[code]
Combofix Logfile:
Code:
Alles auswählen Aufklappen ATTFilter
ComboFix 10-09-14.05 - vvjj 15.09.2010 21:40:23.10.1 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.49.1033.18.953.595 [GMT 2:00]
ausgeführt von:: c:\documents and settings\vvjj\My Documents\cofi.exe
Benutzte Befehlsschalter :: c:\documents and settings\vvjj\My Documents\CFScript.txt
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
FILE ::
"c:\windows\bnetunin.exe"
"c:\windows\diabunin.exe"
"c:\windows\dlinfo_0.drv"
"c:\windows\dlinfo_1.drv"
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\bnetunin.exe
c:\windows\diabunin.exe
c:\windows\dlinfo_0.drv
c:\windows\dlinfo_1.drv
c:\windows\system32\winlogon.exe . . . ist infiziert!!
c:\windows\explorer.exe . . . ist infiziert!!
.
((((((((((((((((((((((( Dateien erstellt von 2010-08-15 bis 2010-09-15 ))))))))))))))))))))))))))))))
.
2010-09-15 17:56 . 2010-09-15 18:03 -------- d-----w- C:\cofi
2010-09-15 17:41 . 2010-09-15 17:41 -------- d-----w- C:\_OTL
2010-09-13 20:52 . 2010-09-13 20:52 -------- d-----w- c:\documents and settings\vvjj\Application Data\Malwarebytes
2010-09-13 20:52 . 2010-04-29 10:19 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-09-13 20:52 . 2010-09-13 20:52 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-09-13 20:52 . 2010-04-29 10:19 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-09-13 20:45 . 2010-09-13 20:52 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-09-05 19:19 . 2010-09-05 19:19 -------- d-----w- c:\program files\Flip Video
2010-09-05 19:04 . 2010-09-05 19:04 -------- d-----w- c:\documents and settings\All Users\Application Data\Flip Video
2010-09-03 18:00 . 2010-09-04 08:21 -------- d-----w- c:\documents and settings\vvjj\Application Data\vlc
2010-09-03 17:59 . 2010-09-03 17:59 -------- d-----w- c:\program files\VideoLAN
2010-08-30 18:47 . 2010-09-13 20:35 -------- d-----w- c:\program files\eMule
2010-08-29 07:10 . 2010-08-29 07:10 -------- d-----w- c:\documents and settings\All Users\Application Data\McAfee
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-09-15 17:54 . 2009-05-31 11:07 -------- d-----w- c:\documents and settings\vvjj\Application Data\Media Player Classic
2010-09-15 17:52 . 2009-05-19 17:05 -------- d-----w- c:\program files\CCleaner
2010-09-06 16:10 . 2009-06-11 08:59 -------- d-----w- c:\documents and settings\vvjj\Application Data\uTorrent
2010-09-03 17:48 . 2009-08-04 20:43 -------- d-----w- c:\documents and settings\vvjj\Application Data\DivX
2010-09-02 11:31 . 2009-12-01 21:52 -------- d-----w- c:\documents and settings\All Users\Application Data\Storm
2010-08-27 22:55 . 2009-05-25 16:57 -------- d-----w- c:\documents and settings\vvjj\Application Data\SogouPY
2010-07-29 21:48 . 2010-07-29 21:48 -------- d-----w- c:\program files\QMI
2010-07-29 21:48 . 2009-05-20 22:36 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-07-25 10:12 . 2009-07-25 08:48 -------- d-----w- c:\program files\DOSBox-0.73
2010-07-18 08:15 . 2010-06-30 16:49 -------- d-----w- c:\documents and settings\vvjj\Application Data\SGPPLog
2010-07-08 18:48 . 2010-07-08 18:48 98304 ----a-w- c:\windows\system32\CmdLineExt.dll
2010-06-30 12:31 . 2008-04-14 12:00 149504 ----a-w- c:\windows\system32\schannel.dll
2010-06-24 12:10 . 2008-04-14 12:00 81920 ----a-w- c:\windows\system32\ieencode.dll
2010-06-24 12:10 . 2008-04-14 12:00 667136 ----a-w- c:\windows\system32\wininet.dll
2010-06-23 13:44 . 2008-04-14 12:00 1851904 ----a-w- c:\windows\system32\win32k.sys
2010-06-21 15:27 . 2008-04-14 12:00 354304 ----a-w- c:\windows\system32\drivers\srv.sys
.
------- Sigcheck -------
[7] 2008-06-20 . AD978A1B783B5719720CFF204B666C8E . 361600 . . [5.1.2600.5625] . . c:\windows\$hf_mig$\KB951748\SP3QFE\tcpip.sys
[7] 2008-06-20 . 9AEFA14BD6B182D61E3119FA5F436D3D . 361600 . . [5.1.2600.5625] . . c:\windows\system32\dllcache\tcpip.sys
[-] 2008-06-20 . EEC9730F9CC03819111D90E6CAA2DCC9 . 361600 . . [5.1.2600.5625] . . c:\windows\system32\drivers\tcpip.sys
[7] 2008-04-14 . 93EA8D04EC73A85DB02EB8805988F733 . 361344 . . [5.1.2600.5512] . . c:\windows\$NtUninstallKB951748$\tcpip.sys
[-] 2008-04-14 . 2A39241E5FBED9C12BE29850232B8D89 . 507904 . . [5.1.2600.5512] . . c:\windows\system32\winlogon.exe
[-] 2008-04-14 . DE4AA5D5375FFEFB183C103F3E50B3D3 . 1033728 . . [6.00.2900.5512] . . c:\windows\explorer.exe
.
((((((((((((((((((((((((((((( SnapShot@2010-09-15_18.01.38 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-09-15 19:44 . 2010-09-15 19:44 16384 c:\windows\temp\Perflib_Perfdata_224.dat
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{201f27d4-3704-41d6-89c1-aa35e39143ed}]
2009-04-02 10:47 333192 ----a-w- c:\program files\AskBarDis\bar\bin\askBar.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{3041d03e-fd4b-44e0-b742-2d9b88305f98}"= "c:\program files\AskBarDis\bar\bin\askBar.dll" [2009-04-02 333192]
[HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]
[HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{3041D03E-FD4B-44E0-B742-2D9B88305F98}"= "c:\program files\AskBarDis\bar\bin\askBar.dll" [2009-04-02 333192]
[HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]
[HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-06-17 150040]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-06-17 170520]
"Persistence"="c:\windows\system32\igfxpers.exe" [2008-06-17 141848]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"RTHDCPL"="RTHDCPL.EXE" [2008-05-16 16862720]
"AzMixerSel"="c:\program files\Realtek\Audio\InstallShield\AzMixerSel.exe" [2006-07-18 53248]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-08-14 149280]
"UpdatePPShortCut"="c:\program files\CyberLink\PowerProducer\MUITransfer\MUIStartMenu.exe" [2008-12-03 218408]
"DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2010-04-12 1135912]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-04-04 36272]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-06-09 976832]
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\PokerStrategy\\PokerStrategy Equilator\\Equilator.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Google\\Google Talk\\googletalk.exe"=
"e:\\World of Warcraft\\WoW-3.2.0-deDE-downloader.exe"=
"e:\\World of Warcraft\\Launcher.exe"=
"e:\\World of Warcraft\\WoW-3.2.0.10192-to-3.2.0.10314-deDE-downloader.exe"=
"e:\\World of Warcraft\\WoW-3.2.0.10314-to-3.2.2.10482-deDE-downloader.exe"=
"e:\\World of Warcraft\\WoW-3.2.2.10482-to-3.2.2.10505-deDE-downloader.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"c:\\Documents and Settings\\vvjj\\My Documents\\Downloads\\qq2009sp6_installer.exe"=
"c:\\Program Files\\Tencent\\QQ\\Bin\\QQ.exe"=
"c:\\Program Files\\Tencent\\QQ\\Bin\\auclt.exe"=
"c:\\spiele\\Qianhong\\Qianhong.exe"=
"e:\\Diablo\\diablo.exe"=
"c:\\Program Files\\SogouInput\\5.0.1.4185\\PinyinUp.exe"=
R2 AntiVirSchedulerService;Avira AntiVir Planer;c:\program files\Avira\AntiVir Desktop\sched.exe [19.05.2009 19:33 108289]
R2 pgsql-8.3;PostgreSQL Database Server 8.3;c:\program files\PostgreSQL\8.3\bin\pg_ctl.exe [01.02.2008 04:02 65536]
R3 IntcHdmiAddService;Intel(R) High Definition Audio HDMI Service;c:\windows\system32\drivers\IntcHdmi.sys [19.05.2009 19:02 108032]
R3 O2MDRDR;O2MDRDR;c:\windows\system32\drivers\o2media.sys [21.05.2009 00:59 51288]
R3 O2SDRDR;O2SDRDR;c:\windows\system32\drivers\o2sd.sys [21.05.2009 00:37 43608]
S2 ASKUpgrade;ASKUpgrade;c:\program files\AskBarDis\bar\bin\ASKUpgrade.exe [11.06.2009 11:00 234888]
S3 epmntdrv;epmntdrv;c:\windows\system32\epmntdrv.sys [21.08.2009 23:39 8704]
S3 EuGdiDrv;EuGdiDrv;c:\windows\system32\EuGdiDrv.sys [21.08.2009 23:39 3072]
S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [08.06.2010 20:04 691696]
.
Inhalt des "geplante Tasks" Ordners
2010-09-05 c:\windows\Tasks\SogouImeMgr.job
- c:\progra~1\SOGOUI~1\501~1.418\SGTool.exe [2010-06-25 13:10]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page =
mLocal Page =
uSearchURL,(Default) = hxxp://toolbar.ask.com/toolbarv/askRedirect?o=13925&gct=&gc=1&q=%s
IE: ???QQ?? - c:\program files\Tencent\QQ\Bin\AddEmotion.htm
DPF: {3D8F74EE-8692-4F8F-B8D2-7522E732519E} - hxxp://game-web.qq.com/client/QQGame2.cab
FF - ProfilePath - c:\documents and settings\vvjj\Application Data\Mozilla\Firefox\Profiles\opx683lu.default\
FF - component: c:\documents and settings\vvjj\Application Data\Mozilla\Firefox\Profiles\opx683lu.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\components\FFExternalAlert.dll
FF - component: c:\documents and settings\vvjj\Application Data\Mozilla\Firefox\Profiles\opx683lu.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\components\RadioWMPCore.dll
FF - plugin: c:\documents and settings\All Users\Application Data\id Software\QuakeLive\npquakezero.dll
FF - plugin: c:\program files\DivX\DivX Plus Web Player\npdivx32.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
---- FIREFOX Richtlinien ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
AddRemove-Battle.net - c:\windows\bnetunin.exe
AddRemove-Diablo - c:\windows\diabunin.exe
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2010-09-15 21:44
Windows 5.1.2600 Service Pack 3 NTFS
Scanne versteckte Prozesse...
Scanne versteckte Autostarteinträge...
Scanne versteckte Dateien...
Scan erfolgreich abgeschlossen
versteckte Dateien: 0
**************************************************************************
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
[HKEY_USERS\S-1-5-21-2025429265-299502267-1801674531-1003\Software\Microsoft\Internet Explorer\MenuExt\ûm*R0RQ*Q*hˆÅ`]
"contexts"=dword:00000002
@="c:\\Program Files\\Tencent\\QQ\\Bin\\AddEmotion.htm"
[HKEY_LOCAL_MACHINE\software\Microsoft\Internet Explorer\MenuExt\ûm*R0RQ*Q*hˆÅ`]
"contexts"=dword:00000002
@="c:\\Program Files\\Tencent\\QQ\\Bin\\AddEmotion.htm"
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------
- - - - - - - > 'winlogon.exe'(760)
c:\program files\Citrix\ICA Client\pnsson.dll
- - - - - - - > 'lsass.exe'(820)
c:\program files\Citrix\ICA Client\pnsson.dll
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\windows\system32\brss01a.exe
c:\program files\Citrix\ICA Client\ssonsvr.exe
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\O2Micro Flash Memory Card Driver\o2flash.exe
c:\windows\RTHDCPL.EXE
c:\windows\system32\igfxsrvc.exe
c:\windows\system32\PnkBstrA.exe
c:\program files\PostgreSQL\8.3\bin\postgres.exe
c:\program files\PostgreSQL\8.3\bin\postgres.exe
c:\program files\PostgreSQL\8.3\bin\postgres.exe
c:\program files\PostgreSQL\8.3\bin\postgres.exe
c:\program files\PostgreSQL\8.3\bin\postgres.exe
c:\program files\PostgreSQL\8.3\bin\postgres.exe
c:\docume~1\vvjj\LOCALS~1\Temp\RtkBtMnt.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2010-09-15 21:47:07 - PC wurde neu gestartet
ComboFix-quarantined-files.txt 2010-09-15 19:47
ComboFix2.txt 2010-09-15 18:02
Vor Suchlauf: 5.908.217.856 bytes free
Nach Suchlauf: 5.896.331.264 bytes free
- - End Of File - - 0539605378F46242ED2321D7E774AD89
--- --- ---
15.09.2010, 20:47
Baum-Darstellung