Code:
Alles auswählen Aufklappen ATTFilter
ComboFix 11-02-10.01 - *** 11.02.2011 16:02:44.1.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.49.1031.18.1023.680 [GMT 1:00]
ausgeführt von:: c:\dokumente und einstellungen\***\Desktop\Cofi.exe
AV: AntiVir Desktop *Disabled/Updated* {AD166499-45F9-482A-A743-FDD3350758C7}
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Install.exe
c:\programme\INSTALL.LOG
.
((((((((((((((((((((((((((((((((((((((( Treiber/Dienste )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_NPF
((((((((((((((((((((((( Dateien erstellt von 2011-01-11 bis 2011-02-11 ))))))))))))))))))))))))))))))
.
2011-02-08 12:07 . 2011-02-08 12:10 -------- d-----w- c:\programme\Winamp
2011-02-06 01:51 . 2011-02-06 01:51 -------- d-----w- C:\found.000
2011-01-21 14:44 . 2011-01-21 14:44 440832 -c----w- c:\windows\system32\dllcache\shimgvw.dll
2011-01-13 07:16 . 2011-01-13 07:16 1409 ----a-w- c:\windows\QTFont.for
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-01-21 14:44 . 2005-09-15 23:55 440832 ----a-w- c:\windows\system32\shimgvw.dll
2011-01-07 14:09 . 2005-09-15 23:55 290048 ----a-w- c:\windows\system32\atmfd.dll
2010-12-31 14:03 . 2005-09-15 23:55 1855104 ----a-w- c:\windows\system32\win32k.sys
2010-12-22 12:34 . 2005-09-15 23:55 301568 ----a-w- c:\windows\system32\kerberos.dll
2010-12-21 19:25 . 2010-10-30 01:57 135096 ----a-w- c:\windows\system32\drivers\avipbb.sys
2010-12-20 23:52 . 2005-09-15 23:55 916480 ----a-w- c:\windows\system32\wininet.dll
2010-12-20 23:52 . 2005-09-15 23:55 43520 ----a-w- c:\windows\system32\licmgr10.dll
2010-12-20 23:52 . 2005-09-15 23:55 1469440 ------w- c:\windows\system32\inetcpl.cpl
2010-12-20 17:25 . 2005-09-15 23:55 737792 ----a-w- c:\windows\system32\lsasrv.dll
2010-12-20 17:09 . 2010-05-20 19:25 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-12-20 17:08 . 2010-05-20 19:25 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-12-20 12:55 . 2005-09-15 23:55 385024 ----a-w- c:\windows\system32\html.iec
2010-12-09 15:15 . 2005-09-15 23:55 743936 ----a-w- c:\windows\system32\ntdll.dll
2010-12-09 15:13 . 2005-09-15 23:55 2195072 ----a-w- c:\windows\system32\ntoskrnl.exe
2010-12-09 15:13 . 2004-08-04 00:50 2071680 ----a-w- c:\windows\system32\ntkrnlpa.exe
2010-12-09 14:29 . 2005-09-15 23:55 33280 ----a-w- c:\windows\system32\csrsrv.dll
2010-12-02 03:35 . 2010-12-02 03:35 4280320 ----a-w- c:\windows\system32\GPhotos.scr
2010-11-23 15:16 . 2010-10-30 01:57 61960 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2010-11-18 18:12 . 2005-09-16 06:04 86016 ----a-w- c:\windows\system32\isign32.dll
2005-05-13 16:12 217073 --sha-r- c:\windows\meta4.exe
2005-10-24 10:13 66560 --sha-r- c:\windows\MOTA113.exe
2005-10-13 20:27 422400 --sha-r- c:\windows\x2.64.exe
2005-10-07 18:14 308224 --sha-r- c:\windows\system32\avisynth.dll
2005-07-14 11:31 27648 --sha-r- c:\windows\system32\AVSredirect.dll
2005-06-26 14:32 616448 --sha-r- c:\windows\system32\cygwin1.dll
2005-06-21 21:37 45568 --sha-r- c:\windows\system32\cygz.dll
2004-01-24 23:00 70656 --sha-r- c:\windows\system32\i420vfw.dll
2006-04-27 09:24 2945024 --sha-r- c:\windows\system32\Smab.dll
2005-02-28 12:16 240128 --sha-r- c:\windows\system32\x.264.exe
2004-01-24 23:00 70656 --sha-r- c:\windows\system32\yv12vfw.dll
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2011-01-11 39408]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPLpr"="c:\programme\Synaptics\SynTP\SynTPLpr.exe" [2004-05-07 98304]
"SynTPEnh"="c:\programme\Synaptics\SynTP\SynTPEnh.exe" [2004-05-07 536576]
"ATIPTA"="c:\ati-cpanel\atiptaxx.exe" [2004-06-10 339968]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"EPSON Stylus C66 Series"="c:\windows\System32\spool\DRIVERS\W32X86\3\E_S4I0S2.EXE" [2003-11-26 99840]
"Adobe ARM"="c:\programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-20 932288]
"avgnt"="c:\programme\Avira\AntiVir Desktop\avgnt.exe" [2010-11-05 281768]
"QuickTime Task"="c:\programme\QuickTime\qttask.exe" [2006-04-26 155648]
"TkBellExe"="c:\programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe" [2008-04-29 185896]
"Adobe Reader Speed Launcher"="c:\programme\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-09-23 35760]
"SunJavaUpdateSched"="c:\programme\Gemeinsame Dateien\Java\Java Update\jusched.exe" [2010-05-14 248552]
"PDFPrint"="c:\programme\PDF24\pdf24.exe" [2011-02-01 220552]
"WinampAgent"="c:\programme\Winamp\winampa.exe" [2010-12-06 74752]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
[HKLM\~\startupfolder\C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^little_helper2.lnk]
path=c:\dokumente und einstellungen\All Users\Startmenü\Programme\Autostart\little_helper2.lnk
backup=c:\windows\pss\little_helper2.lnkCommon Startup
[HKLM\~\startupfolder\C:^Dokumente und Einstellungen^***^Startmenü^Programme^Autostart^Last.fm Helper.lnk]
path=c:\dokumente und einstellungen\***\Startmenü\Programme\Autostart\Last.fm Helper.lnk
backup=c:\windows\pss\Last.fm Helper.lnkStartup
[HKLM\~\startupfolder\C:^Dokumente und Einstellungen^***^Startmenü^Programme^Autostart^Screen Saver Control.lnk]
path=c:\dokumente und einstellungen\***\Startmenü\Programme\Autostart\Screen Saver Control.lnk
backup=c:\windows\pss\Screen Saver Control.lnkStartup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2010-09-23 02:47 35760 ----a-w- c:\programme\Adobe\Reader 9.0\Reader\reader_sl.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2006-02-23 13:45 278528 ----a-w- c:\programme\iTunes\iTunesHelper.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechQuickCamRibbon]
2009-05-08 09:35 2780432 ----a-w- c:\programme\Logitech\Logitech WebCam Software\LWS.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2006-04-26 18:43 155648 ----a-w- c:\programme\QuickTime\qttask.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
2008-04-29 02:23 185896 ----a-w- c:\programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
2010-12-06 22:02 74752 ----a-w- c:\programme\Winamp\winampa.exe
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\SAGENT4.EXE"=
"c:\\Programme\\Java\\jre1.5.0_06\\bin\\javaw.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Programme\\iTunes\\iTunes.exe"=
"c:\\Programme\\BitTorrent\\bittorrent.exe"=
"c:\\Programme\\ICQ6.5\\ICQ.exe"=
"c:\\Programme\\Skype\\Phone\\Skype.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"20:TCP"= 20:TCP:o2 DSL FTP 20
"23:TCP"= 23:TCP:o2 DSL Telnet 23
"161:UDP"= 161:UDP:o2 DSL SNMP 161
R0 tffsport;M-Systems DiskOnChip-2000;c:\windows\system32\drivers\tffsport.sys [08.04.2007 17:55 149376]
R2 AntiVirSchedulerService;Avira AntiVir Planer;c:\programme\Avira\AntiVir Desktop\sched.exe [30.10.2010 02:58 135336]
R2 SweepNet;Sophos Anti-Virus Network;c:\programme\Sophos SWEEP for NT\SWNETSUP.EXE [10.10.2005 23:23 159744]
R3 CONAN;CONAN;c:\windows\system32\drivers\o2mmb.sys [16.09.2005 00:59 191092]
S2 gupdate;Google Update Service (gupdate);c:\programme\Google\Update\GoogleUpdate.exe [06.01.2010 23:29 135664]
S3 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance;c:\magix\Common\Database\bin\fbserver.exe --> c:\magix\Common\Database\bin\fbserver.exe [?]
S3 InterCheck Control;InterCheck Control;c:\programme\Sophos SWEEP for NT\ICNTDRV5.SYS [10.10.2005 23:23 68592]
S3 InterCheck Filter;InterCheck Filter;c:\programme\Sophos SWEEP for NT\ICNTFLT5.SYS [10.10.2005 23:23 16080]
S3 InterCheck Support 01;InterCheck Support 01;c:\programme\Sophos SWEEP for NT\ICNTST01.SYS [10.10.2005 23:23 5232]
S3 InterCheck Support 02;InterCheck Support 02;c:\programme\Sophos SWEEP for NT\ICNTST02.SYS [10.10.2005 23:23 5232]
S3 InterCheck Support 03;InterCheck Support 03;c:\programme\Sophos SWEEP for NT\ICNTST03.SYS [10.10.2005 23:23 5232]
S3 InterCheck Support 04;InterCheck Support 04;c:\programme\Sophos SWEEP for NT\ICNTST04.SYS [10.10.2005 23:23 5232]
S3 InterCheck Support 05;InterCheck Support 05;c:\programme\Sophos SWEEP for NT\ICNTST05.SYS [10.10.2005 23:23 5232]
S3 InterCheck Support 06;InterCheck Support 06;c:\programme\Sophos SWEEP for NT\ICNTST06.SYS [10.10.2005 23:23 5232]
S3 InterCheck Support 07;InterCheck Support 07;c:\programme\Sophos SWEEP for NT\ICNTST07.SYS [10.10.2005 23:23 5232]
S3 InterCheck Support 08;InterCheck Support 08;c:\programme\Sophos SWEEP for NT\ICNTST08.SYS [10.10.2005 23:23 5232]
S3 InterCheck Support 09;InterCheck Support 09;c:\programme\Sophos SWEEP for NT\ICNTST09.SYS [10.10.2005 23:23 5232]
S3 InterCheck Support 10;InterCheck Support 10;c:\programme\Sophos SWEEP for NT\ICNTST10.SYS [10.10.2005 23:23 5232]
S3 InterCheck Support 11;InterCheck Support 11;c:\programme\Sophos SWEEP for NT\ICNTST11.SYS [10.10.2005 23:23 5232]
S3 InterCheck Support 12;InterCheck Support 12;c:\programme\Sophos SWEEP for NT\ICNTST12.SYS [10.10.2005 23:23 5232]
S3 MbxStby;MbxStby;c:\windows\system32\drivers\MbxStby.sys [16.09.2005 00:59 6100]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
getPlusHelper REG_MULTI_SZ getPlusHelper
.
Inhalt des "geplante Tasks" Ordners
2006-12-10 c:\windows\Tasks\FRU Task 2003-04-06 08:52ewlett-Packard2003-04-06 08:52p psc 1200 series5E771253C1676EBED677BF361FDFC537825E15B8156859866.job
- c:\programme\Hewlett-Packard\Digital Imaging\Bin\hpqfrucl.exe [2003-04-05 22:52]
2011-02-11 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\programme\Google\Update\GoogleUpdate.exe [2010-01-06 22:29]
2011-02-11 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\programme\Google\Update\GoogleUpdate.exe [2010-01-06 22:29]
2011-02-11 c:\windows\Tasks\Symantec NetDetect.job
- c:\programme\Symantec\LiveUpdate\NDETECT.EXE [2005-09-27 09:32]
.
.
------- Zusätzlicher Suchlauf -------
.
uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
uStart Page = hxxp://www.google.de/
mWindow Title =
uInternet Settings,ProxyOverride = <local>
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://go.gmx.net/suchbox/gmxsuche?su=%s
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: Google Sidewiki... - c:\programme\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html
TCP: {138C17CF-A9D4-45AE-AD22-6DC816A63E0D} = 213.191.74.18 62.109.123.196
DPF: {AE2B937E-EA7D-4A8D-888C-B68D7F72A3C4} - hxxp://as.photoprintit.de/ips-opdata/layout/default01/activex/IPSUploader4.cab
FF - ProfilePath - c:\dokumente und einstellungen\***\Anwendungsdaten\Mozilla\Firefox\Profiles\z8dpfy2k.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.google.ca/
FF - prefs.js: keyword.URL - hxxp://search.icq.com/search/afe_results.php?ch_id=afex&q=
FF - prefs.js: network.proxy.type - 4
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\programme\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} - c:\programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}
FF - Ext: ICQ Toolbar: {800b5000-a755-47e1-992b-48a1c1357f07} - c:\programme\Mozilla Firefox\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - c:\programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} - c:\programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF - Ext: Java Quick Starter: jqs@sun.com - c:\programme\Java\jre6\lib\deploy\jqs\ff
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF - Ext: Adobe DLM (powered by getPlus(R)): {E2883E8F-472F-4fb0-9522-AC9BF37916A7} - %profile%\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}
FF - Ext: Firefox Universal Uploader (fireuploader): {0200c2a9-70da-4f6d-b527-f5f7d7877228} - %profile%\extensions\{0200c2a9-70da-4f6d-b527-f5f7d7877228}
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
Toolbar-Locked - (no file)
HKLM-Run-little_helper2.exe - (no file)
HKU-Default-RunOnce-ICQ Lite - c:\progra~1\ICQLite\ICQLite.exe
MSConfigStartUp-Regscan - c:\windows\system32\regscan.exe
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2011-02-11 16:11
Windows 5.1.2600 Service Pack 3 NTFS
Scanne versteckte Prozesse...
Scanne versteckte Autostarteinträge...
Scanne versteckte Dateien...
Scan erfolgreich abgeschlossen
versteckte Dateien: 0
**************************************************************************
[HKEY_LOCAL_MACHINE\System\ControlSet002\Services\vsdatant]
"ImagePath"=""
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{1454a5b7-3445-436f-b097-67e478c49c4e}]
@Denied: (Full) (Everyone)
"Model"=dword:00000047
"Therad"=dword:00000020
"MData"=hex(0):2b,8f,78,29,5a,0c,ce,ec,48,d4,68,e5,9f,6a,96,3e,ab,de,c5,81,26,
38,95,44,85,b1,12,f9,90,dd,23,a1,a0,25,31,d6,ce,de,c2,bf,c4,9f,27,cf,25,5d,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}]
@Denied: (Full) (Everyone)
"scansk"=hex(0):cf,3c,2e,37,32,01,9e,4d,ec,44,67,ac,d0,a0,d0,42,e0,68,97,e6,53,
32,a3,50,18,1a,2f,25,da,ba,74,33,fb,13,90,6a,85,07,71,7d,00,00,00,00,00,00,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe,-101"
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe"
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------
- - - - - - - > 'winlogon.exe'(872)
c:\windows\system32\Ati2evxx.dll
- - - - - - - > 'explorer.exe'(3504)
c:\windows\TEMP\logishrd\LVPrcInj01.dll
c:\windows\system32\mshtml.dll
c:\windows\system32\msls31.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\programme\Avira\AntiVir Desktop\avguard.exe
c:\programme\Java\jre6\bin\jqs.exe
c:\programme\Gemeinsame Dateien\LogiShrd\LVMVFM\LVPrcSrv.exe
c:\programme\Avira\AntiVir Desktop\avshadow.exe
c:\windows\system32\Ati2evxx.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2011-02-11 16:17:23 - PC wurde neu gestartet
ComboFix-quarantined-files.txt 2011-02-11 15:17
Vor Suchlauf: 19 Verzeichnis(se), 13.318.266.880 Bytes frei
Nach Suchlauf: 21 Verzeichnis(se), 13.267.243.008 Bytes frei
WindowsXP-KB310994-SP2-Home-BootDisk-DEU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect
- - End Of File - - E8C9F2F51BE3186B975E4BE0052B1914
11.02.2011, 16:24
Baum-Darstellung