Trojaner-Board - Aus Sicherheitsgründen Windows blockiert

hier die ComboFix.txt

Combofix Logfile:
Code:
ComboFix 12-01-04.02 - Bater 04.01.2012  20:18:23.1.2 - x86

Microsoft® Windows Vista™ Home Premium   6.0.6002.2.1252.43.1031.18.3069.1968 [GMT 1:00]

ausgeführt von:: c:\users\Bater\Desktop\ComboFix.exe

AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}

SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

C:\Install.exe

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\hpoddt01.exe.lnk

c:\users\Bater\AppData\Roaming\Adobe\AdobeUpdate .exe

c:\users\Bater\AppData\Roaming\Adobe\plugs

c:\users\Bater\AppData\Roaming\Adobe\plugs\KB4874625.exe

c:\users\Goas\AppData\Local\Microsoft\Windows\Temporary Internet Files\PMH1B86.tmp

c:\users\Goas\AppData\Local\Microsoft\Windows\Temporary Internet Files\PMH4F39.tmp

c:\users\Goas\Windows Live Messenger .lnk

c:\windows\IsUn0407.exe

c:\windows\iun6002.exe

c:\windows\security\Database\tmp.edb

.

Infizierte Kopie von c:\windows\system32\drivers\ntfs.sys wurde gefunden und desinfiziert 

Kopie von - c:\windows\winsxs\x86_microsoft-windows-ntfs_31bf3856ad364e35_6.0.6002.18005_none_a85ca2c91a0d64df\ntfs.sys wurde wiederhergestellt 

.

.

(((((((((((((((((((((((   Dateien erstellt von 2011-12-04 bis 2012-01-04  ))))))))))))))))))))))))))))))

.

.

2012-01-04 19:38 . 2012-01-04 19:38        --------        d-----w-        c:\users\Vivi\AppData\Local\temp

2012-01-04 19:36 . 2012-01-04 19:36        --------        d-----w-        c:\users\Goas\AppData\Local\temp

2012-01-04 19:36 . 2012-01-04 19:36        --------        d-----w-        c:\users\Default\AppData\Local\temp

2012-01-04 19:36 . 2012-01-04 19:36        --------        d-----w-        c:\users\Brigitte\AppData\Local\temp

2012-01-04 15:36 . 2012-01-04 16:18        --------        d-----w-        C:\_OTL

2012-01-03 18:02 . 2012-01-03 18:02        --------        d-----w-        c:\program files\7-Zip

2012-01-03 15:29 . 2012-01-03 15:29        626688        ----a-w-        c:\program files\Mozilla Firefox\msvcr80.dll

2012-01-03 15:29 . 2012-01-03 15:29        548864        ----a-w-        c:\program files\Mozilla Firefox\msvcp80.dll

2012-01-03 15:29 . 2012-01-03 15:29        479232        ----a-w-        c:\program files\Mozilla Firefox\msvcm80.dll

2012-01-03 15:29 . 2012-01-03 15:29        43992        ----a-w-        c:\program files\Mozilla Firefox\mozutils.dll

2011-12-26 18:20 . 2011-12-26 18:20        --------        d-----w-        c:\users\Vivi\AppData\Roaming\Avira

2011-12-26 09:17 . 2011-12-26 09:17        --------        d-----w-        c:\users\Bater\AppData\Roaming\Avira

2011-12-26 07:25 . 2011-12-26 07:25        --------        d-----w-        c:\users\Brigitte\AppData\Roaming\Avira

2011-12-26 07:20 . 2011-12-15 14:00        36000        ----a-w-        c:\windows\system32\drivers\avkmgr.sys

2011-12-26 07:20 . 2011-12-15 14:00        134856        ----a-w-        c:\windows\system32\drivers\avipbb.sys

2011-12-26 07:20 . 2011-12-26 07:20        --------        d-----w-        c:\programdata\Avira

2011-12-26 07:20 . 2011-12-26 07:20        --------        d-----w-        c:\program files\Avira

2011-12-14 20:05 . 2011-10-27 08:01        3602816        ----a-w-        c:\windows\system32\ntkrnlpa.exe

2011-12-14 20:05 . 2011-10-27 08:01        3550080        ----a-w-        c:\windows\system32\ntoskrnl.exe

2011-12-14 20:05 . 2011-10-14 16:02        429056        ----a-w-        c:\windows\system32\EncDec.dll

2011-12-14 20:05 . 2011-11-23 13:37        2043904        ----a-w-        c:\windows\system32\win32k.sys

2011-12-14 20:05 . 2011-11-08 12:10        2409784        ----a-w-        c:\program files\Windows Mail\OESpamFilter.dat

2011-12-14 20:05 . 2011-10-25 15:56        49152        ----a-w-        c:\windows\system32\csrsrv.dll

2011-12-14 20:04 . 2011-11-08 14:42        2048        ----a-w-        c:\windows\system32\tzres.dll

.

.

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2012-01-04 19:40 . 2012-01-04 19:40        56200        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{539BAE5F-B67A-43A3-B1EE-D6B730EA0F6D}\offreg.dll

2011-12-15 14:00 . 2009-11-16 20:33        74640        ----a-w-        c:\windows\system32\drivers\avgntflt.sys

2011-11-24 17:10 . 2011-07-27 07:49        414368        ----a-w-        c:\windows\system32\FlashPlayerCPLApp.cpl

2011-11-21 10:47 . 2012-01-04 04:51        6823496        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{539BAE5F-B67A-43A3-B1EE-D6B730EA0F6D}\mpengine.dll

2012-01-03 15:29 . 2011-05-04 08:19        121816        ----a-w-        c:\program files\mozilla firefox\components\browsercomps.dll

2010-06-18 04:28 . 2008-11-21 20:42        119808        ----a-w-        c:\program files\mozilla firefox\components\GoogleDesktopMozilla.dll

.

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4

.

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{872b5b88-9db5-4310-bdd0-ac189557e5f5}]

2011-12-25 06:46        2735200        ----a-w-        c:\program files\DVDVideoSoftTB\tbDVD1.dll

.

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]

2011-07-26 16:23        1493160        ----a-w-        c:\program files\Ask.com\GenericAskToolbar.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]

"{872b5b88-9db5-4310-bdd0-ac189557e5f5}"= "c:\program files\DVDVideoSoftTB\tbDVD1.dll" [2011-12-25 2735200]

"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2011-07-26 1493160]

.

[HKEY_CLASSES_ROOT\clsid\{872b5b88-9db5-4310-bdd0-ac189557e5f5}]

.

[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]

[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]

[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]

[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

.

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]

"{872B5B88-9DB5-4310-BDD0-AC189557E5F5}"= "c:\program files\DVDVideoSoftTB\tbDVD1.dll" [2011-12-25 2735200]

.

[HKEY_CLASSES_ROOT\clsid\{872b5b88-9db5-4310-bdd0-ac189557e5f5}]

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" [2008-02-28 1828136]

"Akamai NetSession Interface"="c:\users\Bater\AppData\Local\Akamai\netsession_win.exe" [2011-12-12 3305760]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2008-05-07 178712]

"RtHDVCpl"="RtHDVCpl.exe" [2008-05-07 6139904]

"Skytel"="Skytel.exe" [2007-11-20 1826816]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-06-09 13543968]

"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-06-09 92704]

"Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2010-06-18 30192]

"PivotSoftware"="c:\program files\Portrait Displays\Pivot Software\wpctrl.exe" [2007-02-09 694008]

"DT ACR"="c:\program files\Acer Display\eDisplay Management\DTHtml.exe" [2007-09-20 305664]

"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2011-04-20 58656]

"Windows Mobile-based device management"="c:\windows\WindowsMobile\wmdSync.exe" [2008-01-21 215552]

"AdobeAAMUpdater-1.0"="c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2010-03-06 500208]

"AdobeCS5ServiceManager"="c:\program files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" [2010-02-22 406992]

"SwitchBoard"="c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]

"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-10-29 249064]

"PixelPlanet PdfPrinter-Monitor"="c:\program files\Common Files\PixelPlanet\PdfPrinter 6\PdfPrinterMonitor.exe" [2011-05-16 2210672]

"PDFPrint"="c:\program files\PDF24\pdf24.exe" [2011-06-16 220552]

"ApnUpdater"="c:\program files\Ask.com\Updater\Updater.exe" [2011-07-26 397992]

"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2011-07-05 421888]

"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2011-08-18 421736]

"HP Software Update"="c:\program files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe" [2011-05-10 49208]

"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2011-12-15 258512]

.

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

HP Digital Imaging Monitor.lnk - c:\program files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe [2009-5-21 275768]

McAfee Security Scan.lnk - c:\program files\McAfee Security Scan\1.0.150\SSScheduler.exe [2009-7-28 199184]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]

"AppInit_DLLs"=c:\progra~1\Google\GOOGLE~1\GoogleDesktopNetwork3.dll

.

--- Andere Dienste/Treiber im Speicher ---

.

*NewlyCreated* - WS2IFSL

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

WindowsMobile        REG_MULTI_SZ           wcescomm rapimgr

LocalServiceRestricted        REG_MULTI_SZ           WcesComm RapiMgr

LocalServiceAndNoImpersonation        REG_MULTI_SZ           FontCache

getPlusHelper        REG_MULTI_SZ           getPlusHelper

Akamai        REG_MULTI_SZ           Akamai

HPZ12        REG_MULTI_SZ           Pml Driver HPZ12 Net Driver HPZ12

HPService        REG_MULTI_SZ           HPSLPSVC

hpdevmgmt        REG_MULTI_SZ           hpqcxs08 hpqddsvc

.

Inhalt des "geplante Tasks" Ordners

.

2010-04-11 c:\windows\Tasks\User_Feed_Synchronization-{05BC8D19-E81C-4DA5-ADC5-886288E1A6E3}.job

- c:\windows\system32\msfeedssync.exe [2011-06-18 04:18]

.

2010-04-10 c:\windows\Tasks\User_Feed_Synchronization-{494737BE-EC5C-4906-9E85-CF54B61A2600}.job

- c:\windows\system32\msfeedssync.exe [2011-06-18 04:18]

.

.

------- Zusätzlicher Suchlauf -------

.

uStart Page = hxxp://www.aldi.com/

uInternet Settings,ProxyOverride = *.local

IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200

IE: Free YouTube Download - c:\users\Bater\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm

IE: Free YouTube to MP3 Converter - c:\users\Bater\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm

IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~4\Office12\EXCEL.EXE/3000

TCP: DhcpNameServer = 10.0.0.138

FF - ProfilePath - c:\users\Bater\AppData\Roaming\Mozilla\Firefox\Profiles\co4waid2.default\

FF - prefs.js: browser.search.selectedEngine - Google

FF - prefs.js: browser.startup.homepage - hxxp://boardstation.de/

FF - prefs.js: keyword.URL - hxxp://search.icq.com/search/afe_results.php?ch_id=afex&q=

.

- - - - Entfernte verwaiste Registrierungseinträge - - - -

.

HKLM-Run-toolbar_eula_launcher - c:\program files\GoogleEULA\EULALauncher.exe

AddRemove-ANNO 1602 Königs-Edition - c:\windows\IsUn0407.exe

AddRemove-Picasa 3 - c:\users\goas\Desktop\Picasa3\Uninstall.exe

AddRemove-Pixelspeed_LayouterH - c:\windows\iun6002.exe

AddRemove-WatchMyCam_is1 - c:\users\Goas\Desktop\WatchMyCam\unins000.exe

AddRemove-{SbX-136141-9783706830782-stu10}}_is1 - c:\users\Goas\Desktop\Betriebswirtschaft HAK I 08-09 - 9783706830782\unins000.exe

AddRemove-{SbX-140759-9783706833790-stu10}}_is1 - c:\users\Goas\Desktop\HAK\BW\Betriebswirtschaft HAK II 09-10 - 9783706833790\unins000.exe

.

.

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net

Rootkit scan 2012-01-04 20:44

Windows 6.0.6002 Service Pack 2 NTFS

.

Scanne versteckte Prozesse... 

.

Scanne versteckte Autostarteinträge... 

.

Scanne versteckte Dateien... 

.

Scan erfolgreich abgeschlossen

versteckte Dateien: 0

.

**************************************************************************

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Akamai]

"ServiceDll"="c:\program files\common files\akamai/netsession_win_b427739.dll"

.

--------------------- Gesperrte Registrierungsschluessel ---------------------

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\DISPLAY\ACRADA1\5&1bd73e5&0&UID272\Properties\{83da6326-97a6-4088-9453-a1923f573b29}]

@DACL=(02 0000)

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\DISPLAY\ACRADA1\5&1bd73e5&0&UID272\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}]

@DACL=(02 0000)

.

--------------------- Durch laufende Prozesse gestartete DLLs ---------------------

.

- - - - - - - > 'Explorer.exe'(4072)

c:\program files\Portrait Displays\Pivot Software\winphook.dll

.

------------------------ Weitere laufende Prozesse ------------------------

.

c:\program files\Avira\AntiVir Desktop\avguard.exe

c:\program files\Avira\AntiVir Desktop\avshadow.exe

c:\windows\system32\nvvsvc.exe

c:\windows\system32\rundll32.exe

c:\program files\Avira\AntiVir Desktop\sched.exe

c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

c:\program files\Bonjour\mDNSResponder.exe

c:\program files\Common Files\Portrait Displays\Shared\DTSRVC.exe

c:\program files\Intel\Intel Matrix Storage Manager\IAANTMon.exe

c:\program files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe

c:\program files\Nero\Nero8\Nero BackItUp\NBService.exe

c:\program files\Nitro PDF\Reader\NitroPDFReaderDriverService.exe

c:\windows\system32\IoctlSvc.exe

c:\windows\system32\PnkBstrA.exe

c:\program files\Microsoft SQL Server\90\Shared\sqlwriter.exe

c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

c:\windows\system32\WUDFHost.exe

c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe

c:\windows\RtHDVCpl.exe

c:\windows\System32\rundll32.exe

c:\program files\Common Files\Portrait Displays\Shared\HookManager.exe

c:\program files\Common Files\Nero\Lib\NMIndexingService.exe

c:\program files\iPod\bin\iPodService.exe

c:\program files\Windows Media Player\wmplayer.exe

c:\program files\Hewlett-Packard\Digital Imaging\bin\hpqSTE08.exe

c:\program files\Hewlett-Packard\Digital Imaging\bin\hpqbam08.exe

c:\program files\avira\antivir desktop\ipmGui.exe

c:\program files\Hewlett-Packard\Digital Imaging\bin\hpqgpc01.exe

.

**************************************************************************

.

Zeit der Fertigstellung: 2012-01-04  20:49:27 - PC wurde neu gestartet

ComboFix-quarantined-files.txt  2012-01-04 19:49

.

Vor Suchlauf: 14 Verzeichnis(se), 187.191.558.144 Bytes frei

Nach Suchlauf: 21 Verzeichnis(se), 195.882.242.048 Bytes frei

.

- - End Of File - - 37243F015CC597077C30E2D4792DF6A4
--- --- ---