Trojaner-Board - Neu und brauche hilfe

ComboFix 09-08-29.01 - TombRaider 29.08.2009 23:49.1.2 - NTFSx86
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.49.1031.18.3068.2258 [GMT 2:00]
ausgeführt von:: c:\users\TombRaider\Desktop\ComboFix.exe
AV: Norton Internet Security *On-access scanning disabled* (Outdated) {E10A9785-9598-4754-B552-92431C1C35F8}
FW: Norton Internet Security *enabled* {7C21A4C9-F61F-4AC4-B722-A6E19C16F220}
SP: Norton Internet Security *enabled* (Outdated) {CBB7EE13-8244-4DAB-8B55-D5C7AA91E59A}
SP: SUPERAntiSpyware *disabled* (Updated) {222A897C-5018-402e-943F-7E7AC8560DA7}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.

(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\$recycle.bin\S-1-5-21-2497866024-2157264917-1802327469-500
c:\$recycle.bin\S-1-5-21-759888917-3672696587-3597690013-500
c:\windows\Installer\417bf.msi
c:\windows\system32\drivers\kbiwkmbtsqdmmx.sys
c:\windows\system32\drivers\kbiwkmmdoyemrt.sys
c:\windows\system32\drivers\kbiwkmrnfwcpoe.sys
c:\windows\system32\drivers\kbiwkmtxqvxpjb.sys
c:\windows\system32\drivers\kbiwkmvyfogmgx.sys
c:\windows\system32\drivers\kbiwkmwxnkidrn.sys
c:\windows\system32\kbiwkmbsditybf.dat
c:\windows\system32\kbiwkmcejtqsqi.dll
c:\windows\system32\kbiwkmcprxprtt.dat
c:\windows\system32\kbiwkmequmpyii.dll
c:\windows\system32\kbiwkminsviwwm.dll
c:\windows\system32\kbiwkmuhoedvem.dll
c:\windows\system32\kbiwkmumepaupn.dat
c:\windows\system32\kbiwkmumiutysv.dat
c:\windows\system32\kbiwkmvqeesiqn.dll
c:\windows\system32\kbiwkmwcbcxnbc.dll
c:\windows\system32\kbiwkmxeqcqppi.dll
c:\windows\system32\kbiwkmxuevnckp.dat
c:\windows\system32\kbiwkmyvvpnsay.dll
c:\windows\system32\kbiwkmywfpqosa.dll

.
((((((((((((((((((((((((((((((((((((((( Treiber/Dienste )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_kbiwkmidbmtvex
-------\Service_kbiwkmwirbvrep
-------\Legacy_kbiwkmidbmtvex
-------\Legacy_kbiwkmwirbvrep

((((((((((((((((((((((( Dateien erstellt von 2009-07-28 bis 2009-08-29 ))))))))))))))))))))))))))))))
.

2009-08-29 21:55 . 2009-08-29 21:59 -------- d-----w- c:\users\TombRaider\AppData\Local\temp
2009-08-29 21:55 . 2009-08-29 21:55 -------- d-----w- c:\users\Default\AppData\Local\temp
2009-08-29 20:50 . 2009-08-29 20:50 -------- d-----w- c:\program files\Windows Imaging
2009-08-29 20:49 . 2009-08-29 20:50 -------- d-----w- c:\program files\Windows AIK
2009-08-29 20:46 . 2009-08-29 20:46 -------- d-----w- c:\program files\Elaborate Bytes
2009-08-19 20:11 . 2009-08-19 20:11 -------- d-----w- c:\users\TombRaider\AppData\Roaming\DMino
2009-08-19 20:11 . 2009-08-19 20:11 -------- d-----w- c:\users\TombRaider\AppData\Local\DMino
2009-08-19 19:51 . 2009-08-19 19:51 -------- d-----w- c:\users\TombRaider\AppData\Roaming\MAGIX
2009-08-19 19:48 . 2009-08-19 20:35 -------- d-----w- c:\programdata\MAGIX
2009-08-19 19:47 . 2009-08-19 20:35 -------- d-----w- c:\program files\MAGIX
2009-08-19 19:47 . 2007-04-27 07:43 120200 ----a-w- c:\windows\system32\DLLDEV32i.dll
2009-08-19 19:37 . 2009-08-19 20:35 -------- d-----w- c:\windows\system32\MAGIX
2009-08-19 19:37 . 2008-04-15 13:14 700416 ----a-w- c:\windows\system32\mgxoschk.dll
2009-08-19 19:24 . 2009-07-17 14:35 71680 ----a-w- c:\windows\system32\atl.dll
2009-08-19 19:24 . 2009-06-10 12:12 160256 ----a-w- c:\windows\system32\wkssvc.dll
2009-08-19 19:24 . 2009-06-04 12:34 2066432 ----a-w- c:\windows\system32\mstscax.dll
2009-08-19 19:24 . 2009-06-10 12:07 91136 ----a-w- c:\windows\system32\avifil32.dll
2009-08-19 19:24 . 2009-07-14 13:00 313344 ----a-w- c:\windows\system32\wmpdxm.dll
2009-08-19 19:24 . 2009-07-14 12:59 4096 ----a-w- c:\windows\system32\dxmasf.dll
2009-08-19 19:24 . 2009-07-14 12:58 7680 ----a-w- c:\windows\system32\spwmp.dll
2009-08-19 19:23 . 2009-07-14 10:59 8147456 ----a-w- c:\windows\system32\wmploc.DLL
2009-08-19 19:18 . 2008-06-20 01:14 105016 ----a-w- c:\windows\system32\PresentationCFFRasterizerNative_v0300.dll
2009-08-19 19:18 . 2008-06-20 01:14 97800 ----a-w- c:\windows\system32\infocardapi.dll
2009-08-19 19:18 . 2008-06-20 01:14 11264 ----a-w- c:\windows\system32\icardres.dll
2009-08-19 19:18 . 2008-06-20 01:14 622080 ----a-w- c:\windows\system32\icardagt.exe
2009-08-19 19:18 . 2008-06-20 01:14 43544 ----a-w- c:\windows\system32\PresentationHostProxy.dll
2009-08-19 19:18 . 2008-06-20 01:14 781344 ----a-w- c:\windows\system32\PresentationNative_v0300.dll
2009-08-19 19:18 . 2008-06-20 01:14 326160 ----a-w- c:\windows\system32\PresentationHost.exe
2009-08-19 19:13 . 2009-08-19 19:13 -------- d-----w- c:\users\TombRaider\AppData\Local\Mozilla
2009-08-19 19:10 . 2008-07-27 18:03 96760 ----a-w- c:\windows\system32\dfshim.dll
2009-08-19 19:10 . 2008-07-27 18:03 282112 ----a-w- c:\windows\system32\mscoree.dll
2009-08-19 19:10 . 2008-07-27 18:03 41984 ----a-w- c:\windows\system32\netfxperf.dll
2009-08-19 19:10 . 2008-07-27 18:03 158720 ----a-w- c:\windows\system32\mscorier.dll
2009-08-19 19:10 . 2008-07-27 18:03 83968 ----a-w- c:\windows\system32\mscories.dll

.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-08-29 21:59 . 2009-07-10 20:15 117760 ----a-w- c:\users\TombRaider\AppData\Roaming\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2009-08-29 21:58 . 2009-01-08 19:12 28314 ----a-w- c:\programdata\nvModes.dat
2009-08-29 21:56 . 2008-07-31 20:52 12 ----a-w- c:\windows\bthservsdp.dat
2009-08-29 21:53 . 2008-08-01 06:37 618442 ----a-w- c:\windows\system32\perfh007.dat
2009-08-29 21:53 . 2008-08-01 06:37 122842 ----a-w- c:\windows\system32\perfc007.dat
2009-08-19 20:39 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail
2009-08-19 19:58 . 2009-01-08 19:19 109424 ----a-w- c:\users\TombRaider\AppData\Local\GDIPFONTCACHEV1.DAT
2009-08-19 19:50 . 2009-08-19 19:49 -------- d-----w- c:\program files\Common Files\MAGIX Shared
2009-08-19 19:49 . 2009-07-10 19:47 -------- d-----w- c:\program files\Common Files\Xara
2009-08-08 13:34 . 2009-04-18 18:33 55656 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2009-07-18 16:06 . 2009-08-08 13:40 827904 ----a-w- c:\windows\system32\wininet.dll
2009-07-18 16:01 . 2009-08-08 13:40 78336 ----a-w- c:\windows\system32\ieencode.dll
2009-07-18 09:46 . 2009-08-08 13:40 26624 ----a-w- c:\windows\system32\ieUnatt.exe
2009-07-10 20:14 . 2009-07-10 20:14 -------- d-----w- c:\programdata\SUPERAntiSpyware.com
2009-07-10 20:13 . 2009-07-10 20:13 -------- d-----w- c:\program files\SUPERAntiSpyware
2009-07-10 20:13 . 2009-07-10 20:13 -------- d-----w- c:\users\TombRaider\AppData\Roaming\SUPERAntiSpyware.com
2009-07-10 20:12 . 2009-07-10 20:12 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2009-07-10 19:47 . 2008-07-31 21:02 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-07-10 19:47 . 2009-07-10 19:47 -------- d-----w- c:\program files\Xara
2009-07-10 19:44 . 2009-07-10 19:44 -------- d-----w- c:\program files\7-Zip
2009-07-10 12:19 . 2008-07-31 22:04 -------- d-----w- c:\program files\Microsoft Works
2009-07-07 16:31 . 2008-07-31 21:14 -------- d-----w- c:\programdata\Symantec
2009-07-07 16:13 . 2009-07-07 16:13 456304 ----a-w- c:\programdata\Google\Google Toolbar\Update\gtb7724.tmp.exe
2009-06-15 15:24 . 2009-08-08 13:40 156672 ----a-w- c:\windows\system32\t2embed.dll
2009-06-15 15:20 . 2009-08-08 13:40 72704 ----a-w- c:\windows\system32\fontsub.dll
2009-06-15 15:20 . 2009-08-08 13:40 10240 ----a-w- c:\windows\system32\dciman32.dll
2009-06-15 12:52 . 2009-08-08 13:40 289792 ----a-w- c:\windows\system32\atmfd.dll
2009-03-31 20:47 . 2009-08-19 19:13 324976 ----a-w- c:\program files\mozilla firefox\components\coFFPlgn.dll
2009-01-08 20:55 . 2009-01-08 20:55 22 --sha-w- c:\windows\SMINST\HPCD.sys
2008-08-01 06:43 . 2008-08-01 06:40 8192 --sha-w- c:\windows\Users\Default\NTUSER.DAT
.

(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-21 1233920]
"LightScribe Control Panel"="c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe" [2008-02-26 2289664]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-04-18 39408]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2009-06-23 1830128]
"WindowsWelcomeCenter"="oobefldr.dll" - c:\windows\System32\oobefldr.dll [2008-01-21 2153472]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-05-14 13535776]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-05-14 92704]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-01-18 1033512]
"SysTrayApp"="c:\program files\IDT\WDM\sttray.exe" [2008-06-27 442467]
"UCam_Menu"="c:\program files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" [2007-12-24 222504]
"QPService"="c:\program files\HP\QuickPlay\QPService.exe" [2008-06-25 468264]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-21 1008184]
"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2008-02-07 51048]
"QlbCtrl.exe"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2008-03-14 202032]
"OnScreenDisplay"="c:\program files\Hewlett-Packard\HP QuickTouch\HPKBDAPP.exe" [2007-11-01 554288]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"HP Health Check Scheduler"="c:\program files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe" [2008-04-15 70912]
"HP Software Update"="c:\program files\Hp\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]
"hpWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2008-04-15 488752]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_06\bin\jusched.exe" [2008-03-25 144784]
"Google Quick Search Box"="c:\program files\Google\Quick Search Box\GoogleQuickSearchBox.exe" [2009-04-18 68592]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-01-05 413696]
"VirtualCloneDrive"="c:\program files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" [2009-05-26 85160]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
BTTray.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2008-6-19 727592]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-12-22 10:05 356352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"mixer1"=wdmaud.drv

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UacDisableNotify"=dword:00000001
"InternetSettingsDisableNotify"=dword:00000001
"AutoUpdateDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{28725DAD-CF8E-45E7-9953-68F6AF97F9AA}"= c:\program files\HP\QuickPlay\QP.exe:Quick Play
"{46209F83-6D3C-437D-9B97-22CE1C8B597D}"= c:\program files\HP\QuickPlay\QPService.exe:Quick Play Resident Program
"{15B044DB-9DD3-4B40-824D-183FE4BF252B}"= UDP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{9001BDBF-019C-4DAB-91CC-2188152D1255}"= TCP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{89A90472-0FBB-4405-90FC-F638D90BDE24}"= c:\program files\Cyberlink\PowerDirector\PDR.EXE:CyberLink PowerDirector
"{5F65F827-5717-4D39-9B9C-9430316D8F49}"= c:\program files\MSN Messenger\livecall.exe:Windows Live Messenger 8.1 (Phone)
"{C11842E2-EB6B-49C5-B08A-0CD3CCB396B8}"= UDP:c:\program files\Common Files\AOL\Loader\aolload.exe:AOL Loader
"{A882BED7-B2CE-4383-923E-C42616FE2B24}"= TCP:c:\program files\Common Files\AOL\Loader\aolload.exe:AOL Loader
"{224C4694-CEBD-4B20-9A12-39CDDB4AE98F}"= UDP:c:\program files\Ubisoft\Assassin's Creed\AssassinsCreed_Dx9.exe:Assassin's Creed Dx9
"{D3E83A8F-24B0-4904-B4B2-0E4CAFF9361E}"= TCP:c:\program files\Ubisoft\Assassin's Creed\AssassinsCreed_Dx9.exe:Assassin's Creed Dx9
"{73E4967D-5530-4B56-A2CF-0ABEBD68AC3A}"= UDP:c:\program files\Ubisoft\Assassin's Creed\AssassinsCreed_Dx10.exe:Assassin's Creed Dx10
"{3B0A391A-875D-4014-B82B-33DB4299972D}"= TCP:c:\program files\Ubisoft\Assassin's Creed\AssassinsCreed_Dx10.exe:Assassin's Creed Dx10
"{16526482-1238-4B5A-856E-9E9DB00BC481}"= UDP:c:\program files\Ubisoft\Assassin's Creed\AssassinsCreed_Launcher.exe:Assassin's Creed Update
"{C89FA09D-06CF-434E-BA71-6DBE3BC46961}"= TCP:c:\program files\Ubisoft\Assassin's Creed\AssassinsCreed_Launcher.exe:Assassin's Creed Update

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
"EnableFirewall"= 0 (0x0)

R1 IDSvix86;Symantec Intrusion Prevention Driver;c:\progra~2\Symantec\DEFINI~1\SymcData\ipsdefs\20090414.001\IDSvix86.sys [18.04.2009 20:09 272432]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [23.06.2009 11:01 9968]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [23.06.2009 11:01 72944]
R2 AESTFilters;Andrea ST Filters Service;c:\windows\System32\DriverStore\FileRepository\stwrt.inf_a7e996cd\AEstSrv.exe [30.10.2008 01:03 77824]
R2 AntiVirSchedulerService;Avira AntiVir Planer;c:\program files\Avira\AntiVir Desktop\sched.exe [18.04.2009 20:33 108289]
R2 ezSharedSvc;Easybits Shared Services for Windows;c:\windows\system32\svchost.exe -k netsvcs [21.01.2008 04:23 21504]
R2 hpsrv;HP Service;c:\windows\System32\hpservice.exe [18.03.2008 17:24 19456]
R2 LiveUpdate Notice;LiveUpdate Notice;c:\program files\Common Files\Symantec Shared\ccSvcHst.exe [07.02.2008 02:48 149864]
R2 Recovery Service for Windows;Recovery Service for Windows;c:\windows\SMINST\BLService.exe [01.08.2008 00:35 361808]
R3 Com4QLBEx;Com4QLBEx;c:\program files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe [31.07.2008 23:37 193840]
R3 enecir;ENE CIR Receiver;c:\windows\System32\drivers\enecir.sys [24.01.2008 15:23 52736]
R3 JMCR;JMCR;c:\windows\System32\drivers\jmcr.sys [08.07.2008 12:16 96856]
R3 NETw5v32;Intel(R) Wireless WiFi Link Adaptertreiber für Windows Vista 32-Bit;c:\windows\System32\drivers\NETw5v32.sys [30.10.2008 00:54 3658752]
R3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\System32\drivers\nvhda32v.sys [14.05.2008 04:09 43552]
R3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [23.06.2009 11:01 7408]
R3 SYMNDISV;SYMNDISV;c:\windows\System32\drivers\symndisv.sys [19.02.2009 13:31 41008]
S3 COH_Mon;COH_Mon;c:\windows\System32\drivers\COH_Mon.sys [13.01.2008 02:32 23888]
S3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [18.04.2009 20:08 101936]
S3 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance;c:\program files\MAGIX\Common\Database\bin\fbserver.exe --> c:\program files\MAGIX\Common\Database\bin\fbserver.exe [?]

--- Andere Dienste/Treiber im Speicher ---

*NewlyCreated* - COMHOST

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs REG_MULTI_SZ BthServ

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
ezSharedSvc

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
"c:\program files\Common Files\LightScribe\LSRunOnce.exe"
.
Inhalt des "geplante Tasks" Ordners

2009-01-26 c:\windows\Tasks\Norton Internet Security - Systemprüfung ausführen - TombRaider.job
- c:\program files\Norton Internet Security\Norton AntiVirus\Navw32.exe [2008-02-07 12:05]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=de_de&c=83&bd=Pavilion&pf=cnnb
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=de_de&c=83&bd=Pavilion&pf=cnnb
IE: &AOL Toolbar-Suche - c:\programdata\AOL\ieToolbar\resources\de-DE\local\search.html
IE: Bild an &Bluetooth-Gerät senden... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
IE: Seite an &Bluetooth-Gerät senden... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
FF - ProfilePath - c:\users\TombRaider\AppData\Roaming\Mozilla\Firefox\Profiles\fx0zxgh5.default\
FF - prefs.js: browser.startup.homepage - hxxp://alice.aol.de/
FF - component: c:\program files\Mozilla Firefox\components\coFFPlgn.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll

---- FIREFOX Richtlinien ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.enforce_same_site_origin", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.cache_size", 51200);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.ogg.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.wave.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.autoplay.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.urlbar.autocomplete.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("capability.policy.mailnews.*.wholeText", "noAccess");
c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.storage.default_quota", 5120);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("content.sink.event_probe_rate", 3);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.http.prompt-temp-redirect", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("layout.css.dpi", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("layout.css.devPixelsPerPx", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("gestures.enable_single_finger_input", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.max_chrome_script_run_time", 0);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.tcp.sendbuffer", 131072);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("geo.enabled", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.remember_cert_checkbox_default_setting", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr", "moz35");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-cjkt", "moz35");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.blocklist.level", 2);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.restrict.typed", "~");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.default.behavior", 0);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.history", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.formdata", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.passwords", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.downloads", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cookies", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cache", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.sessions", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.offlineApps", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.siteSettings", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.history", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.formdata", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.passwords", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.downloads", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cookies", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cache", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.sessions", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.offlineApps", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.siteSettings", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.sanitize.migrateFx3Prefs", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.ssl_override_behavior", 2);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("security.alternate_certificate_error_page", "certerror");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.autostart", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.dont_prompt_on_enter", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("geo.wifi.uri", "https://www.google.com/loc/json");
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-08-29 23:58
Windows 6.0.6001 Service Pack 1 NTFS

Scanne versteckte Prozesse...

Scanne versteckte Autostarteinträge...

Scanne versteckte Dateien...

Scan erfolgreich abgeschlossen
versteckte Dateien: 0

**************************************************************************
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------

- - - - - - - > 'Explorer.exe'(3052)
c:\windows\system32\btmmhook.dll
c:\windows\system32\btncopy.dll
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\windows\System32\nvvsvc.exe
c:\windows\System32\DriverStore\FileRepository\stwrt.inf_a7e996cd\stacsv.exe
c:\windows\System32\audiodg.exe
c:\windows\System32\rundll32.exe
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\program files\HP\QuickPlay\Kernel\TV\QPCapSvc.exe
c:\program files\HP\QuickPlay\Kernel\TV\QPSched.exe
c:\program files\CyberLink\Shared Files\RichVideo.exe
c:\windows\System32\rundll32.exe
c:\program files\Hewlett-Packard\Shared\hpqWmiEx.exe
c:\program files\Hewlett-Packard\Shared\HpqToaster.exe
c:\program files\WIDCOMM\Bluetooth Software\BTStackServer.exe
c:\program files\Synaptics\SynTP\SynTPHelper.exe
c:\program files\Symantec\LiveUpdate\AluSchedulerSvc.exe
c:\program files\Hewlett-Packard\HP Health Check\HPHC_Service.exe
c:\windows\System32\wbem\WMIADAP.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2009-08-29 0:04 - PC wurde neu gestartet
ComboFix-quarantined-files.txt 2009-08-29 22:03
Vor Suchlauf: 8 Verzeichnis(se), 248.260.423.680 Bytes frei
Nach Suchlauf: 8 Verzeichnis(se), 247.864.033.280 Bytes frei

322 --- E O F --- 2009-08-29 12:53