Trojaner-Board - 30 Tan-Abfrage bei Online-Banking

Cool, danke für die schnelle Antwort.

Hier der Log:

Combofix Logfile:
Code:
ComboFix 11-06-22.01 - xxxxx 22.06.2011  18:33:44.1.4 - x86

Microsoft Windows 7 Professional   6.1.7600.0.1252.49.1031.18.3063.1955 [GMT 2:00]

ausgeführt von:: c:\users\xxxxx\Desktop\ComboFix.exe

AV: AntiVir Desktop *Disabled/Updated* {090F9C29-64CE-6C6F-379C-5901B49A85B7}

SP: AntiVir Desktop *Disabled/Updated* {B26E7DCD-42F4-63E1-0D2C-6273CF1DCF0A}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

 * Neuer Wiederherstellungspunkt wurde erstellt

.

.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

C:\System

c:\system\9E7D3072F58.exe

c:\system\EBFF20CD4C201A5

c:\users\xxxxx\AppData\Local\{0D88C64E-7665-4FBD-9312-6BFB81EA2CDD}

c:\users\xxxxx\AppData\Local\{0D88C64E-7665-4FBD-9312-6BFB81EA2CDD}\chrome.manifest

c:\users\xxxxx\AppData\Local\{0D88C64E-7665-4FBD-9312-6BFB81EA2CDD}\chrome\content\_cfg.js

c:\users\xxxxx\AppData\Local\{0D88C64E-7665-4FBD-9312-6BFB81EA2CDD}\chrome\content\overlay.xul

c:\users\xxxxx\AppData\Local\{0D88C64E-7665-4FBD-9312-6BFB81EA2CDD}\install.rdf

c:\windows\pi.exe

.

.

(((((((((((((((((((((((   Dateien erstellt von 2011-05-22 bis 2011-06-22  ))))))))))))))))))))))))))))))

.

.

2011-06-22 16:36 . 2011-06-22 16:36        --------        d-----w-        c:\users\xxxxx\AppData\Local\temp

2011-06-21 23:23 . 2011-06-21 23:23        --------        d-----w-        c:\users\xxxxx\AppData\Roaming\SUPERAntiSpyware.com

2011-06-21 23:23 . 2011-06-21 23:23        --------        d-----w-        c:\programdata\SUPERAntiSpyware.com

2011-06-21 23:23 . 2011-06-21 23:23        --------        d-----w-        c:\program files\SUPERAntiSpyware

2011-06-18 10:45 . 2011-06-18 10:45        --------        d-----w-        c:\programdata\ATI

2011-06-08 21:49 . 2011-06-08 21:49        404640        ----a-w-        c:\windows\system32\FlashPlayerCPLApp.cpl

2011-06-08 11:13 . 2011-06-10 08:59        0        ----a-w-        c:\users\xxxxx\AppData\Local\Hwofif.bin

2011-05-25 16:37 . 2011-04-22 19:36        26496        ----a-w-        c:\windows\system32\drivers\Diskdump.sys

2011-05-24 09:29 . 2011-05-24 09:29        --------        d-----w-        c:\users\xxxxx\AppData\Roaming\5015

2011-05-24 09:29 . 2011-05-24 09:29        112        ----a-w-        c:\users\xxxxx\AppData\Roaming\srvblck2.tmp

2011-05-24 09:29 . 2011-06-15 23:54        --------        d-----w-        c:\users\xxxxx\AppData\Roaming\xmldm

2011-05-24 09:29 . 2011-05-24 09:29        --------        d-----w-        c:\users\xxxxx\AppData\Roaming\kock

2011-05-24 08:41 . 2011-04-09 05:56        123904        ----a-w-        c:\windows\system32\poqexec.exe

.

.

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2011-05-29 07:11 . 2011-01-23 14:26        39984        ----a-w-        c:\windows\system32\drivers\mbamswissarmy.sys

2011-05-29 07:11 . 2011-01-23 14:26        22712        ----a-w-        c:\windows\system32\drivers\mbam.sys

2011-04-09 06:13 . 2011-05-11 15:13        3957632        ----a-w-        c:\windows\system32\ntkrnlpa.exe

2011-04-09 06:13 . 2011-05-11 15:13        3901824        ----a-w-        c:\windows\system32\ntoskrnl.exe

2011-03-25 03:06 . 2011-05-11 15:13        258560        ----a-w-        c:\windows\system32\drivers\usbhub.sys

2011-03-25 03:06 . 2011-05-11 15:13        284160        ----a-w-        c:\windows\system32\drivers\usbport.sys

2011-03-25 03:06 . 2011-05-11 15:13        75776        ----a-w-        c:\windows\system32\drivers\usbccgp.sys

2011-03-25 03:06 . 2011-05-11 15:13        43008        ----a-w-        c:\windows\system32\drivers\usbehci.sys

2011-03-25 03:06 . 2011-05-11 15:13        20480        ----a-w-        c:\windows\system32\drivers\usbohci.sys

2011-03-25 03:06 . 2011-05-11 15:13        24064        ----a-w-        c:\windows\system32\drivers\usbuhci.sys

2011-03-25 03:06 . 2011-05-11 15:13        5888        ----a-w-        c:\windows\system32\drivers\usbd.sys

2011-03-24 21:40 . 2011-03-24 21:40        472808        ----a-w-        c:\windows\system32\deployJava1.dll

.

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"BiosNotice"="c:\program files\BIOSTAR\BiosNotice\BiosNotice.exe" [2010-06-15 994304]

"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2010-04-30 9210400]

"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2010-12-13 281768]

"lxbkbmgr.exe"="c:\program files\Lexmark X1100 Series\lxbkbmgr.exe" [2008-02-28 74408]

"Malwarebytes' Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2011-05-29 1047656]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 5 (0x5)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableUIADesktopToggle"= 0 (0x0)

"PromptOnSecureDesktop"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"aux1"=wdmaud.drv

.

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]

Security Packages        REG_MULTI_SZ           kerberos msv1_0 schannel wdigest tspkg pku2u livessp

.

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^TMMonitor.lnk]

path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\TMMonitor.lnk

backup=c:\windows\pss\TMMonitor.lnk.CommonStartup

backupExtension=.CommonStartup

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NokiaMServer]

c:\program files\Common Files\Nokia\MPlatform\NokiaMServer [X]

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]

2010-11-10 11:49        932288        ----a-w-        c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]

2010-11-10 11:49        35736        ----a-w-        c:\program files\Adobe\Reader 10.0\Reader\reader_sl.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ArcSoft Connection Service]

2008-02-22 09:33        72192        ----a-w-        c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATICustomerCare]

2010-05-04 15:05        311296        ----a-r-        c:\program files\ATI\ATICustomerCare\ATICustomerCare.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]

2011-01-20 09:20        1305408        ----a-w-        c:\program files\DAEMON Tools Lite\DTLite.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IntelliPoint]

2010-07-21 15:51        1797008        ----a-w-        c:\program files\Microsoft IntelliPoint\ipoint.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NokiaOviSuite2]

2011-01-31 11:16        703360        ----a-w-        c:\program files\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StartCCC]

2010-11-25 20:32        98304        ----a-w-        c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]

2011-04-04 17:10        1242448        ----a-w-        e:\spiele\Halflife\Steam.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]

2010-05-14 10:44        248552        ----a-w-        c:\program files\Common Files\Java\Java Update\jusched.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SUPERAntiSpyware]

2011-06-10 16:26        2424192        ----a-w-        c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]

2010-12-09 10:45        74752        ----a-w-        c:\program files\Winamp\winampa.exe

.

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]

R3 epmntdrv;epmntdrv;c:\windows\system32\epmntdrv.sys [2010-07-15 14216]

R3 EuGdiDrv;EuGdiDrv;c:\windows\system32\EuGdiDrv.sys [2010-07-15 8456]

R3 nmwcdnsu;Nokia USB Flashing Phone Parent;c:\windows\system32\drivers\nmwcdnsu.sys [2010-07-26 137600]

R3 nmwcdnsuc;Nokia USB Flashing Generic;c:\windows\system32\drivers\nmwcdnsuc.sys [2010-07-26 8576]

S1 BIOS;BIOS;c:\windows\system32\drivers\BIOS.sys [2005-03-16 13696]

S1 BS_I2cIo;BS_I2cIo;c:\windows\system32\drivers\BS_I2cIo.sys [2010-05-17 6272]

S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [2011-01-22 218688]

S1 RtlProt;Realtke RtlProt WLAN Utility Protocol Driver;c:\windows\system32\DRIVERS\rtlprot.sys [2007-04-23 25896]

S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [2010-02-17 12872]

S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2010-05-10 67656]

S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2010-11-26 176128]

S2 AntiVirSchedulerService;Avira AntiVir Planer;c:\program files\Avira\AntiVir Desktop\sched.exe [2011-04-27 136360]

S2 lxbk_device;lxbk_device;c:\windows\system32\lxbkcoms.exe [2008-02-19 537256]

S2 SBSDWSCService;SBSD Security Center Service;c:\program files\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368]

S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [2010-11-26 6650368]

S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [2010-11-26 231936]

S3 AtiHDAudioService;ATI Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW73.sys [2010-11-17 101392]

S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt86win7.sys [2010-03-22 278560]

S3 RTL85n86;Realtek 8180/8185 Extensible 802.11 Wireless Device Driver;c:\windows\system32\DRIVERS\RTL85n86.sys [2010-03-23 1812512]

.

.

Inhalt des "geplante Tasks" Ordners

.

2011-06-22 c:\windows\Tasks\RtlVistaStart.job

- c:\program files\TP-LINK\TL-WN313G_353G_353GD\RtWLan.exe [2011-01-20 10:10]

.

.

------- Zusätzlicher Suchlauf -------

.

uStart Page = hxxp://g.live.com/1rewlive4startup/home

IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000

TCP: Interfaces\{B3299CB1-FB3E-4F1D-8277-31D3E90521CD}: NameServer = 192.168.178.1

FF - ProfilePath - c:\users\xxxxx\AppData\Roaming\Mozilla\Firefox\Profiles\u8ct9s5q.default\

FF - prefs.js: browser.search.defaulturl - hxxp://www.bing.com/search?FORM=WLETDF&PC=WLEM&q=

FF - prefs.js: browser.search.selectedEngine - Google

FF - prefs.js: browser.startup.homepage - web.de

FF - prefs.js: keyword.URL - hxxp://www.bing.com/search?FORM=WLETDF&PC=WLEM&q=

FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}

FF - Ext: DAEMON Tools Toolbar: DTToolbar@toolbarnet.com - %profile%\extensions\DTToolbar@toolbarnet.com

FF - Ext: DownloadHelper: {b9db16a4-6edc-47ec-a1f4-b86292ed211d} - %profile%\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}

FF - Ext: Firefox Synchronisation Extension: {A27F3FEF-1113-4cfb-A032-8E12D7D8EE70} - c:\program files\Nokia\Nokia Ovi Suite\Connectors\Bookmarks Connector\FirefoxExtension

FF - Ext: JavaString Helper: {184AA5E6-741D-464a-820E-94B3ABC2F3B4} - c:\users\xxxxx\AppData\Roaming\5015

FF - Ext: JavaString Helper: {184AA5E6-741D-464a-820E-94B3ABC2F3B4} - c:\users\xxxxx\AppData\Roaming\5015

.

- - - - Entfernte verwaiste Registrierungseinträge - - - -

.

HKLM-Run-CmPCIaudio - cmicnfg3.cpl

MSConfigStartUp-4Y3Y0C3A9JWEYJZAN - c:\system\9E7D3072F58.exe

AddRemove-Steam App 12830 - c:\program files\SH Team\SH Client V3\steam.exe

AddRemove-Steam App 2930 - c:\program files\SH Team\SH Client V3\steam.exe

.

.

.

--------------------- Gesperrte Registrierungsschluessel ---------------------

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

Zeit der Fertigstellung: 2011-06-22  18:37:00

ComboFix-quarantined-files.txt  2011-06-22 16:37

.

Vor Suchlauf: 9 Verzeichnis(se), 25.837.469.696 Bytes frei

Nach Suchlauf: 13 Verzeichnis(se), 26.002.919.424 Bytes frei

.

- - End Of File - - C7BF9DE3527299DAD3F6DA3A4EC470C9
--- --- ---