TR/Crypt.ZPACK.Gen in C:\Users\***\AppData\Local\Temp\eapp32hst.dl

ComboFix 10-10-12.03 - *** 13.10.2010  20:49:25.1.2 - x86
ausgeführt von:: c:\users\***\Desktop\cofi.exe
AV: Ashampoo AntiVirus *On-access scanning enabled* (Updated) {87430BA8-187A-42D6-A8FE-8E00DF291089}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\programdata\hpeEEE2.dll

.
(((((((((((((((((((((((   Dateien erstellt von 2010-09-13 bis 2010-10-13  ))))))))))))))))))))))))))))))
.

3208-10-15 08:53 . 3208-10-15 08:53    --------    d-----w-    C:\Application Data
2010-10-13 18:56 . 2010-10-13 18:56    --------    d-----w-    c:\users\*****\AppData\Local\temp
2010-10-13 18:56 . 2010-10-13 18:56    --------    d-----w-    c:\users\*****\AppData\Local\temp
2010-10-13 17:31 . 2010-10-13 17:31    --------    d-----w-    c:\program files\CCleaner
2010-10-13 16:30 . 2010-10-13 16:30    --------    d-----w-    C:\_OTL
2010-10-12 22:05 . 2010-10-12 22:05    --------    d-----w-    c:\users\***\AppData\Roaming\Malwarebytes
2010-10-12 22:05 . 2010-04-29 10:19    38224    ----a-w-    c:\windows\system32\drivers\mbamswissarmy.sys
2010-10-12 22:05 . 2010-10-12 22:05    --------    d-----w-    c:\programdata\Malwarebytes
2010-10-12 22:04 . 2010-10-12 22:05    --------    d-----w-    c:\program files\Malwarebytes' Anti-Malware
2010-10-12 22:04 . 2010-04-29 10:19    20952    ----a-w-    c:\windows\system32\drivers\mbam.sys
2010-10-12 08:55 . 2010-09-09 22:52    6084944    ----a-w-    c:\programdata\Microsoft\Windows Defender\Definition Updates\{E3555D70-92BE-407E-B280-CA739FBE7027}\mpengine.dll
2010-09-29 07:39 . 2010-06-22 13:30    2048    ----a-w-    c:\windows\system32\tzres.dll
2010-09-15 14:56 . 2010-08-17 14:11    128000    ----a-w-    c:\windows\system32\spoolsv.exe
2010-09-15 14:56 . 2010-04-16 16:46    502272    ----a-w-    c:\windows\system32\usp10.dll
2010-09-15 14:56 . 2010-05-27 20:08    739328    ----a-w-    c:\windows\system32\inetcomm.dll
2010-09-15 14:56 . 2010-04-05 17:02    317952    ----a-w-    c:\windows\system32\MP4SDECD.DLL

.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]
"Skype"="c:\program files\Skype\\Phone\Skype.exe" [2010-05-13 26192168]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-21 1008184]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-07-26 13576736]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-07-26 92704]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2010-03-26 8546848]
"PRISMSVR.EXE"="c:\program files\T-Com\Sinus 154 data II\PRISMSVR.EXE" [2004-04-26 295001]

c:\users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Trillian.lnk - c:\program files\Trillian\trillian.exe [2010-8-23 2068832]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
T-Com WLAN Manager.lnk - c:\program files\T-Com\Sinus 154 data II\TS154USB.exe [2004-6-8 327680]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages    REG_MULTI_SZ       msv1_0 setuid

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"AntiVirusOverride"=dword:00000001

R3 CoachVid;CoachVid;c:\windows\system32\DRIVERS\CoachVid.sys [2009-04-06 45344]
R3 DAUpdaterSvc;Dragon Age: Origins - Inhaltsupdater;c:\program files\Dragon Age\bin_ship\DAUpdaterSvc.Service.exe [2009-12-15 25832]
R3 s0016bus;Sony Ericsson Device 0016 driver (WDM);c:\windows\system32\DRIVERS\s0016bus.sys [2008-05-16 89256]
R3 s0016mdfl;Sony Ericsson Device 0016 USB WMC Modem Filter;c:\windows\system32\DRIVERS\s0016mdfl.sys [2008-05-16 15016]
R3 s0016mdm;Sony Ericsson Device 0016 USB WMC Modem Driver;c:\windows\system32\DRIVERS\s0016mdm.sys [2008-05-16 120744]
R3 s0016mgmt;Sony Ericsson Device 0016 USB WMC Device Management Drivers (WDM);c:\windows\system32\DRIVERS\s0016mgmt.sys [2008-05-16 114216]
R3 s0016nd5;Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (NDIS);c:\windows\system32\DRIVERS\s0016nd5.sys [2008-05-16 25512]
R3 s0016obex;Sony Ericsson Device 0016 USB WMC OBEX Interface;c:\windows\system32\DRIVERS\s0016obex.sys [2008-05-16 110632]
R3 s0016unic;Sony Ericsson Device 0016 USB Ethernet Emulation SEMC0016 (WDM);c:\windows\system32\DRIVERS\s0016unic.sys [2008-05-16 115752]
R4 sptd;sptd;c:\windows\system32\Drivers\sptd.sys [2010-08-13 721904]
S2 AntiVirSchedulerService;Avira AntiVir Planer;c:\program files\Avira\AntiVir Desktop\sched.exe [2009-05-13 108289]
S3 DT154_A02;Sinus 154 data II Driver;c:\windows\system32\DRIVERS\TS154USB.sys [2004-06-02 379264]
S3 seehcri;Sony Ericsson seehcri Device Driver;c:\windows\system32\DRIVERS\seehcri.sys [2008-01-09 27632]


[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceNoNetwork    REG_MULTI_SZ       PLA DPS BFE mpssvc
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.one.de
mStart Page = hxxp://www.google.de
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\users\***\AppData\Roaming\Mozilla\Firefox\Profiles\e6n84d4h.default\
FF - plugin: c:\program files\DivX\DivX Plus Web Player\npdivx32.dll
FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll
FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll
FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npsharedview.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX Richtlinien ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true); 
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true); 
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -

AddRemove-InstallShield_{C43C1415-3DFC-4089-9A32-0BECF28A6046} - c:\program files\InstallShield Installation Information\{C43C1415-3DFC-4089-9A32-0BECF28A6046}\autorun.exe


.
--------------------- Gesperrte Registrierungsschluessel ---------------------

[HKEY_USERS\S-1-5-21-3968634118-1431878253-527176528-1000\Software\SecuROM\License information*]
"datasecu"=hex:96,a0,57,44,4d,c4,10,87,6d,b9,eb,ab,70,85,41,7c,31,03,09,66,75,
   a5,3b,f8,b1,86,11,c9,c1,63,de,08,a7,7b,c1,82,6d,24,be,a3,59,09,27,b5,b5,87,\
"rkeysecu"=hex:c8,67,b8,e8,de,9e,e3,35,c7,ab,a6,71,c9,c9,1e,d3

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------

- - - - - - - > 'lsass.exe'(652)
c:\windows\system32\setuid.dll
.
Zeit der Fertigstellung: 2010-10-13  20:57:04
ComboFix-quarantined-files.txt  2010-10-13 18:57

Vor Suchlauf: 11 Verzeichnis(se), 148.744.073.216 Bytes frei
Nach Suchlauf: 14 Verzeichnis(se), 148.974.338.048 Bytes frei

- - End Of File - - EA33F86F34F938B8D3B97B827AC16885