Hallo,

ich benutze Eudora 7.6 als Mail-Client auf dem Rechner. Die AOL-Software habe ich nicht installiert.

Mein Rechner: ASUS Z53T mit Windows Home Premium 32-bit.

Gestern bekam ich einen Anruf, dass jemand von meinem AOL-Account eine Mail mit dem Betreff "Vi..a" und als Inhalt nur ein Link bekommen hat.

Mein Rechner war zu der Zeit online, aber im Ausgangsordner von Eudora sind keine Mails gewesen, wie das eigentlich der Fall hätte sein müssen.
Also bin ich über den Browser zum Web-Interface von AOL. Dort waren die Mails im Sent Ordner. Das sind sie normalerweise nicht, wenn ich vom PC aus Mails verschicke. Ich habe den AOL-Account als POP3 eingerichtet.

Versendet wurden sie an alle gespeicherten Adressen und die, die AOL zusätzlich noch sammelt.

Ich hoffe, dass "nur" mein AOL-Account auf dem Server zum Opfer fiel und nicht mein Rechner.

Bisher gemacht habe ich folgendes:
Suche mit Avira Premium (kein Fund)
Onlinesuche mit Trend Micro Housecall (kein Fund)
Scan mit Malwarebytes. Hier wurden zwei Skripte gefunden, die Bestandteil von FixFoto sind, aber ich habe sie trotzdem löschen lassen
Scan mit ComboFix (Log anbei)
Scan mit HiJackThis (Log anbei)

Verdächtiges ist mir in der letzten Zeit nichts aufgefallen, auch nichts angeklickt. (Ist mir früher schon passiert, seitdem bin ich vorsichtig geworden) Die Mails sind einmal versendet worden, innerhalb von drei Minuten. Das AOL-Passwort habe ich daraufhin von einem anderen Rechner aus geändert.


Log von HiJackThis:
-------------------
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:23:43, on 19.04.2011
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v9.00 (9.00.8112.16421)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\FreePDF_XP\fpassist.exe
C:\Users\Admin\Desktop\HijackThis.exe
C:\Users\Admin\Desktop\hijack\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Program Files\Free Download Manager\iefdm2.dll
O4 - HKLM\..\Run: [FreePDF Assistant] C:\Program Files\FreePDF_XP\fpassist.exe
O4 - HKLM\..\Run: [OODefragTray] C:\Program Files\OO Software\Defrag\oodtray.exe
O8 - Extra context menu item: Alles mit FDM herunterladen - file://C:\Program Files\Free Download Manager\dlall.htm
O8 - Extra context menu item: Auswahl mit FDM herunterladen - file://C:\Program Files\Free Download Manager\dlselected.htm
O8 - Extra context menu item: Datei mit FDM herunterladen - file://C:\Program Files\Free Download Manager\dllink.htm
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Videos mit FDM herunterladen - file://C:\Program Files\Free Download Manager\dlfvideo.htm
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} -
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
O23 - Service: ASLDR Service (ASLDRService) - Unknown owner - C:\Program Files\ATK Hotkey\ASLDRSrv.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: AVM IGD CTRL Service (IGDCTRL) - AVM Berlin - C:\Program Files\FRITZ!DSL\IGDCTRL.EXE
O23 - Service: Nalpeiron Licensing Service (nlsX86cc) - Nalpeiron Ltd. - C:\Windows\system32\nlssrv32.exe
O23 - Service: O&O Defrag (OODefragAgent) - O&O Software GmbH - C:\Program Files\OO Software\Defrag\oodag.exe
O23 - Service: Radio.fx Server (Radio.fx) - Unknown owner - C:\Program Files\Tobit Radio.fx\Server\rfx-server.exe
O23 - Service: RoxMediaDB12 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\12.0\SharedCOM\RoxMediaDB12.exe
O23 - Service: Roxio Hard Drive Watcher 12 (RoxWatch12) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\12.0\SharedCOM\RoxWatch12.exe
O23 - Service: Sandboxie Service (SbieSvc) - SANDBOXIE L.T.D - C:\Program Files\Sandboxie\SbieSvc.exe
O23 - Service: spmgr - Unknown owner - C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe
O23 - Service: SwitchBoard - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe

--
End of file - 3930 bytes






Log von ComboFix:
------------------
ComboFix 11-04-18.02 - Admin 19.04.2011 10:45:46.1.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.49.1031.18.2046.1194 [GMT 2:00]
ausgeführt von:: c:\users\Admin\Desktop\ComboFix.exe
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\XSxS
.
.
((((((((((((((((((((((( Dateien erstellt von 2011-03-19 bis 2011-04-19 ))))))))))))))))))))))))))))))
.
.
2011-04-19 08:55 . 2011-04-19 08:55 -------- d-----w- c:\users\Schattenfee\AppData\Local\temp
2011-04-19 08:55 . 2011-04-19 08:55 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-04-19 08:55 . 2011-04-19 08:55 -------- d-----w- c:\users\Dunkelrabe\AppData\Local\temp
2011-04-19 03:58 . 2011-04-19 03:58 -------- d-----w- c:\users\Admin\AppData\Roaming\GMX
2011-04-16 05:26 . 2011-03-15 04:05 6792528 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{374F84B8-01C0-47A7-96CB-02BAE42F2C0A}\mpengine.dll
2011-04-13 17:15 . 2011-04-13 17:15 -------- d-----w- c:\users\Schattenfee\AppData\Local\O&O
2011-04-13 16:37 . 2011-02-18 14:03 305152 ----a-w- c:\windows\system32\drivers\srv.sys
2011-04-13 16:37 . 2011-02-18 14:03 146432 ----a-w- c:\windows\system32\drivers\srv2.sys
2011-04-13 16:37 . 2011-03-03 10:50 2409784 ----a-w- c:\program files\Windows Mail\OESpamFilter.dat
2011-04-13 16:37 . 2011-02-18 14:03 102400 ----a-w- c:\windows\system32\drivers\srvnet.sys
2011-04-13 16:37 . 2011-03-03 15:42 739328 ----a-w- c:\windows\system32\inetcomm.dll
2011-04-13 16:36 . 2011-02-22 13:24 213504 ----a-w- c:\windows\system32\drivers\mrxsmb10.sys
2011-04-13 16:36 . 2011-02-22 13:24 79360 ----a-w- c:\windows\system32\drivers\mrxsmb20.sys
2011-04-13 16:36 . 2011-02-22 13:23 106496 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2011-04-13 16:36 . 2011-02-22 13:23 69632 ----a-w- c:\windows\system32\drivers\bowser.sys
2011-04-13 16:36 . 2011-03-10 17:03 1162240 ----a-w- c:\windows\system32\mfc42u.dll
2011-04-13 16:36 . 2011-03-10 17:03 1136640 ----a-w- c:\windows\system32\mfc42.dll
2011-04-13 16:36 . 2011-02-16 16:16 34304 ----a-w- c:\windows\system32\atmlib.dll
2011-04-13 16:36 . 2011-02-16 14:02 292864 ----a-w- c:\windows\system32\atmfd.dll
2011-04-13 16:36 . 2011-03-03 13:25 2041856 ----a-w- c:\windows\system32\win32k.sys
2011-04-13 16:35 . 2011-03-02 15:44 86528 ----a-w- c:\windows\system32\dnsrslvr.dll
2011-04-13 16:35 . 2009-05-04 09:59 25088 ----a-w- c:\windows\system32\dnscacheugc.exe
2011-04-11 15:38 . 2011-04-11 15:38 -------- d-----w- c:\users\Schattenfee\AppData\Local\GMX
2011-04-11 15:38 . 2011-04-11 15:38 -------- d-----w- c:\users\Admin\AppData\Local\GMX
2011-04-11 15:38 . 2011-04-11 15:38 -------- d-----w- c:\programdata\GMX
2011-04-11 15:38 . 2010-11-19 15:33 7680 ----a-w- c:\windows\system32\uigxnp.dll
2011-04-11 15:38 . 2010-11-19 15:33 144384 ----a-w- c:\windows\system32\drivers\uigxrdr.SYS
2011-04-11 15:38 . 2011-04-11 15:38 -------- d-----w- c:\program files\GMX
2011-04-09 14:41 . 2011-04-11 15:49 -------- d-----r- c:\users\Schattenfee\Dropbox
2011-04-07 17:30 . 2011-04-07 17:30 -------- d-----w- c:\programdata\FUJIFILM
2011-03-29 22:17 . 2011-03-29 22:17 316928 ----a-w- c:\windows\system32\HDREfexProFC32.dll
2011-03-23 14:53 . 2011-03-23 14:53 -------- d-----w- c:\users\Schattenfee\AppData\Roaming\Miranda
2011-03-23 13:23 . 2011-02-22 13:33 1068544 ----a-w- c:\windows\system32\DWrite.dll
2011-03-23 13:23 . 2011-02-22 13:33 797696 ----a-w- c:\windows\system32\FntCache.dll
2011-03-23 13:23 . 2011-02-22 14:13 288768 ----a-w- c:\windows\system32\XpsGdiConverter.dll
2011-03-22 07:26 . 2011-03-22 07:26 -------- d-----w- c:\users\Admin\AppData\Roaming\Miranda
2011-03-22 07:25 . 2011-03-22 07:25 -------- d-----w- c:\program files\Miranda IM
2011-03-20 18:57 . 2011-04-11 15:50 -------- d-----w- c:\users\Schattenfee\AppData\Roaming\Dropbox
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-04-19 08:36 . 2007-03-31 16:25 45056 ----a-w- c:\windows\system32\acovcnt.exe
2011-03-23 15:08 . 2010-06-01 18:24 3528024 ----a-w- c:\windows\RXSUnins.exe
2011-03-23 15:08 . 2010-06-01 18:24 3528024 ----a-w- c:\windows\RXCUnins.exe
2011-02-02 17:11 . 2010-02-16 19:42 222080 ------w- c:\windows\system32\MpSigStub.exe
2011-01-25 10:41 . 2011-01-25 10:41 1627976 ----a-w- c:\windows\system32\ooscrsav.scr
2011-01-25 10:40 . 2011-01-25 10:40 275784 ----a-w- c:\windows\system32\oodbs.exe
2011-01-25 10:40 . 2011-01-25 10:40 535880 ----a-w- c:\windows\system32\oodssrs.dll
2011-01-25 10:40 . 2011-01-25 10:40 10056 ----a-w- c:\windows\system32\oodbsrs.dll
2011-01-20 16:37 . 2011-02-09 08:36 638336 ----a-w- c:\windows\system32\drivers\dxgkrnl.sys
2011-01-20 16:08 . 2011-02-09 08:36 478720 ----a-w- c:\windows\system32\dxgi.dll
2011-01-20 16:08 . 2011-02-09 08:36 219648 ----a-w- c:\windows\system32\d3d10_1core.dll
2011-01-20 16:08 . 2011-02-09 08:36 160768 ----a-w- c:\windows\system32\d3d10_1.dll
2011-01-20 16:08 . 2011-02-09 08:36 189952 ----a-w- c:\windows\system32\d3d10core.dll
2011-01-20 16:08 . 2011-02-09 08:36 1029120 ----a-w- c:\windows\system32\d3d10.dll
2011-01-20 16:07 . 2011-02-09 08:36 37376 ----a-w- c:\windows\system32\cdd.dll
2011-01-20 16:07 . 2011-02-09 08:36 258048 ----a-w- c:\windows\system32\winspool.drv
2011-01-20 16:07 . 2011-02-09 08:36 586240 ----a-w- c:\windows\system32\stobject.dll
2011-01-20 16:06 . 2011-02-09 08:36 2873344 ----a-w- c:\windows\system32\mf.dll
2011-01-20 16:06 . 2011-02-09 08:36 26112 ----a-w- c:\windows\system32\printfilterpipelineprxy.dll
2011-01-20 16:04 . 2011-02-09 08:36 209920 ----a-w- c:\windows\system32\mfplat.dll
2011-01-20 16:04 . 2011-02-09 08:36 98816 ----a-w- c:\windows\system32\mfps.dll
2011-01-20 14:28 . 2011-02-09 08:36 1554432 ----a-w- c:\windows\system32\xpsservices.dll
2011-01-20 14:27 . 2011-02-09 08:36 876032 ----a-w- c:\windows\system32\XpsPrint.dll
2011-01-20 14:26 . 2011-02-09 08:36 667648 ----a-w- c:\windows\system32\printfilterpipelinesvc.exe
2011-01-20 14:25 . 2011-02-09 08:36 847360 ----a-w- c:\windows\system32\OpcServices.dll
2011-01-20 14:24 . 2011-02-09 08:36 135680 ----a-w- c:\windows\system32\XpsRasterService.dll
2011-01-20 14:15 . 2011-02-09 08:36 979456 ----a-w- c:\windows\system32\MFH264Dec.dll
2011-01-20 14:14 . 2011-02-09 08:36 357376 ----a-w- c:\windows\system32\MFHEAACdec.dll
2011-01-20 14:14 . 2011-02-09 08:36 261632 ----a-w- c:\windows\system32\mfreadwrite.dll
2011-01-20 14:14 . 2011-02-09 08:36 302592 ----a-w- c:\windows\system32\mfmp4src.dll
2011-01-20 14:12 . 2011-02-09 08:36 1172480 ----a-w- c:\windows\system32\d3d10warp.dll
2011-01-20 14:11 . 2011-02-09 08:36 486400 ----a-w- c:\windows\system32\d3d10level9.dll
2011-01-20 13:47 . 2011-02-09 08:36 683008 ----a-w- c:\windows\system32\d2d1.dll
1999-05-06 06:22 224150 --sha-r- c:\windows\ConfigSetRoot\IO.SYS
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2009-12-09 01:19 94208 ----a-w- c:\users\Admin\AppData\Roaming\Dropbox\bin\DropboxExt.13.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2009-12-09 01:19 94208 ----a-w- c:\users\Admin\AppData\Roaming\Dropbox\bin\DropboxExt.13.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2009-12-09 01:19 94208 ----a-w- c:\users\Admin\AppData\Roaming\Dropbox\bin\DropboxExt.13.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"FreePDF Assistant"="c:\program files\FreePDF_XP\fpassist.exe" [2010-06-17 370176]
"OODefragTray"="c:\program files\OO Software\Defrag\oodtray.exe" [2011-01-25 2781000]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{EDB0E980-90BD-11D4-8599-0008C7D3B6F8}"= "c:\eudora\EuShlExt.dll" [2006-08-17 86016]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0OODBS
.
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^FRITZ!DSL Startcenter.lnk]
backup=c:\windows\pss\FRITZ!DSL Startcenter.lnk.CommonStartup
backupExtension=.CommonStartup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InnoSetupRegFile.0000000001]
2010-07-02 11:53 673280 ----a-w- c:\windows\is-AMRPP.exe
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"EPSON Stylus Photo R265 Series"=c:\windows\system32\spool\DRIVERS\W32X86\3\E_FATIBNE.EXE /FU "c:\windows\TEMP\E_S2185.tmp" /EF "HKCU"
"ehTray.exe"=c:\windows\ehome\ehTray.exe
"SandboxieControl"="c:\program files\Sandboxie\SbieCtrl.exe"
"Device Detection"=c:\program files\FUJIFILM\MyFinePix Studio HS20\dd.exe
"rfxsrvtray"="c:\program files\Tobit Radio.fx\Client\rfx-tray.exe"
"GMX_GMX Upload-Manager"="c:\program files\GMX\GMX Upload-Manager\DAVSRV.EXE" /hide
"Sidebar"=c:\program files\Windows Sidebar\sidebar.exe /autoRun
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"RtHDVCpl"=RtHDVCpl.exe
"PowerForPhone"=c:\program files\PowerForPhone\PowerForPhone\PowerForPhone.exe
"NvCplDaemon"=RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
"NvSvc"=RUNDLL32.EXE c:\windows\system32\nvsvc.dll,nvsvcStart
"SMSERIAL"=c:\program files\Motorola\SMSERIAL\sm56hlpr.exe
"NvMediaCenter"=RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
"CPMonitor"="c:\program files\Roxio 2010\5.0\CPMonitor.exe"
"RoxWatchTray"="c:\program files\Common Files\Roxio Shared\12.0\SharedCOM\RoxWatchTray12.exe"
"Desktop Disc Tool"="c:\program files\Roxio 2010\Roxio Burn\RoxioBurnLauncher.exe"
"SwitchBoard"=c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
"AdobeAAMUpdater-1.0"="c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe"
"FreePDF Assistant"=c:\program files\FreePDF_XP\fpassist.exe
"AdobeCS5ServiceManager"="c:\program files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" -launchedbylogin
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" -atboottime
"OODefragTray"=c:\program files\OO Software\Defrag\oodtray.exe
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 10.0\Reader\Reader_sl.exe"
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
"TrueImageMonitor.exe"=c:\program files\Acronis\TrueImageHome\TrueImageMonitor.exe
"Acronis Scheduler2 Service"="c:\program files\Common Files\Acronis\Schedule2\schedhlp.exe"
"AcronisTimounterMonitor"=c:\program files\Acronis\TrueImageHome\TimounterMonitor.exe
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" /min
"Run StartupMonitor"=StartupMonitor.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-2267383666-1444571696-4105452916-1000]
"EnableNotificationsRef"=dword:00000001
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs REG_MULTI_SZ BthServ
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
getPlusHelper REG_MULTI_SZ getPlusHelper
.
Inhalt des "geplante Tasks" Ordners
.
2011-04-19 c:\windows\Tasks\GlaryInitialize.job
- c:\program files\Glary Utilities\initialize.exe [2009-03-12 15:24]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = about:blank
IE: Alles mit FDM herunterladen - file://c:\program files\Free Download Manager\dlall.htm
IE: Auswahl mit FDM herunterladen - file://c:\program files\Free Download Manager\dlselected.htm
IE: Datei mit FDM herunterladen - file://c:\program files\Free Download Manager\dllink.htm
IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Videos mit FDM herunterladen - file://c:\program files\Free Download Manager\dlfvideo.htm
LSP: c:\program files\FRITZ!DSL\\sarah.dll
FF - ProfilePath - c:\users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\l5rhltpp.default\
FF - prefs.js: browser.startup.homepage - about:blank
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF - Ext: Adblock Plus: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} - %profile%\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
FF - Ext: NoScript: {73a6fe31-595d-460b-a920-fcc0f8843232} - %profile%\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}
FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: nglayout.initialpaint.delay - 600
FF - user.js: content.notify.interval - 600000
FF - user.js: content.max.tokenizing.time - 1800000
FF - user.js: content.switch.threshold - 600000
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
MSConfigStartUp-FlashPlayerUpdate - c:\windows\system32\Macromed\Flash\FlashUtil10e.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2011-04-19 10:55
Windows 6.0.6002 Service Pack 2 NTFS
.
Scanne versteckte Prozesse...
.
Scanne versteckte Autostarteinträge...
.
Scanne versteckte Dateien...
.
Scan erfolgreich abgeschlossen
versteckte Dateien: 0
.
**************************************************************************
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\S-1-5-21-2267383666-1444571696-4105452916-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.arw\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 4.arw"
.
[HKEY_USERS\S-1-5-21-2267383666-1444571696-4105452916-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 4.bmp"
.
[HKEY_USERS\S-1-5-21-2267383666-1444571696-4105452916-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cr2\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 4.cr2"
.
[HKEY_USERS\S-1-5-21-2267383666-1444571696-4105452916-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.crw\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 4.crw"
.
[HKEY_USERS\S-1-5-21-2267383666-1444571696-4105452916-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dcr\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 4.dcr"
.
[HKEY_USERS\S-1-5-21-2267383666-1444571696-4105452916-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 4.dib"
.
[HKEY_USERS\S-1-5-21-2267383666-1444571696-4105452916-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dng\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 4.dng"
.
[HKEY_USERS\S-1-5-21-2267383666-1444571696-4105452916-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.emf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 4.emf"
.
[HKEY_USERS\S-1-5-21-2267383666-1444571696-4105452916-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.erf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 4.erf"
.
[HKEY_USERS\S-1-5-21-2267383666-1444571696-4105452916-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.fpx\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 4.fpx"
.
[HKEY_USERS\S-1-5-21-2267383666-1444571696-4105452916-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 4.gif"
.
[HKEY_USERS\S-1-5-21-2267383666-1444571696-4105452916-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.hdr\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 4.hdr"
.
[HKEY_USERS\S-1-5-21-2267383666-1444571696-4105452916-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.ico"
.
[HKEY_USERS\S-1-5-21-2267383666-1444571696-4105452916-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jfif\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 4.jfif"
.
[HKEY_USERS\S-1-5-21-2267383666-1444571696-4105452916-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpe\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 4.jpe"
.
[HKEY_USERS\S-1-5-21-2267383666-1444571696-4105452916-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 4.jpeg"
.
[HKEY_USERS\S-1-5-21-2267383666-1444571696-4105452916-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg\UserChoice]
@Denied: (2) (LocalSystem)
@Denied: (2) (S-1-5-21-2267383666-1444571696-4105452916-1000)
"Progid"="ACDSee Pro 4.jpg"
.
[HKEY_USERS\S-1-5-21-2267383666-1444571696-4105452916-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mos\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 4.mos"
.
[HKEY_USERS\S-1-5-21-2267383666-1444571696-4105452916-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mrw\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 4.mrw"
.
[HKEY_USERS\S-1-5-21-2267383666-1444571696-4105452916-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.nrw\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 4.nrw"
.
[HKEY_USERS\S-1-5-21-2267383666-1444571696-4105452916-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.orf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 4.orf"
.
[HKEY_USERS\S-1-5-21-2267383666-1444571696-4105452916-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pbm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 4.pbm"
.
[HKEY_USERS\S-1-5-21-2267383666-1444571696-4105452916-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pcd\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 4.pcd"
.
[HKEY_USERS\S-1-5-21-2267383666-1444571696-4105452916-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pcx\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 4.pcx"
.
[HKEY_USERS\S-1-5-21-2267383666-1444571696-4105452916-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pef\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 4.pef"
.
[HKEY_USERS\S-1-5-21-2267383666-1444571696-4105452916-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 4.png"
.
[HKEY_USERS\S-1-5-21-2267383666-1444571696-4105452916-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.psd\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 4.psd"
.
[HKEY_USERS\S-1-5-21-2267383666-1444571696-4105452916-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 4.raf"
.
[HKEY_USERS\S-1-5-21-2267383666-1444571696-4105452916-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raw\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 4.raw"
.
[HKEY_USERS\S-1-5-21-2267383666-1444571696-4105452916-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rle\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 4.rle"
.
[HKEY_USERS\S-1-5-21-2267383666-1444571696-4105452916-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rw2\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 4.rw2"
.
[HKEY_USERS\S-1-5-21-2267383666-1444571696-4105452916-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.sr2\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 4.sr2"
.
[HKEY_USERS\S-1-5-21-2267383666-1444571696-4105452916-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.srf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 4.srf"
.
[HKEY_USERS\S-1-5-21-2267383666-1444571696-4105452916-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tga\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 4.tga"
.
[HKEY_USERS\S-1-5-21-2267383666-1444571696-4105452916-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tif\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 4.tif"
.
[HKEY_USERS\S-1-5-21-2267383666-1444571696-4105452916-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 4.tiff"
.
[HKEY_USERS\S-1-5-21-2267383666-1444571696-4105452916-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ttc\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 4.ttc"
.
[HKEY_USERS\S-1-5-21-2267383666-1444571696-4105452916-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ttf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 4.ttf"
.
[HKEY_USERS\S-1-5-21-2267383666-1444571696-4105452916-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 4.wmf"
.
[HKEY_USERS\S-1-5-21-2267383666-1444571696-4105452916-1000\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{7F5AEFD6-1854-9711-BD8D-D3419FA6930F}*]
"gafibjmmeglapm"=hex:62,61,66,6b,00,58
"hafibjmmkffojicj"=hex:69,61,6f,6e,70,68,65,6f,6f,6f,66,6b,61,6d,6c,70,6c,63,
00,00
.
[HKEY_USERS\S-1-5-21-2267383666-1444571696-4105452916-1000\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{FA810C6B-FCB6-71B8-1262-8FBB7D768884}*]
"habmeojcehflbiko"=hex:69,61,61,67,68,68,6f,65,66,67,6a,6f,70,6e,70,61,61,69,
00,00
"gabmeojcoglfkj"=hex:62,61,70,66,00,fa
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7F5AEFD6-1854-9711-BD8D-D3419FA6930F}\InProcServer32*]
"kaejalhbdnocikcajnbpfh"=hex:62,61,65,6b,00,f9
"kaejmkccmpeloagiminocj"=hex:6c,61,6b,69,67,69,61,63,6f,67,64,63,6f,65,6f,66,
69,6a,62,70,62,70,63,64,00,d0
"haejclolekpgbobo"=hex:62,61,64,6b,00,00
"iaejclolekbenojlod"=hex:69,61,6f,6e,70,68,64,6f,6c,69,6c,62,6e,6e,6d,61,68,6b,
00,00
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10o_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10o_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\System*]
"OOCC06.00.00.01WSSV"="8108DDAFDBD9E25AA4C56A86EFACC0335152592092171A281B0A504F6EBBAC0D4CB208CC4AEFE7B9774A69C2E633967A1F17CAAAE6E7A3D75F95337ACDEA60A C362F311F02EC6B04D7C3C349F0A996530B814C8B34E46E7C218C9947CB3AC02675F9F9E46A3F41D90195E964CEF435FBFC7A3E3BB1853091927FF479B8D665D2A4E8084F0BE8851018F8D 1D3E10BAD65BFC189A23AD5E3C3C8CE404A8B0129BBBFA382051400FEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74 CA6A0AC4980AC79335D575E7D6A3B9808A6A0AC4980AC7933A6A0AC4980AC79337DE9A538A07C0C104C6ADB1152330364955F1024C69FEE60E59685ACB552712B1DF484EA219352107A4ED C96E622C4A1BD07F5306A3FC528D28A748FC98B856192136A54A3B1E01212B41A1B70E66FE8FC4C4C8666B097A90AADAC15708AC034F12941CF35C9074D86E268BD2EDE0947C972702B4C6 0C4EAA1DB37C82E687BBD9253DA0D6C40B210904E8071E5DBBBDEDC6CA4F8312BCD8074287C870AAF312A0F60EA0EDE6C7BBBAB2500FE6025D56633E30F1BAF655B17A0584E048E6103384 6D08AA9A79D184598446883E8F347298DB33A9264D5B6EC0764DF42C8EFB23EDC5D350A6815E6365BC020EBD1F6A783706E16B471B7D057CFFA461E4CC5A9A237EE4C30C30568AA3CE16E7 C6ECD3169A65872A97C393BBB64FD00C3AFBD74E204A514EB619840564722024F1811BF60BC68866E2FFEAB95F1016AB58E27C08F30D2B4E5ECECB9FBCB33EC4EAA4BD703834C6E53B71E0 0756A4F4AC886C6E4CB6EFC3A97169240F55FF6233908F61D7F8F6326FEC6A2357D06E5C5A8BAD5D7CFB7DF95D1908E6531D884FDA494895B973C441267138CEE65BDF6E851D07DB3E846E 71B359359DC3055A93DF738E77FA1A43676DBD44C73774F662396F4603BF6193982B9DBE101063563006F606C9B882A3580FB4BCAAD953D50471C5411516E722BE82A2806CDDD9B66CB997 C64E4CA72F2BC3C36E3ACAFCD7F8DDBA2987DD75C46CE25BC1DE3F4701B0B5B039136F966521DE55DE4A44E8BF6912517726BCE9EC9199DE0F0099B629B0BECEAAB0D3CB4EE799588116A0 E44EB51196A8E6B834B288ED85FBC2738DDB77CD7B15A8BCCCB918BBC079F791D89C731AC5D50713AB388DB7389B148429A72757ED7BD77F8623DF11FA93C723EB129792AB091154C6E459 3DBB1F420488E056E9362E73AA37126AED5468595C958DF53302C1D9325D8EB27D4B0A001EBF5D9C51ED95D62C137B4A8CE360ECBAA5972502F1AB2CA451140F1F4E14066E1D111BC7A4A1 9A260B183A9C8575D1EDF599AE26D4987BF4079382E2624D5EA73667DF7D84508CE9A2AE6E0D98BEEBD7C3BC461840C429ABEBAFD7C29DA55517DBAA6"
"OODEFRAG11.00.00.01WORKSTATION"="46ECA36BC6F846503813A1D594AB895CE3D40D198728D9577ED4A2F8ED519CD78576B8761A0C8A88FC0F19D7F01E8B91467460ED7F58A84B7F51 F8B02A2287C477D0A231E1BF7D93AF1304CF767728FEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA6A0AC4980AC 79335D575E7D6A3B9808A6A0AC4980AC7933A6A0AC4980AC7933CB73200D11F15952B2E66022CF36928A06F9EA6C04F396C00D7ED5985CF599340D1A3B12613C34381C53B51639CB8C5347 9BA8D82D8240EF087356400C892816049E49A4D2C868BD256410ACA974D22CFEE6BF2F342990E2827FD3AFA7922B9D7E32CDDC3CA9585E7AB635AE687D99135682DD09EB0CB3B9C1707FF0 2FB062A97F709D576C9A76DA7ACC426B2E5AAE46A8F984039CF8E755C07B619317A8235F3E54663223F5CEB73A8AA630A91EEC4E863A06BF005D825C2BB551A8C660D423A5BC2491173FFC BB00B92654FC05C9F235958DE4C54B69B9631D7D489AE5F32352F0AB1DEF99B374C808572EBDECC7402D43171B117B19997E8F680DE267914C1897A2814ACEB6B0C187A89CF5D5040A1A5E 721078489D6F47D0E694E2BAD0D17CBD846D39CA6006502CD7FE24E7ACE15D63457686309EF0B988A3825355E92C3C539E93BF1F1DCA8C51F8393A6C82A48B3688043B56D09909411B7C60 55A915C3AC962ED7806F1D3F32F3B59D50DC6CEC1C897189017FA599EA20AEA9F9F18DB582DF76EDC7EADC6AF104E02925A61D7D41E6FC581C8B98845958C6C2A63356E871C7ACE3F13AAC C015BA2AAA23DBD9EEB2186703B566B79744BD77B4E37979E879EB160E209A752A84F9076322110C2562E3F7D681970E55459D76F9DCDFBEF2003EF73696DCE4C10F7AEF0A21EA61B728E7 771A56BB6972DC9900056215B8F94B0820183FE6E7D66548E1C841A54B74BD1533002E815B58EEA75237E6DE38258AE15BE5A63036ED1D42DDBD490EFDDB412F7CB6282B3AA5C112AFEA04 9554CD4B3B01C4FCC7C53D2F1CE6FA238673A135D02BDB0990A0AA82765F6A74A569038457664C98CED231F85E86055B84683080E41602B41EECEC3E46AA76998E17880CCCE60B70F95E68 3CE5C9D7A494DDA1EC2D1DB1B8D1C127EAC762437564BED2A0856302A393AC389EDEC161D5531AC72ABE9F64C1BE82C5DD93D7F8B050888DE1C03FA471F6C4262AD00282E6742526488186 0AA40EDC6AD29861B2180F5F175391E1DD3E96726EC992A391773B4B773F323884D7F8BC6B6A98D98199EEF2025EDE370915F8C802D0CD44584885A0A56AE2A32D754F54D1272921E8CBD5 35944FE32EF8A1B49982F484821540BFF6D285F63BCC3DF49A5A703397E0643C5E49562E3B71B4797CC74E8A83FAE76C6A53B528F32411604AF691F5A6D5BF2D6A4F"
"OODEFRAG12.00.00.01PROFESSIONAL"="6BB25C528797B614123B6509CDF6C714BAF48585E9605B34622E05D9F1C2A2EDE65E42A06B8869C49C71C9C006F00AD1A72A3542A2F4445B330 FE42E2B3FD3026E6802814033DAF75C4F52B0A8FEA4CFF54E603A23C72ED41B08EA4579DD02725281ACDD698169B5D7676F2ADFBCE05180F0F3467DC66EBAE8CA1FA4F17BB355F61B8801A 4E465AB280C44E0AB4BFD3BB5678F2595E250CC7F4E42B2FEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA6A0AC4 980AC7933A6171C11EC38DE3DA9C6AECB7A5D1407BA7FD869164D6794F75D4E034B19E785AC947A990575285B2CE242C4A0DE0B834FFE529E6F7D2507A446675A8786FB73BCE6E21F31E87 47D3C971AF3A38B9D34CD5D0FB81F1C41C3D25D6434C16D47C86D4BAF27C066EDAF5DD8117FE5014FAAA141A38C5ED4ADB3775EB8CD5F3CA11B9D4AE348127E09B07020D5F7568DCEF0D13 88DC2D4D7F9C75E84CF895B241866FC73F63E1381F0252CEC0E907A4505F0B84FBDA73998E9D52A8F87ECC419EB881057D466470700921CC05121E8FE0C7D869C18ABDACFF5964CC5B1223 BD511C3B00BDB444567CA669AA3ABA6CDD5B1C83D36F7E599F9C8A70DEF93F6F756B03E8A295E00B9C1166DDB1F1DBFEBA779ECB3B7280D6B56420B08D868DE44DBA6821F4EA4E363795AD D65421932159A18E493416A00D8E8F5252D52DEEC7D6C0300439DE8DC94B246CD8FA0086333927B13DDF674BD80FBAA40C032165C96500B079F3B5A0036583AB8894F4761C13DBE3A63006 E6C1298DB8AD9CF270C9514374F30D19C044298CD7CD469245AD087B603CB087553D3903A93E4071BFC168B3474460FC4434866485F470F65A38427687A113E9BE11F78A8D021B9EED3C44 861F18724E0BBEA7628078960C1B496118F1004D6E32761283E1E22CB95DCE3A6552D6BC6EC92E3439E7F9B86642851011A98C48AC9589A3BC7B65028F405CAC0D66940B05E0DFC8C12B74 DA96F4096F72ACCCB9238CEE091C33BE6B7E75C63FAE254A59F9A9614D11B8445FAF45FD9B516C8E3AF9107DE50E5B3766D3B1CABF7AA7A8FD47EBE1E5C889AFCAB7E8D24C4E90D2B26A92 2CEDF1608E13E311CB6A112CD4896D5B622B3DA17C2F107F610ECE27E95BDCA6605EA6F8461A101DA29A5B1266CADE6D6BAA6C6F8378AFE6B50C0F36467C0B1B9E5E2C0DC0115D1F93EF45 63D6C68E71998C73725D031C9DE2791C3EBBD808EAAE8FA8E25A099C5C0C5447FB10D99829D7DED4960D9AAC0E8ED75ACA586CE08EA1D2C115772B2EA961F8DE385E69457A5C1B1CE58EF3 D2FC511C93D050505B44DA333325000E8C98AC28C691F67B4F81A50724C9B843455560F2D38E3CFFDA34D328E93D124CADB4E3A44AE49CE566D8328517C9CDD5C669C"
"OOCC7.00.00.01PROSTATION"="28AF862F0C9C403933A4CA71637D2EEC8430D156D5923E1730825561D023E1F5BFB6DD76B9E55E9DC992FCA9E77E2DD653DB58ACF4242C0F883B7CC0D6 C59B56BBAD8B3F4B4573EBBF8531AE19C4FD6089006EEA187CCF4021E5305B8DA981D56EBDB6365C8642F3461051DC80543A5AD237E4BED478B89C45C4C44EBA25B7A75EF2D98A0094264B 3F251E951AD010D98F7E625937150A5BF000663E172F7544C6BDC5F039808A48C220AABDD986413AD5B9DBF03EF5FB76D7A290CF4CE2876614729A9F0200F2081D3EDFBCA5622516EC2EA1 3E5BE157ABDC1C172FFC024F8CEAC9D0D2476BF26BCC21F88057F5A54F5107FEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E12 7BECC74CA6A0AC4980AC7933A6171C11EC38DE3DA9C6AECB7A5D1407BA7FD869164D6794C89A0F4A0523E48ADA5D9F4EA574BB6EA120167793AE38C89F13E010C18CEF93B50598AFCA2276 9BE640FBC3CFBEC3505AE9422EACD7E9A7B401B06DF1881690C1DA0B583E22E6F3EEC1CCE655C895468E98BC0E172360AFF3103FA83D17D7B7DB6E8B77ED99EE8CA56724A1990C63D25680 23D82CADEC09FA07D7FE8F94C3FAC598B460FAC4794391BA870111C497DBA0FB097656D19445BBB03BCD69A01EB49735120D1A2426598FC670B849F24CACAC68F57015351257FA5B1D99DD 9C5B213AA2259895FB4874CF1DCC9C5DDED4F20F28E4777B3B5295D3D9A58C16B0A65EEE4562C6C8D3E69D55D18027018EB3C2309FC35DB110763DB403716FCFC7DF734685B37AA6F8BD43 F7FD5F777AD1228F4FB977987121D36C5DB10FB4D791964828CCF63C35F93DB4643EB44D24370DB57A6455450B9F75A663C383ED958115A8CE0E7ABA0B2C082A9833BE11EB9493741810A8 A1E18397D3331D4655804D52C4C83A85C5D72775B96A02AE4BD3858C6BDFB2B090EB05ACBE08A2C4C5A3707FB1794950D2DBC792E300522A2A72647E24DFC5A119B6A35997F5C05D3EA0AA 7D6719B788F9EB2D9D8755D04CFD72D226077748A0665FA177F0E065E4642B7F6342AF06CD78723D0A6CBBAF233F12377562DCB9CAC69A8514420203A3FE0C357C049CB53730EB9D00BA55 21AF86A3390FE997A12C2E2F96F168E98F557A9ED746CE14CE4BA46A3CDA7E9AE0E9910CC7CD3305084A3277E685A0770729E5D435F32C9B5F897E9149A92C5729B943C7913BB8D57C1C0E E4C5F78FE268C376B0E1EA890F74E00D1DB830172ABAFD20630E9AD88E8F0CA178CAA8BC34B4BD044CB4C6359C22B7BDD74166F8895B885402755FD509D6786ECA4FA7924AF3A28853C7D6 E54501E6A7A461776F3AD39FAAD84532D6706CB49C8772BA6255AF72A585FA9A31632C3B8478D7437BD96F7D17B33D6FE4C6EC09F5EC15DBDD5D77A19EB8F2"
"OODEFRAG14.00.00.01PROFESSIONAL"="8E3EB251AF2A66984659610C72B89F93179D7C4D063AA04F1D666F67C23896828C9424FD1C3941F96A647F0F052055E494533011979CB9429F9 AC81C9DA802C97531AD225D9649F157E3523CB9B0D5069E7CC284A4E50BC0DDF88400DE0AAE87BFCE3D9707A30124C7C3B3A67CCB9D20D5D69D130E192E1FFDAFB7F67A9FF4D837ACB1DA4 3051B154EF67284CA965BC0AD231B4B45FA7094FA72690978725C3E7A91620D4F23FEAC4CEE50AEB7FA755C6FA78A61521754BB21F797E1F44B279CFB4198F27C2948BA7AA7FEBC9E127BE CC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74C5D575E7D6A3B98089DB7CE019D40AA5CFEBC9E127BECC74CBA7FD869164D67942 A6C2B6ACB55DB27F929A1E222073F3C7E47C0846A2A4CEABC3C2EDF671F6873AD69CD1E9CD1E1262CDE8F14A3406B77B0A2125ACE87E12A60899181A287E98464A4284D941A50149BBDE00 69F4E4A09125814532F41FB17D3D71BACCCFB4AF283A350D9A7E8905049E0DEFC6AD50C81114063355A85AB1412D85CC9D252A612B18CEB6B045FE3BFAB8AE5810BE1B4758D55B20956E6D C07895DFE0155C4E9398B2C39EC0582DA48299F69DF3DDC1CFDDF33499C59DC4CD89EDBBBC1AB75D6C221F0870EBE395D5622A7ECA7F09A6C37521D0100524088F627F0E33EDDE5838C767 13C42F6512559E4D00AADC850A6C2A079478961D0F7D3ED5BD9EB297ED87A83624DBF29F9C2C5386CED0A9C951FC3FECF205159AE5365B2FC1485008916F134A24A0103481712D3EDDA98F 86AFC6591D09F35C463A724A8DC200888374B5EE731D0C6E634D9BAE56FA4781C2E3CD0F4CCF1D5DF56D38E76A69B371B9A5F2EF4B016146B9A163F0F2DB50F79A7AB39B4BA5498995810A 5B7A8B91846AC0C54A06A61AE5C3CAA2363098B05B97FEFD2D3331A27989A61EF79D5C275C9C5DDC7A8C991A3373DC96E6C063645B74301D648F4A7ED333427F64146115D9C2739823C5E1 4C0AD25F92CA84E5C0182E3AA7F7C61789D789E91C706B214A169755103805CEE9928E0966C07AFB52BDEB68C10CDFE1BAD27B8247331FACE588AB4314C8B9BB90640C14F42ED98907D427 6994C8F77B154B3C4B9922223D9DB14D336656C18A19FC3FA24C5369FCD725AC09BFB061872114869FC3AABCF5FCA4B9F92D79FF1E54737A5EE932C7E634B86942CEDEBD4A7A3BEB0708C9 6CE1F86284D4B339BED5A1ECE3ED7C911905A0C59D8BBEF6FC0AE11A98968A71B0D6C36D9733B8AC771E98C76A3600C1BD64F7C1AD60E59B217FAA34EC58D346B9CADC3418C0FF3FE0B8DB ECC9C5904F1F673A9C4BBBB80CBB69268231D5BD928B6DEDBF3F9490993685722A350E9DAB2B90D620A9AAF44C3A08FAF5528A54669358FF1BBFDBFE9485F6AE981CA"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------
.
- - - - - - - > 'Explorer.exe'(3084)
c:\users\Admin\AppData\Roaming\Dropbox\bin\DropboxExt.13.dll
c:\windows\System32\uigxnp.dll
.
Zeit der Fertigstellung: 2011-04-19 10:59:15
ComboFix-quarantined-files.txt 2011-04-19 08:59
.
Vor Suchlauf: 15 Verzeichnis(se), 10.687.016.960 Bytes frei
Nach Suchlauf: 19 Verzeichnis(se), 10.716.950.528 Bytes frei
.
- - End Of File - - 4FB9447F7BB92B91E78345E16A2458D6

Scan mit Malwarebytes. Hier wurden zwei Skripte gefunden, die Bestandteil von FixFoto sind, aber ich habe sie trotzdem löschen lassen
Scan mit ComboFix (Log anbei)
Scan mit HiJackThis (Log anbei)

1.) Man postet alle Logs von Malwarebytes vollständig!

2.) CF wird nicht auf eigene Faust ausgeführt! => Hinweise zu http://www.trojaner-board.de/95175-combofix.html

3.) Hijackthis ist heutzutage wertlos => http://www.trojaner-board.de/95173-b...es-posten.html

Danke & Entschuldigung