Trojaner-Board - sbcvvhost_win86 sperrt alles

Log fertig
Combofix Logfile:
Code:
ComboFix 11-12-29.02 - Benutzer 29.12.2011  15:07:22.1.4 - x86 MINIMAL

Microsoft® Windows Vista™ Home Premium   6.0.6002.2.1252.49.1031.18.3070.2497 [GMT 1:00]

ausgeführt von:: J:\ComboFix.exe

AV: AntiVir Desktop *Enabled/Updated* {090F9C29-64CE-6C6F-379C-5901B49A85B7}

SP: AntiVir Desktop *Enabled/Updated* {B26E7DCD-42F4-63E1-0D2C-6273CF1DCF0A}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

 * Neuer Wiederherstellungspunkt wurde erstellt

.

.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

c:\program files\Antbar\Ant.com Toolbar\tbHElper.dll

c:\program files\Search Settings

c:\program files\Search Settings\kb128\SeARchsettings.dll

c:\program files\Search Settings\kb128\SearchSettingsRes409.dll

c:\program files\Search Settings\SearchSettings.exe

C:\Recycle.Bin

c:\recycle.bin\Recycle.Bin.exe

c:\users\Benutzer\AppData\Local\squgg.dat

c:\users\Benutzer\AppData\Local\squgg_nav.dat

c:\users\Benutzer\AppData\Local\squgg_navps.dat

c:\users\Benutzer\AppData\Roaming\dwlGina3.dll

c:\users\Benutzer\AppData\Roaming\sbcvvhost_win86.exe

c:\windows\system32\drivers\~GLH0014.TMP

c:\windows\system32\drivers\FSC__PI__MS-7304VP-A13__FUJITSU SIEMENS_MS-7304VP-A13__Default System BIOS_FSC - 20080808_VG.07__ATI Radeon HD 3200 Graphics__ATI Radeon HD 4850 Series .MRK

c:\windows\system32\msprpde.dll

c:\windows\system32\MSSTKPRP.DLL

.

.

(((((((((((((((((((((((   Dateien erstellt von 2011-11-28 bis 2011-12-29  ))))))))))))))))))))))))))))))

.

.

2011-12-29 14:12 . 2011-12-29 14:12        56200        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{CC55C934-4B85-411F-82C0-F341B4D1017F}\offreg.dll

2011-12-27 21:59 . 2011-11-21 10:47        6823496        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{CC55C934-4B85-411F-82C0-F341B4D1017F}\mpengine.dll

2011-12-18 10:10 . 2011-12-18 10:10        414368        ----a-w-        c:\windows\system32\FlashPlayerCPLApp.cpl

2011-12-07 22:37 . 2011-12-07 22:37        2106216        ----a-w-        c:\program files\Mozilla Firefox\D3DCompiler_43.dll

2011-12-07 22:37 . 2011-12-07 22:37        1998168        ----a-w-        c:\program files\Mozilla Firefox\d3dx9_43.dll

2011-12-07 22:37 . 2011-12-07 22:37        134104        ----a-w-        c:\program files\Mozilla Firefox\components\browsercomps.dll

2011-12-07 22:37 . 2011-12-07 22:37        89048        ----a-w-        c:\program files\Mozilla Firefox\libEGL.dll

2011-12-07 22:37 . 2011-12-07 22:37        801752        ----a-w-        c:\program files\Mozilla Firefox\mozsqlite3.dll

2011-12-07 22:37 . 2011-12-07 22:37        478168        ----a-w-        c:\program files\Mozilla Firefox\libGLESv2.dll

2011-12-07 22:37 . 2011-12-07 22:37        1989592        ----a-w-        c:\program files\Mozilla Firefox\mozjs.dll

2011-12-07 22:37 . 2011-12-07 22:37        15832        ----a-w-        c:\program files\Mozilla Firefox\mozalloc.dll

2011-12-04 12:56 . 2011-12-04 12:56        --------        d-----w-        c:\users\Benutzer\AppData\Roaming\PC Speed Maximizer

2011-12-04 12:56 . 2011-12-04 12:56        --------        d-----w-        c:\program files\PC Speed Maximizer

.

.

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2011-12-07 22:37 . 2011-12-07 22:37        134104        ----a-w-        c:\program files\mozilla firefox\components\browsercomps.dll

.

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4

.

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{DA3D342F-FF20-4E31-9E82-22334155730C}]

2009-06-02 14:51        2695168        ----a-w-        c:\program files\Antbar\Ant.com Toolbar\tbcore3.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]

"{6CD56C02-CB4D-41B5-A0FE-B479061CCB41}"= "c:\program files\Antbar\Ant.com Toolbar\tbcore3.dll" [2009-06-02 2695168]

.

[HKEY_CLASSES_ROOT\clsid\{6cd56c02-cb4d-41b5-a0fe-b479061ccb41}]

[HKEY_CLASSES_ROOT\TBSB00982.TBSB00982.3]

[HKEY_CLASSES_ROOT\TypeLib\{EC4085F2-8DB3-45a6-AD0B-CA289F3C5D7E}]

[HKEY_CLASSES_ROOT\TBSB00982.TBSB00982]

.

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]

"{6CD56C02-CB4D-41B5-A0FE-B479061CCB41}"= "c:\program files\Antbar\Ant.com Toolbar\tbcore3.dll" [2009-06-02 2695168]

.

[HKEY_CLASSES_ROOT\clsid\{6cd56c02-cb4d-41b5-a0fe-b479061ccb41}]

[HKEY_CLASSES_ROOT\TBSB00982.TBSB00982.3]

[HKEY_CLASSES_ROOT\TypeLib\{EC4085F2-8DB3-45a6-AD0B-CA289F3C5D7E}]

[HKEY_CLASSES_ROOT\TBSB00982.TBSB00982]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]

@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]

2011-10-31 21:02        94208        ----a-w-        c:\users\Benutzer\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]

@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]

2011-10-31 21:02        94208        ----a-w-        c:\users\Benutzer\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]

@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]

2011-10-31 21:02        94208        ----a-w-        c:\users\Benutzer\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]

@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]

2011-10-31 21:02        94208        ----a-w-        c:\users\Benutzer\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ccleaner"="c:\program files\CCleaner\CCleaner.exe" [2011-01-24 2200376]

"PC Speed Maximizer"="c:\program files\PC Speed Maximizer\SPMTray.exe" [2009-09-29 205072]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"EnergySettings"="c:\program files\Fujitsu Siemens Computers\Energy Settings\EnergySettings.exe" [2008-09-19 113664]

"FSCRecovery"="c:\program files\Fujitsu Siemens Computers\Fujitsu Siemens Computers Recovery\FSCRecoveryReminder.exe" [2008-06-18 268096]

"KeyConfiguration"="c:\program files\Fujitsu Siemens Computers\Key Configuration Tool\KeyConfigurationTool.exe" [2008-09-04 413184]

"ZoneAlarm Client"="c:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [2008-03-03 959976]

"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]

"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-05-04 148888]

"PDFPrint"="c:\program files\PDF24\pdf24.exe" [2011-04-28 220552]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-10-03 35696]

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-21 932288]

"RtHDVCpl"="RtHDVCpl.exe" [2008-08-27 6281760]

.

c:\users\Benutzer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

Dropbox.lnk - c:\users\Benutzer\AppData\Roaming\Dropbox\bin\Dropbox.exe [2011-12-5 24242056]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"EnableLUA"= 0 (0x0)

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]

BootExecute        REG_MULTI_SZ           autocheck autochk /r \??\K:\0autocheck autochk *

.

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Microsoft Office.lnk]

path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Office.lnk

backup=c:\windows\pss\Microsoft Office.lnk.CommonStartup

backupExtension=.CommonStartup

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]

2009-10-03 02:08        35696        ----a-w-        c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google EULA Launcher]

2008-05-28 11:40        20480        ----a-w-        c:\program files\Google\Google EULA\GoogleEULALauncher.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RtHDVCpl]

2008-08-27 15:55        6281760        ----a-w-        c:\windows\RtHDVCpl.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sidebar]

2009-04-11 06:28        1233920        ----a-w-        c:\program files\Windows Sidebar\sidebar.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StartCCC]

2008-07-16 14:57        61440        ----a-w-        c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]

2011-11-13 18:15        1242448        ----a-w-        c:\program files\Steam\steam.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]

2008-08-03 23:02        36352        ----a-w-        c:\program files\Winamp\winampa.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WMPNSCFG]

2008-01-21 02:25        202240        ----a-w-        c:\program files\Windows Media Player\wmpnscfg.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]

"DisableMonitoring"=dword:00000001

.

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]

R3 ewsercd;Huawei DataCard USB Serial Port;c:\windows\system32\DRIVERS\ewsercd.sys [2011-08-09 100224]

R3 hwusbfake;Huawei DataCard USB Fake;c:\windows\system32\DRIVERS\ewusbfake.sys [2011-08-09 103040]

R3 netr28u;RT2870 USB Wireless LAN Card Driver for Vista;c:\windows\system32\DRIVERS\netr28u.sys [2008-07-31 641024]

R3 RTL8187B;Realtek RTL8187B Wireless 802.11g 54Mbps USB 2.0 Network Adapter;c:\windows\system32\DRIVERS\RTL8187B.sys [2007-02-08 211456]

R3 RtlProt;Realtke RtlProt WLAN Utility Protocol Driver;c:\windows\system32\DRIVERS\rtlprot.sys [2006-12-02 15360]

R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]

S2 AntiVirSchedulerService;Avira AntiVir Planer;c:\program files\Avira\AntiVir Desktop\sched.exe [2009-05-13 108289]

S2 SSPORT;SSPORT;c:\windows\system32\Drivers\SSPORT.sys [2007-01-08 5120]

S2 TeamViewer5;TeamViewer 5;c:\program files\TeamViewer\Version5\TeamViewer_Service.exe [2010-09-24 1960744]

S2 WTGService;WTGService;c:\program files\Verbindungsassistent\WTGService.exe [2010-02-23 329168]

.

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

LocalServiceAndNoImpersonation        REG_MULTI_SZ           FontCache

.

Inhalt des "geplante Tasks" Ordners

.

2011-12-29 c:\windows\Tasks\RtlVistaStart.job

- c:\program files\REALTEK USB Wireless LAN Driver and Utility\RtWLan.exe [2009-02-27 13:20]

.

2011-12-29 c:\windows\Tasks\User_Feed_Synchronization-{9D4FF234-A9EB-451C-A287-7E40D6624724}.job

- c:\windows\system32\msfeedssync.exe [2008-01-21 02:24]

.

.

------- Zusätzlicher Suchlauf -------

.

uStart Page = hxxp://www.google.de/webhp?rls=ig

mStart Page = hxxp://www.google.com/ig/redirectdomain?brand=FUJD&bmod=FUJD

TCP: DhcpNameServer = 192.168.1.1

DPF: {DE405D53-E02B-4391-BF2E-0577956F1C37} - hxxps://www.innerpass.com/innerpass_prod/widget/InnerMeetingLaunch.dll

FF - ProfilePath - c:\users\Benutzer\AppData\Roaming\Mozilla\Firefox\Profiles\btz3zuop.default\

FF - prefs.js: browser.search.defaulturl - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2685&invocationType=tb50ffwinampie7&query=

FF - prefs.js: browser.search.selectedEngine - Google

FF - prefs.js: browser.startup.homepage - hxxp://www.google.de

FF - prefs.js: keyword.URL - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2685&invocationType=tb50ffwinampab&query=

.

- - - - Entfernte verwaiste Registrierungseinträge - - - -

.

HKCU-Run-Recycle.Bin.exe - c:\recycle.bin\Recycle.Bin.exe

HKCU-Run-WBhXTAWuFpmNyON - c:\users\Benutzer\AppData\Roaming\sbcvvhost_win86.exe

HKLM-Run-WBhXTAWuFpmNyON - c:\users\Benutzer\AppData\Roaming\sbcvvhost_win86.exe

HKU-Default-Run-Picasa Media Detector - c:\program files\Picasa2\PicasaMediaDetector.exe

HKU-Default-Run-fsc-reg - c:\fsc-reg\fscreg.exe

MSConfigStartUp-Norman ZANDA - c:\program files\Norman\Npm\Bin\ZLH.EXE

MSConfigStartUp-NPCTray - c:\program files\Norman\npc\bin\npc_tray.exe

MSConfigStartUp-Pando - c:\program files\Pando Networks\Pando\Pando.exe

MSConfigStartUp-SearchSettings - c:\program files\Search Settings\SearchSettings.exe

MSConfigStartUp-squgg - c:\users\benutzer\appdata\local\squgg.exe

.

.

.

**************************************************************************

Scanne versteckte Prozesse... 

.

Scanne versteckte Autostarteinträge... 

.

Scanne versteckte Dateien... 

.

Scan erfolgreich abgeschlossen

versteckte Dateien: 

.

**************************************************************************

.

--------------------- Gesperrte Registrierungsschluessel ---------------------

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\Tcpip6\Parameters\Interfaces\{0e6fde21-12ee-440f-888c-82ec1066bf11}]

@DACL=(02 0000)

"Dhcpv6Iaid"=dword:11001f1f

"Dhcpv6State"=dword:00000000

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\Tcpip6\Parameters\Interfaces\{33d8b32d-b92d-4622-8256-5e16ed767f84}]

@DACL=(02 0000)

"Dhcpv6Iaid"=dword:0a002185

"Dhcpv6State"=dword:00000000

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\Tcpip6\Parameters\Interfaces\{7bb29a37-9a08-4b3c-a080-9e4cc9fdf878}]

@DACL=(02 0000)

"Dhcpv6Iaid"=dword:100015af

"Dhcpv6State"=dword:00000000

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\Tcpip6\Parameters\Interfaces\{9c642153-bfe0-4511-a0b6-e778ddd5ea9e}]

@DACL=(02 0000)

"Dhcpv6Iaid"=dword:07001422

"Dhcpv6State"=dword:00000000

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\Tcpip6\Parameters\Interfaces\{ad813ad0-f2f2-4f2c-9fc3-89ffa138f69d}]

@DACL=(02 0000)

"Dhcpv6Iaid"=dword:10020054

"Dhcpv6State"=dword:00000000

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\Tcpip6\Parameters\Interfaces\{ba32a50a-3d27-4fae-8591-5916311409be}]

@DACL=(02 0000)

"Dhcpv6Iaid"=dword:0c001422

"Dhcpv6State"=dword:00000000

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\Tcpip6\Parameters\Interfaces\{f50c0996-5b4a-4c6a-a322-6e991d4caa0e}]

@DACL=(02 0000)

"Dhcpv6Iaid"=dword:06001422

"Dhcpv6State"=dword:00000000

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\Tcpip6\Parameters\Interfaces\{f70a361f-6437-4fcc-91a4-cd88d468d91b}]

@DACL=(02 0000)

"Dhcpv6Iaid"=dword:0e001422

"Dhcpv6State"=dword:00000000

.

--------------------- Durch laufende Prozesse gestartete DLLs ---------------------

.

- - - - - - - > 'Explorer.exe'(3752)

c:\users\Benutzer\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll

.

------------------------ Weitere laufende Prozesse ------------------------

.

c:\windows\system32\Ati2evxx.exe

c:\windows\system32\Ati2evxx.exe

c:\program files\Avira\AntiVir Desktop\avguard.exe

c:\program files\Nero\Nero8\Nero BackItUp\NBService.exe

c:\windows\system32\IoctlSvc.exe

c:\program files\Electronic Arts\Medal of Honor Airborne\UnrealEngine3\MOHAGame\pb\PnkBstrA.exe

c:\program files\Fujitsu Siemens Computers\SystemDiagnostics\OnlineDiagnostic\TestManager\TestHandler.exe

c:\windows\system32\conime.exe

c:\windows\system32\WUDFHost.exe

c:\\?\c:\windows\system32\wbem\WMIADAP.EXE

c:\windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe

.

**************************************************************************

.

Zeit der Fertigstellung: 2011-12-29  15:17:22 - PC wurde neu gestartet

ComboFix-quarantined-files.txt  2011-12-29 14:16

.

Vor Suchlauf: 9.341.804.544 Bytes frei

Nach Suchlauf: 9.239.953.408 Bytes frei

.

- - End Of File - - 7934D131312463F56E96B2C85ECD9CE8
--- --- ---