Think Point, wirklich entfernt?

emrah55 · 13.12.2010, 14:17

Combofix Logfile:

Code:

ATTFilter

ComboFix 10-12-11.06 - Emrah 13.12.2010  13:58:04.2.2 - x86
Microsoft Windows 7 Home Premium   6.1.7600.0.1252.49.1031.18.1977.1270 [GMT 1:00]
ausgeführt von:: c:\users\Emrah\Desktop\cofi.exe
Benutzte Befehlsschalter :: c:\users\Emrah\Desktop\CFScript.txt
AV: Kaspersky PURE *Disabled/Updated* {AE1D740B-8F0F-D137-211D-873D44B3F4AE}
FW: Kaspersky PURE *Disabled* {9626F52E-C560-D06F-0A42-2E08BA60B3D5}
SP: Kaspersky PURE *Disabled/Updated* {157C95EF-A935-DEB9-1BAD-BC4F3F34BE13}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

FILE ::
"c:\program files\EagleR.dll"
"c:\program files\EagleSvr.exe"
"c:\users\Emrah\AppData\Roaming\ntvdmdz.dll"
.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\EagleR.dll
c:\program files\EagleSvr.exe
c:\users\Emrah\AppData\Roaming\ntvdmdz.dll
c:\windows\3636C9237AD64DE3978A09609AEE8ECF.TMP
c:\windows\3636C9237AD64DE3978A09609AEE8ECF.TMP\WiseCustomCall.dll
c:\windows\3636C9237AD64DE3978A09609AEE8ECF.TMP\WiseCustomCalla.dll
c:\windows\3636C9237AD64DE3978A09609AEE8ECF.TMP\WiseCustomCalla17.dll
c:\windows\3636C9237AD64DE3978A09609AEE8ECF.TMP\WiseCustomCalla18.dll
c:\windows\3636C9237AD64DE3978A09609AEE8ECF.TMP\WiseCustomCalla18.exe
c:\windows\3636C9237AD64DE3978A09609AEE8ECF.TMP\WiseCustomCalla19.dll
c:\windows\3636C9237AD64DE3978A09609AEE8ECF.TMP\WiseCustomCalla2.dll
c:\windows\3636C9237AD64DE3978A09609AEE8ECF.TMP\WiseCustomCalla20.dll
c:\windows\3636C9237AD64DE3978A09609AEE8ECF.TMP\WiseCustomCalla21.dll
c:\windows\3636C9237AD64DE3978A09609AEE8ECF.TMP\WiseCustomCalla21.exe
c:\windows\3636C9237AD64DE3978A09609AEE8ECF.TMP\WiseData.ini

.
(((((((((((((((((((((((   Dateien erstellt von 2010-11-13 bis 2010-12-13  ))))))))))))))))))))))))))))))
.

2010-12-13 13:08 . 2010-12-13 13:08	--------	d-----w-	c:\users\Default\AppData\Local\temp
2010-12-12 18:24 . 2010-12-12 18:24	--------	d-----w-	c:\program files\CCleaner
2010-12-11 10:50 . 2010-12-11 10:50	--------	d-----w-	c:\users\Emrah\AppData\Roaming\Kaspersky Lab
2010-12-10 22:25 . 2010-12-10 22:25	--------	d-----w-	C:\_OTL
2010-12-10 16:48 . 2010-11-10 04:33	6273872	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{0C7C52F0-01CD-4EC3-B288-6D90A748F615}\mpengine.dll
2010-12-10 09:05 . 2009-12-25 15:42	162320	----a-w-	c:\program files\Mozilla Firefox\extensions\linkfilter@kaspersky.ru\components\KavLinkFilter.dll
2010-12-10 09:05 . 2010-12-10 09:25	97859	----a-w-	c:\windows\system32\drivers\klick.dat
2010-12-10 09:05 . 2010-12-10 09:25	114243	----a-w-	c:\windows\system32\drivers\klin.dat
2010-12-10 09:04 . 2009-12-14 11:44	88632	----a-w-	c:\windows\system32\drivers\CSCrySec.sys
2010-12-10 09:04 . 2009-12-14 11:44	39352	----a-w-	c:\windows\system32\drivers\CSVirtualDiskDrv.sys
2010-12-10 09:03 . 2010-12-10 09:03	--------	d-----w-	c:\program files\Common Files\InfoWatch
2010-12-10 09:03 . 2010-12-10 09:03	--------	d-----w-	c:\program files\Kaspersky Lab
2010-12-10 08:18 . 2010-12-13 12:49	--------	d-----w-	c:\programdata\Kaspersky Lab
2010-12-09 21:59 . 2010-12-10 16:12	--------	dc----w-	c:\windows\system32\DRVSTORE
2010-12-09 21:59 . 2010-12-09 21:59	98392	----a-w-	c:\windows\system32\drivers\SBREDrv.sys
2010-12-09 21:54 . 2010-12-09 21:54	--------	d-----w-	c:\users\Emrah\AppData\Local\Sunbelt Software
2010-12-09 21:53 . 2010-12-10 16:12	--------	d-----w-	c:\programdata\Lavasoft
2010-12-09 13:53 . 2010-12-10 16:12	--------	d-----w-	c:\program files\Lavasoft
2010-12-08 21:27 . 2010-12-09 14:26	--------	d-----w-	c:\programdata\Spybot - Search & Destroy
2010-12-08 21:08 . 2010-12-08 21:20	16968	----a-w-	c:\windows\system32\drivers\hitmanpro35.sys
2010-12-08 21:06 . 2010-12-09 14:26	--------	d-----w-	c:\programdata\Hitman Pro
2010-12-08 08:16 . 2010-12-08 08:16	--------	d-----w-	c:\users\Emrah\AppData\Roaming\Malwarebytes
2010-12-08 08:16 . 2010-11-29 16:42	38224	----a-w-	c:\windows\system32\drivers\mbamswissarmy.sys
2010-12-08 08:16 . 2010-12-08 08:16	--------	d-----w-	c:\programdata\Malwarebytes
2010-12-08 08:16 . 2010-11-29 16:42	20952	----a-w-	c:\windows\system32\drivers\mbam.sys
2010-12-08 08:16 . 2010-12-08 08:16	--------	d-----w-	c:\program files\Malwarebytes' Anti-Malware
2010-12-08 00:07 . 2010-12-08 00:07	--------	d-----w-	c:\program files\Common Files\Wise Installation Wizard
2010-12-05 21:12 . 2010-12-12 18:29	--------	d-----w-	c:\users\Emrah\AppData\Roaming\Media Player Classic
2010-12-05 21:06 . 2010-03-15 09:31	165376	----a-w-	c:\windows\system32\unrar.dll
2010-12-05 21:05 . 2010-06-08 16:10	790528	----a-w-	c:\windows\system32\xvidcore.dll
2010-12-05 21:05 . 2010-06-08 16:10	134144	----a-w-	c:\windows\system32\xvidvfw.dll
2010-12-05 21:05 . 2010-01-17 15:18	151552	----a-w-	c:\windows\system32\ac3acm.acm
2010-12-05 21:05 . 2008-09-24 18:41	839680	----a-w-	c:\windows\system32\lameACM.acm
2010-12-05 21:05 . 2004-01-25 16:18	217088	----a-w-	c:\windows\system32\yv12vfw.dll
2010-12-05 21:05 . 2010-10-18 08:00	108032	----a-w-	c:\windows\system32\ff_vfw.dll
2010-12-05 21:05 . 2010-12-05 21:11	--------	d-----w-	c:\program files\K-Lite Codec Pack
2010-12-05 10:03 . 2010-12-09 14:26	--------	d-----w-	c:\users\Emrah\AppData\Roaming\vlc
2010-11-25 22:20 . 2010-11-25 22:20	--------	d-----w-	c:\users\Emrah\AppData\Local\Google
2010-11-25 22:19 . 2010-11-25 22:19	--------	d-----w-	c:\program files\Google
2010-11-24 08:45 . 2010-10-19 08:10	7680	----a-w-	c:\program files\Internet Explorer\iecompat.dll

.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-10-19 09:41 . 2009-10-24 16:21	222080	------w-	c:\windows\system32\MpSigStub.exe
2010-09-30 09:41 . 2010-09-30 09:41	80896	----a-w-	c:\windows\cadkasdeinst01.exe
2010-09-15 02:50 . 2010-07-09 06:45	472808	----a-w-	c:\windows\system32\deployJava1.dll
.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\KAVOverlayIcon]
@="{dd230880-495a-11d1-b064-008048ec2fc5}"
[HKEY_CLASSES_ROOT\CLSID\{dd230880-495a-11d1-b064-008048ec2fc5}]
2009-12-25 15:42	129552	----a-w-	c:\program files\Kaspersky Lab\Kaspersky PURE\shellex.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\DTLite.exe" [2010-04-01 357696]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-07-14 1173504]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"VitaKeyPdtWzd"="c:\program files\Acer Bio Protection\PdtWzd.exe" [2009-06-01 3558912]
"PLFSetI"="c:\windows\PLFSetI.exe" [2009-10-24 200704]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2009-03-06 1434920]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-06-03 135168]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-06-03 166912]
"Persistence"="c:\windows\system32\igfxpers.exe" [2009-06-03 143872]
"DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2010-09-01 1164584]
"SAP_WUS_UNT"="c:\program files\SAP\SAPsetup\setup\Updater\NwSapSetupUserNotificationTool.exe" [2010-02-25 226672]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-09-23 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-20 932288]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
"Malwarebytes' Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2010-11-29 963976]
"AVP"="c:\program files\Kaspersky Lab\Kaspersky PURE\avp.exe" [2009-12-25 340456]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2009-7-17 795936]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\progra~1\KASPER~1\KASPER~1\mzvkbd3.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"mixer1"=wdmaud.drv

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Notification Packages	REG_MULTI_SZ   	c:\program files\Acer Bio Protection\PwdFilter

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys [2009-04-08 29472]
R3 esgiguard;esgiguard;c:\program files\Enigma Software Group\SpyHunter\esgiguard.sys [x]
R3 ewusbnet;HUAWEI USB-NDIS miniport;c:\windows\system32\DRIVERS\ewusbnet.sys [2009-06-29 112128]
R3 hitmanpro35;Hitman Pro 3.5 Support Driver;c:\windows\system32\drivers\hitmanpro35.sys [2010-12-08 16968]
R3 hwusbfake;Huawei DataCard USB Fake;c:\windows\system32\DRIVERS\ewusbfake.sys [2009-06-29 102912]
S0 CSCrySec;InfoWatch Encrypt Sector Library driver;c:\windows\system32\DRIVERS\CSCrySec.sys [2009-12-14 88632]
S0 KLBG;Kaspersky Lab Boot Guard Driver;c:\windows\system32\DRIVERS\klbg.sys [2009-10-14 36880]
S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2010-05-04 691696]
S1 CSVirtualDiskDrv;InfoWatch Virtual Disk driver;c:\windows\system32\DRIVERS\CSVirtualDiskDrv.sys [2009-12-14 39352]
S1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter;c:\windows\system32\DRIVERS\klim6.sys [2009-09-14 21520]
S1 LUMDriver;LUMDriver;c:\windows\system32\drivers\LUMDriver.sys [2007-04-24 16688]
S2 CSObjectsSrv;Verwaltungsservice vom CryproStorage-System;c:\program files\Common Files\InfoWatch\CryptoStorage\ProtectedObjectsSrv.exe [2009-12-21 743992]
S2 FPSensor;EgisTec-Corp Fingerprint Reader Driver (FPSensor.sys);c:\windows\system32\Drivers\FPSensor.sys [2009-10-24 22528]
S2 IGBASVC;EgisTec Service;c:\program files\Acer Bio Protection\BASVC.exe [2009-06-01 3444736]
S2 NWSAPAutoWorkstationUpdateSvc;SAPSetup Automatic Workstation Update Service;c:\program files\SAP\SAPsetup\setup\Updater\NwSapAutoWorkstationUpdateService.exe [2010-02-25 263536]
S3 klmouflt;Kaspersky Lab KLMOUFLT;c:\windows\system32\DRIVERS\klmouflt.sys [2009-10-02 19472]
S3 netw5v32;Intel(R) Wireless WiFi Link 5000-Serie - Adaptertreiber für Windows Vista 32 Bit;c:\windows\system32\DRIVERS\netw5v32.sys [2009-07-13 4231168]
S3 RTL8167;Realtek 8167 NT-Treiber;c:\windows\system32\DRIVERS\Rt86win7.sys [2009-07-13 139776]

.
.
------- Zusätzlicher Suchlauf -------
.
IE: Bild an &Bluetooth-Gerät senden... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Hinzufügen zu Anti-Banner - c:\program files\Kaspersky Lab\Kaspersky PURE\ie_banner_deny.htm
IE: Nach Microsoft &Excel exportieren - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Seite an &Bluetooth-Gerät senden... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
FF - ProfilePath - c:\users\Emrah\AppData\Roaming\Mozilla\Firefox\Profiles\wyvc1yc3.default\
FF - prefs.js: browser.startup.homepage - tonline.de
FF - prefs.js: network.proxy.type - 2
FF - component: c:\program files\Mozilla Firefox\extensions\linkfilter@kaspersky.ru\components\KavLinkFilter.dll
FF - component: c:\users\Emrah\AppData\Roaming\Kaspersky Lab\Password Manager\kpmAutofill\components\kpmAutofill.dll
FF - plugin: c:\program files\DivX\DivX Plus Web Player\npdivx32.dll
FF - plugin: c:\program files\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\Java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
FF - Ext: Kaspersky URL Advisor: linkfilter@kaspersky.ru - c:\program files\Mozilla Firefox\extensions\linkfilter@kaspersky.ru
FF - Ext: Password Manager Autofill Engine: {72CA2996-F580-47DF-98FF-0B853D09CEC8} - c:\users\Emrah\AppData\Roaming\Kaspersky Lab\Password Manager\kpmAutofill

---- FIREFOX Richtlinien ----
FF - user.js: yahoo.homepage.dontask - true
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------

[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (LocalSystem)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
   d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,76,34,0b,d2,95,e5,b2,47,8e,ae,82,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
   d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,76,34,0b,d2,95,e5,b2,47,8e,ae,82,\

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------

- - - - - - - > 'lsass.exe'(544)
c:\program files\Acer Bio Protection\PwdFilter.DLL
.
Zeit der Fertigstellung: 2010-12-13  14:11:55
ComboFix-quarantined-files.txt  2010-12-13 13:11
ComboFix2.txt  2010-12-12 18:57

Vor Suchlauf: 15 Verzeichnis(se), 107.719.774.208 Bytes frei
Nach Suchlauf: 16 Verzeichnis(se), 107.668.918.272 Bytes frei

- - End Of File - - 775378AFA1FBC72762AFF59FAD954112

--- --- ---

Think Point, wirklich entfernt?

Log-Analyse und Auswertung: Think Point, wirklich entfernt?

Think Point, wirklich entfernt?

Ähnliche Themen: Think Point, wirklich entfernt?