Trojaner-Board - GVU Trojaner mit Webcam Win7

hey markus,

habe ich so ausgeführt. Hier die .txt

Combofix Logfile:
Code:
ComboFix 12-07-11.03 - Benny 11.07.2012  17:56:48.1.4 - x86

Microsoft Windows 7 Home Premium   6.1.7601.1.1252.49.1031.18.3061.2014 [GMT 2:00]

ausgeführt von:: c:\users\Benny\Desktop\ComboFix.exe

AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}

SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

c:\programdata\FullRemove.exe

c:\users\Benny\AppData\Local\Temp\99cab429-f99d-4f69-9d04-113ad532bd0f\CliSecureRT.dll

c:\users\Benny\AppData\Roaming\.#

c:\windows\system32\muzapp.exe

.

.

(((((((((((((((((((((((   Dateien erstellt von 2012-06-11 bis 2012-07-11  ))))))))))))))))))))))))))))))

.

.

2012-07-11 16:03 . 2012-07-11 16:06        --------        d-----w-        c:\users\Benny\AppData\Local\temp

2012-07-11 16:03 . 2012-07-11 16:03        --------        d-----w-        c:\users\Default\AppData\Local\temp

2012-07-11 11:04 . 2012-06-12 02:40        2345984        ----a-w-        c:\windows\system32\win32k.sys

2012-07-11 10:26 . 2012-06-02 04:45        67440        ----a-w-        c:\windows\system32\drivers\ksecdd.sys

2012-07-11 10:26 . 2012-06-02 04:45        134000        ----a-w-        c:\windows\system32\drivers\ksecpkg.sys

2012-07-11 10:26 . 2012-06-02 04:40        369336        ----a-w-        c:\windows\system32\drivers\cng.sys

2012-07-11 10:26 . 2012-06-02 04:40        225280        ----a-w-        c:\windows\system32\schannel.dll

2012-07-11 10:26 . 2012-06-02 04:39        219136        ----a-w-        c:\windows\system32\ncrypt.dll

2012-07-11 10:26 . 2012-06-06 05:05        1390080        ----a-w-        c:\windows\system32\msxml6.dll

2012-07-11 10:26 . 2012-06-06 05:05        1236992        ----a-w-        c:\windows\system32\msxml3.dll

2012-07-11 10:26 . 2010-06-26 03:24        2048        ----a-w-        c:\windows\system32\msxml3r.dll

2012-07-11 10:26 . 2012-06-06 05:05        352256        ----a-w-        c:\program files\Common Files\System\ado\msadomd.dll

2012-07-11 10:26 . 2012-06-06 05:05        1019904        ----a-w-        c:\program files\Common Files\System\ado\msado15.dll

2012-07-11 10:26 . 2012-06-06 05:03        805376        ----a-w-        c:\windows\system32\cdosys.dll

2012-07-11 10:25 . 2012-06-06 05:05        143360        ----a-w-        c:\program files\Common Files\System\ado\msjro.dll

2012-07-11 10:25 . 2012-06-06 05:05        372736        ----a-w-        c:\program files\Common Files\System\ado\msadox.dll

2012-07-11 10:25 . 2012-06-06 05:05        57344        ----a-w-        c:\program files\Common Files\System\ado\msador15.dll

2012-07-11 10:25 . 2012-06-06 05:05        212992        ----a-w-        c:\program files\Common Files\System\msadc\msadco.dll

2012-07-10 15:28 . 2012-05-31 03:41        6762896        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{F75FC5AE-A95E-42EF-B06A-E2E93DBB4E7E}\mpengine.dll

2012-07-09 20:51 . 2012-07-09 20:51        --------        d-----w-        C:\_OTL

2012-07-05 21:00 . 2012-06-04 07:59        181432        ----a-w-        c:\windows\system32\drivers\ssudmdm.sys

2012-07-05 21:00 . 2012-06-04 07:59        80824        ----a-w-        c:\windows\system32\drivers\ssudbus.sys

2012-07-04 10:03 . 2012-07-04 10:03        --------        d-----w-        C:\Programme

2012-06-30 13:43 . 2012-06-30 13:43        770384        ----a-w-        c:\program files\Mozilla Firefox\msvcr100.dll

2012-06-30 13:43 . 2012-06-30 13:43        421200        ----a-w-        c:\program files\Mozilla Firefox\msvcp100.dll

2012-06-24 22:39 . 2012-07-07 14:39        --------        d-----w-        c:\users\Benny\AppData\Roaming\vlc

2012-06-19 16:10 . 2012-06-02 22:19        53784        ----a-w-        c:\windows\system32\wuauclt.exe

2012-06-19 16:10 . 2012-06-02 22:19        45080        ----a-w-        c:\windows\system32\wups2.dll

2012-06-19 16:10 . 2012-06-02 22:19        1933848        ----a-w-        c:\windows\system32\wuaueng.dll

2012-06-19 16:10 . 2012-06-02 22:12        2422272        ----a-w-        c:\windows\system32\wucltux.dll

2012-06-19 16:10 . 2012-06-02 22:19        35864        ----a-w-        c:\windows\system32\wups.dll

2012-06-19 16:10 . 2012-06-02 22:19        577048        ----a-w-        c:\windows\system32\wuapi.dll

2012-06-19 16:10 . 2012-06-02 22:12        88576        ----a-w-        c:\windows\system32\wudriver.dll

2012-06-19 16:09 . 2012-06-02 13:19        171904        ----a-w-        c:\windows\system32\wuwebv.dll

2012-06-19 16:09 . 2012-06-02 13:12        33792        ----a-w-        c:\windows\system32\wuapp.exe

2012-06-14 10:57 . 2012-04-28 03:17        183808        ----a-w-        c:\windows\system32\drivers\rdpwd.sys

2012-06-14 10:57 . 2012-04-26 04:45        58880        ----a-w-        c:\windows\system32\rdpwsx.dll

2012-06-14 10:57 . 2012-04-26 04:45        129536        ----a-w-        c:\windows\system32\rdpcorekmts.dll

2012-06-14 10:57 . 2012-04-26 04:41        8192        ----a-w-        c:\windows\system32\rdrmemptylst.exe

2012-06-14 10:57 . 2012-04-07 11:26        2342400        ----a-w-        c:\windows\system32\msi.dll

2012-06-14 10:57 . 2012-05-01 04:44        164352        ----a-w-        c:\windows\system32\profsvc.dll

2012-06-14 10:57 . 2012-04-24 04:36        140288        ----a-w-        c:\windows\system32\cryptsvc.dll

2012-06-14 10:57 . 2012-04-24 04:36        1158656        ----a-w-        c:\windows\system32\crypt32.dll

2012-06-14 10:57 . 2012-04-24 04:36        103936        ----a-w-        c:\windows\system32\cryptnet.dll

.

.

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2012-05-29 07:38 . 2011-03-02 05:57        330240        ----a-w-        c:\windows\MASetupCaller.dll

2012-05-08 16:06 . 2012-04-09 23:41        137928        ----a-w-        c:\windows\system32\drivers\avipbb.sys

2012-05-08 16:06 . 2012-04-09 23:41        83392        ----a-w-        c:\windows\system32\drivers\avgntflt.sys

2012-06-30 13:43 . 2012-01-22 21:03        85472        ----a-w-        c:\program files\mozilla firefox\components\browsercomps.dll

.

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4

.

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]

"{c95a4e8e-816d-4655-8c79-d736da1adb6d}"= "c:\program files\Hotspot_Shield\prxtbHots.dll" [2011-01-17 175912]

.

[HKEY_CLASSES_ROOT\clsid\{c95a4e8e-816d-4655-8c79-d736da1adb6d}]

.

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{c95a4e8e-816d-4655-8c79-d736da1adb6d}]

2011-01-17 14:54        175912        ----a-w-        c:\program files\Hotspot_Shield\prxtbHots.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]

"{c95a4e8e-816d-4655-8c79-d736da1adb6d}"= "c:\program files\Hotspot_Shield\prxtbHots.dll" [2011-01-17 175912]

.

[HKEY_CLASSES_ROOT\clsid\{c95a4e8e-816d-4655-8c79-d736da1adb6d}]

.

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]

"{C95A4E8E-816D-4655-8C79-D736DA1ADB6D}"= "c:\program files\Hotspot_Shield\prxtbHots.dll" [2011-01-17 175912]

.

[HKEY_CLASSES_ROOT\clsid\{c95a4e8e-816d-4655-8c79-d736da1adb6d}]

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]

"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1174016]

"Spotify Web Helper"="c:\users\Benny\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe" [2012-05-07 932528]

"KiesPDLR"="c:\program files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe" [2012-07-03 21432]

"KiesPreload"="c:\program files\Samsung\Kies\Kies.exe" [2012-07-03 975288]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2009-12-14 8120864]

"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2010-02-26 1713448]

"CLMLServer"="c:\program files\CyberLink\Power2Go\CLMLSvc.exe" [2009-06-03 103720]

"UpdateP2GoShortCut"="c:\program files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" [2009-05-19 222504]

"APLangApp"="c:\program files\AnyPC Client\APLangApp.exe" [2009-10-20 13312]

"UCam_Menu"="c:\program files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" [2009-05-19 222504]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-09-07 37296]

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-03-30 937920]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2010-02-10 13834856]

"DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2011-07-28 1259376]

"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2011-05-10 49208]

"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-01-18 254696]

"BCSSync"="c:\program files\Microsoft Office\Office14\BCSSync.exe" [2010-03-13 91520]

"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2012-05-08 348624]

"KiesTrayAgent"="c:\program files\Samsung\Kies\KiesTrayAgent.exe" [2012-07-03 3524536]

.

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2009-5-21 275768]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 5 (0x5)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"aux"=wdmaud.drv

.

R2 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [x]

R3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudbus.sys [x]

R3 Impcd;Impcd;c:\windows\system32\DRIVERS\Impcd.sys [x]

R3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files\Microsoft Office\Office14\GROOVE.EXE [x]

R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files\Mozilla Maintenance Service\maintenanceservice.exe [x]

R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [x]

R3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt86win7.sys [x]

R3 ssudmdm;SAMSUNG  Mobile USB Modem Drivers (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudmdm.sys [x]

R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]

R3 vnet;Shrew Soft Virtual Adapter;c:\windows\system32\DRIVERS\virtualnet.sys [x]

R3 WatAdminSvc;Windows-Aktivierungstechnologieservice;c:\windows\system32\Wat\WatAdminSvc.exe [x]

S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys [x]

S1 SABI;SAMSUNG Kernel Driver For Windows 7;c:\windows\system32\Drivers\SABI.sys [x]

S1 vflt;Shrew Soft Lightweight Filter;c:\windows\system32\DRIVERS\vfilter.sys [x]

S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]

S2 AntiVirSchedulerService;Avira Planer;c:\program files\Avira\AntiVir Desktop\sched.exe [x]

S2 cpuz135;cpuz135;c:\windows\system32\drivers\cpuz135_x32.sys [x]

S2 dtpd;ShrewSoft DNS Proxy Daemon;c:\program files\ShrewSoft\VPN Client\dtpd.exe [x]

S2 iked;ShrewSoft IKE Daemon;c:\program files\ShrewSoft\VPN Client\iked.exe [x]

S2 ipsecd;ShrewSoft IPSEC Daemon;c:\program files\ShrewSoft\VPN Client\ipsecd.exe [x]

S2 Rezip;Rezip;c:\windows\SYSTEM32\Rezip.exe [x]

S2 SBSDWSCService;SBSD Security Center Service;c:\program files\Spybot - Search & Destroy\SDWinSec.exe [x]

S2 vpnagent;Cisco AnyConnect VPN Agent;c:\program files\Cisco\Cisco AnyConnect VPN Client\vpnagent.exe [x]

S3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda32v.sys [x]

S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [x]

S3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x86.sys [x]

.

.

--- Andere Dienste/Treiber im Speicher ---

.

*NewlyCreated* - WS2IFSL

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

HPZ12        REG_MULTI_SZ           Pml Driver HPZ12 Net Driver HPZ12

HPService        REG_MULTI_SZ           HPSLPSVC

hpdevmgmt        REG_MULTI_SZ           hpqcxs08 hpqddsvc

.

Inhalt des "geplante Tasks" Ordners

.

2012-03-23 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1410236154-1455553273-2078879821-1000Core1cd0904d9f5a2b3.job

- c:\users\Benny\AppData\Local\Google\Update\GoogleUpdate.exe [2012-01-22 14:44]

.

2012-07-11 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1410236154-1455553273-2078879821-1000UA.job

- c:\users\Benny\AppData\Local\Google\Update\GoogleUpdate.exe [2012-01-22 14:44]

.

.

------- Zusätzlicher Suchlauf -------

.

uStart Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT1561552

IE: An OneNote s&enden - c:\progra~1\MICROS~3\Office14\ONBttnIE.dll/105

IE: Free YouTube to Mp3 Converter - c:\users\Benny\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm

IE: Nach Microsoft &Excel exportieren - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000

IE: Nach Microsoft E&xcel exportieren - c:\progra~1\MICROS~3\Office14\EXCEL.EXE/3000

IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000

TCP: DhcpNameServer = 192.168.0.1

TCP: Interfaces\{25DD4BA0-AC00-4817-8F5B-03DE8B9D2BA9}: NameServer = 144.41.2.20,144.41.5.20

FF - ProfilePath - c:\users\Benny\AppData\Roaming\Mozilla\Firefox\Profiles\isev31b5.default\

.

- - - - Entfernte verwaiste Registrierungseinträge - - - -

.

Toolbar-Locked - (no file)

HKCU-Run-KiesAirMessage - c:\program files\Samsung\Kies\KiesAirMessage.exe

SafeBoot-MCODS

AddRemove-01_Simmental - c:\program files\Samsung\USB Drivers\01_Simmental\Uninstall.exe

AddRemove-02_Siberian - c:\program files\Samsung\USB Drivers\02_Siberian\Uninstall.exe

AddRemove-03_Swallowtail - c:\program files\Samsung\USB Drivers\03_Swallowtail\Uninstall.exe

AddRemove-04_semseyite - c:\program files\Samsung\USB Drivers\04_semseyite\Uninstall.exe

AddRemove-05_Sloan - c:\program files\Samsung\USB Drivers\05_Sloan\Uninstall.exe

AddRemove-06_Spencer - c:\program files\Samsung\USB Drivers\06_Spencer\Uninstall.exe

AddRemove-07_Schorl - c:\program files\Samsung\USB Drivers\07_Schorl\Uninstall.exe

AddRemove-08_EMPChipset - c:\program files\Samsung\USB Drivers\08_EMPChipset\Uninstall.exe

AddRemove-09_Hsp - c:\program files\Samsung\USB Drivers\09_Hsp\Uninstall.exe

AddRemove-11_HSP_Plus_Default - c:\program files\Samsung\USB Drivers\11_HSP_Plus_Default\Uninstall.exe

AddRemove-16_Shrewsbury - c:\program files\Samsung\USB Drivers\16_Shrewsbury\Uninstall.exe

AddRemove-17_EMP_Chipset2 - c:\program files\Samsung\USB Drivers\17_EMP_Chipset2\Uninstall.exe

AddRemove-18_Zinia_Serial_Driver - c:\program files\Samsung\USB Drivers\18_Zinia_Serial_Driver\Uninstall.exe

AddRemove-19_VIA_driver - c:\program files\Samsung\USB Drivers\19_VIA_driver\Uninstall.exe

AddRemove-20_NXP_Driver - c:\program files\Samsung\USB Drivers\20_NXP_Driver\Uninstall.exe

AddRemove-21_Searsburg - c:\program files\Samsung\USB Drivers\21_Searsburg\Uninstall.exe

AddRemove-22_WiBro_WiMAX - c:\program files\Samsung\USB Drivers\22_WiBro_WiMAX\Uninstall.exe

AddRemove-24_flashusbdriver - c:\program files\Samsung\USB Drivers\24_flashusbdriver\Uninstall.exe

AddRemove-25_escape - c:\program files\Samsung\USB Drivers\25_escape\Uninstall.exe

.

.

.

--------------------- Gesperrte Registrierungsschluessel ---------------------

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

------------------------ Weitere laufende Prozesse ------------------------

.

c:\windows\system32\nvvsvc.exe

c:\windows\system32\nvvsvc.exe

c:\program files\Avira\AntiVir Desktop\avguard.exe

c:\program files\xampp\FileZillaFTP\FileZillaServer.exe

c:\program files\CDBurnerXP\NMSAccessU.exe

c:\windows\system32\taskhost.exe

c:\program files\Avira\AntiVir Desktop\avshadow.exe

c:\windows\system32\conhost.exe

c:\program files\Samsung\Samsung Support Center\SSCKbdHk.exe

c:\program files\Samsung\Samsung Recovery Solution 4\WCScheduler.exe

c:\program files\AnyPC Client\APLanMgrC.exe

c:\windows\servicing\TrustedInstaller.exe

c:\windows\system32\conhost.exe

c:\windows\system32\sppsvc.exe

c:\program files\Windows Media Player\wmpnetwk.exe

.

**************************************************************************

.

Zeit der Fertigstellung: 2012-07-11  18:12:21 - PC wurde neu gestartet

ComboFix-quarantined-files.txt  2012-07-11 16:12

.

Vor Suchlauf: 12 Verzeichnis(se), 26.280.935.424 Bytes frei

Nach Suchlauf: 17 Verzeichnis(se), 25.805.275.136 Bytes frei

.

- - End Of File - - D33743E64BA0A959B9A49F529A2E54AE
--- --- ---