Trojaner-Board - Wahrscheinlich Virus eingefangen

Code:
ComboFix 11-12-21.02 - Margit_2 22.12.2011  13:40:25.2.2 - x86

Microsoft® Windows Vista™ Home Premium   6.0.6002.2.1252.49.1031.18.3545.2328 [GMT 1:00]

ausgeführt von:: c:\users\Margit_2\Desktop\ComboFix.exe

AV: AntiVir Desktop *Enabled/Updated* {090F9C29-64CE-6C6F-379C-5901B49A85B7}

SP: AntiVir Desktop *Enabled/Updated* {B26E7DCD-42F4-63E1-0D2C-6273CF1DCF0A}

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

.

(((((((((((((((((((((((   Dateien erstellt von 2011-11-22 bis 2011-12-22  ))))))))))))))))))))))))))))))

.

.

2011-12-22 12:52 . 2011-12-22 12:52        --------        d-----w-        c:\users\Margit_2\AppData\Local\temp

2011-12-22 12:52 . 2011-12-22 12:52        --------        d-----w-        c:\users\h\AppData\Local\temp

2011-12-22 12:52 . 2011-12-22 12:52        --------        d-----w-        c:\users\Gast\AppData\Local\temp

2011-12-22 12:52 . 2011-12-22 12:52        --------        d-----w-        c:\users\f\AppData\Local\temp

2011-12-22 12:52 . 2011-12-22 12:52        --------        d-----w-        c:\users\f.Margit-PC\AppData\Local\temp

2011-12-22 12:52 . 2011-12-22 12:52        --------        d-----w-        c:\users\Default\AppData\Local\temp

2011-12-21 18:28 . 2011-12-21 18:28        --------        d-----w-        c:\users\Margit_2\AppData\Roaming\Malwarebytes

2011-12-21 18:27 . 2011-12-21 18:27        --------        d-----w-        c:\programdata\Malwarebytes

2011-12-21 18:27 . 2011-12-21 18:27        --------        d-----w-        c:\program files\Malwarebytes' Anti-Malware

2011-12-21 18:27 . 2011-08-31 16:00        22216        ----a-w-        c:\windows\system32\drivers\mbam.sys

2011-12-21 08:53 . 2011-12-21 17:08        --------        d-----w-        c:\programdata\AVAST Software

2011-12-21 08:53 . 2011-12-21 08:53        --------        d-----w-        c:\program files\AVAST Software

2011-12-16 15:48 . 2011-12-16 15:48        0        ---ha-w-        c:\users\Margit_2\AppData\Local\BIT695.tmp

2011-12-15 19:38 . 2011-12-15 19:38        115        ----a-w-        c:\users\Margit_2\AppData\Roaming\Microsoft\2171\bl10718142_64.bat

2011-12-15 19:35 . 2011-12-15 19:35        --------        d-----w-        c:\users\Margit_2\AppData\Roaming\PCDr

2011-12-15 16:44 . 2011-12-15 19:33        --------        d-----w-        c:\users\TEMP

2011-12-15 16:14 . 2011-12-15 16:23        --------        d-----w-        C:\542311bc1d1cc07be6cbe8e940

2011-12-15 16:03 . 2011-12-15 16:03        115        ----a-w-        c:\users\Margit_2\AppData\Roaming\Microsoft\2171\bl368817_64.bat

2011-12-14 12:23 . 2011-10-27 08:01        3602816        ----a-w-        c:\windows\system32\ntkrnlpa.exe

2011-12-14 12:23 . 2011-10-27 08:01        3550080        ----a-w-        c:\windows\system32\ntoskrnl.exe

2011-12-14 12:23 . 2011-11-08 12:10        2409784        ----a-w-        c:\program files\Windows Mail\OESpamFilter.dat

2011-12-14 12:23 . 2011-11-23 13:37        2043904        ----a-w-        c:\windows\system32\win32k.sys

2011-12-14 12:23 . 2011-10-14 16:02        429056        ----a-w-        c:\windows\system32\EncDec.dll

2011-12-14 12:23 . 2011-10-25 15:56        49152        ----a-w-        c:\windows\system32\csrsrv.dll

2011-12-14 12:23 . 2011-11-08 14:42        2048        ----a-w-        c:\windows\system32\tzres.dll

2011-12-11 19:37 . 2011-12-11 19:37        --------        d-sh--w-        c:\windows\system32\%APPDATA%

2011-12-11 19:21 . 2011-12-21 07:54        --------        d-sh--w-        c:\users\Margit_2\AppData\Local\6c3fb6ff

2011-12-11 19:18 . 2011-12-21 07:55        --------        d-----w-        c:\users\Margit_2\AppData\Roaming\3F48C

2011-12-11 19:18 . 2011-12-15 19:33        --------        d-----w-        c:\users\Margit_2\Tracing

2011-12-11 19:18 . 2011-12-21 10:13        --------        d-----w-        c:\users\Margit_2\AppData\Roaming\14F3F

2011-12-11 19:17 . 2011-12-21 07:54        --------        d-sh--r-        c:\users\Margit_2\2397-5973-7874-8623

2011-12-09 07:38 . 2011-11-21 10:47        6823496        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{ACDEF732-E5AF-4A98-977B-0342703A206F}\mpengine.dll

.

.

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2011-11-11 19:15 . 2011-05-09 18:51        134104        ----a-w-        c:\program files\mozilla firefox\components\browsercomps.dll

.

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Apoint"="c:\program files\DellTPad\Apoint.exe" [2009-03-31 217088]

"IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-03-31 141848]

"Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2008-12-21 3810304]

"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2008-05-07 178712]

"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2011-08-31 449608]

"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-03-31 173592]

.

c:\users\h\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

Dell Dock.lnk - c:\program files\Dell\DellDock\DellDock.exe [2009-2-27 1316192]

.

c:\users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

Dell Dock First Run.lnk - c:\program files\Dell\DellDock\DellDock.exe [2009-2-27 1316192]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\GoToAssist]

2009-06-28 03:15        10536        ----a-w-        c:\program files\Citrix\GoToAssist\514\g2awinlogon.dll

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

@="Driver"

.

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]

"SightSpeed"="c:\program files\Dell Video Chat\DellVideoChat.exe" -bootmode

"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"

"ehTray.exe"=c:\windows\ehome\ehTray.exe

"WMPNSCFG"=c:\program files\Windows Media Player\WMPNSCFG.exe

"3AE.exe"=c:\users\Margit_2\AppData\Roaming\Microsoft\2171\3AE.exe

"NokiaSuite.exe"=c:\program files\Nokia\Nokia Suite\NokiaSuite.exe -tray

"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" /background

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe"

"dellsupportcenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" /P dellsupportcenter

"Dell DataSafe Online"="c:\program files\Dell DataSafe Online\DataSafeOnline.exe" /m

"PDVDDXSrv"="c:\program files\CyberLink\PowerDVD DX\PDVDDXSrv.exe"

"QuickSet"=c:\program files\Dell\QuickSet\QuickSet.exe

"Dell Webcam Central"="c:\program files\Dell Webcam\Dell Webcam Central\WebcamDell2.exe" /mode2

"3AE.exe"=c:\program files\LP\2171\3AE.exe

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

"SysTrayApp"=%ProgramFiles%\IDT\WDM\sttray.exe

"Persistence"=c:\windows\system32\igfxpers.exe

.

R2 AESTFilters;Andrea ST Filters Service;c:\windows\System32\DriverStore\FileRepository\stwrt.inf_f6ef8056\aestsrv.exe [x]

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]

R2 DockLoginService;Dock Login Service;c:\program files\Dell\DellDock\DockLogin.exe [x]

R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-02-07 135664]

R3 gupdatem;Google Update-Dienst (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2010-02-07 135664]

R3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [x]

R3 PCD5SRVC{3F6A8B78-EC003E00-05040104};PCD5SRVC{3F6A8B78-EC003E00-05040104} - PCDR Kernel Mode Service Helper Driver;c:\progra~1\DELLSU~1\HWDiag\bin\PCD5SRVC.pkms [2008-11-04 22904]

S2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [2011-08-31 366152]

S3 CtClsFlt;Creative Camera Class Upper Filter Driver;c:\windows\system32\DRIVERS\CtClsFlt.sys [2008-12-31 144128]

S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2011-08-31 22216]

S3 OA009Ufd;Creative Camera OA009 Upper Filter Driver;c:\windows\system32\DRIVERS\OA009Ufd.sys [2009-03-06 133632]

S3 OA009Vid;Creative Camera OA009 Function Driver;c:\windows\system32\DRIVERS\OA009Vid.sys [2009-03-19 271552]

.

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

LocalServiceAndNoImpersonation        REG_MULTI_SZ           FontCache

.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost  - NetSvcs

UxTuneUp

.

Inhalt des "geplante Tasks" Ordners

.

2011-12-22 c:\windows\Tasks\1-Klick-Wartung.job

- c:\program files\TuneUp Utilities 2009\OneClickStarter.exe [2009-11-16 12:00]

.

2011-12-22 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-07 00:02]

.

2011-12-22 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-07 00:02]

.

.

------- Zusätzlicher Suchlauf -------

.

uStart Page = hxxp://start.icq.com/

uInternet Settings,ProxyServer = http=127.0.0.1:55374

TCP: DhcpNameServer = 192.168.2.1

FF - ProfilePath - c:\users\Margit_2\AppData\Roaming\Mozilla\Firefox\Profiles\7xiiiyxa.default\

FF - prefs.js: browser.search.selectedEngine - Google

FF - prefs.js: browser.startup.homepage - t-online.de

FF - prefs.js: keyword.URL - hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.1.7&q=

FF - user.js: nglayout.initialpaint.delay - 600

FF - user.js: content.notify.interval - 600000

FF - user.js: content.max.tokenizing.time - 1800000

FF - user.js: content.switch.threshold - 600000

FF - user.js: network.http.max-persistent-connections-per-server - 4

.

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net

Rootkit scan 2011-12-22 13:52

Windows 6.0.6002 Service Pack 2 NTFS

.

Scanne versteckte Prozesse... 

.

Scanne versteckte Autostarteinträge... 

.

Scanne versteckte Dateien... 

.

Scan erfolgreich abgeschlossen

versteckte Dateien: 0

.

**************************************************************************

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\PCD5SRVC{3F6A8B78-EC003E00-05040104}]

"ImagePath"="\??\c:\progra~1\DELLSU~1\HWDiag\bin\PCD5SRVC.pkms"

.

--------------------- Gesperrte Registrierungsschluessel ---------------------

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

Zeit der Fertigstellung: 2011-12-22  13:55:20

ComboFix-quarantined-files.txt  2011-12-22 12:55

ComboFix2.txt  2011-12-21 22:10

.

Vor Suchlauf: 14 Verzeichnis(se), 227.640.389.632 Bytes frei

Nach Suchlauf: 15 Verzeichnis(se), 227.601.367.040 Bytes frei

.

- - End Of File - - CACE21FE694275ADBB25EC8C77BB9AA8