online banking TAN s wurden abgefragt Trojaner

ComboFix 10-12-30.03 - *** 31.12.2010  12:38:30.1.2 - x86
Microsoft® Windows Vista™ Home Premium   6.0.6000.0.1252.49.1031.18.2038.969 [GMT 1:00]
ausgeführt von:: c:\users\***\Desktop\cofi.exe
.

(((((((((((((((((((((((   Dateien erstellt von 2010-11-28 bis 2010-12-31  ))))))))))))))))))))))))))))))
.

2010-12-31 11:45 . 2010-12-31 11:46	--------	d-----w-	c:\users\***\AppData\Local\temp
2010-12-31 11:45 . 2010-12-31 11:45	--------	d-----w-	c:\users\Default\AppData\Local\temp
2010-12-31 11:08 . 2010-12-31 11:13	--------	d-----w-	c:\program files\CCleaner
2010-12-31 10:54 . 2010-11-10 04:33	6273872	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{8E8D08C4-F51F-49EF-816A-CD9EC11A5052}\mpengine.dll
2010-12-24 19:41 . 2010-12-24 19:41	--------	d-----w-	c:\program files\7-Zip
2010-12-24 14:30 . 2010-12-24 14:30	--------	d-----w-	c:\users\***\AppData\Roaming\Malwarebytes
2010-12-24 14:29 . 2010-12-20 17:09	38224	----a-w-	c:\windows\system32\drivers\mbamswissarmy.sys
2010-12-24 14:29 . 2010-12-24 14:29	--------	d-----w-	c:\programdata\Malwarebytes
2010-12-24 14:29 . 2010-12-24 14:29	--------	d-----w-	c:\program files\Malwarebytes' Anti-Malware
2010-12-24 14:29 . 2010-12-20 17:08	20952	----a-w-	c:\windows\system32\drivers\mbam.sys
2010-12-09 19:22 . 2010-12-09 19:23	--------	d-----w-	c:\program files\iTunes
2010-12-09 19:19 . 2010-12-09 19:19	159744	----a-w-	c:\program files\Internet Explorer\Plugins\npqtplugin7.dll
2010-12-09 19:19 . 2010-12-09 19:19	159744	----a-w-	c:\program files\Internet Explorer\Plugins\npqtplugin6.dll
2010-12-09 19:19 . 2010-12-09 19:19	159744	----a-w-	c:\program files\Internet Explorer\Plugins\npqtplugin5.dll
2010-12-09 19:19 . 2010-12-09 19:19	159744	----a-w-	c:\program files\Internet Explorer\Plugins\npqtplugin4.dll
2010-12-09 19:19 . 2010-12-09 19:19	159744	----a-w-	c:\program files\Internet Explorer\Plugins\npqtplugin3.dll
2010-12-09 19:19 . 2010-12-09 19:19	159744	----a-w-	c:\program files\Internet Explorer\Plugins\npqtplugin2.dll
2010-12-09 19:19 . 2010-12-09 19:19	159744	----a-w-	c:\program files\Internet Explorer\Plugins\npqtplugin.dll
2010-12-09 19:19 . 2010-12-09 19:19	--------	d-----w-	c:\program files\QuickTime
2010-12-09 19:12 . 2010-12-09 19:12	--------	d-----w-	c:\program files\Bonjour

.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-10-19 09:41 . 2009-10-03 14:57	222080	------w-	c:\windows\system32\MpSigStub.exe
2010-10-07 11:23 . 2010-10-07 11:23	91424	----a-w-	c:\windows\system32\dnssd.dll
2010-10-07 11:23 . 2010-10-07 11:23	75040	----a-w-	c:\windows\system32\jdns_sd.dll
2010-10-07 11:23 . 2010-10-07 11:23	197920	----a-w-	c:\windows\system32\dnssdX.dll
2010-10-07 11:23 . 2010-10-07 11:23	107808	----a-w-	c:\windows\system32\dns-sd.exe
.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883840]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-12-23 143360]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2006-11-02 125440]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="RtHDVCpl.exe" [2007-02-15 4390912]
"SMSERIAL"="c:\program files\Motorola\SMSERIAL\sm56hlpr.exe" [2006-11-22 630784]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-02-15 857648]
"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 155648]
"TVBroadcast"="c:\program files\Sceneo\Bonavista\Services\ODSBC\ODSBCApp.exe" [2007-05-08 790016]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2006-11-15 151552]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-06-06 142104]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-06-06 154392]
"Persistence"="c:\windows\system32\igfxpers.exe" [2007-06-06 138008]
"LaunchAp"="c:\program files\Launch Manager\LaunchAp.exe" [2005-07-25 32768]
"HotkeyApp"="c:\program files\Launch Manager\HotkeyApp.exe" [2006-12-14 192512]
"LMgrOSD"="c:\program files\Launch Manager\OSD.exe" [2006-12-26 180224]
"Wbutton"="c:\program files\Launch Manager\Wbutton.exe" [2006-11-09 86016]
"UVS10 Preload"="c:\program files\Ulead Systems\Ulead VideoStudio SE DVD\uvPL.exe" [2006-08-10 36864]
"Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2007-07-16 220160]
"toolbar_eula_launcher"="c:\program files\GoogleEULA\EULALauncher.exe" [2007-02-09 16896]
"avgnt"="c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-07-25 266497]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"EEventManager"="c:\progra~1\EPSONS~1\EVENTM~1\EEventManager.exe" [2008-12-04 665424]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2010-02-17 177472]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-10-11 149280]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-09-08 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-11-17 421160]
"Malwarebytes' Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2010-12-20 963976]

c:\users\Annina\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2009-2-26 97680]
OpenOffice.org 2.4.lnk - c:\program files\OpenOffice.org 2.4\program\quickstart.exe [2008-1-21 393216]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{E37CB5F0-51F5-4395-A808-5FA49E399003}"= "c:\program files\GbPlugin\gbiehcef.dll" [2008-03-05 341576]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\progra~1\Google\GOOGLE~2\GoogleDesktopNetwork3.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv

R1 mailKmd;mailKmd; [x]
R3 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance;c:\program files\ALDI Sued Foto Service\Common\Database\bin\fbserver.exe [2005-11-17 1527900]
R3 PDNMp50;PDNMp50 NDIS Protocol Driver;c:\windows\system32\drivers\PDNMp50.sys [2006-11-28 28224]
R3 PDNSp50;PDNSp50 NDIS Protocol Driver;c:\windows\system32\drivers\PDNSp50.sys [2006-11-28 27072]
S2 GbpSv;Gbp Service;c:\progra~1\GbPlugin\GbpSv.exe [2008-03-05 50760]
S2 GnabService;GnabService;c:\program files\common files\gnab\service\servicecontroller.exe [2007-04-13 36864]
S2 srvcPVR;Sceneo PVR Service;c:\program files\Sceneo\Bonavista\Services\PVR\PVRService.exe [2007-05-04 1600512]
S3 RTL8187B;Realtek RTL8187B Wireless 802.11g 54Mbps USB 2.0 Network Adapter;c:\windows\system32\DRIVERS\RTL8187B.sys [2007-07-05 277504]
S3 WisLMSvc;WisLMSvc;c:\program files\Launch Manager\WisLMSvc.exe [2006-11-17 118784]

.
Inhalt des "geplante Tasks" Ordners

2010-12-31 c:\windows\Tasks\User_Feed_Synchronization-{D124B4E8-514D-4EBB-9597-5F704DA25B31}.job
- c:\windows\system32\msfeedssync.exe [2006-11-02 09:45]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.google.de/
mStart Page = hxxp://alice.aol.de
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.com/keyword/%s
IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
IE: {{0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - hxxp://rover.ebay.com/rover/1/707-1170-17534-22/4
TCP: {422A2817-56AA-485B-9921-58EE0232FE4A} = 213.191.74.18 62.109.123.197
DPF: {AE2B937E-EA7D-4A8D-888C-B68D7F72A3C4} - hxxp://as.photoprintit.de/ips-opdata/layout/default01/activex/IPSUploader4.cab
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2010-12-31 12:46
Windows 6.0.6000  NTFS

Scanne versteckte Prozesse... 

Scanne versteckte Autostarteinträge... 

Scanne versteckte Dateien... 

Scan erfolgreich abgeschlossen
versteckte Dateien: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\GbpSv]
"ImagePath"="c:\progra~1\GbPlugin\GbpSv.exe"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------

- - - - - - - > 'Explorer.exe'(1628)
c:\program files\Common Files\Ahead\Lib\NeroSearchBar.dll
c:\program files\Common Files\Ahead\Lib\MFC71U.DLL
c:\program files\Common Files\Ahead\Lib\BCGCBPRO800u.dll
.
Zeit der Fertigstellung: 2010-12-31  12:49:34
ComboFix-quarantined-files.txt  2010-12-31 11:49

Vor Suchlauf: 6.950.277.120 Bytes frei
Nach Suchlauf: 6.568.288.256 Bytes frei

- - End Of File - - 860C356A57BE896E9866CB08990E408A