Trojaner-Board - Rechner langsam// Kaspersky - Schwarze Liste beschädigt

Trojaner-Board (https://www.trojaner-board.de/)

- Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)

- - Rechner langsam// Kaspersky - Schwarze Liste beschädigt - Update erfolglos (https://www.trojaner-board.de/107049-rechner-langsam-kaspersky-schwarze-liste-beschaedigt-update-erfolglos.html)

Zitat:

13:42:11.0580 3404 \Device\Harddisk0\DR0 ( TDSS File System ) - skipped by user
13:42:11.0580 3404 \Device\Harddisk0\DR0 ( TDSS File System ) - User select action: Skip

Das TDSS File System bitte mit dem TDSS-Killer löschen lassen, starte Windows danach neu und mach ein neues Log mit diesem Tool. Poste es wieder mit CODE-Tags umschlossen.

Wie geht das mit dem löschen lassen?

Weil bei mir steht bei den Eintragen diese 3404 nicht davor...

Zitat:

Weil bei mir steht bei den Eintragen diese 3404 nicht davor...

Oh das ist doch irrelevant...
Einfach den TDSS-Killer scannen lassen und danach NUR DIESE TDSS FILE SYSTEM Einträge löschen

Also alle Funde löschen?

Was hab ich denn in meinem Posting geschrieben? :eek:
Alle Funde? Nein, nur TDSS FILE SYSTEM!! :kloppen:

Erstmal danke bis hier hin.

Hatte die letzten tage nicht soviel zeit.

Also wie geht das jetzt genau?

TDSS-Killer scannen lassen, bei den Ergebnissen alles auf Skip bis auf das TDSS File System, nur das löschen (DELETE!)

Erledigt, danach erneut gescannt.
Beim erneuten Scan wurde nichts mehr gefunden...

Dann bitte jetzt CF ausführen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix

Lade dir ComboFix hier herunter auf deinen Desktop.

Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.

Starte cofi.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.

Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.

Wichtiger Hinweis:

Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!

Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

Solltest du nach der Ausführung von Combofix Probleme beim Starten von Anwendungen haben und Meldungen erhalten wie

Zitat:

Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.

startest du Windows dann manuell neu und die Fehlermeldungen sollten nicht mehr auftauchen.

Code:

ComboFix 12-01-12.02 - *** 12.01.2012  13:25:14.1.2 - x86

Microsoft Windows 7 Home Premium   6.1.7601.1.1252.49.1031.18.3071.1751 [GMT 1:00]

ausgeführt von:: c:\users\***\Desktop\ComboFix.exe

AV: Kaspersky Security Suite CBE 11 *Disabled/Updated* {2EAA32A5-1EE1-1B22-95DA-337730C6E984}

FW: Kaspersky Security Suite CBE 11 *Disabled* {1691B380-548E-1A7A-BE85-9A42CE15AEFF}

SP: Kaspersky Security Suite CBE 11 *Disabled/Updated* {95CBD341-38DB-14AC-AF6A-08054B41A339}

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

C:\CFLog

.

.

(((((((((((((((((((((((   Dateien erstellt von 2011-12-12 bis 2012-01-12  ))))))))))))))))))))))))))))))

.

.

2012-01-12 12:33 . 2012-01-12 12:33        --------        d-----w-        c:\users\Default\AppData\Local\temp

2012-01-11 11:37 . 2011-11-17 05:38        1288472        ----a-w-        c:\windows\system32\ntdll.dll

2012-01-11 11:37 . 2011-11-19 14:01        67072        ----a-w-        c:\windows\system32\packager.dll

2012-01-11 11:37 . 2011-10-26 04:32        514560        ----a-w-        c:\windows\system32\qdvd.dll

2012-01-11 11:37 . 2011-10-26 04:32        1328128        ----a-w-        c:\windows\system32\quartz.dll

2012-01-10 22:48 . 2012-01-10 22:48        0        ----a-w-        c:\windows\system32\sho2D15.tmp

2012-01-10 14:31 . 2012-01-10 14:31        952        --sha-w-        c:\programdata\KGyGaAvL.sys

2012-01-10 12:40 . 2012-01-12 12:15        56200        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{262C9AAC-E1A4-48CB-862D-31CFF9AA9157}\offreg.dll

2012-01-10 12:40 . 2011-11-30 01:21        6823496        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{262C9AAC-E1A4-48CB-862D-31CFF9AA9157}\mpengine.dll

2012-01-09 17:02 . 2012-01-09 17:02        138056        ----a-w-        c:\windows\system32\drivers\PnkBstrK.sys

2012-01-09 17:02 . 2012-01-09 17:02        189248        ----a-w-        c:\windows\system32\PnkBstrB.exe

2012-01-09 17:02 . 2012-01-09 17:02        189248        ----a-w-        c:\windows\system32\PnkBstrB.ex0

2012-01-09 17:02 . 2012-01-09 17:02        75136        ----a-w-        c:\windows\system32\PnkBstrA.exe

2012-01-09 16:56 . 2012-01-09 16:56        --------        d-----w-        c:\program files\EA Games

2012-01-08 14:36 . 2011-10-10 07:46        17712        ----a-w-        c:\windows\system32\nitrolocalui2.dll

2012-01-08 14:36 . 2011-10-10 07:46        26416        ----a-w-        c:\windows\system32\nitrolocalmon2.dll

2012-01-08 14:36 . 2012-01-08 14:36        --------        d-----w-        c:\programdata\Nitro PDF

2012-01-08 14:36 . 2012-01-08 14:36        --------        d-----w-        c:\program files\Common Files\Nitro PDF

2012-01-07 22:44 . 2008-11-13 09:26        616024        ----a-w-        c:\windows\system32\comctl32.ocx

2012-01-07 15:27 . 2012-01-07 15:27        --------        d-----w-        c:\programdata\UDL

2012-01-07 15:23 . 2002-07-25 16:06        282624        ----a-w-        c:\program files\Common Files\InstallShield\UpdateService\agent.exe

2012-01-07 15:22 . 2012-01-07 15:27        --------        d-----w-        c:\program files\Epson Software

2012-01-07 15:22 . 2002-12-05 13:10        155648        ----a-w-        c:\program files\Common Files\InstallShield\Professional\RunTime\0701\Intel32\iuser.dll

2012-01-07 15:22 . 2002-12-02 14:22        5632        ----a-w-        c:\program files\Common Files\InstallShield\Professional\RunTime\0701\Intel32\DotNetInstaller.exe

2012-01-07 15:22 . 2002-12-02 12:33        57344        ----a-w-        c:\program files\Common Files\InstallShield\Professional\RunTime\0701\Intel32\ctor.dll

2012-01-07 15:22 . 2002-12-02 12:33        237568        ----a-w-        c:\program files\Common Files\InstallShield\Professional\RunTime\0701\Intel32\iscript.dll

2012-01-07 15:22 . 2012-01-07 15:22        282756        ----a-w-        c:\program files\Common Files\InstallShield\Professional\RunTime\0701\Intel32\setup.dll

2012-01-07 15:22 . 2012-01-07 15:22        163972        ----a-w-        c:\program files\Common Files\InstallShield\Professional\RunTime\0701\Intel32\iGdi.dll

2012-01-07 15:22 . 2003-02-27 15:12        696320        ----a-w-        c:\program files\Common Files\InstallShield\Professional\RunTime\0701\Intel32\iKernel.dll

2012-01-07 15:20 . 2007-04-10 00:06        8192        ----a-w-        c:\windows\system32\E_DCINST.DLL

2012-01-07 15:20 . 2008-08-08 01:09        86528        ----a-w-        c:\windows\system32\E_FLBFDE.DLL

2012-01-07 15:20 . 2007-12-07 01:01        78848        ----a-w-        c:\windows\system32\E_FD4BFDE.DLL

2012-01-07 15:20 . 2012-01-07 15:27        --------        d-----w-        c:\programdata\EPSON

2012-01-07 15:15 . 2012-01-07 15:23        --------        d-----w-        c:\program files\epson

2012-01-07 15:15 . 2009-04-30 23:00        15872        ----a-w-        c:\windows\system32\escdev.dll

2012-01-07 15:15 . 2009-04-30 23:00        128392        ----a-w-        c:\windows\system32\esdevapp.exe

2012-01-07 15:15 . 2008-11-16 23:00        342016        ----a-w-        c:\windows\system32\eswiaud.dll

2011-12-31 02:44 . 2011-12-31 12:26        --------        d-----w-        c:\programdata\VirtualizedApplications

2011-12-31 01:07 . 2011-12-31 01:07        --------        d-----w-        c:\windows\system32\URTTEMP

2011-12-31 01:05 . 2011-12-31 01:14        --------        d-----w-        C:\AiO-Files

2011-12-30 23:12 . 2012-01-01 14:34        --------        d-----w-        c:\program files\Microsoft Application Virtualization Client

2011-12-30 18:16 . 2011-12-30 18:16        --------        d-----w-        c:\users\Public\CyberLink

2011-12-30 00:02 . 2011-12-30 00:02        --------        d-----w-        c:\program files\Windows Media Components

2011-12-29 15:27 . 2011-12-29 15:27        --------        d-----w-        c:\program files\Microsoft CAPICOM 2.1.0.2

2011-12-28 20:04 . 2011-12-28 20:04        --------        d-----w-        c:\program files\TeamViewer

2011-12-28 14:04 . 2011-12-28 14:04        --------        d-----w-        c:\windows\system32\SPReview

2011-12-28 14:03 . 2011-12-28 14:03        --------        d-----w-        c:\programdata\Logitech

2011-12-28 14:03 . 2011-12-28 14:03        --------        d-----w-        c:\program files\Common Files\LWS

2011-12-28 14:03 . 2011-12-28 14:03        --------        d-----w-        c:\programdata\LogiShrd

2011-12-28 14:03 . 2011-12-28 14:03        --------        d-----w-        c:\program files\Logitech

2011-12-28 14:01 . 2011-12-28 14:01        --------        d-----w-        c:\windows\system32\EventProviders

2011-12-28 13:57 . 2011-12-28 14:05        --------        d-----w-        c:\program files\Common Files\logishrd

2011-12-28 13:45 . 2011-04-22 19:14        27008        ----a-w-        c:\windows\system32\drivers\Diskdump.sys

2011-12-28 13:43 . 2011-02-03 05:54        219008        ----a-w-        c:\windows\system32\drivers\dxgmms1.sys

2011-12-28 13:43 . 2010-11-20 12:29        728448        ----a-w-        c:\windows\system32\drivers\dxgkrnl.sys

2011-12-28 13:43 . 2010-11-20 11:56        107520        ----a-w-        c:\windows\system32\cdd.dll

2011-12-28 13:20 . 2010-11-20 12:21        750592        ----a-w-        c:\windows\system32\schedsvc.dll

2011-12-28 13:18 . 2010-11-20 12:21        189952        ----a-w-        c:\windows\system32\wdscore.dll

2011-12-28 13:18 . 2010-11-20 12:21        363008        ----a-w-        c:\windows\system32\wbemcomn.dll

2011-12-28 13:18 . 2010-11-20 12:21        189952        ----a-w-        c:\program files\Windows Portable Devices\sqmapi.dll

2011-12-28 13:18 . 2010-11-20 12:19        606208        ----a-w-        c:\windows\system32\wbem\fastprox.dll

2011-12-28 13:18 . 2010-11-20 12:21        189952        ----a-w-        c:\windows\system32\sqmapi.dll

2011-12-28 05:47 . 2010-02-11 07:10        293376        ----a-w-        c:\windows\system32\browserchoice.exe

2011-12-28 03:07 . 2010-12-23 05:54        850944        ----a-w-        c:\windows\system32\sbe.dll

2011-12-28 01:55 . 2011-12-28 01:55        --------        d-----w-        c:\programdata\Malwarebytes

2011-12-28 01:55 . 2011-12-10 14:24        20464        ----a-w-        c:\windows\system32\drivers\mbam.sys

2011-12-28 01:05 . 2011-12-28 01:44        115369        ----a-w-        c:\windows\system32\drivers\klin.dat

2011-12-28 01:05 . 2011-12-28 01:44        97961        ----a-w-        c:\windows\system32\drivers\klick.dat

2011-12-28 01:04 . 2012-01-12 12:23        --------        d-----w-        c:\programdata\Kaspersky Lab

2011-12-27 23:50 . 2011-12-27 23:50        --------        d-----r-        C:\Sandbox

2011-12-27 17:29 . 2011-12-27 17:29        --------        d-----w-        c:\program files\Z8Games

2011-12-27 15:50 . 2011-12-27 15:58        --------        d-----w-        c:\programdata\Skype

2011-12-27 15:46 . 2011-12-27 15:46        --------        d-----w-        C:\SG Interactive

2011-12-27 15:42 . 2012-01-08 14:36        --------        d-----w-        C:\Programme

2011-12-27 15:13 . 2012-01-10 13:37        --------        d-----w-        c:\users\***

2011-12-27 15:13 . 2011-12-27 15:13        --------        d-----w-        c:\programdata\Corel

2011-12-27 15:13 . 2011-12-27 15:13        --------        d-----w-        c:\program files\Common Files\Protexis

2011-12-27 15:12 . 2011-12-27 15:12        --------        d-----w-        c:\program files\Common Files\Corel

2011-12-27 15:12 . 2011-12-27 15:12        --------        d-----w-        c:\program files\Corel

2011-12-27 15:11 . 2011-12-27 15:11        --------        d-----w-        c:\program files\PlayReady

2011-12-27 15:09 . 2011-12-27 15:09        --------        d-----w-        c:\program files\Microsoft Sync Framework

2011-12-27 15:08 . 2011-12-27 15:08        --------        d-----w-        c:\program files\Microsoft SQL Server Compact Edition

2011-12-27 15:07 . 2011-12-27 15:07        --------        d-----w-        c:\program files\Microsoft

2011-12-27 15:07 . 2011-12-27 15:07        --------        d-----w-        c:\program files\Windows Live SkyDrive

2011-12-27 15:07 . 2011-12-27 15:09        --------        d-----w-        c:\program files\Windows Live

2011-12-27 15:06 . 2011-12-27 15:06        --------        d-----w-        c:\windows\PCHEALTH

2011-12-27 15:06 . 2011-12-27 15:06        --------        d-----w-        c:\program files\Common Files\Windows Live

2011-12-27 15:04 . 2011-12-27 15:04        --------        d-sh--we        C:\Documents and Settings

2011-12-27 15:04 . 2011-12-27 15:04        --------        d-----w-        C:\Recovery

.

.

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2011-12-28 14:53 . 2009-07-14 02:05        152576        ----a-w-        c:\windows\system32\msclmd.dll

2011-11-15 13:29 . 2010-06-29 13:41        222080        ------w-        c:\windows\system32\MpSigStub.exe

2011-11-10 04:54 . 2010-06-30 10:03        472808        ----a-w-        c:\windows\system32\deployJava1.dll

.

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1174016]

"ICQ"="c:\programme\ICQ7.5\ICQ.exe" [2011-08-01 124480]

"Skype"="c:\programme\Skype\Phone\Skype.exe" [2011-10-13 17351304]

"SandboxieControl"="c:\programme\Sandboxie\SbieCtrl.exe" [2011-11-23 442640]

"Speech Recognition"="c:\windows\Speech\Common\sapisvr.exe" [2009-07-14 51712]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"IAStorIcon"="c:\program files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe" [2010-03-04 284696]

"CLMLServer"="c:\program files\CyberLink\Power2Go\CLMLSvc.exe" [2009-11-02 103720]

"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2010-04-07 8555040]

"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2010-05-27 98304]

"AVP"="c:\programme\Kaspersky Lab\Kaspersky Security Suite CBE 11\avp.exe" [2011-04-13 387696]

"LWS"="c:\programme\Logitech\LWS\Webcam Software\LWS.exe" [2011-08-12 205336]

"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696]

"EEventManager"="c:\progra~1\EPSONS~1\EVENTM~1\EEventManager.exe" [2009-04-07 673616]

.

c:\users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

ICQ Ignore Checker.lnk - c:\programme\ICQ Ignore Checker\ICQ Ignore Checker.exe [2012-1-4 937984]

Logitech . Produktregistrierung.lnk - c:\programme\Logitech\Ereg\eReg.exe [2009-11-16 517384]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 5 (0x5)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]

"AppInit_DLLs"=c:\progra~3\KASPER~1\KASPER~1\mzvkbd3.dll c:\progra~3\KASPER~1\KASPER~1\kloehk.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"aux2"=wdmaud.drv

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]

"DisableMonitoring"=dword:00000001

.

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]

R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4640000]

R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224]

R3 XDva391;XDva391;c:\windows\system32\XDva391.sys [x]

S1 kl2;kl2;c:\windows\system32\DRIVERS\kl2.sys [2010-06-09 11352]

S1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter;c:\windows\system32\DRIVERS\klim6.sys [2010-04-22 22104]

S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-13 48128]

S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2010-05-27 176128]

S2 cvhsvc;Client Virtualization Handler;c:\program files\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [2010-10-20 821664]

S2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [2010-03-04 13336]

S2 NitroReaderDriverReadSpool2;NitroPDFReaderDriverCreatorReadSpool2;c:\programme\Nitro PDFReader 2\NitroPDFReaderDriverService2.exe [2011-10-10 196912]

S2 sftlist;Application Virtualization Client;c:\program files\Microsoft Application Virtualization Client\sftlist.exe [2010-09-14 508264]

S2 TeamViewer7;TeamViewer 7;c:\program files\TeamViewer\Version7\TeamViewer_Service.exe [2011-12-14 2984832]

S2 UMVPFSrv;UMVPFSrv;c:\program files\Common Files\logishrd\LVMVFM\UMVPFSrv.exe [2011-08-19 450848]

S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [2010-05-27 5586432]

S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [2010-05-27 209920]

S3 CompFilter;UVCCompositeFilter;c:\windows\system32\DRIVERS\lvbusflt.sys [2011-08-19 22176]

S3 klmouflt;Kaspersky Lab KLMOUFLT;c:\windows\system32\DRIVERS\klmouflt.sys [2009-11-02 19984]

S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt86win7.sys [2011-06-10 394856]

S3 RTL8192su;Realtek RTL8192SU Wireless LAN 802.11n USB 2.0 Network Adapter;c:\windows\system32\DRIVERS\RTL8192su.sys [2010-11-25 603240]

S3 Sftfs;Sftfs;c:\windows\system32\DRIVERS\Sftfslh.sys [2010-09-14 577384]

S3 Sftplay;Sftplay;c:\windows\system32\DRIVERS\Sftplaylh.sys [2010-09-14 194408]

S3 Sftredir;Sftredir;c:\windows\system32\DRIVERS\Sftredirlh.sys [2010-09-14 21864]

S3 Sftvol;Sftvol;c:\windows\system32\DRIVERS\Sftvollh.sys [2010-09-14 19304]

S3 sftvsa;Application Virtualization Service Agent;c:\program files\Microsoft Application Virtualization Client\sftvsa.exe [2010-09-14 219496]

S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [2009-07-13 14336]

.

.

.

------- Zusätzlicher Suchlauf -------

.

uStart Page = 

IE: Hinzufügen zu Anti-Banner - c:\programme\Kaspersky Lab\Kaspersky Security Suite CBE 11\ie_banner_deny.htm

IE: {{0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - hxxp://rover.ebay.com/rover/1/707-37276-17534-31/4

IE: {{7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - c:\programme\ICQ7.5\ICQ.exe

TCP: DhcpNameServer = 83.169.185.161 192.168.0.1

FF - ProfilePath - c:\users\***\AppData\Roaming\Mozilla\Firefox\Profiles\423xf1hp.default\

FF - prefs.js: browser.startup.homepage - hxxp://www.google.de/firefox

FF - prefs.js: keyword.URL - hxxp://www.google.de/#hl=de&cp=3&gs_id=g&xhr=t&q=

pref(dom.disable_open_during_load, true);

FF - user.js: network.http.max-persistent-connections-per-server - 4

FF - user.js: content.max.tokenizing.time - 200000

FF - user.js: content.notify.interval - 100000

FF - user.js: content.switch.threshold - 650000

FF - user.js: nglayout.initialpaint.delay - 300

pref('extensions.shownSelectionUI',true);

pref('extensions.autoDisableScopes',0);

.

- - - - Entfernte verwaiste Registrierungseinträge - - - -

.

SafeBoot-BsScanner

.

.

.

--------------------- Gesperrte Registrierungsschluessel ---------------------

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

Zeit der Fertigstellung: 2012-01-12  13:41:41

ComboFix-quarantined-files.txt  2012-01-12 12:41

.

Vor Suchlauf: 12 Verzeichnis(se), 831.107.203.072 Bytes frei

Nach Suchlauf: 14 Verzeichnis(se), 831.447.314.432 Bytes frei

.

- - End Of File - - 9EF14940DA5F92B27E210E286FA1ED0E

Combofix - Scripten

1. Starte das Notepad (Start / Ausführen / notepad[Enter])

2. Jetzt füge mit copy/paste den ganzen Inhalt der untenstehenden Codebox in das Notepad Fenster ein.

Code:

File::

c:\windows\system32\XDva391.sys
 

Driver::

XDva391.sys

3. Speichere im Notepad als CFScript.txt auf dem Desktop.

4. Deaktivere den Guard Deines Antivirenprogramms und eine eventuell vorhandene Software Firewall.
(Auch Guards von Ad-, Spyware Programmen und den Tea Timer (wenn vorhanden) !)

5. Dann ziehe die CFScript.txt auf die cofi.exe, so wie es im unteren Bild zu sehen ist. Damit wird Combofix neu gestartet.

http://users.pandora.be/bluepatchy/m...s/CFScript.gif

6. Nach dem Neustart (es wird gefragt ob Du neustarten willst), poste bitte die folgenden Log Dateien:
Combofix.txt

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!

# Kann gelöscht werden.#

Code:

ComboFix 12-01-12.04 - *** 12.01.2012  23:31:56.2.2 - x86

Microsoft Windows 7 Home Premium   6.1.7601.1.1252.49.1031.18.3071.1732 [GMT 1:00]

ausgeführt von:: c:\users\***\Desktop\ComboFix.exe

Benutzte Befehlsschalter :: c:\users\***\Desktop\CFScript.txt

AV: Kaspersky Security Suite CBE 11 *Disabled/Updated* {2EAA32A5-1EE1-1B22-95DA-337730C6E984}

FW: Kaspersky Security Suite CBE 11 *Disabled* {1691B380-548E-1A7A-BE85-9A42CE15AEFF}

SP: Kaspersky Security Suite CBE 11 *Disabled/Updated* {95CBD341-38DB-14AC-AF6A-08054B41A339}

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

FILE ::

"c:\windows\system32\XDva391.sys"

.

.

(((((((((((((((((((((((   Dateien erstellt von 2011-12-12 bis 2012-01-12  ))))))))))))))))))))))))))))))

.

.

2012-01-12 22:36 . 2012-01-12 22:36        --------        d-----w-        c:\users\Default\AppData\Local\temp

2012-01-12 22:36 . 2012-01-12 22:36        --------        d-----w-        c:\users\Administrator\AppData\Local\temp

2012-01-10 22:48 . 2012-01-10 22:48        0        ----a-w-        c:\windows\system32\sho2D15.tmp

2012-01-10 14:31 . 2012-01-10 14:31        952        --sha-w-        c:\programdata\KGyGaAvL.sys

2012-01-10 12:40 . 2012-01-12 22:00        56200        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{262C9AAC-E1A4-48CB-862D-31CFF9AA9157}\offreg.dll

2012-01-10 12:40 . 2011-11-30 01:21        6823496        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{262C9AAC-E1A4-48CB-862D-31CFF9AA9157}\mpengine.dll

2012-01-09 17:02 . 2012-01-09 17:02        138056        ----a-w-        c:\windows\system32\drivers\PnkBstrK.sys

2012-01-09 17:02 . 2012-01-09 17:02        189248        ----a-w-        c:\windows\system32\PnkBstrB.exe

2012-01-09 17:02 . 2012-01-09 17:02        189248        ----a-w-        c:\windows\system32\PnkBstrB.ex0

2012-01-09 17:02 . 2012-01-09 17:02        75136        ----a-w-        c:\windows\system32\PnkBstrA.exe

2012-01-09 16:56 . 2012-01-09 16:56        --------        d-----w-        c:\program files\EA Games

2012-01-08 14:36 . 2011-10-10 07:46        17712        ----a-w-        c:\windows\system32\nitrolocalui2.dll

2012-01-08 14:36 . 2011-10-10 07:46        26416        ----a-w-        c:\windows\system32\nitrolocalmon2.dll

2012-01-08 14:36 . 2012-01-08 14:36        --------        d-----w-        c:\programdata\Nitro PDF

2012-01-08 14:36 . 2012-01-08 14:36        --------        d-----w-        c:\program files\Common Files\Nitro PDF

2012-01-07 22:44 . 2008-11-13 09:26        616024        ----a-w-        c:\windows\system32\comctl32.ocx

2012-01-07 15:27 . 2012-01-07 15:27        --------        d-----w-        c:\programdata\UDL

2012-01-07 15:23 . 2002-07-25 16:06        282624        ----a-w-        c:\program files\Common Files\InstallShield\UpdateService\agent.exe

2012-01-07 15:22 . 2012-01-07 15:27        --------        d-----w-        c:\program files\Epson Software

2012-01-07 15:22 . 2002-12-05 13:10        155648        ----a-w-        c:\program files\Common Files\InstallShield\Professional\RunTime\0701\Intel32\iuser.dll

2012-01-07 15:22 . 2002-12-02 14:22        5632        ----a-w-        c:\program files\Common Files\InstallShield\Professional\RunTime\0701\Intel32\DotNetInstaller.exe

2012-01-07 15:22 . 2002-12-02 12:33        57344        ----a-w-        c:\program files\Common Files\InstallShield\Professional\RunTime\0701\Intel32\ctor.dll

2012-01-07 15:22 . 2002-12-02 12:33        237568        ----a-w-        c:\program files\Common Files\InstallShield\Professional\RunTime\0701\Intel32\iscript.dll

2012-01-07 15:22 . 2012-01-07 15:22        282756        ----a-w-        c:\program files\Common Files\InstallShield\Professional\RunTime\0701\Intel32\setup.dll

2012-01-07 15:22 . 2012-01-07 15:22        163972        ----a-w-        c:\program files\Common Files\InstallShield\Professional\RunTime\0701\Intel32\iGdi.dll

2012-01-07 15:22 . 2003-02-27 15:12        696320        ----a-w-        c:\program files\Common Files\InstallShield\Professional\RunTime\0701\Intel32\iKernel.dll

2012-01-07 15:20 . 2007-04-10 00:06        8192        ----a-w-        c:\windows\system32\E_DCINST.DLL

2012-01-07 15:20 . 2008-08-08 01:09        86528        ----a-w-        c:\windows\system32\E_FLBFDE.DLL

2012-01-07 15:20 . 2007-12-07 01:01        78848        ----a-w-        c:\windows\system32\E_FD4BFDE.DLL

2012-01-07 15:20 . 2012-01-07 15:27        --------        d-----w-        c:\programdata\EPSON

2012-01-07 15:15 . 2012-01-07 15:23        --------        d-----w-        c:\program files\epson

2012-01-07 15:15 . 2009-04-30 23:00        15872        ----a-w-        c:\windows\system32\escdev.dll

2012-01-07 15:15 . 2009-04-30 23:00        128392        ----a-w-        c:\windows\system32\esdevapp.exe

2012-01-07 15:15 . 2008-11-16 23:00        342016        ----a-w-        c:\windows\system32\eswiaud.dll

2011-12-31 02:44 . 2011-12-31 12:26        --------        d-----w-        c:\programdata\VirtualizedApplications

2011-12-31 01:07 . 2011-12-31 01:07        --------        d-----w-        c:\windows\system32\URTTEMP

2011-12-31 01:05 . 2011-12-31 01:14        --------        d-----w-        C:\AiO-Files

2011-12-30 23:12 . 2012-01-01 14:34        --------        d-----w-        c:\program files\Microsoft Application Virtualization Client

2011-12-30 18:16 . 2011-12-30 18:16        --------        d-----w-        c:\users\Public\CyberLink

2011-12-30 00:02 . 2011-12-30 00:02        --------        d-----w-        c:\program files\Windows Media Components

2011-12-29 15:27 . 2011-12-29 15:27        --------        d-----w-        c:\program files\Microsoft CAPICOM 2.1.0.2

2011-12-28 20:04 . 2011-12-28 20:04        --------        d-----w-        c:\program files\TeamViewer

2011-12-28 14:04 . 2011-12-28 14:04        --------        d-----w-        c:\windows\system32\SPReview

2011-12-28 14:03 . 2011-12-28 14:03        --------        d-----w-        c:\programdata\Logitech

2011-12-28 14:03 . 2011-12-28 14:03        --------        d-----w-        c:\program files\Common Files\LWS

2011-12-28 14:03 . 2011-12-28 14:03        --------        d-----w-        c:\programdata\LogiShrd

2011-12-28 14:03 . 2011-12-28 14:03        --------        d-----w-        c:\program files\Logitech

2011-12-28 14:01 . 2011-12-28 14:01        --------        d-----w-        c:\windows\system32\EventProviders

2011-12-28 13:57 . 2011-12-28 14:05        --------        d-----w-        c:\program files\Common Files\logishrd

2011-12-28 13:45 . 2011-04-22 19:14        27008        ----a-w-        c:\windows\system32\drivers\Diskdump.sys

2011-12-28 13:43 . 2011-02-03 05:54        219008        ----a-w-        c:\windows\system32\drivers\dxgmms1.sys

2011-12-28 13:43 . 2010-11-20 12:29        728448        ----a-w-        c:\windows\system32\drivers\dxgkrnl.sys

2011-12-28 13:43 . 2010-11-20 11:56        107520        ----a-w-        c:\windows\system32\cdd.dll

2011-12-28 13:20 . 2010-11-20 12:21        750592        ----a-w-        c:\windows\system32\schedsvc.dll

2011-12-28 13:18 . 2010-11-20 12:21        189952        ----a-w-        c:\windows\system32\wdscore.dll

2011-12-28 13:18 . 2010-11-20 12:21        363008        ----a-w-        c:\windows\system32\wbemcomn.dll

2011-12-28 13:18 . 2010-11-20 12:21        189952        ----a-w-        c:\program files\Windows Portable Devices\sqmapi.dll

2011-12-28 13:18 . 2010-11-20 12:19        606208        ----a-w-        c:\windows\system32\wbem\fastprox.dll

2011-12-28 13:18 . 2010-11-20 12:21        189952        ----a-w-        c:\windows\system32\sqmapi.dll

2011-12-28 05:47 . 2010-02-11 07:10        293376        ----a-w-        c:\windows\system32\browserchoice.exe

2011-12-28 03:07 . 2010-12-23 05:54        850944        ----a-w-        c:\windows\system32\sbe.dll

2011-12-28 01:55 . 2011-12-28 01:55        --------        d-----w-        c:\programdata\Malwarebytes

2011-12-28 01:55 . 2011-12-10 14:24        20464        ----a-w-        c:\windows\system32\drivers\mbam.sys

2011-12-28 01:05 . 2011-12-28 01:44        115369        ----a-w-        c:\windows\system32\drivers\klin.dat

2011-12-28 01:05 . 2011-12-28 01:44        97961        ----a-w-        c:\windows\system32\drivers\klick.dat

2011-12-28 01:04 . 2012-01-12 22:01        --------        d-----w-        c:\programdata\Kaspersky Lab

2011-12-27 23:50 . 2011-12-27 23:50        --------        d-----r-        C:\Sandbox

2011-12-27 17:29 . 2011-12-27 17:29        --------        d-----w-        c:\program files\Z8Games

2011-12-27 15:50 . 2011-12-27 15:58        --------        d-----w-        c:\programdata\Skype

2011-12-27 15:46 . 2011-12-27 15:46        --------        d-----w-        C:\SG Interactive

2011-12-27 15:42 . 2012-01-12 21:56        --------        d-----w-        C:\Programme

2011-12-27 15:13 . 2012-01-12 21:56        --------        d-----w-        c:\users\***

2011-12-27 15:13 . 2011-12-27 15:13        --------        d-----w-        c:\programdata\Corel

2011-12-27 15:13 . 2011-12-27 15:13        --------        d-----w-        c:\program files\Common Files\Protexis

2011-12-27 15:12 . 2011-12-27 15:12        --------        d-----w-        c:\program files\Common Files\Corel

2011-12-27 15:12 . 2011-12-27 15:12        --------        d-----w-        c:\program files\Corel

2011-12-27 15:11 . 2011-12-27 15:11        --------        d-----w-        c:\program files\PlayReady

2011-12-27 15:09 . 2011-12-27 15:09        --------        d-----w-        c:\program files\Microsoft Sync Framework

2011-12-27 15:08 . 2011-12-27 15:08        --------        d-----w-        c:\program files\Microsoft SQL Server Compact Edition

2011-12-27 15:07 . 2011-12-27 15:07        --------        d-----w-        c:\program files\Microsoft

2011-12-27 15:07 . 2011-12-27 15:07        --------        d-----w-        c:\program files\Windows Live SkyDrive

2011-12-27 15:07 . 2011-12-27 15:09        --------        d-----w-        c:\program files\Windows Live

2011-12-27 15:06 . 2011-12-27 15:06        --------        d-----w-        c:\windows\PCHEALTH

2011-12-27 15:06 . 2011-12-27 15:06        --------        d-----w-        c:\program files\Common Files\Windows Live

2011-12-27 15:04 . 2011-12-27 15:04        --------        d-sh--we        C:\Documents and Settings

2011-12-27 15:04 . 2011-12-27 15:04        --------        d-----w-        C:\Recovery

.

.

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2011-12-28 14:53 . 2009-07-14 02:05        152576        ----a-w-        c:\windows\system32\msclmd.dll

2011-11-15 13:29 . 2010-06-29 13:41        222080        ------w-        c:\windows\system32\MpSigStub.exe

2011-11-10 04:54 . 2010-06-30 10:03        472808        ----a-w-        c:\windows\system32\deployJava1.dll

.

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1174016]

"ICQ"="c:\programme\ICQ7.5\ICQ.exe" [2011-08-01 124480]

"Skype"="c:\programme\Skype\Phone\Skype.exe" [2011-10-13 17351304]

"SandboxieControl"="c:\programme\Sandboxie\SbieCtrl.exe" [2011-11-23 442640]

"Speech Recognition"="c:\windows\Speech\Common\sapisvr.exe" [2009-07-14 51712]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"IAStorIcon"="c:\program files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe" [2010-03-04 284696]

"CLMLServer"="c:\program files\CyberLink\Power2Go\CLMLSvc.exe" [2009-11-02 103720]

"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2010-04-07 8555040]

"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2010-05-27 98304]

"AVP"="c:\programme\Kaspersky Lab\Kaspersky Security Suite CBE 11\avp.exe" [2011-04-13 387696]

"LWS"="c:\programme\Logitech\LWS\Webcam Software\LWS.exe" [2011-08-12 205336]

"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696]

"EEventManager"="c:\progra~1\EPSONS~1\EVENTM~1\EEventManager.exe" [2009-04-07 673616]

.

c:\users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

ICQ Ignore Checker.lnk - c:\programme\ICQ Ignore Checker\ICQ Ignore Checker.exe [2012-1-4 937984]

Logitech . Produktregistrierung.lnk - c:\programme\Logitech\Ereg\eReg.exe [2009-11-16 517384]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 5 (0x5)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"aux2"=wdmaud.drv

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]

"DisableMonitoring"=dword:00000001

.

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]

R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4640000]

R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224]

R3 XDva391;XDva391;c:\windows\system32\XDva391.sys [x]

S1 kl2;kl2;c:\windows\system32\DRIVERS\kl2.sys [2010-06-09 11352]

S1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter;c:\windows\system32\DRIVERS\klim6.sys [2010-04-22 22104]

S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-13 48128]

S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2010-05-27 176128]

S2 cvhsvc;Client Virtualization Handler;c:\program files\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [2010-10-20 821664]

S2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [2010-03-04 13336]

S2 NitroReaderDriverReadSpool2;NitroPDFReaderDriverCreatorReadSpool2;c:\programme\Nitro PDFReader 2\NitroPDFReaderDriverService2.exe [2011-10-10 196912]

S2 sftlist;Application Virtualization Client;c:\program files\Microsoft Application Virtualization Client\sftlist.exe [2010-09-14 508264]

S2 TeamViewer7;TeamViewer 7;c:\program files\TeamViewer\Version7\TeamViewer_Service.exe [2011-12-14 2984832]

S2 UMVPFSrv;UMVPFSrv;c:\program files\Common Files\logishrd\LVMVFM\UMVPFSrv.exe [2011-08-19 450848]

S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [2010-05-27 5586432]

S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [2010-05-27 209920]

S3 CompFilter;UVCCompositeFilter;c:\windows\system32\DRIVERS\lvbusflt.sys [2011-08-19 22176]

S3 klmouflt;Kaspersky Lab KLMOUFLT;c:\windows\system32\DRIVERS\klmouflt.sys [2009-11-02 19984]

S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt86win7.sys [2011-06-10 394856]

S3 RTL8192su;Realtek RTL8192SU Wireless LAN 802.11n USB 2.0 Network Adapter;c:\windows\system32\DRIVERS\RTL8192su.sys [2010-11-25 603240]

S3 Sftfs;Sftfs;c:\windows\system32\DRIVERS\Sftfslh.sys [2010-09-14 577384]

S3 Sftplay;Sftplay;c:\windows\system32\DRIVERS\Sftplaylh.sys [2010-09-14 194408]

S3 Sftredir;Sftredir;c:\windows\system32\DRIVERS\Sftredirlh.sys [2010-09-14 21864]

S3 Sftvol;Sftvol;c:\windows\system32\DRIVERS\Sftvollh.sys [2010-09-14 19304]

S3 sftvsa;Application Virtualization Service Agent;c:\program files\Microsoft Application Virtualization Client\sftvsa.exe [2010-09-14 219496]

S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [2009-07-13 14336]

.

.

.

------- Zusätzlicher Suchlauf -------

.

uStart Page = 

IE: Hinzufügen zu Anti-Banner - c:\programme\Kaspersky Lab\Kaspersky Security Suite CBE 11\ie_banner_deny.htm

IE: {{0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - hxxp://rover.ebay.com/rover/1/707-37276-17534-31/4

IE: {{7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - c:\programme\ICQ7.5\ICQ.exe

TCP: DhcpNameServer = 83.169.185.161 192.168.0.1

FF - ProfilePath - c:\users\***\AppData\Roaming\Mozilla\Firefox\Profiles\423xf1hp.default\

FF - prefs.js: browser.startup.homepage - hxxp://www.google.de/firefox

FF - prefs.js: keyword.URL - hxxp://www.google.de/#hl=de&cp=3&gs_id=g&xhr=t&q=

pref(dom.disable_open_during_load, true);

FF - user.js: network.http.max-persistent-connections-per-server - 4

FF - user.js: content.max.tokenizing.time - 200000

FF - user.js: content.notify.interval - 100000

FF - user.js: content.switch.threshold - 650000

FF - user.js: nglayout.initialpaint.delay - 300

pref('extensions.shownSelectionUI',true);

pref('extensions.autoDisableScopes',0);

.

.

--------------------- Gesperrte Registrierungsschluessel ---------------------

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

Zeit der Fertigstellung: 2012-01-12  23:37:57

ComboFix-quarantined-files.txt  2012-01-12 22:37

ComboFix2.txt  2012-01-12 22:19

ComboFix3.txt  2012-01-12 12:41

.

Vor Suchlauf: 13 Verzeichnis(se), 831.563.919.360 Bytes frei

Nach Suchlauf: 14 Verzeichnis(se), 831.379.816.448 Bytes frei

.

- - End Of File - - C0808E77701930EED0E2910151B4EEA3

Oh einer kleiner marginaler Fehler ist mir unterlaufen. Mach es bitte nochmal so:

Combofix - Scripten

1. Starte das Notepad (Start / Ausführen / notepad[Enter])

2. Jetzt füge mit copy/paste den ganzen Inhalt der untenstehenden Codebox in das Notepad Fenster ein.

Code:

Driver::

XDva391

Code:

ComboFix 12-01-13.01 - *** 13.01.2012  13:19:42.3.2 - x86

Microsoft Windows 7 Home Premium   6.1.7601.1.1252.49.1031.18.3071.2063 [GMT 1:00]

ausgeführt von:: c:\users\***\Desktop\ComboFix.exe

Benutzte Befehlsschalter :: c:\users\***\Desktop\CFScript.txt

AV: Kaspersky Security Suite CBE 11 *Disabled/Updated* {2EAA32A5-1EE1-1B22-95DA-337730C6E984}

FW: Kaspersky Security Suite CBE 11 *Disabled* {1691B380-548E-1A7A-BE85-9A42CE15AEFF}

SP: Kaspersky Security Suite CBE 11 *Disabled/Updated* {95CBD341-38DB-14AC-AF6A-08054B41A339}

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

.

(((((((((((((((((((((((((((((((((((((((   Treiber/Dienste   )))))))))))))))))))))))))))))))))))))))))))))))))

.

.

-------\Legacy_XDVA391

-------\Service_XDva391

.

.

(((((((((((((((((((((((   Dateien erstellt von 2011-12-13 bis 2012-01-13  ))))))))))))))))))))))))))))))

.

.

2012-01-13 12:25 . 2012-01-13 12:25        --------        d-----w-        c:\users\Default\AppData\Local\temp

2012-01-13 12:25 . 2012-01-13 12:25        --------        d-----w-        c:\users\Administrator\AppData\Local\temp

2012-01-13 10:38 . 2012-01-13 12:28        56200        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{262C9AAC-E1A4-48CB-862D-31CFF9AA9157}\offreg.dll

2012-01-12 22:04 . 2011-11-17 05:38        1288472        ----a-w-        c:\windows\system32\ntdll.dll

2012-01-12 22:04 . 2011-11-19 14:01        67072        ----a-w-        c:\windows\system32\packager.dll

2012-01-12 22:04 . 2011-10-26 04:32        514560        ----a-w-        c:\windows\system32\qdvd.dll

2012-01-12 22:04 . 2011-10-26 04:32        1328128        ----a-w-        c:\windows\system32\quartz.dll

2012-01-10 22:48 . 2012-01-10 22:48        0        ----a-w-        c:\windows\system32\sho2D15.tmp

2012-01-10 14:31 . 2012-01-10 14:31        952        --sha-w-        c:\programdata\KGyGaAvL.sys

2012-01-10 12:40 . 2011-11-30 01:21        6823496        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{262C9AAC-E1A4-48CB-862D-31CFF9AA9157}\mpengine.dll

2012-01-09 17:02 . 2012-01-09 17:02        138056        ----a-w-        c:\windows\system32\drivers\PnkBstrK.sys

2012-01-09 17:02 . 2012-01-09 17:02        189248        ----a-w-        c:\windows\system32\PnkBstrB.exe

2012-01-09 17:02 . 2012-01-09 17:02        189248        ----a-w-        c:\windows\system32\PnkBstrB.ex0

2012-01-09 17:02 . 2012-01-09 17:02        75136        ----a-w-        c:\windows\system32\PnkBstrA.exe

2012-01-09 16:56 . 2012-01-09 16:56        --------        d-----w-        c:\program files\EA Games

2012-01-08 14:36 . 2011-10-10 07:46        17712        ----a-w-        c:\windows\system32\nitrolocalui2.dll

2012-01-08 14:36 . 2011-10-10 07:46        26416        ----a-w-        c:\windows\system32\nitrolocalmon2.dll

2012-01-08 14:36 . 2012-01-08 14:36        --------        d-----w-        c:\programdata\Nitro PDF

2012-01-08 14:36 . 2012-01-08 14:36        --------        d-----w-        c:\program files\Common Files\Nitro PDF

2012-01-07 22:44 . 2008-11-13 09:26        616024        ----a-w-        c:\windows\system32\comctl32.ocx

2012-01-07 15:27 . 2012-01-07 15:27        --------        d-----w-        c:\programdata\UDL

2012-01-07 15:23 . 2002-07-25 16:06        282624        ----a-w-        c:\program files\Common Files\InstallShield\UpdateService\agent.exe

2012-01-07 15:22 . 2012-01-07 15:27        --------        d-----w-        c:\program files\Epson Software

2012-01-07 15:22 . 2002-12-05 13:10        155648        ----a-w-        c:\program files\Common Files\InstallShield\Professional\RunTime\0701\Intel32\iuser.dll

2012-01-07 15:22 . 2002-12-02 14:22        5632        ----a-w-        c:\program files\Common Files\InstallShield\Professional\RunTime\0701\Intel32\DotNetInstaller.exe

2012-01-07 15:22 . 2002-12-02 12:33        57344        ----a-w-        c:\program files\Common Files\InstallShield\Professional\RunTime\0701\Intel32\ctor.dll

2012-01-07 15:22 . 2002-12-02 12:33        237568        ----a-w-        c:\program files\Common Files\InstallShield\Professional\RunTime\0701\Intel32\iscript.dll

2012-01-07 15:22 . 2012-01-07 15:22        282756        ----a-w-        c:\program files\Common Files\InstallShield\Professional\RunTime\0701\Intel32\setup.dll

2012-01-07 15:22 . 2012-01-07 15:22        163972        ----a-w-        c:\program files\Common Files\InstallShield\Professional\RunTime\0701\Intel32\iGdi.dll

2012-01-07 15:22 . 2003-02-27 15:12        696320        ----a-w-        c:\program files\Common Files\InstallShield\Professional\RunTime\0701\Intel32\iKernel.dll

2012-01-07 15:20 . 2007-04-10 00:06        8192        ----a-w-        c:\windows\system32\E_DCINST.DLL

2012-01-07 15:20 . 2008-08-08 01:09        86528        ----a-w-        c:\windows\system32\E_FLBFDE.DLL

2012-01-07 15:20 . 2007-12-07 01:01        78848        ----a-w-        c:\windows\system32\E_FD4BFDE.DLL

2012-01-07 15:20 . 2012-01-07 15:27        --------        d-----w-        c:\programdata\EPSON

2012-01-07 15:15 . 2012-01-07 15:23        --------        d-----w-        c:\program files\epson

2012-01-07 15:15 . 2009-04-30 23:00        15872        ----a-w-        c:\windows\system32\escdev.dll

2012-01-07 15:15 . 2009-04-30 23:00        128392        ----a-w-        c:\windows\system32\esdevapp.exe

2012-01-07 15:15 . 2008-11-16 23:00        342016        ----a-w-        c:\windows\system32\eswiaud.dll

2011-12-31 02:44 . 2011-12-31 12:26        --------        d-----w-        c:\programdata\VirtualizedApplications

2011-12-31 01:07 . 2011-12-31 01:07        --------        d-----w-        c:\windows\system32\URTTEMP

2011-12-31 01:05 . 2011-12-31 01:14        --------        d-----w-        C:\AiO-Files

2011-12-30 23:12 . 2012-01-01 14:34        --------        d-----w-        c:\program files\Microsoft Application Virtualization Client

2011-12-30 18:16 . 2011-12-30 18:16        --------        d-----w-        c:\users\Public\CyberLink

2011-12-30 00:02 . 2011-12-30 00:02        --------        d-----w-        c:\program files\Windows Media Components

2011-12-29 15:27 . 2011-12-29 15:27        --------        d-----w-        c:\program files\Microsoft CAPICOM 2.1.0.2

2011-12-28 20:04 . 2011-12-28 20:04        --------        d-----w-        c:\program files\TeamViewer

2011-12-28 14:04 . 2011-12-28 14:04        --------        d-----w-        c:\windows\system32\SPReview

2011-12-28 14:03 . 2011-12-28 14:03        --------        d-----w-        c:\programdata\Logitech

2011-12-28 14:03 . 2011-12-28 14:03        --------        d-----w-        c:\program files\Common Files\LWS

2011-12-28 14:03 . 2011-12-28 14:03        --------        d-----w-        c:\programdata\LogiShrd

2011-12-28 14:03 . 2011-12-28 14:03        --------        d-----w-        c:\program files\Logitech

2011-12-28 14:01 . 2011-12-28 14:01        --------        d-----w-        c:\windows\system32\EventProviders

2011-12-28 13:57 . 2011-12-28 14:05        --------        d-----w-        c:\program files\Common Files\logishrd

2011-12-28 13:45 . 2011-04-22 19:14        27008        ----a-w-        c:\windows\system32\drivers\Diskdump.sys

2011-12-28 13:43 . 2011-02-03 05:54        219008        ----a-w-        c:\windows\system32\drivers\dxgmms1.sys

2011-12-28 13:43 . 2010-11-20 12:29        728448        ----a-w-        c:\windows\system32\drivers\dxgkrnl.sys

2011-12-28 13:43 . 2010-11-20 11:56        107520        ----a-w-        c:\windows\system32\cdd.dll

2011-12-28 13:20 . 2010-11-20 12:21        750592        ----a-w-        c:\windows\system32\schedsvc.dll

2011-12-28 13:18 . 2010-11-20 12:21        189952        ----a-w-        c:\windows\system32\wdscore.dll

2011-12-28 13:18 . 2010-11-20 12:21        363008        ----a-w-        c:\windows\system32\wbemcomn.dll

2011-12-28 13:18 . 2010-11-20 12:21        189952        ----a-w-        c:\program files\Windows Portable Devices\sqmapi.dll

2011-12-28 13:18 . 2010-11-20 12:19        606208        ----a-w-        c:\windows\system32\wbem\fastprox.dll

2011-12-28 13:18 . 2010-11-20 12:21        189952        ----a-w-        c:\windows\system32\sqmapi.dll

2011-12-28 05:47 . 2010-02-11 07:10        293376        ----a-w-        c:\windows\system32\browserchoice.exe

2011-12-28 03:07 . 2010-12-23 05:54        850944        ----a-w-        c:\windows\system32\sbe.dll

2011-12-28 01:55 . 2011-12-28 01:55        --------        d-----w-        c:\programdata\Malwarebytes

2011-12-28 01:55 . 2011-12-10 14:24        20464        ----a-w-        c:\windows\system32\drivers\mbam.sys

2011-12-28 01:05 . 2011-12-28 01:44        115369        ----a-w-        c:\windows\system32\drivers\klin.dat

2011-12-28 01:05 . 2011-12-28 01:44        97961        ----a-w-        c:\windows\system32\drivers\klick.dat

2011-12-28 01:04 . 2012-01-13 12:31        --------        d-----w-        c:\programdata\Kaspersky Lab

2011-12-27 23:50 . 2011-12-27 23:50        --------        d-----r-        C:\Sandbox

2011-12-27 17:29 . 2011-12-27 17:29        --------        d-----w-        c:\program files\Z8Games

2011-12-27 15:50 . 2011-12-27 15:58        --------        d-----w-        c:\programdata\Skype

2011-12-27 15:46 . 2011-12-27 15:46        --------        d-----w-        C:\SG Interactive

2011-12-27 15:42 . 2012-01-12 21:56        --------        d-----w-        C:\Programme

2011-12-27 15:13 . 2012-01-12 21:56        --------        d-----w-        c:\users\***

2011-12-27 15:13 . 2011-12-27 15:13        --------        d-----w-        c:\programdata\Corel

2011-12-27 15:13 . 2011-12-27 15:13        --------        d-----w-        c:\program files\Common Files\Protexis

2011-12-27 15:12 . 2011-12-27 15:12        --------        d-----w-        c:\program files\Common Files\Corel

2011-12-27 15:12 . 2011-12-27 15:12        --------        d-----w-        c:\program files\Corel

2011-12-27 15:11 . 2011-12-27 15:11        --------        d-----w-        c:\program files\PlayReady

2011-12-27 15:09 . 2011-12-27 15:09        --------        d-----w-        c:\program files\Microsoft Sync Framework

2011-12-27 15:08 . 2011-12-27 15:08        --------        d-----w-        c:\program files\Microsoft SQL Server Compact Edition

2011-12-27 15:07 . 2011-12-27 15:07        --------        d-----w-        c:\program files\Microsoft

2011-12-27 15:07 . 2011-12-27 15:07        --------        d-----w-        c:\program files\Windows Live SkyDrive

2011-12-27 15:07 . 2011-12-27 15:09        --------        d-----w-        c:\program files\Windows Live

2011-12-27 15:06 . 2011-12-27 15:06        --------        d-----w-        c:\windows\PCHEALTH

2011-12-27 15:06 . 2011-12-27 15:06        --------        d-----w-        c:\program files\Common Files\Windows Live

2011-12-27 15:04 . 2011-12-27 15:04        --------        d-sh--we        C:\Documents and Settings

2011-12-27 15:04 . 2011-12-27 15:04        --------        d-----w-        C:\Recovery

.

.

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2011-12-28 14:53 . 2009-07-14 02:05        152576        ----a-w-        c:\windows\system32\msclmd.dll

2011-11-15 13:29 . 2010-06-29 13:41        222080        ------w-        c:\windows\system32\MpSigStub.exe

2011-11-10 04:54 . 2010-06-30 10:03        472808        ----a-w-        c:\windows\system32\deployJava1.dll

.

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1174016]

"ICQ"="c:\programme\ICQ7.5\ICQ.exe" [2011-08-01 124480]

"Skype"="c:\programme\Skype\Phone\Skype.exe" [2011-10-13 17351304]

"SandboxieControl"="c:\programme\Sandboxie\SbieCtrl.exe" [2011-11-23 442640]

"Speech Recognition"="c:\windows\Speech\Common\sapisvr.exe" [2009-07-14 51712]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"IAStorIcon"="c:\program files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe" [2010-03-04 284696]

"CLMLServer"="c:\program files\CyberLink\Power2Go\CLMLSvc.exe" [2009-11-02 103720]

"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2010-04-07 8555040]

"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2010-05-27 98304]

"AVP"="c:\programme\Kaspersky Lab\Kaspersky Security Suite CBE 11\avp.exe" [2011-04-13 387696]

"LWS"="c:\programme\Logitech\LWS\Webcam Software\LWS.exe" [2011-08-12 205336]

"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696]

"EEventManager"="c:\progra~1\EPSONS~1\EVENTM~1\EEventManager.exe" [2009-04-07 673616]

.

c:\users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

ICQ Ignore Checker.lnk - c:\programme\ICQ Ignore Checker\ICQ Ignore Checker.exe [2012-1-4 937984]

Logitech . Produktregistrierung.lnk - c:\programme\Logitech\Ereg\eReg.exe [2009-11-16 517384]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 5 (0x5)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"aux2"=wdmaud.drv

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]

"DisableMonitoring"=dword:00000001

.

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]

R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4640000]

R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224]

S1 kl2;kl2;c:\windows\system32\DRIVERS\kl2.sys [2010-06-09 11352]

S1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter;c:\windows\system32\DRIVERS\klim6.sys [2010-04-22 22104]

S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-13 48128]

S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2010-05-27 176128]

S2 cvhsvc;Client Virtualization Handler;c:\program files\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [2010-10-20 821664]

S2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [2010-03-04 13336]

S2 NitroReaderDriverReadSpool2;NitroPDFReaderDriverCreatorReadSpool2;c:\programme\Nitro PDFReader 2\NitroPDFReaderDriverService2.exe [2011-10-10 196912]

S2 sftlist;Application Virtualization Client;c:\program files\Microsoft Application Virtualization Client\sftlist.exe [2010-09-14 508264]

S2 TeamViewer7;TeamViewer 7;c:\program files\TeamViewer\Version7\TeamViewer_Service.exe [2011-12-14 2984832]

S2 UMVPFSrv;UMVPFSrv;c:\program files\Common Files\logishrd\LVMVFM\UMVPFSrv.exe [2011-08-19 450848]

S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [2010-05-27 5586432]

S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [2010-05-27 209920]

S3 CompFilter;UVCCompositeFilter;c:\windows\system32\DRIVERS\lvbusflt.sys [2011-08-19 22176]

S3 klmouflt;Kaspersky Lab KLMOUFLT;c:\windows\system32\DRIVERS\klmouflt.sys [2009-11-02 19984]

S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt86win7.sys [2011-06-10 394856]

S3 RTL8192su;Realtek RTL8192SU Wireless LAN 802.11n USB 2.0 Network Adapter;c:\windows\system32\DRIVERS\RTL8192su.sys [2010-11-25 603240]

S3 Sftfs;Sftfs;c:\windows\system32\DRIVERS\Sftfslh.sys [2010-09-14 577384]

S3 Sftplay;Sftplay;c:\windows\system32\DRIVERS\Sftplaylh.sys [2010-09-14 194408]

S3 Sftredir;Sftredir;c:\windows\system32\DRIVERS\Sftredirlh.sys [2010-09-14 21864]

S3 Sftvol;Sftvol;c:\windows\system32\DRIVERS\Sftvollh.sys [2010-09-14 19304]

S3 sftvsa;Application Virtualization Service Agent;c:\program files\Microsoft Application Virtualization Client\sftvsa.exe [2010-09-14 219496]

S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [2009-07-13 14336]

.

.

.

------- Zusätzlicher Suchlauf -------

.

uStart Page = 

IE: Hinzufügen zu Anti-Banner - c:\programme\Kaspersky Lab\Kaspersky Security Suite CBE 11\ie_banner_deny.htm

IE: {{0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - hxxp://rover.ebay.com/rover/1/707-37276-17534-31/4

IE: {{7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - c:\programme\ICQ7.5\ICQ.exe

TCP: DhcpNameServer = 83.169.185.161 192.168.0.1

FF - ProfilePath - c:\users\***\AppData\Roaming\Mozilla\Firefox\Profiles\423xf1hp.default\

FF - prefs.js: browser.startup.homepage - hxxp://www.google.de/firefox

FF - prefs.js: keyword.URL - hxxp://www.google.de/#hl=de&cp=3&gs_id=g&xhr=t&q=

pref(dom.disable_open_during_load, true);

FF - user.js: network.http.max-persistent-connections-per-server - 4

FF - user.js: content.max.tokenizing.time - 200000

FF - user.js: content.notify.interval - 100000

FF - user.js: content.switch.threshold - 650000

FF - user.js: nglayout.initialpaint.delay - 300

pref('extensions.shownSelectionUI',true);

pref('extensions.autoDisableScopes',0);

.

.

--------------------- Gesperrte Registrierungsschluessel ---------------------

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

------------------------ Weitere laufende Prozesse ------------------------

.

c:\programme\Sandboxie\SbieSvc.exe

c:\windows\system32\atieclxx.exe

c:\programdata\EPSON\EPW!3 SSRP\E_S40ST7.EXE

c:\programdata\EPSON\EPW!3 SSRP\E_S40RP7.EXE

c:\windows\system32\PnkBstrA.exe

c:\windows\system32\PnkBstrB.exe

c:\program files\Common Files\Protexis\License Service\PsiService_2.exe

c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe

c:\windows\system32\WUDFHost.exe

c:\windows\servicing\TrustedInstaller.exe

c:\program files\Windows Media Player\wmpnetwk.exe

c:\windows\system32\taskhost.exe

c:\windows\system32\conhost.exe

c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe

c:\programme\Logitech\LWS\Webcam Software\CameraHelperShell.exe

c:\program files\Epson Software\Event Manager\EEventManager.exe

c:\program files\Common Files\Logishrd\LQCVFX\COCIManager.exe

c:\program files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe

.

**************************************************************************

.

Zeit der Fertigstellung: 2012-01-13  13:35:57 - PC wurde neu gestartet

ComboFix-quarantined-files.txt  2012-01-13 12:35

ComboFix2.txt  2012-01-12 22:37

ComboFix3.txt  2012-01-12 22:19

ComboFix4.txt  2012-01-12 12:41

.

Vor Suchlauf: 13 Verzeichnis(se), 831.237.120.000 Bytes frei

Nach Suchlauf: 14 Verzeichnis(se), 830.647.885.824 Bytes frei

.

- - End Of File - - 3B97B859B653895893F2F0F2DCD451DA