Trojaner-Board - Meldung: Achtung: Windowssystem wird Blockiert wegen Virus!

So hoffe das ist das was erwünsscht ist.

Combofix Logfile:
Code:
ComboFix 12-02-13.01 - Markus 13.02.2012  17:04:52.1.4 - x86

Microsoft® Windows Vista™ Home Premium   6.0.6002.2.1252.49.1031.18.3326.1641 [GMT 1:00]

ausgeführt von:: c:\users\Markus\Downloads\ComboFix.exe

AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}

SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

c:\program files\AutocompletePro

c:\program files\AutocompletePro\AutocompletePro.dll

c:\program files\AutocompletePro\chrome\autocompleteprochrome.crx

c:\program files\AutocompletePro\FireFoxExtension.exe

c:\program files\AutocompletePro\InstTracker.exe

c:\program files\AutocompletePro\support@predictad.com\chrome.manifest

c:\program files\AutocompletePro\support@predictad.com\chrome\content\browserOverlay.xul

c:\program files\AutocompletePro\support@predictad.com\chrome\content\options.js

c:\program files\AutocompletePro\support@predictad.com\chrome\content\options.xul

c:\program files\AutocompletePro\support@predictad.com\chrome\content\utils.js

c:\program files\AutocompletePro\support@predictad.com\defaults\preferences\predictad.js

c:\program files\AutocompletePro\support@predictad.com\install.rdf

c:\program files\AutocompletePro\unins000.dat

c:\program files\AutocompletePro\unins000.exe

c:\programdata\Tarma Installer

c:\programdata\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\_Setup.dll

c:\programdata\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\_Setupx.dll

c:\programdata\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\Setup.dat

c:\programdata\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\Setup.exe

c:\programdata\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\Setup.ico

c:\users\Markus\AppData\Local\._Revolution_

c:\users\Markus\AppData\Roaming\app

c:\users\Markus\AppData\Roaming\app\Jerakine_lang.dat

c:\users\Markus\AppData\Roaming\app\Jerakine_lang_vesrion.dat

c:\users\Markus\Desktop\Setup.exe

c:\windows\IsUn0407.exe

.

.

(((((((((((((((((((((((   Dateien erstellt von 2012-01-13 bis 2012-02-13  ))))))))))))))))))))))))))))))

.

.

2012-02-13 16:12 . 2012-02-13 16:12        --------        d-----w-        c:\users\Default\AppData\Local\temp

2012-02-13 14:45 . 2012-01-06 04:19        6557240        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{3B9E8679-A50F-418A-A906-D99953AB377B}\mpengine.dll

2012-02-13 14:26 . 2012-02-13 14:44        --------        d-----w-        C:\_OTL

2012-02-08 13:45 . 2012-02-08 13:46        --------        d-----w-        c:\users\Markus\AppData\Local\SWTOR

2012-02-08 10:49 . 2012-02-08 10:49        --------        d-----w-        c:\program files\Common Files\BioWare

2012-01-27 00:57 . 2011-11-17 06:48        440192        ----a-w-        c:\windows\system32\drivers\ksecdd.sys

2012-01-27 00:57 . 2011-11-16 16:23        278528        ----a-w-        c:\windows\system32\schannel.dll

2012-01-27 00:57 . 2011-11-16 16:21        1259008        ----a-w-        c:\windows\system32\lsasrv.dll

2012-01-27 00:57 . 2011-11-16 16:23        377344        ----a-w-        c:\windows\system32\winhttp.dll

2012-01-27 00:57 . 2011-11-16 16:23        72704        ----a-w-        c:\windows\system32\secur32.dll

2012-01-27 00:57 . 2011-11-16 14:12        9728        ----a-w-        c:\windows\system32\lsass.exe

.

.

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2012-01-29 04:10 . 2009-10-03 00:03        237072        ------w-        c:\windows\system32\MpSigStub.exe

2012-01-01 23:14 . 2011-11-11 15:55        414368        ----a-w-        c:\windows\system32\FlashPlayerCPLApp.cpl

2011-11-28 18:01 . 2011-01-07 08:09        41184        ----a-w-        c:\windows\avastSS.scr

2011-11-28 18:01 . 2009-10-03 11:20        199816        ----a-w-        c:\windows\system32\aswBoot.exe

2011-11-28 17:53 . 2011-04-08 15:43        435032        ----a-w-        c:\windows\system32\drivers\aswSnx.sys

2011-11-28 17:53 . 2009-10-03 11:20        314456        ----a-w-        c:\windows\system32\drivers\aswSP.sys

2011-11-28 17:52 . 2009-10-03 11:20        34392        ----a-w-        c:\windows\system32\drivers\aswRdr.sys

2011-11-28 17:52 . 2009-10-03 11:20        52952        ----a-w-        c:\windows\system32\drivers\aswTdi.sys

2011-11-28 17:52 . 2009-10-03 11:20        55128        ----a-w-        c:\windows\system32\drivers\aswMonFlt.sys

2011-11-28 17:51 . 2009-10-03 11:20        20568        ----a-w-        c:\windows\system32\drivers\aswFsBlk.sys

2011-11-25 15:59 . 2012-01-13 17:26        376320        ----a-w-        c:\windows\system32\winsrv.dll

2011-11-23 13:37 . 2011-12-16 18:49        2043904        ----a-w-        c:\windows\system32\win32k.sys

2011-11-18 20:23 . 2012-01-13 17:26        1205064        ----a-w-        c:\windows\system32\ntdll.dll

2011-11-18 17:47 . 2012-01-13 17:25        66560        ----a-w-        c:\windows\system32\packager.dll

2012-01-07 09:14 . 2011-10-02 03:23        121816        ----a-w-        c:\program files\mozilla firefox\components\browsercomps.dll

.

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4

.

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]

"{EEE6C35D-6118-11DC-9C72-001320C79847}"= "c:\program files\SweetIM\Toolbars\Internet Explorer\mgHelper.dll" [2009-05-20 177464]

.

[HKEY_CLASSES_ROOT\clsid\{eee6c35d-6118-11dc-9c72-001320c79847}]

[HKEY_CLASSES_ROOT\SweetIM_URLSearchHook.ToolbarURLSearchHook.1]

[HKEY_CLASSES_ROOT\TypeLib\{EEE6C35F-6118-11DC-9C72-001320C79847}]

[HKEY_CLASSES_ROOT\SweetIM_URLSearchHook.ToolbarURLSearchHook]

.

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{EEE6C35C-6118-11DC-9C72-001320C79847}]

2009-05-20 12:36        1258808        ----a-w-        c:\program files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll

.

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}]

2011-02-28 22:11        191488        ------w-        c:\program files\Yontoo Layers\YontooIEClient.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]

"{EEE6C35B-6118-11DC-9C72-001320C79847}"= "c:\program files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll" [2009-05-20 1258808]

.

[HKEY_CLASSES_ROOT\clsid\{eee6c35b-6118-11dc-9c72-001320c79847}]

[HKEY_CLASSES_ROOT\SWEETIE.IEToolbar.1]

[HKEY_CLASSES_ROOT\TypeLib\{EEE6C35E-6118-11DC-9C72-001320C79847}]

[HKEY_CLASSES_ROOT\SWEETIE.IEToolbar]

.

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]

"{EEE6C35B-6118-11DC-9C72-001320C79847}"= "c:\program files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll" [2009-05-20 1258808]

.

[HKEY_CLASSES_ROOT\clsid\{eee6c35b-6118-11dc-9c72-001320c79847}]

[HKEY_CLASSES_ROOT\SWEETIE.IEToolbar.1]

[HKEY_CLASSES_ROOT\TypeLib\{EEE6C35E-6118-11DC-9C72-001320C79847}]

[HKEY_CLASSES_ROOT\SWEETIE.IEToolbar]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]

@="{472083B0-C522-11CF-8763-00608CC02F24}"

[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]

2011-11-28 18:01        122512        ----a-w-        c:\program files\Alwil Software\Avast5\ashShell.dll

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"WindowsWelcomeCenter"="oobefldr.dll" [2009-04-11 2153472]

"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]

"Steam"="c:\steam\steam.exe" [2011-08-04 1242448]

"BitTorrent DNA"="c:\users\Markus\Program Files\DNA\btdna.exe" [2010-03-25 323392]

"RocketDock"="c:\rocketdock\RocketDock.exe" [2007-09-02 495616]

"Akamai NetSession Interface"="c:\users\Markus\AppData\Local\Akamai\netsession_win.exe" [2012-02-02 3329824]

"Personal ID"="c:\progra~1\COOLSP~1\PERSON~1\PID.EXE" [2011-11-11 1132984]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"RtHDVCpl"="RtHDVCpl.exe" [2007-01-09 4186112]

"DMXLauncher"="c:\program files\Roxio\Media Experience\DMXLauncher.exe" [2007-02-12 109304]

"toolbar_eula_launcher"="c:\program files\Packard Bell\GOOGLE_EULA\EULALauncher.exe" [2007-02-20 28672]

"ACTIVBOARD"="c:\program files\Packard Bell\FIJI\aboard.exe" [2007-01-18 79416]

"QuickFinder Scheduler"="c:\program files\WordPerfect Office X3\Programs\QFSCHD130.EXE" [2007-01-02 83568]

"SweetIM"="c:\program files\SweetIM\Messenger\SweetIM.exe" [2009-08-26 111928]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-12-21 35760]

"avast"="c:\program files\Alwil Software\Avast5\avastUI.exe" [2011-11-28 3744552]

"Babylon Client"="c:\program files\Babylon\Babylon-Pro\Babylon.exe" [2012-01-24 3189360]

.

c:\users\Markus\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

CurseClientStartup.ccip [2011-7-2 0]

Xfire.lnk - c:\xfire\Xfire.exe [2011-4-16 3510160]

.

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

Rainmeter.lnk - c:\rainmeter\Rainmeter.exe [2011-2-6 99840]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

LocalServiceAndNoImpersonation        REG_MULTI_SZ           FontCache

Akamai        REG_MULTI_SZ           Akamai

.

Inhalt des "geplante Tasks" Ordners

.

.

------- Zusätzlicher Suchlauf -------

.

uStart Page = hxxp://search.babylon.com/home

uInternet Settings,ProxyOverride = 127.0.0.1:9421

IE: Translate this web page with Babylon - c:\program files\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll/ActionTU.htm

IE: Translate with Babylon - c:\program files\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll/Action.htm

IE: Öffnen mit WordPerfect - c:\program files\WordPerfect Office X3\Programs\WPLauncher.hta

Trusted Zone: clonewarsadventures.com

Trusted Zone: freerealms.com

Trusted Zone: soe.com

Trusted Zone: sony.com

TCP: DhcpNameServer = 192.168.178.1

FF - ProfilePath - c:\users\Markus\AppData\Roaming\Mozilla\Firefox\Profiles\r20r9pz9.default\

FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=

FF - prefs.js: browser.search.selectedEngine - ICQ Search

FF - prefs.js: browser.startup.homepage - hxxp://start.icq.com/

FF - prefs.js: keyword.URL - hxxp://search.sweetim.com/search.asp?src=2&q=

FF - user.js: extensions.BabylonToolbar_i.babTrack - 

FF - user.js: extensions.BabylonToolbar_i.babExt - 

FF - user.js: extensions.BabylonToolbar_i.srcExt - def

FF - user.js: extensions.BabylonToolbar_i.id - 1470878e000000000000001d6018cbb3

FF - user.js: extensions.BabylonToolbar_i.hardId - 1470878e000000000000001d6018cbb3

FF - user.js: extensions.BabylonToolbar_i.instlDay - 15383

FF - user.js: extensions.BabylonToolbar_i.vrsn - 1.5.3.17

FF - user.js: extensions.BabylonToolbar_i.vrsni - 1.5.3.17

FF - user.js: extensions.BabylonToolbar_i.vrsnTs - 1.5.3.1716:56

FF - user.js: extensions.BabylonToolbar_i.prtnrId - babylon

FF - user.js: extensions.BabylonToolbar_i.prdct - BabylonToolbar

FF - user.js: extensions.BabylonToolbar_i.aflt - babclient

FF - user.js: extensions.BabylonToolbar_i.smplGrp - none

FF - user.js: extensions.BabylonToolbar_i.tlbrId - base

FF - user.js: extensions.BabylonToolbar_i.instlRef - std

.

- - - - Entfernte verwaiste Registrierungseinträge - - - -

.

HKCU-Run-BLASC - c:\program files\buffed\BLASC.exe

HKCU-Run-EA Core - c:\electronic arts\EADM\Core.exe

HKCU-Run-ICQ - ~c:\icq6.5\ICQ.exe

HKLM-Run-CmPCIaudio - CMICNFG3.cpl

AddRemove-AutocompletePro3_is1 - c:\program files\AutocompletePro\unins000.exe

AddRemove-{889DF117-14D1-44EE-9F31-C5FB5D47F68B} - c:\progra~2\TARMAI~1\{889DF~1\Setup.exe

.

.

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net

Rootkit scan 2012-02-13 17:12

Windows 6.0.6002 Service Pack 2 NTFS

.

Scanne versteckte Prozesse... 

.

Scanne versteckte Autostarteinträge... 

.

HKCU\Software\Microsoft\Windows\CurrentVersion\Run

  Personal ID = c:\progra~1\COOLSP~1\PERSON~1\PID.EXE?i 

.

Scanne versteckte Dateien... 

.

.

C:\## aswSnx private storage

.

Scan erfolgreich abgeschlossen

versteckte Dateien: 1

.

**************************************************************************

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\Akamai]

"ServiceDll"="c:\program files\common files\akamai/netsession_win_7de0ed9.dll"

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\npggsvc]

"ImagePath"="c:\windows\system32\GameMon.des -service"

.

--------------------- Gesperrte Registrierungsschluessel ---------------------

.

[HKEY_USERS\S-1-5-21-768403612-3869789265-1316577870-1002\Software\SecuROM\License information*]

"datasecu"=hex:6b,2c,9c,8c,88,55,11,92,b9,e4,02,b7,61,ae,87,ea,2f,fb,15,da,d7,

   d3,a0,03,30,c8,2d,ae,81,0e,5d,17,0c,3b,28,0e,6b,36,f0,0c,91,4e,94,8d,10,34,\

"rkeysecu"=hex:23,f5,a3,19,65,e5,ed,2e,91,60,ba,48,fb,3c,1b,8a

.

Zeit der Fertigstellung: 2012-02-13  17:14:50

ComboFix-quarantined-files.txt  2012-02-13 16:14

.

Vor Suchlauf: 52 Verzeichnis(se), 148.145.348.608 Bytes frei

Nach Suchlauf: 58 Verzeichnis(se), 148.114.194.432 Bytes frei

.

- - End Of File - - 831309BA22E1A9BE0C83D2E1B47C68EA
--- --- ---