logfile von combofix
könnt ihr mal über das logfile von combofix gucken er hat es mir per stick gebracht
log of gofi: Code:
ComboFix 10-04-21.01 - Thorsten1 24.04.2010 18:36:18.1.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.49.1031.18.3071.2431 [GMT 2:00]
ausgeführt von:: o:\ilko\ComboFix.exe
AV: Kaspersky Security Suite CBE 09 *On-access scanning disabled* (Updated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}
FW: Kaspersky Security Suite CBE 09 *disabled* {2C4D4BC6-0793-4956-A9F9-E252435469C0}
Achtung - Auf diesem PC ist keine Wiederherstellungskonsole installiert !!
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\install.exe
d:\dokume~1\THORST~1\LOKALE~1\Temp\tmp11.tmp
d:\dokumente und einstellungen\Thorsten1\Anwendungsdaten\.#
d:\dokumente und einstellungen\Thorsten1\Anwendungsdaten\inst.exe
d:\dokumente und einstellungen\Thorsten1\Lokale Einstellungen\Temp\tmp11.tmp
d:\programme\Dealio Toolbar
d:\programme\Dealio Toolbar\FF\chrome.manifest
d:\programme\Dealio Toolbar\FF\chrome\content\chevron.js
d:\programme\Dealio Toolbar\FF\chrome\content\chevron.xul
d:\programme\Dealio Toolbar\FF\chrome\content\login.js
d:\programme\Dealio Toolbar\FF\chrome\content\login.xul
d:\programme\Dealio Toolbar\FF\chrome\content\parser.js
d:\programme\Dealio Toolbar\FF\chrome\content\RssTickerWidget.js
d:\programme\Dealio Toolbar\FF\chrome\content\searchbox.js
d:\programme\Dealio Toolbar\FF\chrome\content\searchbox.xul
d:\programme\Dealio Toolbar\FF\chrome\content\widgichevron.js
d:\programme\Dealio Toolbar\FF\chrome\content\widgicomm.js
d:\programme\Dealio Toolbar\FF\chrome\content\widgihandling.js
d:\programme\Dealio Toolbar\FF\chrome\content\widgilisteners.js
d:\programme\Dealio Toolbar\FF\chrome\content\widgitoolbarplugin.js
d:\programme\Dealio Toolbar\FF\chrome\content\widgitoolbarplugin.xul
d:\programme\Dealio Toolbar\FF\chrome\content\widgiui.js
d:\programme\Dealio Toolbar\FF\chrome\locale\EN-US\searchbox.dtd
d:\programme\Dealio Toolbar\FF\chrome\locale\EN-US\widgitoolbarplugin.dtd
d:\programme\Dealio Toolbar\FF\chrome\locale\EN-US\widgitoolbarplugin.properties
d:\programme\Dealio Toolbar\FF\chrome\locale\EN-US\yahoo-search.gif
d:\programme\Dealio Toolbar\FF\chrome\skin\amazon.gif
d:\programme\Dealio Toolbar\FF\chrome\skin\apple.gif
d:\programme\Dealio Toolbar\FF\chrome\skin\barnes.gif
d:\programme\Dealio Toolbar\FF\chrome\skin\bestbuy.gif
d:\programme\Dealio Toolbar\FF\chrome\skin\chevron.gif
d:\programme\Dealio Toolbar\FF\chrome\skin\dealio_logo.gif
d:\programme\Dealio Toolbar\FF\chrome\skin\dealio_logo_hover.gif
d:\programme\Dealio Toolbar\FF\chrome\skin\ebay.gif
d:\programme\Dealio Toolbar\FF\chrome\skin\icon_settings.gif
d:\programme\Dealio Toolbar\FF\chrome\skin\macys.gif
d:\programme\Dealio Toolbar\FF\chrome\skin\newegg.gif
d:\programme\Dealio Toolbar\FF\chrome\skin\overstock.gif
d:\programme\Dealio Toolbar\FF\chrome\skin\search-button-hover.gif
d:\programme\Dealio Toolbar\FF\chrome\skin\search-button.gif
d:\programme\Dealio Toolbar\FF\chrome\skin\search-chevron-hover.gif
d:\programme\Dealio Toolbar\FF\chrome\skin\search-chevron.gif
d:\programme\Dealio Toolbar\FF\chrome\skin\search_amazon.gif
d:\programme\Dealio Toolbar\FF\chrome\skin\search_dealio.gif
d:\programme\Dealio Toolbar\FF\chrome\skin\search_ebay.gif
d:\programme\Dealio Toolbar\FF\chrome\skin\search_yahoo.gif
d:\programme\Dealio Toolbar\FF\chrome\skin\searchbox.css
d:\programme\Dealio Toolbar\FF\chrome\skin\separator.gif
d:\programme\Dealio Toolbar\FF\chrome\skin\target.gif
d:\programme\Dealio Toolbar\FF\chrome\skin\walmart.gif
d:\programme\Dealio Toolbar\FF\chrome\skin\widgitoolbarplugin.css
d:\programme\Dealio Toolbar\FF\components\config.ini
d:\programme\Dealio Toolbar\FF\components\dealioToolbarFF.dll
d:\programme\Dealio Toolbar\FF\components\IFBHOHelperWidgiToolbar.xpt
d:\programme\Dealio Toolbar\FF\components\IFBHOWidgiToolbar.xpt
d:\programme\Dealio Toolbar\FF\install.rdf
d:\programme\Dealio Toolbar\IE\4.0.2\config.ini
d:\programme\Dealio Toolbar\IE\4.0.2\dealioToolbarIE.dll
d:\programme\Dealio Toolbar\Res\amazon.gif
d:\programme\Dealio Toolbar\Res\apple.gif
d:\programme\Dealio Toolbar\Res\barnes.gif
d:\programme\Dealio Toolbar\Res\bestbuy.gif
d:\programme\Dealio Toolbar\Res\dealio_logo.gif
d:\programme\Dealio Toolbar\Res\dealio_logo_hover.gif
d:\programme\Dealio Toolbar\Res\ebay.gif
d:\programme\Dealio Toolbar\Res\icon_settings.gif
d:\programme\Dealio Toolbar\Res\macys.gif
d:\programme\Dealio Toolbar\Res\newegg.gif
d:\programme\Dealio Toolbar\Res\overstock.gif
d:\programme\Dealio Toolbar\Res\search-button-hover.gif
d:\programme\Dealio Toolbar\Res\search-button.gif
d:\programme\Dealio Toolbar\Res\search-chevron-hover.gif
d:\programme\Dealio Toolbar\Res\search-chevron.gif
d:\programme\Dealio Toolbar\Res\search_amazon.gif
d:\programme\Dealio Toolbar\Res\search_dealio.gif
d:\programme\Dealio Toolbar\Res\search_ebay.gif
d:\programme\Dealio Toolbar\Res\search_yahoo.gif
d:\programme\Dealio Toolbar\Res\target.gif
d:\programme\Dealio Toolbar\Res\walmart.gif
d:\programme\Dealio Toolbar\Res\widgets.xml
d:\programme\Dealio Toolbar\WidgiHelper.exe
d:\programme\Search Settings
d:\programme\Search Settings\FF\chrome.manifest
d:\programme\Search Settings\FF\chrome\content\plugin.js
d:\programme\Search Settings\FF\chrome\content\plugin.xul
d:\programme\Search Settings\FF\chrome\content\protection.js
d:\programme\Search Settings\FF\chrome\content\utils.js
d:\programme\Search Settings\FF\chrome\locale\en-US\searchsettingsplugin.dtd
d:\programme\Search Settings\FF\chrome\locale\en-US\searchsettingsplugin.properties
d:\programme\Search Settings\FF\components\IFBHOSearch.xpt
d:\programme\Search Settings\FF\components\IFBHOSearchHelperEngine.xpt
d:\programme\Search Settings\FF\components\IFHelperPreferences.xpt
d:\programme\Search Settings\FF\components\SearchSettingsFF.dll
d:\programme\Search Settings\FF\install.rdf
d:\programme\Search Settings\SeARchsettings.dll
d:\programme\Search Settings\SearchSettings.exe
d:\programme\Search Settings\SearchSettingsRes409.dll
d:\windows\jestertb.dll
d:\windows\system32\SHELLLNK.TLB
.
((((((((((((((((((((((( Dateien erstellt von 2010-03-24 bis 2010-04-24 ))))))))))))))))))))))))))))))
.
2010-04-23 21:24 . 2010-04-23 21:24 -------- d-----w- d:\dokumente und einstellungen\Thorsten1\Anwendungsdaten\Nero
2010-04-23 21:21 . 2010-04-23 21:22 -------- d-----w- d:\programme\Nero
2010-04-23 21:21 . 2010-04-23 21:22 -------- d-----w- d:\dokumente und einstellungen\All Users\Anwendungsdaten\Nero
2010-04-23 21:21 . 2010-04-23 21:21 -------- d-----w- d:\programme\Gemeinsame Dateien\Nero
2010-04-16 21:25 . 2010-04-17 21:58 -------- d-----w- d:\programme\OpenTTD
2010-04-16 21:00 . 2010-04-16 21:00 -------- d-----w- d:\dokumente und einstellungen\Thorsten1\Anwendungsdaten\Atari
2010-04-16 20:53 . 2010-04-16 20:53 -------- d-----w- d:\programme\Atari
2010-04-15 22:42 . 2010-04-15 22:42 -------- d-sh--w- d:\dokumente und einstellungen\Thorsten1\IECompatCache
2010-04-15 22:11 . 2010-04-15 22:11 -------- d-----w- d:\dokumente und einstellungen\Thorsten1\Anwendungsdaten\TrueCrypt
2010-04-15 17:19 . 2010-04-15 17:26 -------- dc----w- D:\Far Cry 2
2010-04-05 16:02 . 2010-04-05 16:02 -------- d-----w- d:\dokumente und einstellungen\Thorsten1\Anwendungsdaten\Canneverbe_Limited
2010-04-05 16:01 . 2010-04-05 16:01 -------- d-----w- d:\dokumente und einstellungen\Thorsten1\Anwendungsdaten\WinSplit
2010-04-05 16:00 . 2010-04-05 16:00 -------- d-----w- d:\programme\WinSplit
2010-04-05 15:59 . 2010-04-05 15:59 -------- d-----w- d:\programme\CDBurnerXP
2010-04-05 15:28 . 2010-04-05 15:28 -------- d-----w- d:\dokumente und einstellungen\Thorsten1\Anwendungsdaten\ViStart
2010-04-05 15:28 . 2010-04-05 15:28 -------- d-----w- d:\dokumente und einstellungen\Thorsten1\Anwendungsdaten\ViSplore
2010-04-05 15:27 . 2010-04-24 16:44 -------- d-----w- d:\windows\system32\VIRepair
2010-04-05 15:23 . 2010-04-05 15:23 -------- d-----w- d:\programme\ViSplore
2010-04-05 15:23 . 2009-04-25 01:12 348161 ----a-w- d:\windows\system32\viwc.exe
2010-04-05 15:23 . 2010-04-05 15:23 -------- d-----w- d:\programme\TrueTransparency
2010-04-05 15:23 . 2010-04-24 16:44 -------- d-----w- d:\programme\WinFlip
2010-04-05 15:23 . 2010-04-24 16:44 -------- d-----w- d:\programme\ViStart
2010-04-05 15:23 . 2010-04-05 15:23 -------- d-----w- d:\programme\ViGlance
2010-04-05 15:23 . 2010-04-05 15:23 -------- d-----w- d:\programme\Vista Rainbar
2010-04-05 15:23 . 2010-04-05 15:23 -------- d-----w- d:\programme\Vista Drive Icon
2010-04-05 15:23 . 2009-03-18 06:46 6181376 ----a-w- d:\windows\system32\sevenui.exe
2010-04-05 15:23 . 2006-12-10 23:15 498176 ----a-w- d:\windows\system32\logon.scr
2010-04-05 15:20 . 2010-04-05 15:23 -------- d-----w- d:\windows\system32\VITrans
2010-04-05 15:20 . 2010-04-05 15:26 -------- dc----w- D:\VTPFiles
2010-04-05 15:20 . 2006-12-03 15:15 111104 ----a-w- d:\windows\system32\Uharc.exe
2010-04-05 15:20 . 2006-12-03 15:15 19968 ----a-w- d:\windows\system32\reico.exe
2010-04-05 15:20 . 2006-12-03 15:15 69632 ----a-w- d:\windows\system32\moveex.exe
2010-04-05 15:20 . 2006-12-03 15:14 8636 ----a-w- d:\windows\system32\modifype.exe
2010-04-05 15:20 . 2004-11-27 17:00 94208 ----a-w- d:\windows\system32\pskill.exe
2010-04-05 15:19 . 2009-03-23 15:39 20480 ----a-w- d:\windows\system32\scrnrdr.exe
2010-03-27 21:14 . 2010-04-24 16:18 -------- d-----w- d:\dokumente und einstellungen\Thorsten1\Anwendungsdaten\vlc
2010-03-27 19:39 . 2010-03-27 19:39 -------- d-----w- d:\dokumente und einstellungen\Thorsten1\Anwendungsdaten\Rainmeter
2010-03-27 19:24 . 2010-03-27 20:17 -------- d-----w- d:\programme\nLite
2010-03-27 19:23 . 2010-03-27 19:23 -------- d-----w- d:\programme\JAP
2010-03-27 19:21 . 2010-03-27 19:21 -------- d-----w- d:\programme\ATITool
2010-03-27 19:20 . 2000-08-19 17:29 268048 ----a-w- d:\windows\system32\dxtmeta2.dll
2010-03-26 19:22 . 2010-03-26 19:22 -------- d-----w- d:\programme\THQ
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-04-24 16:48 . 2004-08-04 12:00 84318 ----a-w- d:\windows\system32\perfc007.dat
2010-04-24 16:48 . 2004-08-04 12:00 458476 ----a-w- d:\windows\system32\perfh007.dat
2010-04-24 16:17 . 2010-02-01 20:51 -------- d-----w- d:\dokumente und einstellungen\Thorsten1\Anwendungsdaten\Vista Start Menu
2010-04-24 14:52 . 2009-12-03 01:55 -------- d--h--w- d:\programme\InstallShield Installation Information
2010-04-15 22:36 . 2009-12-03 02:50 -------- d-----w- d:\programme\Microsoft Games
2010-04-15 22:35 . 2010-01-04 10:01 -------- d-----w- d:\programme\Dexpot
2010-04-15 22:32 . 2009-12-04 21:24 -------- d-----w- d:\programme\Armagetron Advanced
2010-04-15 22:26 . 2009-12-24 10:57 -------- d-----w- d:\programme\GameSpy Arcade
2010-04-15 22:24 . 2009-12-09 20:03 -------- d-----w- d:\dokumente und einstellungen\All Users\Anwendungsdaten\BioWare
2010-04-15 22:20 . 2009-12-04 21:25 -------- d-----w- d:\programme\Pacman EX2
2010-04-15 22:14 . 2010-02-01 20:16 -------- d-----w- d:\programme\Sandboxie
2010-04-15 22:13 . 2009-12-29 00:53 -------- d-----w- d:\programme\TeamViewer
2010-04-15 22:09 . 2010-02-06 12:02 -------- d-----w- d:\programme\Mobile Partner
2010-04-15 22:08 . 2010-02-06 20:11 -------- d-----w- d:\programme\8start Launcher
2010-04-10 19:26 . 2009-12-21 20:46 -------- d-----w- d:\dokumente und einstellungen\Thorsten1\Anwendungsdaten\dvdcss
2010-04-05 15:32 . 2009-12-04 21:46 -------- d-----w- d:\programme\Playlogic
2010-04-05 15:27 . 2009-12-03 02:03 24272 ----a-w- d:\dokumente und einstellungen\Thorsten1\Lokale Einstellungen\Anwendungsdaten\GDIPFONTCACHEV1.DAT
2010-03-27 20:21 . 2010-03-06 22:36 2331264 ----a-w- d:\windows\system32\TUKernel.exe
2010-03-26 19:21 . 2010-01-10 17:10 -------- d-----w- d:\programme\Jade Empire
2010-03-23 20:24 . 2009-12-20 17:59 -------- d-----w- d:\programme\PopTray
2010-03-13 09:53 . 2010-01-19 22:04 -------- d-----w- d:\programme\LGInternetKit
2010-03-06 22:47 . 2009-12-03 03:28 -------- d-----w- d:\programme\Valve
2010-03-06 22:34 . 2010-03-06 22:27 -------- d-----w- d:\dokumente und einstellungen\All Users\Anwendungsdaten\TuneUp Software
2010-03-06 22:30 . 2010-03-06 22:29 -------- d-----w- d:\programme\TuneUp Utilities 2007
2010-02-14 18:09 . 2010-02-14 18:05 78621 -c--a-w- D:\SH_Uninstall.exe
2010-02-01 21:05 . 2010-02-01 21:05 47360 ----a-w- d:\windows\system32\drivers\pcouffin.sys
2010-02-01 21:05 . 2010-02-01 21:05 47360 ----a-w- d:\dokumente und einstellungen\Thorsten1\Anwendungsdaten\pcouffin.sys
2010-02-01 20:55 . 2010-02-01 20:55 217664 ----a-w- d:\windows\system32\drivers\truecrypt.sys
2010-02-01 20:25 . 2010-02-01 20:25 64827 ----a-w- d:\windows\BricoPackUninst.cmd
2010-02-01 20:25 . 2010-02-01 20:23 6120 ----a-w- d:\windows\BricoPackFoldersDelete.cmd
2009-12-13 14:08 . 2009-12-13 14:08 0 --sh--w- d:\windows\S0A9B406E.tmp
.
------- Sigcheck -------
[-] 2009-08-06 . 0B6DABD6FFF1AD42A3CD65A1C7EE8F35 . 68832 . . [7.4.7600.226] . . d:\windows\ServicePackFiles\i386\wuauclt.exe
[-] 2009-08-06 . 0B6DABD6FFF1AD42A3CD65A1C7EE8F35 . 68832 . . [7.4.7600.226] . . d:\windows\system32\wuauclt.exe
[7] 2004-08-04 . 032CA12162E89E545356525554EA12A7 . 111616 . . [5.4.3790.2180] . . d:\windows\$NtServicePackUninstall$\wuauclt.exe
[7] 2009-10-29 . D473C3526B86547643858E40FD096422 . 3091968 . . [6.00.2900.5897] . . d:\windows\$hf_mig$\KB976325\SP3GDR\mshtml.dll
[-] 2009-10-29 . A5A9BAEF52C5BB4647654C996C658C5B . 6214656 . . [8.00.6001.18854] . . d:\windows\ServicePackFiles\i386\mshtml.dll
[7] 2009-10-29 . 686E3FB68E8E41CD6B2970E6D49F1E14 . 5940736 . . [8.00.6001.18854] . . d:\windows\SoftwareDistribution\Download\85af8afe81c33bd591227dcad3f455c7\SP3GDR\mshtml.dll
[-] 2009-10-29 . A5A9BAEF52C5BB4647654C996C658C5B . 6214656 . . [8.00.6001.18854] . . d:\windows\system32\mshtml.dll
[7] 2009-10-29 . 686E3FB68E8E41CD6B2970E6D49F1E14 . 5940736 . . [8.00.6001.18854] . . d:\windows\system32\dllcache\mshtml.dll
[-] 2009-10-29 . A5A9BAEF52C5BB4647654C996C658C5B . 6214656 . . [8.00.6001.18854] . . d:\windows\system32\VITrans\mshtml.dll
[7] 2009-10-29 . 430315D0CAA115EA42EFDF31A93AB5D0 . 5944320 . . [8.00.6001.22945] . . d:\windows\$hf_mig$\KB976325-IE8\SP3QFE\mshtml.dll
[7] 2009-10-29 . 430315D0CAA115EA42EFDF31A93AB5D0 . 5944320 . . [8.00.6001.22945] . . d:\windows\SoftwareDistribution\Download\85af8afe81c33bd591227dcad3f455c7\SP3QFE\mshtml.dll
[7] 2009-10-29 . 2DE2C731DC298392D763BF62C0310D4A . 3084288 . . [6.00.2900.3640] . . d:\windows\ie8\mshtml.dll
[7] 2009-10-29 . 0B59B93A2524462E02EB2084FEA2E9C1 . 3094016 . . [6.00.2900.5897] . . d:\windows\$hf_mig$\KB976325\SP3QFE\mshtml.dll
[7] 2009-10-29 . A49E11FC06282A68232DE1AF1E9C9CD3 . 3091968 . . [6.00.2900.3640] . . d:\windows\$hf_mig$\KB976325\SP2QFE\mshtml.dll
[7] 2009-03-08 . D469A0EBA2EF5C6BEE8065B7E3196E5E . 5937152 . . [8.00.6001.18702] . . d:\windows\ie8updates\KB976325-IE8\mshtml.dll
[7] 2004-08-04 . CAC51AD576713E5F0CE2251ED3A7FE82 . 3003392 . . [6.00.2900.2180] . . d:\windows\$NtUninstallKB976325$\mshtml.dll
[7] 2009-08-04 . 121AEDCE2F5A65D63C9D51B9198FA7B3 . 2191488 . . [5.1.2600.5857] . . d:\windows\$hf_mig$\KB971486\SP3GDR\ntoskrnl.exe
[7] 2009-08-04 . 121AEDCE2F5A65D63C9D51B9198FA7B3 . 2191488 . . [5.1.2600.5857] . . d:\windows\Driver Cache\i386\ntoskrnl.exe
[-] 2009-08-04 . 6EB34AE2EA883B4DF1FF4E13213A218E . 2200576 . . [5.1.2600.5857] . . d:\windows\system32\ntoskrnl.exe
[7] 2009-08-04 . 121AEDCE2F5A65D63C9D51B9198FA7B3 . 2191488 . . [5.1.2600.5857] . . d:\windows\system32\dllcache\ntoskrnl.exe
[7] 2009-08-04 . 121AEDCE2F5A65D63C9D51B9198FA7B3 . 2191488 . . [5.1.2600.5857] . . d:\windows\system32\VITrans\ntoskrnl.exe
[7] 2009-08-04 . 4B86421F2D85D9A4ECB06885C40B8EEB . 2191616 . . [5.1.2600.5857] . . d:\windows\$hf_mig$\KB971486\SP3QFE\ntoskrnl.exe
[7] 2009-08-04 . 2D5CFDE135E502FB4290F6C280FDE252 . 2188288 . . [5.1.2600.3610] . . d:\windows\$hf_mig$\KB971486\SP2QFE\ntoskrnl.exe
[7] 2009-08-04 . C1D5F1360805BF21E2108A0FCDB0E121 . 2182656 . . [5.1.2600.3610] . . d:\windows\$NtServicePackUninstall$\ntoskrnl.exe
[7] 2009-02-10 . D3453310FC92736E674FFDC6E3F455B7 . 2191488 . . [5.1.2600.5755] . . d:\windows\$hf_mig$\KB956572\SP3QFE\ntoskrnl.exe
[7] 2009-02-09 . E22124EC3A33F40755DCD2F4B1BE8A87 . 2188416 . . [5.1.2600.3520] . . d:\windows\$hf_mig$\KB956572\SP2QFE\ntoskrnl.exe
[7] 2009-02-09 . FEE1600B76B196D9993CD468DA7524F7 . 2191360 . . [5.1.2600.5755] . . d:\windows\$hf_mig$\KB956572\SP3GDR\ntoskrnl.exe
[7] 2009-02-09 . FEE1600B76B196D9993CD468DA7524F7 . 2191360 . . [5.1.2600.5755] . . d:\windows\$NtUninstallKB971486$\ntoskrnl.exe
[7] 2008-04-14 . 354C9291513BCE4D0ED6B0C6A15470F8 . 2191360 . . [5.1.2600.5512] . . d:\windows\$NtUninstallKB956572$\ntoskrnl.exe
[7] 2008-04-14 . 354C9291513BCE4D0ED6B0C6A15470F8 . 2191360 . . [5.1.2600.5512] . . d:\windows\ServicePackFiles\i386\ntoskrnl.exe
[7] 2004-08-04 . DC888C9C4CA0EEA7A3CB7E6B610F75C7 . 2183296 . . [5.1.2600.2180] . . d:\windows\$NtUninstallKB971486_0$\ntoskrnl.exe
[-] 2009-10-29 . 30A8EC1E0BC95727E8D195D948081547 . 907264 . . [8.00.6001.18854] . . d:\windows\ServicePackFiles\i386\wininet.dll
[7] 2009-10-29 . 3426FBE495D1825D5C09C84D1E9361C1 . 916480 . . [8.00.6001.18854] . . d:\windows\SoftwareDistribution\Download\85af8afe81c33bd591227dcad3f455c7\SP3GDR\wininet.dll
[-] 2009-10-29 . 30A8EC1E0BC95727E8D195D948081547 . 907264 . . [8.00.6001.18854] . . d:\windows\system32\wininet.dll
[7] 2009-10-29 . 3426FBE495D1825D5C09C84D1E9361C1 . 916480 . . [8.00.6001.18854] . . d:\windows\system32\dllcache\wininet.dll
[7] 2009-10-29 . 0A4248E124C88EDD1E0A93AE93E4DB6A . 916480 . . [8.00.6001.22945] . . d:\windows\$hf_mig$\KB976325-IE8\SP3QFE\wininet.dll
[7] 2009-10-29 . 0A4248E124C88EDD1E0A93AE93E4DB6A . 916480 . . [8.00.6001.22945] . . d:\windows\SoftwareDistribution\Download\85af8afe81c33bd591227dcad3f455c7\SP3QFE\wininet.dll
[7] 2009-10-29 . C64DCEA39BD8845BADB6CF9DB6E14D8B . 667648 . . [6.00.2900.3640] . . d:\windows\ie8\wininet.dll
[7] 2009-10-29 . 547B7FF3C91C09E7EE82760DA4323706 . 672768 . . [6.00.2900.5897] . . d:\windows\$hf_mig$\KB976325\SP3GDR\wininet.dll
[7] 2009-10-29 . 132C1D9C2DDCDFF55746D73508250362 . 674304 . . [6.00.2900.5897] . . d:\windows\$hf_mig$\KB976325\SP3QFE\wininet.dll
[7] 2009-10-29 . 66F8DD3C5A2F6B5B839B96F9704B40BA . 674304 . . [6.00.2900.3640] . . d:\windows\$hf_mig$\KB976325\SP2QFE\wininet.dll
[7] 2009-03-08 . 6CE32F7778061CCC5814D5E0F282D369 . 914944 . . [8.00.6001.18702] . . d:\windows\ie8updates\KB976325-IE8\wininet.dll
[7] 2004-08-04 . B1A1DA99C4A6EBFD59F86A453BF02F39 . 662016 . . [6.00.2900.2180] . . d:\windows\$NtUninstallKB976325$\wininet.dll
[-] 2008-04-14 . 3BE58541F9F9F6559CE194F077853D4C . 1491456 . . [6.00.2900.5512] . . d:\windows\explorer.exe
[-] 2008-04-14 . BB8E0AE6833A774F4792CB8892CA92E6 . 979456 . . [6.00.2900.5512] . . d:\windows\system32\VITrans\explorer.exe
[-] 2008-04-14 . BB8E0AE6833A774F4792CB8892CA92E6 . 979456 . . [6.00.2900.5512] . . d:\windows\ServicePackFiles\i386\explorer.exe
[7] 2004-08-04 . 22FE1BE02EADDE1632E478E4125639E0 . 1035264 . . [6.00.2900.2180] . . d:\windows\$NtServicePackUninstall$\explorer.exe
[7] 2009-08-04 . C50ED62BB5CDC5AD4F3985ED39C6AE87 . 2068480 . . [5.1.2600.5857] . . d:\windows\$hf_mig$\KB971486\SP3QFE\ntkrnlpa.exe
[7] 2009-08-04 . 602A85B23E5D9E6402D7205AFBE6FEB4 . 2068352 . . [5.1.2600.5857] . . d:\windows\$hf_mig$\KB971486\SP3GDR\ntkrnlpa.exe
[7] 2009-08-04 . 602A85B23E5D9E6402D7205AFBE6FEB4 . 2068352 . . [5.1.2600.5857] . . d:\windows\Driver Cache\i386\ntkrnlpa.exe
[-] 2009-08-04 . BB848FA5FA1F008597E41FC98E28A84B . 2077440 . . [5.1.2600.5857] . . d:\windows\system32\ntkrnlpa.exe
[7] 2009-08-04 . 602A85B23E5D9E6402D7205AFBE6FEB4 . 2068352 . . [5.1.2600.5857] . . d:\windows\system32\dllcache\ntkrnlpa.exe
[7] 2009-08-04 . 602A85B23E5D9E6402D7205AFBE6FEB4 . 2068352 . . [5.1.2600.5857] . . d:\windows\system32\VITrans\ntkrnlpa.exe
[7] 2009-08-04 . BAA0FD3FF565346D0C5EE3F7F8E10001 . 2065280 . . [5.1.2600.3610] . . d:\windows\$hf_mig$\KB971486\SP2QFE\ntkrnlpa.exe
[7] 2009-08-04 . 65B10BD35ECFB3A0ADDDEEB2F0350B70 . 2060032 . . [5.1.2600.3610] . . d:\windows\$NtServicePackUninstall$\ntkrnlpa.exe
[7] 2009-02-10 . 321917CFF934663C48C1E91A930E5D71 . 2068352 . . [5.1.2600.5755] . . d:\windows\$hf_mig$\KB956572\SP3GDR\ntkrnlpa.exe
[7] 2009-02-10 . 321917CFF934663C48C1E91A930E5D71 . 2068352 . . [5.1.2600.5755] . . d:\windows\$NtUninstallKB971486$\ntkrnlpa.exe
[7] 2009-02-09 . 84C1C109552E9E276FF004E181B80C25 . 2065280 . . [5.1.2600.3520] . . d:\windows\$hf_mig$\KB956572\SP2QFE\ntkrnlpa.exe
[7] 2009-02-09 . 1F9DA92672B8B5720C5FB1E87D8F249F . 2068480 . . [5.1.2600.5755] . . d:\windows\$hf_mig$\KB956572\SP3QFE\ntkrnlpa.exe
[7] 2008-04-14 . E51980EF65CED4490A7395A06C08DA34 . 2068224 . . [5.1.2600.5512] . . d:\windows\$NtUninstallKB956572$\ntkrnlpa.exe
[7] 2008-04-14 . E51980EF65CED4490A7395A06C08DA34 . 2068224 . . [5.1.2600.5512] . . d:\windows\ServicePackFiles\i386\ntkrnlpa.exe
[7] 2004-08-04 . CE41FC4C06499A389D39B301879535FB . 2059136 . . [5.1.2600.2180] . . d:\windows\$NtUninstallKB971486_0$\ntkrnlpa.exe
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{57BCA5FA-5DBB-45a2-B558-1755C3F6253B}"= "d:\programme\Winamp Toolbar\winamptb.dll" [2009-05-06 1262888]
"{038cb5c7-48ea-4af9-94e0-a1646542e62b}"= "d:\programme\ToggleEN\tbTog0.dll" [2009-07-02 2215960]
[HKEY_CLASSES_ROOT\clsid\{57bca5fa-5dbb-45a2-b558-1755c3f6253b}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLTBSearch.1]
[HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLTBSearch]
[HKEY_CLASSES_ROOT\clsid\{038cb5c7-48ea-4af9-94e0-a1646542e62b}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{038cb5c7-48ea-4af9-94e0-a1646542e62b}]
2009-07-02 09:18 2215960 ----a-w- d:\programme\ToggleEN\tbTog0.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{201f27d4-3704-41d6-89c1-aa35e39143ed}]
2008-11-24 19:25 333192 ----a-w- d:\programme\AskBarDis\bar\bin\askBar.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{038cb5c7-48ea-4af9-94e0-a1646542e62b}"= "d:\programme\ToggleEN\tbTog0.dll" [2009-07-02 2215960]
"{3041d03e-fd4b-44e0-b742-2d9b88305f98}"= "d:\programme\AskBarDis\bar\bin\askBar.dll" [2008-11-24 333192]
[HKEY_CLASSES_ROOT\clsid\{038cb5c7-48ea-4af9-94e0-a1646542e62b}]
[HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]
[HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{038CB5C7-48EA-4AF9-94E0-A1646542E62B}"= "d:\programme\ToggleEN\tbTog0.dll" [2009-07-02 2215960]
"{3041D03E-FD4B-44E0-B742-2D9B88305F98}"= "d:\programme\AskBarDis\bar\bin\askBar.dll" [2008-11-24 333192]
[HKEY_CLASSES_ROOT\clsid\{038cb5c7-48ea-4af9-94e0-a1646542e62b}]
[HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]
[HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"InfoCockpit"="d:\programme\T-Online\T-Online_Software_6\Info-Cockpit\IC_START.EXE" [2009-04-29 268800]
"T-Online_Software_6\WLAN-Access Finder"="d:\programme\T-Online\WLAN-Access Finder\ToWLaAcF.exe" [2008-04-08 671796]
"VistaStartMenu"="d:\programme\Vista Start Menu\VistaStartMenu.exe" [2009-04-13 2171392]
"Any Wallpaper"="d:\programme\AnyUtils\Any Wallpaper\AnyWallpaper.exe" [2008-07-26 122880]
"viwc"="d:\windows\system32\viwc.exe" [2009-04-25 348161]
"ViGlance"="d:\programme\ViGlance\ViGlance.exe" [2009-04-24 323584]
"WinFlip"="d:\programme\WinFlip\WinFlip.exe" [2008-05-21 483328]
"Vista Rainbar"="d:\programme\Vista Rainbar\launcher.exe" [2009-03-19 135528]
"ViSplore"="d:\programme\ViSplore\ViSplore.exe" [2009-02-04 389120]
"ViStart"="d:\programme\ViStart\ViStart.exe" [2009-04-17 860160]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="d:\programme\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-07-02 98304]
"RTHDCPL"="RTHDCPL.EXE" [2009-07-29 18671104]
"TVBroadcast"="d:\programme\Sceneo\AbsolutTV\SERVICES\ODSBC\ODSBCApp.exe" [2008-06-02 797696]
"CoolSwitch"="d:\windows\system32\taskswitch.exe" [2002-03-19 45632]
"Start WingMan Profiler"="d:\programme\Logitech\Gaming Software\LWEMon.exe" [2008-04-04 88584]
"DrvIcon"="d:\programme\Vista Drive Icon\DrvIcon.exe" [2008-04-13 49152]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="d:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
"InfoCockpit"="d:\programme\T-Online\T-Online_Software_6\Info-Cockpit\IC_START.EXE" [2009-04-29 268800]
d:\dokumente und einstellungen\Thorsten1\Startmen\Programme\Autostart\
UberIcon.lnk - d:\windows\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe [2006-5-21 180224]
Y'z Shadow.lnk - d:\windows\BricoPacks\Vista Inspirat 2\YzShadow\YzShadow.exe [2006-5-21 155648]
d:\dokumente und einstellungen\All Users\Startmen\Programme\Autostart\
MultiMon Taskbar.lnk - d:\programme\MMTaskbar\MultiMon.exe [2010-1-4 294912]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"UIHost"=hex(2):73,65,76,65,6e,75,69,2e,65,78,65,00
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"RocketDock"="d:\windows\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"Ashampoo Core Tuner"="d:\programme\Ashampoo\Ashampoo Core Tuner\ct.exe" -TRAY
"SunJavaUpdateSched"="d:\programme\Java\jre6\bin\jusched.exe"
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"d:\\WINDOWS\\system32\\usmt\\migwiz.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"d:\\Programme\\Valve\\hl.exe"=
"d:\\Programme\\Sierra\\FEAR\\FEAR.exe"=
"d:\\Programme\\Sierra\\FEAR\\FEARMP.exe"=
"d:\\Programme\\EA Games\\Medal of Honor Pacific Assault(tm)\\mohpa.exe"=
"d:\\Programme\\THQ\\S.T.A.L.K.E.R. - Shadow of Chernobyl\\bin\\XR_3DA.exe"=
"d:\\Programme\\THQ\\S.T.A.L.K.E.R. - Shadow of Chernobyl\\bin\\dedicated\\XR_3DA.exe"=
R2 apmSAWCtrl;apm - SAW control service;d:\programme\abylonsoft\SAWipe\SAWCtrlSer.EXE [22.12.2009 13:05 230224]
R2 Application Updater;Application Updater;d:\programme\Application Updater\ApplicationUpdater.exe [16.12.2009 18:38 375296]
R2 ASKUpgrade;ASKUpgrade;d:\programme\AskBarDis\bar\bin\ASKUpgrade.exe [01.02.2010 23:13 234888]
R2 MZCCntrl;T-Online WLAN Adapter Steuerungsdienst;d:\programme\Gemeinsame Dateien\Marmiko Shared\MZCCntrl.exe [11.12.2009 23:12 61440]
R2 srvcPVR;Sceneo PVR Service;d:\programme\Sceneo\AbsolutTV\Services\PVR\pvrservice.exe [22.12.2009 13:40 1811456]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;d:\windows\system32\drivers\klim5.sys [30.04.2008 19:06 24592]
R3 MACNDIS5;MACNDIS5 NDIS Protocol Driver;d:\progra~1\GEMEIN~1\MARMIK~1\MACNDIS5.SYS [11.12.2009 23:12 17280]
S1 ntiomin;ntiomin; [x]
S3 Ambfilt;Ambfilt;d:\windows\system32\drivers\Ambfilt.sys [11.12.2009 21:58 1684736]
S3 hwusbdev;Huawei DataCard USB PNP Device;d:\windows\system32\DRIVERS\ewusbdev.sys --> d:\windows\system32\DRIVERS\ewusbdev.sys [?]
S3 MIINPazX;MIINPazX NDIS Protocol Driver;d:\progra~1\GEMEIN~1\MARMIK~1\MInfraIS\MIINPazX.SYS [11.12.2009 23:11 17152]
S3 MTOnlPktAlyX;MTOnlPktAlyX NDIS Protocol Driver;d:\progra~1\T-Online\T-ONLI~1\BASIS-~1\Basis1\MTOnlPktAlyX.SYS [11.12.2009 23:11 17536]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{9C450606-ED24-4958-92BA-B8940C99D441}]
2009-03-04 15:32 8192 ----a-w- d:\programme\PixiePack Codec Pack\InstallerHelper.exe
.
Inhalt des "geplante Tasks" Ordners
2010-03-06 d:\windows\Tasks\1-Klick-Wartung.job
- d:\programme\TuneUp Utilities 2007\SystemOptimizer.exe [2006-11-15 13:02]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.windowsxlive.net
uDefault_Search_URL = hxxp://www.google.com/ie
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: &Winamp Search - d:\dokumente und einstellungen\All Users\Anwendungsdaten\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html
IE: Add to Google Photos Screensa&ver - d:\windows\system32\GPhotos.scr/200
FF - ProfilePath - d:\dokumente und einstellungen\Thorsten1\Anwendungsdaten\Mozilla\Firefox\Profiles\h6cm96iz.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2077543&SearchSource=3&q={searchTerms}
FF - prefs.js: browser.startup.homepage - hxxp://search.conduit.com/?ctid=CT2077543&SearchSource=13
FF - prefs.js: keyword.URL - hxxp://de.search.yahoo.com/search?fr=greentree_ff1&ei=utf-8&type=196149&p=
FF - component: d:\dokumente und einstellungen\Thorsten1\Anwendungsdaten\Mozilla\Firefox\Profiles\h6cm96iz.default\extensions\{038cb5c7-48ea-4af9-94e0-a1646542e62b}\components\FFExternalAlert.dll
FF - component: d:\dokumente und einstellungen\Thorsten1\Anwendungsdaten\Mozilla\Firefox\Profiles\h6cm96iz.default\extensions\{0b38152b-1b20-484d-a11f-5e04a9b0661f}\components\WinampTBPlayer.dll
FF - component: d:\dokumente und einstellungen\Thorsten1\Anwendungsdaten\Mozilla\Firefox\Profiles\h6cm96iz.default\extensions\piclens@cooliris.com\components\cooliris.dll
FF - plugin: d:\dokumente und einstellungen\Thorsten1\Anwendungsdaten\Mozilla\Firefox\Profiles\h6cm96iz.default\extensions\piclens@cooliris.com\plugins\npcoolirisplugin.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - d:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
BHO-{01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C} - d:\programme\Dealio Toolbar\IE\4.0.2\dealioToolbarIE.dll
Toolbar-{01398B87-61AF-4FFB-9AB5-1A1C5FB39A9C} - d:\programme\Dealio Toolbar\IE\4.0.2\dealioToolbarIE.dll
WebBrowser-{604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - (no file)
HKLM-Run-SearchSettings - d:\programme\Search Settings\SearchSettings.exe
AddRemove-Die Gilde 2 - Gold Edition - d:\programme\Die Gilde 2 - Gold Edition\uninstall.exe
AddRemove-Rainmeter - d:\programme\Rainmeter\uninst.exe
AddRemove-Vista Drive Icon - d:\programme\Vista Drive Icon\uninst.exe
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2010-04-24 18:44
Windows 5.1.2600 Service Pack 3 NTFS
Scanne versteckte Prozesse...
Scanne versteckte Autostarteinträge...
Scanne versteckte Dateien...
Scan erfolgreich abgeschlossen
versteckte Dateien: 0
**************************************************************************
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
[HKEY_USERS\S-1-5-21-329068152-776561741-839522115-1004\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:bb,d1,67,ee,25,01,5b,44,5f,44,45,5c,b8,09,35,34,c1,8d,be,79,16,48,cb,
dd,59,58,34,c2,a1,bd,71,fd,77,ea,e8,4f,74,c0,be,c0,7e,cd,88,1f,22,66,eb,27,\
"??"=hex:65,f8,d9,d8,a1,e3,79,18,c8,01,ad,14,4f,3e,c0,ba
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------
- - - - - - - > 'winlogon.exe'(1100)
d:\windows\system32\Ati2evxx.dll
d:\windows\system32\cscui.dll
- - - - - - - > 'lsass.exe'(1164)
d:\windows\system32\wdigest.dll
- - - - - - - > 'explorer.exe'(1680)
d:\windows\system32\SHDOCVW.dll
d:\windows\BricoPacks\Vista Inspirat 2\YzShadow\YzShadow.dll
d:\windows\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon.dll
d:\programme\WinFlip\WFHook.dll
d:\windows\system32\SETUPAPI.dll
d:\programme\Vista Start Menu\VistaStartMenu.dll
d:\windows\system32\NETSHELL.dll
d:\windows\system32\credui.dll
d:\programme\ViStart\StartHook.dll
d:\windows\system32\webcheck.dll
d:\windows\system32\WPDShServiceObj.dll
d:\windows\system32\PortableDeviceTypes.dll
d:\windows\system32\PortableDeviceApi.dll
.
------------------------ Weitere laufende Prozesse ------------------------
.
d:\windows\system32\Ati2evxx.exe
d:\windows\system32\Ati2evxx.exe
d:\programme\Java\jre6\bin\jqs.exe
d:\programme\Gemeinsame Dateien\Nero\Nero BackItUp 4\NBService.exe
d:\programme\CDBurnerXP\NMSAccessU.exe
d:\windows\system32\wscntfy.exe
d:\windows\RTHDCPL.EXE
d:\programme\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
d:\programme\T-Online\T-Online_Software_6\Info-Cockpit\INFOCOCKPIT.EXE
d:\progra~1\VISTAR~1\Rainbar.exe
d:\progra~1\T-Online\T-ONLI~1\BASIS-~1\Basis2\PROFIL~1.EXE
d:\programme\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
d:\progra~1\T-Online\T-ONLI~1\Notifier\Notifier.exe
d:\progra~1\T-Online\T-ONLI~1\BASIS-~1\Basis2\kernel.exe
d:\progra~1\T-Online\T-ONLI~1\BASIS-~1\Basis2\sc_watch.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2010-04-24 18:55:35 - PC wurde neu gestartet
ComboFix-quarantined-files.txt 2010-04-24 16:55
Vor Suchlauf: 8 Verzeichnis(se), 34.203.586.560 Bytes frei
Nach Suchlauf: 9 Verzeichnis(se), 34.497.028.096 Bytes frei
- - End Of File - - 5E385D9AEA579DC8746253C2EA425489
|
