| aschi_maroc | 18.05.2011 18:07 |
hab doch hinbekommen
Hier die Logfile:
Combofix Logfile: Code:
ComboFix 11-05-17.03 - The One 18.05.2011 18:56:03.1.2 - x86
Microsoft® Windows Vista™ Home Basic 6.0.6001.1.1252.49.1031.18.2046.1121 [GMT 2:00]
ausgeführt von:: c:\users\The One\Desktop\cofi.exe.exe
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\The One\AppData\Roaming\Local
c:\users\The One\AppData\Roaming\Local\Temp\DDM\Settings\0.ddi
c:\users\The One\AppData\Roaming\Local\Temp\DDM\Settings\1.ddi
c:\users\The One\AppData\Roaming\Local\Temp\DDM\Settings\2.ddi
c:\users\The One\AppData\Roaming\Local\Temp\DDM\Settings\3.ddi
c:\users\The One\AppData\Roaming\Local\Temp\DDM\Settings\3ab2392bf5752604cd57c42955dce824.ddr
c:\users\The One\AppData\Roaming\Local\Temp\DDM\Settings\4.ddi
c:\users\The One\AppData\Roaming\Local\Temp\DDM\Settings\5.ddi
c:\users\The One\AppData\Roaming\Local\Temp\DDM\Settings\6.ddi
c:\users\The One\AppData\Roaming\Local\Temp\DDM\Settings\iamlegend.avi.ddr
c:\users\The One\AppData\Roaming\Local\Temp\DDM\Settings\Scarface.170.min.intro.avi(2).ddr
c:\users\The One\AppData\Roaming\Local\Temp\DDM\Settings\Scarface.170.min.intro.avi(3).ddr
c:\users\The One\AppData\Roaming\Local\Temp\DDM\Settings\Scarface.170.min.intro.avi(4).ddr
c:\users\The One\AppData\Roaming\Local\Temp\DDM\Settings\Scarface.170.min.intro.avi(5).ddr
c:\users\The One\AppData\Roaming\Local\Temp\DDM\Settings\Scarface.170.min.intro.avi.ddr
c:\users\The One\AppData\Roaming\Local\Temp\DDM\Settings\settings.ddi
c:\users\The One\AppData\Roaming\Local\Temp\DDM\Settings\Temporary Downloaded Files\3ab2392bf5752604cd57c42955dce824
c:\users\The One\AppData\Roaming\Local\Temp\DDM\Settings\Temporary Downloaded Files\iamlegend.avi
c:\users\The One\AppData\Roaming\Local\Temp\DDM\Settings\Temporary Downloaded Files\Scarface.170.min.intro(2).avi
c:\users\The One\AppData\Roaming\Local\Temp\DDM\Settings\Temporary Downloaded Files\Scarface.170.min.intro(3).avi
c:\users\The One\AppData\Roaming\Local\Temp\DDM\Settings\Temporary Downloaded Files\Scarface.170.min.intro(4).avi
c:\users\The One\AppData\Roaming\Local\Temp\DDM\Settings\Temporary Downloaded Files\Scarface.170.min.intro.avi
c:\users\The One\AppData\Roaming\Local\Temp\DDM\Settings\Temporary Downloaded Files\Scarface.170.min.intro.avi(5).ddp
c:\users\The One\AppData\Roaming\Tesar\zouvr.exe
.
.
((((((((((((((((((((((( Dateien erstellt von 2011-04-18 bis 2011-05-18 ))))))))))))))))))))))))))))))
.
.
2011-05-18 17:01 . 2011-05-18 17:01 -------- d-----w- c:\users\The One\AppData\Local\temp
2011-05-18 17:01 . 2011-05-18 17:01 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-05-18 14:10 . 2011-05-18 16:49 -------- d-----w- c:\users\The One\AppData\Roaming\Eksyc
2011-05-18 14:09 . 2011-05-18 14:09 -------- d-----w- C:\_OTL
2011-05-18 11:29 . 2010-12-20 16:09 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-05-18 11:29 . 2010-12-20 16:08 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-05-18 09:54 . 2011-04-11 07:04 7071056 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{50E1AE3E-FC37-4619-A8FA-7346F6049EB6}\mpengine.dll
2011-05-17 20:39 . 2011-05-17 20:39 -------- d-----w- c:\users\The One\AppData\Roaming\Malwarebytes
2011-05-17 20:38 . 2011-05-17 20:38 -------- d-----w- c:\programdata\Malwarebytes
2011-05-17 20:38 . 2011-05-18 12:36 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2011-05-11 11:56 . 2011-04-07 12:01 2409784 ----a-w- c:\program files\Windows Mail\OESpamFilter.dat
2011-05-09 16:05 . 2004-10-22 00:18 749568 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\10\50\Intel32\iKernel.dll
2011-05-09 16:05 . 2004-10-22 00:17 69715 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\10\50\Intel32\ctor.dll
2011-05-09 16:05 . 2004-10-22 00:17 274432 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\10\50\Intel32\iscript.dll
2011-05-09 16:05 . 2004-10-22 00:16 180224 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\10\50\Intel32\iuser.dll
2011-05-09 16:05 . 2004-10-22 00:16 5632 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\10\50\Intel32\DotNetInstaller.exe
2011-05-09 16:05 . 2011-05-09 16:05 323716 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\10\50\Intel32\setup.dll
2011-05-09 16:05 . 2011-05-09 16:05 192644 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\10\50\Intel32\iGdi.dll
2011-05-08 12:56 . 2011-05-08 12:56 -------- d-----w- c:\windows\ShellNew
2011-05-07 22:59 . 2007-04-06 12:21 77824 ----a-w- c:\windows\ZS211Cap.exe
2011-05-07 22:59 . 2007-04-06 09:06 57344 ----a-w- c:\windows\ZSSnp211.exe
2011-05-07 22:59 . 2006-08-09 15:37 81920 ----a-w- c:\windows\system32\ZS211STI.dll
2011-05-07 22:59 . 2006-07-14 12:36 172115 ----a-w- c:\windows\system32\ZS211Prp.Ax
2011-05-07 22:59 . 2011-05-07 22:59 -------- d-----w- c:\program files\Vimicro
2011-05-07 22:59 . 2007-06-13 07:24 1469312 ----a-w- c:\windows\system32\drivers\ZS211.sys
2011-05-07 22:59 . 2006-08-18 14:58 49152 ----a-w- c:\windows\Domino.exe
2011-05-07 22:59 . 2006-03-14 12:28 172032 ----a-w- c:\windows\amcap.exe
2011-05-06 16:07 . 2011-05-06 16:07 -------- d-----w- c:\program files\Sanny Builder 3
2011-05-06 14:09 . 2005-05-26 13:34 2297552 ----a-w- c:\windows\system32\d3dx9_26.dll
2011-05-06 14:09 . 2008-10-15 04:22 4379984 ----a-w- c:\windows\system32\D3DX9_40.dll
2011-05-06 13:48 . 2011-05-06 13:48 -------- d-----w- c:\users\The One\AppData\Roaming\NVIDIA
2011-05-06 13:47 . 2011-05-06 13:48 -------- d-----w- c:\users\The One\AppData\Roaming\ENBSeries Configurator for GTA San Andreas
2011-05-06 13:47 . 2011-05-06 13:48 -------- d-----w- c:\program files\ENBSeries Configurator for GTA San Andreas
2011-05-05 20:54 . 2011-05-18 09:45 -------- d-----w- c:\users\UpdatusUser
2011-05-05 20:49 . 2011-04-08 05:14 944232 ----a-w- c:\windows\system32\nvdispco3220140.dll
2011-05-05 20:49 . 2011-04-08 05:14 855656 ----a-w- c:\windows\system32\nvgenco322060.dll
2011-05-05 20:49 . 2011-04-08 05:14 6299752 ----a-w- c:\windows\system32\nvwgf2um.dll
2011-05-05 20:49 . 2011-04-08 05:14 57960 ----a-w- c:\windows\system32\OpenCL.dll
2011-05-05 20:49 . 2011-04-08 05:14 5180824 ----a-w- c:\windows\system32\nvcuda.dll
2011-05-05 20:49 . 2011-04-08 05:14 2765928 ----a-w- c:\windows\system32\nvcuvid.dll
2011-05-05 20:49 . 2011-04-08 05:14 2074216 ----a-w- c:\windows\system32\nvcuvenc.dll
2011-05-05 20:49 . 2011-04-08 05:14 15227496 ----a-w- c:\windows\system32\nvoglv32.dll
2011-05-05 20:49 . 2011-04-08 05:14 13007464 ----a-w- c:\windows\system32\nvcompiler.dll
2011-05-05 20:49 . 2011-04-08 05:14 10690024 ----a-w- c:\windows\system32\drivers\nvlddmkm.sys
2011-05-05 17:14 . 2011-05-05 17:14 -------- d-----w- c:\users\The One\AppData\Local\ApplicationHistory
2011-05-05 12:33 . 2011-05-05 12:33 -------- d-----w- c:\program files\San Andreas Mod Installer
2011-05-05 12:33 . 2011-05-05 12:33 -------- d-----w- c:\windows\San Andreas Mod Installer
2011-05-04 20:49 . 2011-05-04 20:49 98304 ----a-w- c:\windows\system32\CmdLineExt.dll
2011-05-03 20:23 . 2011-05-03 20:23 -------- d-----w- c:\programdata\G & G Soft
2011-04-27 12:16 . 2011-03-03 14:56 28672 ----a-w- c:\windows\system32\Apphlpdm.dll
2011-04-27 12:16 . 2011-03-03 13:01 4240384 ----a-w- c:\windows\system32\GameUXLegacyGDFs.dll
2011-04-26 12:16 . 2011-05-01 13:14 -------- d-----w- c:\programdata\NFS Underground
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-04-09 16:55 . 2011-04-09 16:55 15453336 ----a-w- c:\windows\system32\xlive.dll
2011-04-09 16:55 . 2011-04-09 16:55 13642904 ----a-w- c:\windows\system32\xlivefnt.dll
2011-04-08 05:14 . 2011-05-05 20:49 10920 ----a-w- c:\windows\system32\drivers\nvBridge.kmd
2011-04-08 05:14 . 2011-02-09 16:43 10071656 ----a-w- c:\windows\system32\nvd3dum.dll
2011-04-08 05:14 . 2011-02-09 16:43 2034280 ----a-w- c:\windows\system32\nvapi.dll
2011-04-07 20:43 . 2011-04-07 20:43 580200 ----a-w- c:\windows\system32\easyUpdatusAPIU.dll
2011-04-07 20:43 . 2011-04-07 20:43 612456 ----a-w- c:\windows\system32\nvvsvc.exe
2011-04-07 20:43 . 2011-04-07 20:43 2582120 ----a-w- c:\windows\system32\nvsvcr.dll
2011-04-07 20:43 . 2011-04-07 20:43 111208 ----a-w- c:\windows\system32\nvmctray.dll
2011-04-07 20:43 . 2011-04-07 20:43 3701352 ----a-w- c:\windows\system32\nvcpl.dll
2011-04-07 20:43 . 2011-04-07 20:43 2565224 ----a-w- c:\windows\system32\nvsvc.dll
2011-03-10 16:12 . 2011-04-14 16:50 1161728 ----a-w- c:\windows\system32\mfc42u.dll
2011-03-10 16:12 . 2011-04-14 16:50 1136640 ----a-w- c:\windows\system32\mfc42.dll
2011-03-03 15:00 . 2011-04-14 16:50 738816 ----a-w- c:\windows\system32\inetcomm.dll
2011-03-03 14:56 . 2011-04-27 12:16 173056 ----a-w- c:\windows\apppatch\AcXtrnal.dll
2011-03-03 14:56 . 2011-04-27 12:16 459776 ----a-w- c:\windows\apppatch\AcSpecfc.dll
2011-03-03 14:56 . 2011-04-27 12:16 541696 ----a-w- c:\windows\apppatch\AcLayers.dll
2011-03-03 14:56 . 2011-04-27 12:16 2153984 ----a-w- c:\windows\apppatch\AcGenral.dll
2011-03-03 12:53 . 2011-04-14 16:50 2040832 ----a-w- c:\windows\system32\win32k.sys
2011-03-02 14:49 . 2011-04-14 16:50 86528 ----a-w- c:\windows\system32\dnsrslvr.dll
2011-02-22 12:52 . 2011-04-14 16:50 213504 ----a-w- c:\windows\system32\drivers\mrxsmb10.sys
2011-02-22 12:52 . 2011-04-14 16:50 79360 ----a-w- c:\windows\system32\drivers\mrxsmb20.sys
2011-02-22 12:51 . 2011-04-14 16:50 105984 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2011-02-22 12:51 . 2011-04-14 16:50 69632 ----a-w- c:\windows\system32\drivers\bowser.sys
2011-02-18 15:48 . 2011-04-14 16:50 833024 ----a-w- c:\windows\system32\wininet.dll
2011-02-18 15:45 . 2011-04-14 16:50 78336 ----a-w- c:\windows\system32\ieencode.dll
2011-02-18 14:36 . 2011-02-18 14:36 41984 ----a-w- c:\windows\system32\drivers\usbaapl.sys
2011-02-18 14:36 . 2011-02-18 14:36 4184352 ----a-w- c:\windows\system32\usbaaplrc.dll
2011-02-18 14:09 . 2011-04-14 16:50 389632 ----a-w- c:\windows\system32\html.iec
2011-02-18 13:48 . 2011-04-14 16:50 1383424 ----a-w- c:\windows\system32\mshtml.tlb
2011-02-18 13:31 . 2011-04-14 16:50 304640 ----a-w- c:\windows\system32\drivers\srv.sys
2011-02-18 13:31 . 2011-04-14 16:50 146432 ----a-w- c:\windows\system32\drivers\srv2.sys
2011-02-18 13:31 . 2011-04-14 16:50 102400 ----a-w- c:\windows\system32\drivers\srvnet.sys
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2010-04-16 3872080]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-18 202240]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="RtHDVCpl.exe" [2008-07-03 6266880]
"Skytel"="Skytel.exe" [2008-06-25 1826816]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2011-03-07 421160]
"ZSSnp211"="c:\windows\ZSSnp211.exe" [2007-04-06 57344]
"Domino"="c:\windows\Domino.exe" [2006-08-18 49152]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DivX Download Manager]
2010-12-08 21:15 63360 ----a-w- c:\program files\DivX\DivX Plus Web Player\DDMService.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DivXUpdate]
2010-12-08 19:17 1226608 ----a-w- c:\program files\DivX\DivX Update\DivXUpdate.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\uTorrent]
2010-11-08 13:47 328568 ----a-w- c:\program files\uTorrent\uTorrent.exe
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"uTorrent"="c:\program files\uTorrent\uTorrent.exe"
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"AntiVirusOverride"=dword:00000001
.
R3 cpuz129;cpuz129;c:\users\THEONE~1\AppData\Local\Temp\cpuz_x32.sys [x]
R3 ewusbnet;HUAWEI USB-NDIS miniport;c:\windows\system32\DRIVERS\ewusbnet.sys [x]
R3 FLASHSYS;FLASHSYS;c:\program files\MSI\Live Update 4\LU4\FLASHSYS.sys [2007-12-14 9216]
R3 hwusbdev;Huawei DataCard USB PNP Device;c:\windows\system32\DRIVERS\ewusbdev.sys [x]
S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2010-12-01 691696]
S2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [2011-04-08 2218600]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2011-04-07 378472]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - KLMD25
*NewlyCreated* - MBAMSWISSARMY
*Deregistered* - klmd25
*Deregistered* - MBAMSwissArmy
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc
.
.
------- Zusätzlicher Suchlauf -------
.
uInternet Settings,ProxyOverride = *.local
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\Office10\EXCEL.EXE/3000
IE: Free YouTube to MP3 Converter - c:\users\The One\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm
FF - ProfilePath - c:\users\The One\AppData\Roaming\Mozilla\Firefox\Profiles\j7dg20k2.default\
FF - prefs.js: browser.search.defaulturl -
FF - prefs.js: browser.search.selectedEngine -
FF - user.js: network.cookie.cookieBehavior - 0
FF - user.js: privacy.clearOnShutdown.cookies - false
FF - user.js: security.warn_viewing_mixed - false
FF - user.js: security.warn_viewing_mixed.show_once - false
FF - user.js: security.warn_submit_insecure - false
FF - user.js: security.warn_submit_insecure.show_once - false
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
HKCU-Run-{523FD411-CA09-5E4F-4E33-4C715ED06521} - c:\users\The One\AppData\Roaming\Tesar\zouvr.exe
AddRemove-New Great Effects 1.6 Uninstall - c:\program files\Rockstar Games\mods\New Great Effects1.6\NGE_Uninstall.exe
AddRemove-{91CD08AA-5402-4C64-A9CA-C7B4A479C003}_is1 - c:\program files\Counter Strike Source\unins000.exe
AddRemove-Counter-Strike 1.6: New Era - c:\users\The One\The one\counter strike\uninst.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover
Rootkit scan 2011-05-18 19:01
Windows 6.0.6001 Service Pack 1 NTFS
.
Scanne versteckte Prozesse...
.
Scanne versteckte Autostarteinträge...
.
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
msnmsgr = "c:\program files\Windows Live\Messenger\msnmsgr.exe" /background??s
.
Scanne versteckte Dateien...
.
Scan erfolgreich abgeschlossen
versteckte Dateien: 0
.
**************************************************************************
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\S-1-5-21-1598736755-777327258-245303262-1000\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
@Allowed: (Read) (RestrictedCode)
"??"=hex:54,e0,ab,a1,4d,08,0f,43,9a,76,e9,f2,db,d5,ba,ec,5c,90,d6,a0,14,a2,63,
86,23,ba,2a,1a,fc,a9,e1,04,97,c1,50,8b,bb,89,0d,f3,eb,e4,7a,22,a8,44,74,79,\
"??"=hex:90,c2,9c,2a,df,93,29,c1,9f,04,05,e4,4f,e8,c3,ab
.
[HKEY_USERS\S-1-5-21-1598736755-777327258-245303262-1000\Software\SecuROM\License information*]
"datasecu"=hex:d3,cf,b0,1b,eb,4f,43,e6,97,02,de,a5,33,00,c2,6b,aa,a9,50,ee,ac,
78,1c,3b,b7,19,81,c2,72,bb,ab,29,89,a7,24,13,df,fd,22,5d,c5,e9,5d,24,fc,f6,\
"rkeysecu"=hex:8f,77,c5,b8,79,dc,6c,81,23,0c,98,0d,92,c3,a2,9e
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Zeit der Fertigstellung: 2011-05-18 19:04:06
ComboFix-quarantined-files.txt 2011-05-18 17:04
.
Vor Suchlauf: 13 Verzeichnis(se), 83.587.645.440 Bytes frei
Nach Suchlauf: 16 Verzeichnis(se), 83.545.038.848 Bytes frei
.
- - End Of File - - 313FC5E09F64889694F2A71AD63B15FA
--- --- --- |
