Trojaner-Board - TR/ Agent.Gen

Code:
ComboFix 12-07-16.01 - HOLGER 17.07.2012  15:07:59.4.2 - x86

Microsoft Windows 7 Home Premium   6.1.7601.1.1252.49.1031.18.3327.2337 [GMT 2:00]

ausgeführt von:: c:\users\HOLGER\Desktop\ComboFix.exe

AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}

SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

 * Neuer Wiederherstellungspunkt wurde erstellt

.

.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

c:\windows\system32\pt

c:\windows\system32\pt\Lagoon.resources.dll

.

.

(((((((((((((((((((((((   Dateien erstellt von 2012-06-17 bis 2012-07-17  ))))))))))))))))))))))))))))))

.

.

2012-07-17 13:16 . 2012-07-17 13:16        --------        d-----w-        c:\users\HOLGER\AppData\Local\temp

2012-07-17 13:16 . 2012-07-17 13:16        --------        d-----w-        c:\users\Default\AppData\Local\temp

2012-07-17 10:03 . 2012-06-29 08:44        6891424        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{15780653-6E30-4B62-B30B-E966F203C7B3}\mpengine.dll

2012-07-16 13:38 . 2012-07-16 13:41        --------        d-----w-        C:\_OTL

2012-07-11 20:42 . 2012-07-11 20:42        --------        d-----w-        C:\FRST

2012-07-11 07:03 . 2012-06-02 09:08        140920        ----a-w-        c:\program files\Internet Explorer\sqmapi.dll

2012-07-11 07:03 . 2012-06-02 08:22        194560        ----a-w-        c:\program files\Internet Explorer\ieproxy.dll

2012-07-11 07:03 . 2012-06-02 08:16        2382848        ----a-w-        c:\windows\system32\mshtml.tlb

2012-07-11 07:00 . 2012-06-12 02:40        2345984        ----a-w-        c:\windows\system32\win32k.sys

2012-06-27 17:24 . 2012-06-27 17:24        --------        d-----w-        c:\users\HOLGER\AppData\Roaming\Malwarebytes

2012-06-27 17:24 . 2012-06-27 17:24        --------        d-----w-        c:\programdata\Malwarebytes

2012-06-27 17:24 . 2012-06-27 17:24        --------        d-----w-        c:\program files\Malwarebytes' Anti-Malware

2012-06-27 17:24 . 2012-04-04 13:56        22344        ----a-w-        c:\windows\system32\drivers\mbam.sys

2012-06-27 07:44 . 2012-06-27 07:44        --------        d-----w-        c:\users\HOLGER\AppData\Local\Apps

2012-06-24 08:53 . 2009-06-30 08:37        28552        ----a-w-        c:\windows\system32\drivers\pavboot.sys

2012-06-24 08:53 . 2012-06-24 08:53        --------        d-----w-        c:\program files\Panda Security

2012-06-22 04:09 . 2012-06-02 22:19        53784        ----a-w-        c:\windows\system32\wuauclt.exe

2012-06-22 04:09 . 2012-06-02 22:19        45080        ----a-w-        c:\windows\system32\wups2.dll

2012-06-22 04:09 . 2012-06-02 22:19        1933848        ----a-w-        c:\windows\system32\wuaueng.dll

2012-06-22 04:09 . 2012-06-02 22:12        2422272        ----a-w-        c:\windows\system32\wucltux.dll

2012-06-22 04:09 . 2012-06-02 22:19        35864        ----a-w-        c:\windows\system32\wups.dll

2012-06-22 04:09 . 2012-06-02 22:19        577048        ----a-w-        c:\windows\system32\wuapi.dll

2012-06-22 04:09 . 2012-06-02 22:12        88576        ----a-w-        c:\windows\system32\wudriver.dll

2012-06-22 04:09 . 2012-06-02 13:19        171904        ----a-w-        c:\windows\system32\wuwebv.dll

2012-06-22 04:09 . 2012-06-02 13:12        33792        ----a-w-        c:\windows\system32\wuapp.exe

.

.

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2012-05-31 10:25 . 2010-01-22 13:33        237072        ------w-        c:\windows\system32\MpSigStub.exe

2012-05-09 04:16 . 2012-03-13 06:30        137928        ----a-w-        c:\windows\system32\drivers\avipbb.sys

2012-05-09 04:16 . 2012-03-13 06:30        83392        ----a-w-        c:\windows\system32\drivers\avgntflt.sys

2012-05-01 04:44 . 2012-06-13 15:48        164352        ----a-w-        c:\windows\system32\profsvc.dll

2012-04-28 03:17 . 2012-06-13 15:48        183808        ----a-w-        c:\windows\system32\drivers\rdpwd.sys

2012-04-26 04:45 . 2012-06-13 15:48        58880        ----a-w-        c:\windows\system32\rdpwsx.dll

2012-04-26 04:45 . 2012-06-13 15:48        129536        ----a-w-        c:\windows\system32\rdpcorekmts.dll

2012-04-26 04:41 . 2012-06-13 15:48        8192        ----a-w-        c:\windows\system32\rdrmemptylst.exe

2012-04-24 04:36 . 2012-06-13 15:47        1158656        ----a-w-        c:\windows\system32\crypt32.dll

2012-04-24 04:36 . 2012-06-13 15:47        140288        ----a-w-        c:\windows\system32\cryptsvc.dll

2012-04-24 04:36 . 2012-06-13 15:47        103936        ----a-w-        c:\windows\system32\cryptnet.dll

2012-04-19 18:05 . 2010-12-21 18:40        1236816        ----a-w-        c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll

2012-06-14 22:19 . 2012-06-18 18:09        85472        ----a-w-        c:\program files\mozilla firefox\components\browsercomps.dll

.

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4

.

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]

"{872b5b88-9db5-4310-bdd0-ac189557e5f5}"= "c:\program files\DVDVideoSoftTB\prxtbDVD0.dll" [2011-05-09 176936]

.

[HKEY_CLASSES_ROOT\clsid\{872b5b88-9db5-4310-bdd0-ac189557e5f5}]

.

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{872b5b88-9db5-4310-bdd0-ac189557e5f5}]

2011-05-09 08:49        176936        ----a-w-        c:\program files\DVDVideoSoftTB\prxtbDVD0.dll

.

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{EEE6C35C-6118-11DC-9C72-001320C79847}]

2012-04-24 12:24        1310000        ----a-w-        c:\program files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]

"{872b5b88-9db5-4310-bdd0-ac189557e5f5}"= "c:\program files\DVDVideoSoftTB\prxtbDVD0.dll" [2011-05-09 176936]

"{EEE6C35B-6118-11DC-9C72-001320C79847}"= "c:\program files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll" [2012-04-24 1310000]

.

[HKEY_CLASSES_ROOT\clsid\{872b5b88-9db5-4310-bdd0-ac189557e5f5}]

.

[HKEY_CLASSES_ROOT\clsid\{eee6c35b-6118-11dc-9c72-001320c79847}]

[HKEY_CLASSES_ROOT\SWEETIE.IEToolbar.1]

[HKEY_CLASSES_ROOT\TypeLib\{EEE6C35E-6118-11DC-9C72-001320C79847}]

[HKEY_CLASSES_ROOT\SWEETIE.IEToolbar]

.

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]

"{872B5B88-9DB5-4310-BDD0-AC189557E5F5}"= "c:\program files\DVDVideoSoftTB\prxtbDVD0.dll" [2011-05-09 176936]

.

[HKEY_CLASSES_ROOT\clsid\{872b5b88-9db5-4310-bdd0-ac189557e5f5}]

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1174016]

"Facebook Update"="c:\users\HOLGER\AppData\Local\Facebook\Update\FacebookUpdate.exe" [2012-07-17 138096]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"CLMLServer"="c:\program files\CyberLink\Power2Go\CLMLSvc.exe" [2009-06-03 103720]

"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2009-11-10 7866912]

"lxeemon.exe"="c:\program files\Lexmark Pro700 Series\lxeemon.exe" [2010-05-17 770728]

"EzPrint"="c:\program files\Lexmark Pro700 Series\ezprint.exe" [2009-10-01 139944]

"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2012-05-09 348624]

"SweetIM"="c:\program files\SweetIM\Messenger\SweetIM.exe" [2012-02-16 114992]

"Sweetpacks Communicator"="c:\program files\SweetIM\Communicator\SweetPacksUpdateManager.exe" [2012-02-26 295728]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2012-03-27 37296]

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-02 843712]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 5 (0x5)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]

Security Packages        REG_MULTI_SZ           kerberos msv1_0 schannel wdigest tspkg pku2u livessp

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe"

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe"

.

R2 lxeeCATSCustConnectService;lxeeCATSCustConnectService;c:\windows\system32\spool\DRIVERS\W32X86\3\\lxeeserv.exe [x]

R3 BBSvc;Bing Bar Update Service;c:\program files\Microsoft\BingBar\BBSvc.EXE [x]

R3 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance;c:\program files\Common Files\MAGIX Services\Database\bin\fbserver.exe [x]

R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files\Mozilla Maintenance Service\maintenanceservice.exe [x]

R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [x]

R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]

S0 nvamacpi;NVIDIA Away Mode System;c:\windows\system32\DRIVERS\NVAMACPI.sys [x]

S0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [x]

S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys [x]

S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]

S2 AntiVirSchedulerService;Avira Planer;c:\program files\Avira\AntiVir Desktop\sched.exe [x]

S2 BBUpdate;BBUpdate;c:\program files\Microsoft\BingBar\SeaPort.EXE [x]

S2 Fabs;FABS - Helping agent for MAGIX media database;c:\program files\Common Files\MAGIX Services\Database\bin\FABS.exe [x]

S2 lxee_device;lxee_device;c:\windows\system32\lxeecoms.exe [x]

S2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [x]

S2 WMI_Hook_Service;WMI_Hook_Service;c:\program files\msi\OSD hot keys\WMI_Hook_Service.exe [x]

S3 hidkmdf;Microsoft HID Class Shim for KMDF;c:\windows\system32\DRIVERS\hidkmdf.sys [x]

S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [x]

S3 NW1950;NextWindow 1950 Touch Screen;c:\windows\system32\DRIVERS\NW1950.sys [x]

S3 NxpCap;CTX capture service;c:\windows\system32\DRIVERS\NxpCap.sys [x]

S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt86win7.sys [x]

S3 rtl8192se;Realtek Wireless LAN 802.11n PCI-E NIC NT Driver;c:\windows\system32\DRIVERS\rtl8192se.sys [x]

S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [x]

S3 WSDPrintDevice;WSD-Druckunterstützung durch UMB;c:\windows\system32\DRIVERS\WSDPrint.sys [x]

.

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

BullGuard_Backup        REG_MULTI_SZ           BsBackup

.

Inhalt des "geplante Tasks" Ordners

.

2012-07-17 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3655861120-308642264-2925887876-1000Core.job

- c:\users\HOLGER\AppData\Local\Facebook\Update\FacebookUpdate.exe [2011-10-23 11:45]

.

2012-07-17 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3655861120-308642264-2925887876-1000UA.job

- c:\users\HOLGER\AppData\Local\Facebook\Update\FacebookUpdate.exe [2011-10-23 11:45]

.

.

------- Zusätzlicher Suchlauf -------

.

uInternet Settings,ProxyOverride = <local>

IE: An OneNote s&enden - c:\progra~1\MIF5BA~1\Office14\ONBttnIE.dll/105

IE: Nach Microsoft E&xcel exportieren - c:\progra~1\MIF5BA~1\Office14\EXCEL.EXE/3000

IE: Nach Microsoft E&xel exportieren - c:\progra~1\MIF5BA~1\Office12\EXCEL.EXE/3000

IE: {{0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - hxxp://rover.ebay.com/rover/1/707-37276-17534-31/4

TCP: DhcpNameServer = 192.168.2.1

FF - ProfilePath - c:\users\HOLGER\AppData\Roaming\Mozilla\Firefox\Profiles\3u9oss91.default\

FF - prefs.js: network.proxy.type - 0

.

.

--------------------- Gesperrte Registrierungsschluessel ---------------------

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

Zeit der Fertigstellung: 2012-07-17  15:34:19

ComboFix-quarantined-files.txt  2012-07-17 13:34

ComboFix2.txt  2012-07-09 13:25

ComboFix3.txt  2012-07-04 19:43

ComboFix4.txt  2012-07-04 08:09

.

Vor Suchlauf: 15 Verzeichnis(se), 879.974.621.184 Bytes frei

Nach Suchlauf: 17 Verzeichnis(se), 881.982.246.912 Bytes frei

.

- - End Of File - - 14851A766931A6C6D67B9804F3147FA3
jetzt sind wieder ein paar icons auf dem desktop verschwunden und wieder nur weisse blätter da die exe scheinen aber noch zu funktionieren