
Windows 5.1.2600 Service Pack 3 NTFS

Scanne versteckte Prozesse...

Scanne versteckte Autostarteinträge...

Scanne versteckte Dateien...


**************************************************************************
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------

- - - - - - - > 'winlogon.exe'(972)
c:\windows\system32\Ati2evxx.dll
c:\windows\system32\tphklock.dll

- - - - - - - > 'explorer.exe'(2624)
c:\programme\ScanSoft\OmniPageSE\ophook32.dll
c:\progra~1\ThinkPad\UTILIT~1\pwrmonit.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\btncopy.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\windows\system32\ibmpmsvc.exe
c:\windows\system32\ati2evxx.exe
c:\programme\Intel\Wireless\Bin\EvtEng.exe
c:\programme\Intel\Wireless\Bin\S24EvMon.exe
c:\windows\system32\ati2evxx.exe
c:\programme\ThinkPad\PkgMgr\HOTKEY\TPONSCR.exe
c:\programme\ThinkPad\PkgMgr\HOTKEY_1\TpScrex.exe
c:\windows\system32\rundll32.exe
c:\windows\system32\rundll32.exe
c:\windows\system32\rundll32.exe
c:\progra~1\MICROS~4\rapimgr.exe
c:\programme\IBM\Bluetooth Software\bin\btwdins.exe
c:\programme\Gemeinsame Dateien\Microsoft Shared\VS7Debug\mdm.exe
c:\programme\Intel\Wireless\Bin\RegSrvc.exe
c:\programme\Analog Devices\SoundMAX\SMAgent.exe
c:\programme\Gemeinsame Dateien\Lenovo\tvt_reg_monitor_svc.exe
c:\windows\system32\TPHDEXLG.exe
c:\windows\system32\TpKmpSvc.exe
c:\programme\IBM ThinkVantage\Client Security Solution\ibmtcsd.exe
c:\programme\IBM ThinkVantage\Rescue and Recovery\rrservice.exe
c:\programme\Gemeinsame Dateien\Lenovo\Scheduler\tvtsched.exe
c:\programme\Lenovo\System Update\SUService.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2009-09-12 16:17 - PC wurde neu gestartet
ComboFix-quarantined-files.txt 2009-09-12 14:16
ComboFix2.txt 2009-09-11 23:28
ComboFix3.txt 2009-09-10 20:37

Vor Suchlauf: 18 Verzeichnis(se), 23.155.613.696 Bytes frei
Nach Suchlauf: 19 Verzeichnis(se), 23.153.037.312 Bytes frei

325 --- E O F --- 2009-09-10 10:21