Trojaner-Board - ComboFix log

hallo, hab mal ein scan mit combofix mit admin gestartet....
ich kann leider mit einem scanbericht nichts anfangen.
Ich weiß aber, sobald ein buchstabe im bereich bis 50 mach hat er was gefunden :
Combofix Logfile:
Code:
ComboFix 11-02-09.05 - Borg 10.02.2011 22:00:35.5.2 - x64

Microsoft Windows 7 Ultimate 6.1.7600.0.1252.49.1031.18.4086.3007 [GMT 1:00]

ausgeführt von:: c:\users\Borg\Downloads\ComboFix.exe

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

 

((((((((((((((((((((((( Dateien erstellt von 2011-01-10 bis 2011-02-10 ))))))))))))))))))))))))))))))

.

 

2011-02-09 19:06 . 2011-01-07 08:06    46080    ----a-w-    c:\windows\system32\atmlib.dll

2011-02-09 19:06 . 2011-01-07 07:27    34304    ----a-w-    c:\windows\SysWow64\atmlib.dll

2011-02-09 19:06 . 2011-01-07 05:49    366080    ----a-w-    c:\windows\system32\atmfd.dll

2011-02-09 19:06 . 2011-01-07 05:33    294400    ----a-w-    c:\windows\SysWow64\atmfd.dll

2011-02-09 19:03 . 2011-01-13 10:20    7844688    ----a-w-    c:\programdata\Microsoft\Windows Defender\Definition Updates\{A63E5B82-1EA1-45A5-8420-C80D4DA5CFBB}\mpengine.dll

2011-02-01 23:20 . 2011-02-02 00:47    --------    d-----w-    c:\program files\CCleaner

2011-01-31 19:13 . 2011-01-31 19:13    --------    d-----w-    c:\users\Borg\AppData\Roaming\Canon

2011-01-31 19:10 . 2011-01-31 19:10    --------    d-----w-    c:\users\Borg\AppData\Roaming\ABBYY

2011-01-31 19:01 . 2011-01-31 19:10    --------    d-----w-    c:\program files (x86)\ABBYY FineReader 10

2011-01-31 19:01 . 2011-01-31 19:01    --------    d-----w-    c:\programdata\ABBYY

2011-01-17 10:23 . 2011-01-17 10:23    --------    d-----w-    c:\users\Alex

2011-01-14 00:28 . 2009-11-25 11:47    99176    ----a-w-    c:\windows\SysWow64\PresentationHostProxy.dll

2011-01-14 00:28 . 2009-11-25 11:47    49472    ----a-w-    c:\windows\SysWow64\netfxperf.dll

2011-01-14 00:28 . 2009-11-25 11:47    48960    ----a-w-    c:\windows\system32\netfxperf.dll

2011-01-14 00:28 . 2009-11-25 11:47    297808    ----a-w-    c:\windows\SysWow64\mscoree.dll

2011-01-14 00:28 . 2009-11-25 11:47    295264    ----a-w-    c:\windows\SysWow64\PresentationHost.exe

2011-01-14 00:28 . 2009-11-25 11:47    1130824    ----a-w-    c:\windows\SysWow64\dfshim.dll

2011-01-14 00:28 . 2009-11-25 11:47    109912    ----a-w-    c:\windows\system32\PresentationHostProxy.dll

2011-01-14 00:28 . 2009-11-25 11:47    444752    ----a-w-    c:\windows\system32\mscoree.dll

2011-01-14 00:28 . 2009-11-25 11:47    320352    ----a-w-    c:\windows\system32\PresentationHost.exe

2011-01-14 00:28 . 2009-11-25 11:47    1942856    ----a-w-    c:\windows\system32\dfshim.dll

2011-01-14 00:28 . 2010-02-23 08:16    294912    ----a-w-    c:\windows\system32\browserchoice.exe

2011-01-14 00:23 . 2011-01-14 00:23    --------    d-----w-    c:\windows\SysWow64\x64

2011-01-14 00:23 . 2009-09-23 18:30    1002008    ----a-w-    c:\windows\SysWow64\igxpun.exe

2011-01-14 00:19 . 2010-03-04 04:32    243712    ----a-w-    c:\windows\system32\drivers\ks.sys

2011-01-13 11:09 . 2011-01-13 11:09    --------    d-----w-    c:\program files\Western Digital Corp

2011-01-13 11:09 . 2011-01-13 11:09    --------    d-----w-    c:\program files (x86)\Western Digital Corp

2011-01-13 10:48 . 2011-01-13 10:48    --------    d-----w-    c:\program files (x86)\Western Digital Technologies

2011-01-13 10:26 . 2011-01-13 10:26    --------    d-----w-    c:\program files (x86)\Driver-Soft

2011-01-13 09:46 . 2011-01-13 09:46    --------    d-----w-    c:\programdata\Driver Whiz

2011-01-13 09:43 . 2010-10-19 08:47    7680    ----a-w-    c:\program files\Internet Explorer\iecompat.dll

2011-01-13 09:42 . 2010-04-07 07:37    861184    ----a-w-    c:\windows\system32\oleaut32.dll

2011-01-13 09:35 . 2009-12-29 08:03    220672    ----a-w-    c:\windows\system32\wintrust.dll

2011-01-13 09:35 . 2009-12-29 06:55    172032    ----a-w-    c:\windows\SysWow64\wintrust.dll

2011-01-13 09:34 . 2010-01-09 07:19    139264    ----a-w-    c:\windows\system32\cabview.dll

2011-01-13 09:34 . 2010-01-09 06:52    132608    ----a-w-    c:\windows\SysWow64\cabview.dll

2011-01-13 09:32 . 2011-01-13 09:32    --------    d-----w-    c:\users\Borg\AppData\Local\Mozilla

 

.

(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

 

((((((((((((((((((((((((((((( SnapShot_2011-02-09_22.14.01 )))))))))))))))))))))))))))))))))))))))))

.

+ 2009-07-14 05:10 . 2011-02-10 20:30    40040 c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin

- 2009-07-14 05:10 . 2011-02-09 20:15    40040 c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin

- 2010-11-03 16:45 . 2011-02-09 20:13    16384 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat

+ 2010-11-03 16:45 . 2011-02-09 22:38    16384 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat

- 2010-11-03 16:45 . 2011-02-09 20:13    32768 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat

+ 2010-11-03 16:45 . 2011-02-09 22:38    32768 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat

+ 2009-07-14 04:54 . 2011-02-09 22:38    16384 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat

- 2009-07-14 04:54 . 2011-02-09 20:13    16384 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat

+ 2009-07-14 04:46 . 2011-02-09 22:16    71944 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform\Cache\cache.dat

+ 2010-11-03 19:01 . 2011-02-10 20:31    16384 c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat

- 2010-11-03 19:01 . 2011-02-09 22:04    16384 c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat

- 2010-11-03 19:01 . 2011-02-09 22:04    16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat

+ 2010-11-03 19:01 . 2011-02-10 20:31    16384 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat

+ 2010-11-03 17:22 . 2011-02-10 20:30    9240 c:\windows\system32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-177188593-430259469-983622175-1000_UserData.bin

+ 2011-02-10 21:06 . 2011-02-10 21:06    2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat

- 2011-02-09 22:11 . 2011-02-09 22:11    2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat

+ 2011-02-10 21:06 . 2011-02-10 21:06    2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat

- 2011-02-09 22:11 . 2011-02-09 22:11    2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat

+ 2010-12-29 16:46 . 2011-02-10 00:04    190078 c:\windows\system32\wdi\SuspendPerformanceDiagnostics_SystemData_FastS4.bin

- 2009-07-14 05:01 . 2011-02-09 22:10    609260 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat

+ 2009-07-14 05:01 . 2011-02-10 21:05    609260 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat

- 2009-07-14 02:34 . 2011-02-09 20:27    10223616 c:\windows\system32\SMI\Store\Machine\SCHEMA.DAT

+ 2009-07-14 02:34 . 2011-02-10 20:42    10223616 c:\windows\system32\SMI\Store\Machine\SCHEMA.DAT

.

(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

"Bonus.SSR.FR10"="c:\program files (x86)\ABBYY FineReader 10\Bonus.ScreenshotReader.exe" [2010-09-23 941320]

 

c:\users\Alex\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

OpenOffice.org 3.2.lnk - c:\program files (x86)\OpenOffice.org 3\program\quickstart.exe [2009-12-15 384000]

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 0 (0x0)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableLUA"= 0 (0x0)

"EnableUIADesktopToggle"= 0 (0x0)

"PromptOnSecureDesktop"= 0 (0x0)

 

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]

R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]

R3 CT20XUT;CT20XUT;c:\windows\system32\drivers\CT20XUT.SYS [2010-07-07 230488]

R3 CTEXFIFX;CTEXFIFX;c:\windows\system32\drivers\CTEXFIFX.SYS [2010-07-07 1445976]

R3 CTHWIUT;CTHWIUT;c:\windows\system32\drivers\CTHWIUT.SYS [2010-07-07 95320]

R3 SwitchBoard;SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]

R4 Creative Audio Engine Licensing Service;Creative Audio Engine Licensing Service;c:\program files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [2010-11-03 79360]

S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2010-11-03 834544]

S3 CT20XUT.SYS;CT20XUT.SYS;c:\windows\System32\drivers\CT20XUT.SYS [2010-07-07 230488]

S3 CTEXFIFX.SYS;CTEXFIFX.SYS;c:\windows\System32\drivers\CTEXFIFX.SYS [2010-07-07 1445976]

S3 CTHWIUT.SYS;CTHWIUT.SYS;c:\windows\System32\drivers\CTHWIUT.SYS [2010-07-07 95320]

S3 ha20x22k;Creative 20X2 HAL Driver;c:\windows\system32\drivers\ha20x22k.sys [2010-07-07 1612888]

 

.

 

--------- x86-64 -----------

 

.

------- Zusätzlicher Suchlauf -------

.

uLocal Page = c:\windows\system32\blank.htm

mLocal Page = c:\windows\SysWOW64\blank.htm

FF - ProfilePath - c:\users\Borg\AppData\Roaming\Mozilla\Firefox\Profiles\80rz6yhb.default\

FF - prefs.js: browser.startup.homepage - hxxp://google.com

FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files (x86)\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

FF - Ext: Polski slownik poprawnej pisowni: pl@dictionaries.addons.mozilla.org - %profile%\extensions\pl@dictionaries.addons.mozilla.org

FF - Ext: WOT: {a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7} - %profile%\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}

FF - Ext: DownloadHelper: {b9db16a4-6edc-47ec-a1f4-b86292ed211d} - %profile%\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}

.

.

--------------------- Gesperrte Registrierungsschluessel ---------------------

 

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

Zeit der Fertigstellung: 2011-02-10 22:12:19 - PC wurde neu gestartet

ComboFix-quarantined-files.txt 2011-02-10 21:12

ComboFix2.txt 2011-02-09 22:18

ComboFix3.txt 2011-02-02 00:55

ComboFix4.txt 2011-02-01 23:37

ComboFix5.txt 2011-02-10 20:58

 

Vor Suchlauf: 8 Verzeichnis(se), 38.564.392.960 Bytes frei

Nach Suchlauf: 9 Verzeichnis(se), 38.486.814.720 Bytes frei

 

- - End Of File - - AD272641D0A9798281FE207EBF2B50A9
--- --- ---