TR/Crypt.XPACK.Gen klaut Passwörter in C:\Windows\Temp\_avast04_

ComboFix 10-09-02.04 - Georg 03.09.2010  20:23:50.1.2 - x86 NETWORK
Microsoft Windows 7 Home Premium   6.1.7600.0.1252.49.1031.18.3037.2646 [GMT 2:00]
ausgeführt von:: c:\users\Georg\Desktop\ComboFix.exe
 * Neuer Wiederherstellungspunkt wurde erstellt
.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Install.exe
c:\programdata\FullRemove.exe
c:\windows\SEC
c:\windows\SEC\172100logo.bmp
c:\windows\SEC\banner.png
c:\windows\SEC\Computer.png
c:\windows\SEC\Media _S_ Logo.png
c:\windows\SEC\Samsung.png
c:\windows\SEC\Samsung2.png
c:\windows\SEC\SamsungLogo.png
c:\windows\SEC\Thumbs.db
c:\windows\SEC\Wallpapers\Thumbs.db
c:\windows\SEC\Wallpapers\wallpaper.jpg
c:\windows\SEC\Wallpapers\wallpaper1.jpg
c:\windows\SEC\Wallpapers\Wallpaper2.jpg

.
(((((((((((((((((((((((   Dateien erstellt von 2010-08-03 bis 2010-09-03  ))))))))))))))))))))))))))))))
.

2010-09-03 18:22 . 2010-09-03 18:23	--------	d-----w-	C:\32788R22FWJFW
2010-09-03 18:11 . 2010-09-03 18:11	--------	d-----w-	C:\_OTL
2010-09-03 16:56 . 2010-09-03 16:56	--------	d-----w-	c:\users\Georg\AppData\Roaming\Malwarebytes
2010-09-03 16:55 . 2010-04-29 13:39	38224	----a-w-	c:\windows\system32\drivers\mbamswissarmy.sys
2010-09-03 16:55 . 2010-09-03 16:55	--------	d-----w-	c:\programdata\Malwarebytes
2010-09-03 16:55 . 2010-04-29 13:39	20952	----a-w-	c:\windows\system32\drivers\mbam.sys
2010-09-03 16:55 . 2010-09-03 16:55	--------	d-----w-	c:\program files\7-Zip
2010-09-03 13:01 . 2010-09-03 13:01	29992	----a-w-	c:\windows\system32\drivers\GRD.sys
2010-09-03 12:35 . 2010-09-03 12:35	47560	----a-w-	c:\windows\system32\drivers\PktIcpt.sys
2010-09-03 12:34 . 2010-09-03 12:34	62024	----a-w-	c:\windows\system32\drivers\MiniIcpt.sys
2010-09-03 12:34 . 2010-09-03 12:34	33480	----a-w-	c:\windows\system32\drivers\GDBehave.sys
2010-09-03 12:34 . 2010-09-03 12:34	40904	----a-w-	c:\windows\system32\drivers\gdwfpcd32.sys
2010-09-03 12:34 . 2010-09-03 18:04	--------	d-----w-	c:\programdata\G DATA
2010-09-03 12:34 . 2010-09-03 18:03	--------	d-----w-	c:\program files\G Data
2010-09-03 12:34 . 2010-09-03 18:03	--------	d-----w-	c:\program files\Common Files\G Data
2010-09-03 12:30 . 2010-09-03 12:30	--------	d-----w-	c:\users\Georg\AppData\Local\Downloaded Installations
2010-09-03 12:25 . 2010-09-03 12:25	--------	d-----w-	c:\users\Georg\AppData\Roaming\Avira
2010-09-03 12:23 . 2010-03-01 07:05	124784	----a-w-	c:\windows\system32\drivers\avipbb.sys
2010-09-03 12:23 . 2010-02-16 11:24	60936	----a-w-	c:\windows\system32\drivers\avgntflt.sys
2010-09-03 12:23 . 2009-05-11 09:49	51992	----a-w-	c:\windows\system32\drivers\avgntdd.sys
2010-09-03 12:23 . 2009-05-11 09:49	17016	----a-w-	c:\windows\system32\drivers\avgntmgr.sys
2010-09-03 12:23 . 2010-09-03 12:23	--------	d-----w-	c:\programdata\Avira
2010-09-03 12:23 . 2010-09-03 12:23	--------	d-----w-	c:\program files\Avira
2010-09-03 12:13 . 2010-09-03 12:13	107888	----a-w-	c:\windows\system32\CmdLineExt.dll
2010-09-03 12:09 . 2010-09-03 12:09	--------	d-----w-	c:\windows\system32\xlive
2010-09-03 12:09 . 2010-09-03 12:09	--------	d-----w-	c:\program files\Microsoft Games for Windows - LIVE
2010-09-02 17:52 . 2010-09-02 17:52	--------	d-----w-	c:\users\Georg\AppData\Roaming\Activision
2010-09-02 17:52 . 2010-09-02 17:52	--------	d-----w-	c:\programdata\Activision
2010-09-02 17:37 . 2010-09-02 17:37	--------	d-----w-	c:\users\Georg\AppData\Local\Rockstar Games
2010-09-02 14:04 . 2010-09-02 14:04	--------	d-----w-	c:\users\Georg\AppData\Local\World in Conflict
2010-09-01 19:16 . 2010-09-03 12:32	--------	d-----w-	c:\users\Georg\AppData\Local\Google
2010-09-01 19:04 . 2010-09-01 19:04	--------	d--h--r-	c:\users\Georg\AppData\Roaming\SecuROM

.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-09-03 18:16 . 2009-09-22 22:10	726520	----a-w-	c:\windows\system32\perfh010.dat
2010-09-03 18:16 . 2009-09-22 22:10	141330	----a-w-	c:\windows\system32\perfc010.dat
2010-09-03 18:16 . 2009-09-22 22:05	700598	----a-w-	c:\windows\system32\perfh007.dat
2010-09-03 18:16 . 2009-09-22 22:05	149714	----a-w-	c:\windows\system32\perfc007.dat
2010-09-03 18:16 . 2009-09-22 22:00	731464	----a-w-	c:\windows\system32\perfh00C.dat
2010-09-03 18:16 . 2009-09-22 22:00	144394	----a-w-	c:\windows\system32\perfc00C.dat
2010-09-03 17:59 . 2009-09-22 05:29	--------	d-----w-	c:\programdata\McAfee
2010-09-03 12:36 . 2009-09-22 05:44	--------	d-----w-	c:\program files\Google
2010-09-02 18:32 . 2009-09-22 05:19	--------	d--h--w-	c:\program files\InstallShield Installation Information
2010-09-01 22:57 . 2009-09-22 05:27	--------	d-----w-	c:\programdata\WinClon
2009-06-10 21:26 . 2009-07-14 02:04	9633792	--sha-r-	c:\windows\Fonts\StaticCache.dat
2009-07-14 01:14 . 2009-07-13 23:42	396800	--sha-w-	c:\windows\winsxs\x86_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7600.16385_none_f12e83abb108c86c\WinMail.exe
.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{83FF80F4-8C74-4b80-B5BA-C8DDD434E5C4}]
2009-09-22 05:44	433648	----a-w-	c:\programdata\Partner\Partner.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-09-22 39408]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-08-31 13797992]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2009-08-19 7711264]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2009-07-14 1541416]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"UCam_Menu"="c:\program files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" [2009-02-25 218408]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2010-03-02 282792]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"GrpConv"="grpconv -o" [X]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv

R1 SABI;SAMSUNG Kernel Driver For Windows 7;c:\windows\system32\Drivers\SABI.sys [2009-05-28 10752]
R2 AntiVirSchedulerService;Avira AntiVir Planer;c:\program files\Avira\AntiVir Desktop\sched.exe [2010-02-24 135336]
R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-09-03 135664]
R2 OberonGameConsoleService;Oberon Media Game Console service;c:\program files\Samsung Casual Games\GameConsole\OberonGameConsoleService.exe [2009-08-13 44312]
R3 Partner Service;Partner Service;c:\programdata\Partner\Partner.exe [2009-09-22 332272]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-13 48128]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt86win7.sys [2009-07-31 187392]

.
Inhalt des "geplante Tasks" Ordners

2010-09-03 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-09-03 12:36]

2010-09-03 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-09-03 12:36]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.google.com/ig/redirectdomain?brand=smsn&bmod=smsn
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -

Toolbar-Locked - (no file)
HKLM-RunOnce-<NO NAME> - (no file)
SafeBoot-mcmscsvc
SafeBoot-MCODS


.
--------------------- Gesperrte Registrierungsschluessel ---------------------

[HKEY_USERS\S-1-5-21-771618654-3341757510-301361698-1000\Software\SecuROM\License information*]
"datasecu"=hex:a0,ca,36,d8,61,b4,a2,5d,76,bc,f5,6f,db,2c,69,53,be,53,ae,17,63,
   06,1a,b7,f3,c8,4f,55,83,01,34,2d,41,83,bf,75,54,62,04,0f,bf,f1,1c,a0,df,44,\
"rkeysecu"=hex:6a,cb,88,e8,72,80,44,60,46,95,92,0f,ad,47,09,3f

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2010-09-03  20:30:52
ComboFix-quarantined-files.txt  2010-09-03 18:30

Vor Suchlauf: 8 Verzeichnis(se), 223.749.730.304 Bytes frei
Nach Suchlauf: 13 Verzeichnis(se), 223.417.974.784 Bytes frei

- - End Of File - - 73428C0905E8B405196B17C6864B2DE8