Trojaner-Board - Aus Sicherheitsgründen wird Ihr System blockiert!!!

so hier ist die combofix.txt
Combofix Logfile:
Code:
ComboFix 11-12-27.01 - Micha 27.12.2011  21:22:07.1.2 - x86

Microsoft Windows 7 Home Premium   6.1.7600.0.1252.49.1031.18.3037.1989 [GMT 1:00]

ausgeführt von:: c:\users\Micha\Desktop\ComboFix.exe

AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}

SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

c:\programdata\NOTEPAD.EXE-x.txt

c:\programdata\RUNDLL32.EXE-x.txt

c:\users\Micha\~app.tmp

c:\windows\IsUn0407.exe

c:\windows\ST6UNST.000

c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\kna0.07425984709815214.exe.lnk

.

.

(((((((((((((((((((((((   Dateien erstellt von 2011-11-27 bis 2011-12-27  ))))))))))))))))))))))))))))))

.

.

2071-07-25 07:13 . 2006-11-21 18:48        203576        ------w-        c:\program files\Microsoft Games\Age of Empires III\autopatcher2.exe

2011-12-27 20:14 . 2011-12-27 20:14        --------        d-----w-        c:\users\Micha\AppData\Roaming\Avira

2011-12-27 20:09 . 2011-12-15 14:00        74640        ----a-w-        c:\windows\system32\drivers\avgntflt.sys

2011-12-27 20:09 . 2011-12-15 14:00        36000        ----a-w-        c:\windows\system32\drivers\avkmgr.sys

2011-12-27 20:09 . 2011-12-15 14:00        134856        ----a-w-        c:\windows\system32\drivers\avipbb.sys

2011-12-27 20:09 . 2011-12-27 20:09        --------        d-----w-        c:\programdata\Avira

2011-12-27 20:09 . 2011-12-27 20:09        --------        d-----w-        c:\program files\Avira

2011-12-27 19:40 . 2011-12-27 19:40        56200        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{2D853245-65CA-4CC4-B4CA-F75D2100C8B4}\offreg.dll

2011-12-27 19:38 . 2011-12-27 19:38        --------        d-----w-        c:\program files\7-Zip

2011-12-27 18:41 . 2011-12-27 19:41        --------        d-----w-        C:\_OTL

2011-12-27 08:58 . 2011-11-21 10:47        6823496        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{2D853245-65CA-4CC4-B4CA-F75D2100C8B4}\mpengine.dll

2011-12-25 13:14 . 2011-12-25 13:14        --------        d-----w-        c:\programdata\ICQ

2011-12-25 13:14 . 2011-12-25 13:14        --------        d-----w-        c:\program files\ICQ6Toolbar

2011-12-25 13:14 . 2011-12-26 14:28        --------        d-----w-        c:\users\Micha\AppData\Roaming\ICQ

2011-12-25 13:14 . 2011-12-25 13:21        --------        d-----w-        c:\program files\ICQ7.7

2011-12-22 15:50 . 2011-12-22 15:50        --------        d-----w-        c:\program files\LTC

2011-12-15 12:42 . 2011-11-24 04:23        2340352        ----a-w-        c:\windows\system32\win32k.sys

2011-12-15 12:42 . 2011-11-05 04:30        2048        ----a-w-        c:\windows\system32\tzres.dll

2011-12-15 12:42 . 2011-10-15 05:48        534528        ----a-w-        c:\windows\system32\EncDec.dll

2011-12-15 12:42 . 2011-10-26 04:25        38912        ----a-w-        c:\windows\system32\csrsrv.dll

2011-12-15 12:42 . 2011-10-26 04:42        3901808        ----a-w-        c:\windows\system32\ntoskrnl.exe

2011-12-15 12:42 . 2011-10-26 04:42        3957104        ----a-w-        c:\windows\system32\ntkrnlpa.exe

2011-12-12 15:51 . 2011-12-12 15:51        --------        d-----w-        c:\users\Micha\AppData\Roaming\KISSsoft AG

2011-12-09 18:54 . 2011-12-09 18:54        --------        d-----w-        C:\Temp

2011-12-09 18:50 . 2003-07-09 10:35        128        ----a-w-        c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\SendTo\dir_purge_explorer.bat

2011-12-09 18:50 . 2003-07-09 10:35        128        ----a-w-        c:\users\Micha\AppData\Roaming\Microsoft\Windows\SendTo\dir_purge_explorer.bat

2011-12-09 18:50 . 2011-12-12 17:15        --------        d-----w-        C:\stoolswf5_student

2011-12-09 18:29 . 1997-07-10 23:00        251664        ----a-w-        c:\windows\system32\msrd2x35.dll

2011-12-09 18:29 . 1997-07-10 23:00        24336        ----a-w-        c:\windows\system32\msjter35.dll

2011-12-09 18:29 . 1997-07-10 23:00        121104        ----a-w-        c:\windows\system32\msjint35.dll

2011-12-09 18:29 . 1997-07-10 23:00        1037312        ----a-w-        c:\windows\system32\msjet35.dll

2011-12-09 18:29 . 1997-01-22 21:26        565760        ----a-w-        c:\windows\system32\Msvcp50.dll

2011-12-09 18:29 . 1996-11-08 02:48        368912        ----a-w-        c:\windows\system32\vbar332.dll

2011-12-09 18:04 . 2011-12-12 16:13        --------        d-----w-        c:\users\Micha\AppData\Roaming\PTC

2011-12-09 18:02 . 2011-12-09 18:02        --------        d-----w-        c:\program files\Common Files\PTC

2011-12-09 18:02 . 2011-12-09 18:02        --------        d-----w-        c:\program files\PTC

2011-12-09 17:41 . 1998-10-29 15:45        306688        ----a-w-        c:\windows\IsUninst.exe

2011-12-09 17:16 . 2011-12-12 16:29        --------        d-----w-        c:\program files\ProENGINEER Student Edition

2011-12-09 17:14 . 2011-12-16 18:34        --------        d-----w-        C:\ProE

2011-12-01 07:06 . 2011-12-01 14:06        --------        d-----w-        C:\EDV-Projekt

.

.

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2011-09-29 15:43 . 2011-11-10 13:21        1285488        ----a-w-        c:\windows\system32\drivers\tcpip.sys

.

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\VeriFace Enc]

@="{771C7324-DA80-49D3-8017-753B0AF60951}"

[HKEY_CLASSES_ROOT\CLSID\{771C7324-DA80-49D3-8017-753B0AF60951}]

2009-11-25 11:19        1410312        ----a-w-        c:\windows\System32\IcnOvrly.dll

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"DAEMON Tools Lite"="c:\programme\DAEMON Tools Lite\DTLite.exe" [2010-04-01 357696]

"Akamai NetSession Interface"="c:\users\Micha\AppData\Local\Akamai\netsession_win.exe" [2011-12-12 3305760]

"ICQ"="c:\program files\ICQ7.7\ICQ.exe" [2011-12-25 127040]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2009-06-04 186904]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-10-03 13826664]

"SmartAudio"="c:\program files\CONEXANT\SAII\SAIICpl.exe" [2009-07-16 307768]

"VeriFaceManager"="c:\program files\Lenovo\VeriFace\PManage.exe" [2009-11-25 3122440]

"UpdateP2GShortCut"="c:\program files\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe" [2008-12-03 218408]

"EnergyUtility"="c:\program files\Lenovo\Energy Management\utility.exe" [2009-09-29 4114288]

"Energy Management"="c:\program files\Lenovo\Energy Management\Energy Management.exe" [2009-09-29 5064560]

"ArcSoft Connection Service"="c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe" [2010-10-27 207424]

"VirtualCloneDrive"="c:\program files\VirtualCloneDrive\VCDDaemon.exe" [2009-06-17 85160]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-12-21 35760]

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-21 932288]

"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-08-10 421888]

"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]

"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2011-12-15 258512]

.

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

Bluetooth.lnk - c:\program files\Lenovo\Bluetooth Software\BTTray.exe [2009-8-11 795936]

TMMonitor.lnk - c:\programme\ArcSoft3.5\TMMonitor.exe [2010-4-29 258048]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 0 (0x0)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableLUA"= 0 (0x0)

"EnableUIADesktopToggle"= 0 (0x0)

"PromptOnSecureDesktop"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"mixer5"=wdmaud.drv

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

@="Driver"

.

R3 Bridge0;Bridge0;c:\windows\system32\drivers\WDBridge.sys [2009-07-28 63240]

R3 k57nd60x;Broadcom NetLink (TM) Gigabit Ethernet - NDIS 6.0;c:\windows\system32\DRIVERS\k57nd60x.sys [2009-07-13 229888]

R3 Lenovo ReadyComm AppSvc;Lenovo ReadyComm AppSvc;c:\program files\Lenovo\ReadyComm\AppSvc.exe [2009-08-14 509192]

R3 Lenovo ReadyComm ConnSvc;Lenovo ReadyComm ConnSvc;c:\program files\Lenovo\ReadyComm\ConnSvc.exe [2009-09-22 579400]

R3 PS_MDP;ReadyComm Presentation Space Helper Service;c:\windows\System32\IgrsSvcs.exe [2009-07-14 20992]

R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys [x]

R3 RTL2832U_IRHID;HID Infrared Remote Receiver;c:\windows\system32\DRIVERS\RTL2832U_IRHID.sys [2009-10-05 31872]

R3 RTL2832UBDA;REALTEK 2832U BDA Driver;c:\windows\system32\drivers\RTL2832UBDA.sys [2009-10-26 93344]

R3 RTL2832UUSB;REALTEK 2832U USB Driver;c:\windows\system32\Drivers\RTL2832UUSB.sys [2009-10-26 32800]

R3 RtsUIR;Realtek IR Driver;c:\windows\system32\DRIVERS\Rts516xIR.sys [x]

R3 WinRing0_1_2_0;WinRing0_1_2_0;d:\test\ECECECEC\WinRing0.sys [x]

R3 wsvd;wsvd;c:\windows\system32\DRIVERS\wsvd.sys [2009-07-21 81704]

S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2010-08-28 691696]

S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys [2011-12-15 36000]

S1 funfrm;funfrm; [x]

S2 Akamai;Akamai NetSession Interface;c:\windows\System32\svchost.exe [2009-07-14 20992]

S2 AntiVirSchedulerService;Avira Planer;c:\program files\Avira\AntiVir Desktop\sched.exe [2011-12-15 86224]

S2 ICQ Service;ICQ Service;c:\program files\ICQ6Toolbar\ICQ Service.exe [2011-08-17 247872]

S2 IGRS;IGRS;c:\program files\Lenovo\ReadyComm\common\IGRS.exe [2009-07-14 38152]

S2 ReadyComm.DirectRouter;ReadyComm.DirectRouter;c:\windows\System32\IgrsSvcs.exe [2009-07-14 20992]

S3 ACPIVPC;Lenovo Virtual Power Controller Driver;c:\windows\system32\DRIVERS\AcpiVpc.sys [2009-05-19 21520]

S3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys [2009-04-07 29472]

S3 netw5v32;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;c:\windows\system32\DRIVERS\netw5v32.sys [2009-05-14 4231680]

S3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda32v.sys [2009-08-11 66592]

S3 usbsmi;Lenovo EasyCamera;c:\windows\system32\DRIVERS\SMIksdrv.sys [2009-06-19 168704]

S3 wdmirror;wdmirror;c:\windows\system32\DRIVERS\WDMirror.sys [2009-07-16 11792]

.

.

--- Andere Dienste/Treiber im Speicher ---

.

*NewlyCreated* - AVGNTFLT

*NewlyCreated* - AVIPBB

*NewlyCreated* - AVKMGR

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

LocalServiceAndNoImpersonation        REG_MULTI_SZ           SSDPSRV upnphost SCardSvr TBS FontCache fdrespub AppIDSvc QWAVE wcncsvc SensrSvc Mcx2Svc

IgrsSvcs        REG_MULTI_SZ           ReadyComm.DirectRouter PS_MDP

Akamai        REG_MULTI_SZ           Akamai

.

.

------- Zusätzlicher Suchlauf -------

.

uStart Page = hxxp://lenovo.msn.com

IE: Bild an &Bluetooth-Gerät senden... - c:\program files\Lenovo\Bluetooth Software\btsendto_ie_ctx.htm

IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000

IE: Seite an &Bluetooth-Gerät senden... - c:\program files\Lenovo\Bluetooth Software\btsendto_ie.htm

IE: {{77F665FD-3F60-4B0A-AE14-EC124B7A7FCE} - c:\program files\ICQ7.7\ICQ.exe

TCP: DhcpNameServer = 192.168.1.1

FF - ProfilePath - 

.

- - - - Entfernte verwaiste Registrierungseinträge - - - -

.

Toolbar-Locked - (no file)

HKLM-Run-IR_SERVER - c:\progra~3\Realtek\REALTE~1\IR_SERVER.exe

SafeBoot-mcmscsvc

SafeBoot-MCODS

AddRemove-lcc-win32 (base system)_is1 - c:\lcc\unins000.exe

AddRemove-Startup TOOLS WF5 Student Download - c:\windows\IsUn0407.exe

AddRemove-WinLiveSuite_Wave3 - c:\program files\Windows Live\Installer\wlarp.exe

AddRemove-{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD} - c:\program files\Apoint2K\Uninstap.exe

.

.

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Akamai]

"ServiceDll"="c:\program files\common files\akamai/netsession_win_b427739.dll"

.

--------------------- Gesperrte Registrierungsschluessel ---------------------

.

[HKEY_USERS\S-1-5-21-4108214383-3331945202-3000640415-1004\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]

"??"=hex:8a,86,70,23,db,75,34,88,ce,63,9a,ba,e5,c4,31,29,74,a6,de,1e,14,59,58,

   34,d9,25,e4,8a,a6,f5,db,5b,c0,a4,ad,a1,db,7e,42,5f,fd,60,81,16,7c,1a,ac,cb,\

"??"=hex:2c,55,28,37,21,11,66,67,19,d6,59,0f,dc,96,33,6a

.

[HKEY_USERS\S-1-5-21-4108214383-3331945202-3000640415-1004\Software\SecuROM\License information*]

"datasecu"=hex:21,ae,9f,6e,f4,00,dc,01,40,2d,00,ae,32,95,12,ba,2a,2c,49,d7,e5,

   c3,5d,d1,fc,82,fe,91,f6,5f,e0,e8,69,89,cf,8b,b3,83,17,65,eb,fe,8f,93,f5,0b,\

"rkeysecu"=hex:a6,13,cb,9b,75,76,7a,43,95,0b,18,93,6d,74,51,d4

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

Zeit der Fertigstellung: 2011-12-27  21:30:49

ComboFix-quarantined-files.txt  2011-12-27 20:30

.

Vor Suchlauf: 15 Verzeichnis(se), 371.321.024.512 Bytes frei

Nach Suchlauf: 21 Verzeichnis(se), 372.124.573.696 Bytes frei

.

- - End Of File - - 7075DD7311C428DFEED38BD38D9788E4
--- --- ---