ComboFix Log-Datei

ComboFix 10-06-01.01 - T.H.29 02.06.2010   9:01.1.2 - x86 MINIMAL
Microsoft® Windows Vista™ Home Premium   6.0.6002.2.1252.49.1031.18.2046.1600 [GMT 2:00]
ausgeführt von:: c:\users\T.H.29\Desktop\cofi.exe.exe
.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
---- Vorheriger Suchlauf -------
.
C:\cleanup.exe
c:\windows\system\BisonCam.dll
C:\zip.exe

.
(((((((((((((((((((((((   Dateien erstellt von 2010-05-02 bis 2010-06-02  ))))))))))))))))))))))))))))))
.

2010-06-02 07:06 . 2010-06-02 07:07	--------	d-----w-	c:\users\T.H.29\AppData\Local\temp
2010-06-02 07:06 . 2010-06-02 07:06	--------	d-----w-	c:\users\Default\AppData\Local\temp
2010-06-02 06:49 . 2010-06-02 06:57	--------	d-----w-	C:\cofi.exe
2010-06-02 06:26 . 2010-06-02 06:26	574	----a-w-	C:\cleanup.bat
2010-06-02 06:04 . 2010-06-02 06:59	--------	d-----w-	c:\windows\system32\wbem\repository
2010-06-01 16:58 . 2010-06-01 16:58	--------	d-----w-	c:\users\T.H.29\AppData\Roaming\Ladia Group
2010-06-01 16:13 . 2010-06-01 16:14	--------	d-----w-	c:\program files\Ancient Rome
2010-06-01 16:08 . 2010-06-01 16:09	--------	d-----w-	c:\program files\Build-a-Lot 4 - Power Source
2010-06-01 15:57 . 2010-06-01 15:57	--------	d-----w-	c:\users\T.H.29\AppData\Roaming\Happyville__
2010-06-01 15:57 . 2010-06-01 16:57	--------	d-----w-	c:\program files\Happyville - Die Herausforderung Utopia
2010-06-01 15:51 . 2010-06-01 15:52	--------	d-----w-	C:\BigFishGamesCache
2010-05-26 10:24 . 2010-04-23 14:13	2048	----a-w-	c:\windows\system32\tzres.dll
2010-05-12 15:32 . 2010-01-29 15:40	738816	----a-w-	c:\windows\system32\inetcomm.dll

.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-06-01 16:57 . 2009-11-12 17:39	31966	----a-w-	c:\programdata\nvModes.dat
2010-05-13 17:57 . 2006-11-02 11:18	--------	d-----w-	c:\program files\Windows Mail
2010-05-12 09:21 . 2009-11-12 18:18	221568	------w-	c:\windows\system32\MpSigStub.exe
2010-05-10 21:45 . 2010-03-05 19:28	--------	d-----w-	c:\users\T.H.29\AppData\Roaming\ICQ
2010-05-06 20:56 . 2006-11-02 15:33	633836	----a-w-	c:\windows\system32\perfh007.dat
2010-05-06 20:56 . 2006-11-02 15:33	127582	----a-w-	c:\windows\system32\perfc007.dat
2010-04-25 13:44 . 2010-04-21 20:03	--------	d-----w-	c:\users\T.H.29\AppData\Roaming\SecondLife
2010-03-05 14:01 . 2010-04-14 11:03	420352	----a-w-	c:\windows\system32\vbscript.dll
2009-09-25 16:41 . 2009-09-25 16:41	1044480	----a-w-	c:\program files\mozilla firefox\plugins\libdivx.dll
2009-09-25 16:41 . 2009-09-25 16:41	200704	----a-w-	c:\program files\mozilla firefox\plugins\ssldivx.dll
.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-10 1233920]
"ccleaner"="c:\program files\CCleaner\ccleaner.exe" [2010-02-24 1771320]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-18 1008184]
"RtHDVCpl"="RtHDVCpl.exe" [2007-04-10 4431872]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-08-19 13793824]
"MSSE"="c:\program files\Microsoft Security Essentials\msseces.exe" [2010-02-21 1093208]
"DataCardMonitor"="c:\program files\T-Mobile\web'n'walk Manager\DataCardMonitor.exe" [2009-11-13 253952]
"FIC HotKey"="c:\program files\Hotkey Utility\tray.exe" [2007-07-13 561152]
"PowerManager"="c:\program files\Power Manager\PM.exe" [2007-05-16 29696]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"GrpConv"="grpconv -o" [X]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^FRITZ!DSL Startcenter.lnk]
backup=c:\windows\pss\FRITZ!DSL Startcenter.lnk.CommonStartup
backupExtension=.CommonStartup
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AppleSyncNotifier
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\uTorrent

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Apoint]
2007-05-25 10:17	159744	----a-w-	c:\program files\Apoint2K\Apoint.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BisonAPP]
2007-05-17 21:22	49152	----a-w-	c:\windows\BisonCam\BisonAPP.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FIC HotKey]
2007-07-13 13:38	561152	----a-w-	c:\program files\Hotkey Utility\tray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PowerManager]
2007-05-16 10:42	29696	----a-w-	c:\program files\Power Manager\PM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Silent Mode]
2007-06-27 08:56	253952	----a-w-	c:\program files\Light Sensor Utility\Sensor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skytel]
2007-04-04 15:22	1822720	----a-w-	c:\windows\SkyTel.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"VistaSp2"=hex(b):e7,6a,d8,53,d2,63,ca,01

R0 izjiyz;izjiyz;c:\windows\system32\drivers\sezrz.sys [x]
R2 AntiVirSchedulerService;Avira AntiVir Planer;c:\program files\Avira\AntiVir Desktop\sched.exe [2009-05-13 108289]
R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-02-23 135664]
R2 regi;regi;c:\windows\system32\drivers\regi.sys [2007-04-17 11032]
R2 TuneUp.UtilitiesSvc;TuneUp Utilities Service;c:\program files\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe [2009-10-30 1021256]
R3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\DRIVERS\MpNWMon.sys [2009-12-02 42368]
R3 Netaapl;Apple Mobile Device Ethernet Service;c:\windows\system32\DRIVERS\netaapl.sys [x]
R3 netr73;TL-WN321G USB Wireless Adapter;c:\windows\system32\DRIVERS\netr73.sys [x]
R3 SIS163u;SiS163 USB Wireless LAN Adapter Driver;c:\windows\system32\DRIVERS\sis163u.sys [2007-05-07 218624]
R3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;c:\program files\TuneUp Utilities 2010\TuneUpUtilitiesDriver32.sys [2009-10-14 10064]


[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation	REG_MULTI_SZ   	FontCache

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost  - NetSvcs
UxTuneUp
.
Inhalt des "geplante Tasks" Ordners

2010-05-30 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-23 23:55]

2010-05-30 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-23 23:55]

2010-05-30 c:\windows\Tasks\User_Feed_Synchronization-{56DBA741-5485-41AD-97D8-27F2FFEAF24B}.job
- c:\windows\system32\msfeedssync.exe [2010-03-31 04:54]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://start.icq.com/
LSP: bmnet.dll
FF - ProfilePath - c:\users\T.H.29\AppData\Roaming\Mozilla\Firefox\Profiles\rznj9nvm.default\
FF - prefs.js: browser.startup.homepage - hxxp://de.start3.mozilla.com/firefox?client=firefox-a&rls=org.mozilla:de:official
FF - prefs.js: keyword.URL - hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=2.0.0.1&q=
FF - component: c:\users\T.H.29\AppData\Roaming\Mozilla\Firefox\Profiles\rznj9nvm.default\extensions\fb_add_on@avm.de\components\FB_AddOn.dll
FF - plugin: c:\program files\Google\Update\1.2.183.23\npGoogleOneClick8.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX Richtlinien ----
FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: nglayout.initialpaint.delay - 600
FF - user.js: content.notify.interval - 600000
FF - user.js: content.max.tokenizing.time - 1800000
FF - user.js: content.switch.threshold - 600000
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation",  false);
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -

WebBrowser-{604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - (no file)
WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
HKLM-RunOnce-Cleanup - C:\cleanup.exe
HKLM-RunOnce-<NO NAME> - (no file)



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2010-06-02 09:07
Windows 6.0.6002 Service Pack 2 NTFS

Scanne versteckte Prozesse... 

Scanne versteckte Autostarteinträge... 

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
  DataCardMonitor = c:\program files\T-Mobile\web'n'walk Manager\DataCardMonitor.exe?VA=c:\program files\QuickTime\Q???ZS???h7??????ip?SystemDrive=C:?SystemRoot=c:\windows?temp=c:\Users\THB5BE~1.29\AppData\Local\Temp?TMP=c:\users\THB5BE~1.29\AppData\Local\Temp?USERDOMAIN=TH29 

Scanne versteckte Dateien... 

Scan erfolgreich abgeschlossen
versteckte Dateien: 0

**************************************************************************
.
--------------------- Gesperrte Registrierungsschluessel ---------------------

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------

- - - - - - - > 'lsass.exe'(444)
c:\windows\system32\bmnet.dll
.
Zeit der Fertigstellung: 2010-06-02  09:08:32
ComboFix-quarantined-files.txt  2010-06-02 07:08

Vor Suchlauf: 12 Verzeichnis(se), 32.608.169.984 Bytes frei
Nach Suchlauf: 13 Verzeichnis(se), 32.333.811.712 Bytes frei

- - End Of File - - 2A7D4405F176493CD33DF88874F7BF23