Trojaner-Board - my srart by incredibar ..... mich hat´s auch erwischt!

[CODE]
Combofix Logfile:
Code:
ComboFix 12-08-14.05 - Roland 15.08.2012   9:00.1.2 - x86

Microsoft Windows 7 Professional   6.1.7601.1.1252.49.1031.18.3582.2454 [GMT 2:00]

ausgeführt von:: c:\users\Roland \Downloads\ComboFix.exe

AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}

SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

c:\users\Roland \AppData\Local\Temp\_MEI30802\_ctypes.pyd

c:\users\Roland \AppData\Local\Temp\_MEI30802\_elementtree.pyd

c:\users\Roland \AppData\Local\Temp\_MEI30802\_hashlib.pyd

c:\users\Roland \AppData\Local\Temp\_MEI30802\_socket.pyd

c:\users\Roland \AppData\Local\Temp\_MEI30802\_ssl.pyd

c:\users\Roland \AppData\Local\Temp\_MEI30802\pyexpat.pyd

c:\users\Roland \AppData\Local\Temp\_MEI30802\pysqlite2._sqlite.pyd

c:\users\Roland \AppData\Local\Temp\_MEI30802\python26.dll

c:\users\Roland \AppData\Local\Temp\_MEI30802\pythoncom26.dll

c:\users\Roland \AppData\Local\Temp\_MEI30802\PyWinTypes26.dll

c:\users\Roland \AppData\Local\Temp\_MEI30802\select.pyd

c:\users\Roland \AppData\Local\Temp\_MEI30802\unicodedata.pyd

c:\users\Roland \AppData\Local\Temp\_MEI30802\win32api.pyd

c:\users\Roland \AppData\Local\Temp\_MEI30802\win32com.shell.shell.pyd

c:\users\Roland \AppData\Local\Temp\_MEI30802\win32crypt.pyd

c:\users\Roland \AppData\Local\Temp\_MEI30802\win32event.pyd

c:\users\Roland \AppData\Local\Temp\_MEI30802\win32file.pyd

c:\users\Roland \AppData\Local\Temp\_MEI30802\win32inet.pyd

c:\users\Roland \AppData\Local\Temp\_MEI30802\win32pdh.pyd

c:\users\Roland \AppData\Local\Temp\_MEI30802\win32process.pyd

c:\users\Roland \AppData\Local\Temp\_MEI30802\windows._cacheinvalidation.pyd

c:\users\Roland \AppData\Local\Temp\_MEI30802\wx._controls_.pyd

c:\users\Roland \AppData\Local\Temp\_MEI30802\wx._core_.pyd

c:\users\Roland \AppData\Local\Temp\_MEI30802\wx._gdi_.pyd

c:\users\Roland \AppData\Local\Temp\_MEI30802\wx._html2.pyd

c:\users\Roland \AppData\Local\Temp\_MEI30802\wx._misc_.pyd

c:\users\Roland \AppData\Local\Temp\_MEI30802\wx._windows_.pyd

c:\users\Roland \AppData\Local\Temp\_MEI30802\wx._wizard.pyd

c:\users\Roland \AppData\Local\Temp\_MEI30802\wxbase293u_net_vc.dll

c:\users\Roland \AppData\Local\Temp\_MEI30802\wxbase293u_vc.dll

c:\users\Roland \AppData\Local\Temp\_MEI30802\wxmsw293u_adv_vc.dll

c:\users\Roland \AppData\Local\Temp\_MEI30802\wxmsw293u_core_vc.dll

c:\users\Roland \AppData\Local\Temp\_MEI30802\wxmsw293u_html_vc.dll

c:\users\Roland \AppData\Local\Temp\_MEI30802\wxmsw293u_webview_vc.dll

c:\users\ROLAND~1\AppData\Local\Temp\_MEI30802\_ctypes.pyd

c:\users\ROLAND~1\AppData\Local\Temp\_MEI30802\_elementtree.pyd

c:\users\ROLAND~1\AppData\Local\Temp\_MEI30802\_hashlib.pyd

c:\users\ROLAND~1\AppData\Local\Temp\_MEI30802\_socket.pyd

c:\users\ROLAND~1\AppData\Local\Temp\_MEI30802\_ssl.pyd

c:\users\ROLAND~1\AppData\Local\Temp\_MEI30802\pyexpat.pyd

c:\users\ROLAND~1\AppData\Local\Temp\_MEI30802\pysqlite2._sqlite.pyd

c:\users\ROLAND~1\AppData\Local\Temp\_MEI30802\python26.dll

c:\users\ROLAND~1\AppData\Local\Temp\_MEI30802\pythoncom26.dll

c:\users\ROLAND~1\AppData\Local\Temp\_MEI30802\PyWinTypes26.dll

c:\users\ROLAND~1\AppData\Local\Temp\_MEI30802\select.pyd

c:\users\ROLAND~1\AppData\Local\Temp\_MEI30802\unicodedata.pyd

c:\users\ROLAND~1\AppData\Local\Temp\_MEI30802\win32api.pyd

c:\users\ROLAND~1\AppData\Local\Temp\_MEI30802\win32com.shell.shell.pyd

c:\users\ROLAND~1\AppData\Local\Temp\_MEI30802\win32crypt.pyd

c:\users\ROLAND~1\AppData\Local\Temp\_MEI30802\win32event.pyd

c:\users\ROLAND~1\AppData\Local\Temp\_MEI30802\win32file.pyd

c:\users\ROLAND~1\AppData\Local\Temp\_MEI30802\win32inet.pyd

c:\users\ROLAND~1\AppData\Local\Temp\_MEI30802\win32pdh.pyd

c:\users\ROLAND~1\AppData\Local\Temp\_MEI30802\win32process.pyd

c:\users\ROLAND~1\AppData\Local\Temp\_MEI30802\windows._cacheinvalidation.pyd

c:\users\ROLAND~1\AppData\Local\Temp\_MEI30802\wx._controls_.pyd

c:\users\ROLAND~1\AppData\Local\Temp\_MEI30802\wx._core_.pyd

c:\users\ROLAND~1\AppData\Local\Temp\_MEI30802\wx._gdi_.pyd

c:\users\ROLAND~1\AppData\Local\Temp\_MEI30802\wx._html2.pyd

c:\users\ROLAND~1\AppData\Local\Temp\_MEI30802\wx._misc_.pyd

c:\users\ROLAND~1\AppData\Local\Temp\_MEI30802\wx._windows_.pyd

c:\users\ROLAND~1\AppData\Local\Temp\_MEI30802\wx._wizard.pyd

c:\users\ROLAND~1\AppData\Local\Temp\_MEI30802\wxbase293u_net_vc.dll

c:\users\ROLAND~1\AppData\Local\Temp\_MEI30802\wxbase293u_vc.dll

c:\users\ROLAND~1\AppData\Local\Temp\_MEI30802\wxmsw293u_adv_vc.dll

c:\users\ROLAND~1\AppData\Local\Temp\_MEI30802\wxmsw293u_core_vc.dll

c:\users\ROLAND~1\AppData\Local\Temp\_MEI30802\wxmsw293u_html_vc.dll

c:\users\ROLAND~1\AppData\Local\Temp\_MEI30802\wxmsw293u_webview_vc.dll

c:\windows\IsUn0407.exe

.

.

(((((((((((((((((((((((   Dateien erstellt von 2012-07-15 bis 2012-08-15  ))))))))))))))))))))))))))))))

.

.

2012-08-15 07:11 . 2012-08-15 07:14        --------        d-----w-        c:\users\Roland\AppData\Local\temp

2012-08-15 06:47 . 2012-07-06 19:23        393728        ----a-w-        c:\windows\system32\drivers\bthport.sys

2012-08-15 06:44 . 2012-05-05 07:46        400896        ----a-w-        c:\windows\system32\srcore.dll

2012-08-15 06:44 . 2012-07-18 17:47        2345984        ----a-w-        c:\windows\system32\win32k.sys

2012-08-15 06:44 . 2012-02-11 05:43        492032        ----a-w-        c:\windows\system32\win32spl.dll

2012-08-15 06:44 . 2012-02-11 05:37        317440        ----a-w-        c:\windows\system32\spoolsv.exe

2012-08-15 06:43 . 2012-07-04 21:14        41984        ----a-w-        c:\windows\system32\browcli.dll

2012-08-15 06:43 . 2012-07-04 21:14        102912        ----a-w-        c:\windows\system32\browser.dll

2012-08-15 06:43 . 2012-05-14 04:33        769024        ----a-w-        c:\windows\system32\localspl.dll

2012-08-14 06:46 . 2012-07-16 00:41        6891424        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{AA64F1B9-294C-40B5-AA65-C0EE9FE4683B}\mpengine.dll

2012-08-11 14:01 . 2012-03-09 12:06        24576        ----a-w-        c:\windows\system32\kdbsdk32.dll

2012-08-09 14:52 . 2012-08-09 14:52        --------        d-----w-        C:\_OTL

.

.

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2012-08-03 07:32 . 2012-03-31 16:40        426184        ----a-w-        c:\windows\system32\FlashPlayerApp.exe

2012-08-03 07:32 . 2011-07-22 14:41        70344        ----a-w-        c:\windows\system32\FlashPlayerCPLApp.cpl

2012-07-03 11:46 . 2012-07-02 10:46        22344        ----a-w-        c:\windows\system32\drivers\mbam.sys

2012-06-11 11:50 . 2012-06-11 11:50        159232        ----a-w-        c:\windows\system32\clinfo.exe

2012-06-11 11:50 . 2012-06-11 11:50        65024        ----a-w-        c:\windows\system32\OpenVideo.dll

2012-06-11 11:50 . 2012-06-11 11:50        56320        ----a-w-        c:\windows\system32\OVDecode.dll

2012-06-11 11:49 . 2012-06-11 11:49        13008896        ----a-w-        c:\windows\system32\amdocl.dll

2012-06-06 05:05 . 2012-07-11 06:54        1390080        ----a-w-        c:\windows\system32\msxml6.dll

2012-06-06 05:05 . 2012-07-11 06:54        1236992        ----a-w-        c:\windows\system32\msxml3.dll

2012-06-06 05:03 . 2012-07-11 06:54        805376        ----a-w-        c:\windows\system32\cdosys.dll

2012-06-04 09:54 . 2012-06-04 09:54        74752        ----a-w-        c:\windows\system32\RegisterIEPKEYs.exe

2012-06-04 09:54 . 2012-06-04 09:54        161792        ----a-w-        c:\windows\system32\msls31.dll

2012-06-04 09:54 . 2012-06-04 09:54        86528        ----a-w-        c:\windows\system32\iesysprep.dll

2012-06-04 09:54 . 2012-06-04 09:54        76800        ----a-w-        c:\windows\system32\SetIEInstalledDate.exe

2012-06-04 09:54 . 2012-06-04 09:54        74752        ----a-w-        c:\windows\system32\iesetup.dll

2012-06-04 09:54 . 2012-06-04 09:54        63488        ----a-w-        c:\windows\system32\tdc.ocx

2012-06-04 09:54 . 2012-06-04 09:54        48640        ----a-w-        c:\windows\system32\mshtmler.dll

2012-06-04 09:54 . 2012-06-04 09:54        420864        ----a-w-        c:\windows\system32\vbscript.dll

2012-06-04 09:54 . 2012-06-04 09:54        367104        ----a-w-        c:\windows\system32\html.iec

2012-06-04 09:54 . 2012-06-04 09:54        35840        ----a-w-        c:\windows\system32\imgutil.dll

2012-06-04 09:54 . 2012-06-04 09:54        23552        ----a-w-        c:\windows\system32\licmgr10.dll

2012-06-04 09:54 . 2012-06-04 09:54        152064        ----a-w-        c:\windows\system32\wextract.exe

2012-06-04 09:54 . 2012-06-04 09:54        150528        ----a-w-        c:\windows\system32\iexpress.exe

2012-06-04 09:54 . 2012-06-04 09:54        11776        ----a-w-        c:\windows\system32\mshta.exe

2012-06-04 09:54 . 2012-06-04 09:54        110592        ----a-w-        c:\windows\system32\IEAdvpack.dll

2012-06-04 09:54 . 2012-06-04 09:54        101888        ----a-w-        c:\windows\system32\admparse.dll

2012-06-02 22:19 . 2012-06-22 06:00        53784        ----a-w-        c:\windows\system32\wuauclt.exe

2012-06-02 22:19 . 2012-06-22 06:00        45080        ----a-w-        c:\windows\system32\wups2.dll

2012-06-02 22:19 . 2012-06-22 05:59        35864        ----a-w-        c:\windows\system32\wups.dll

2012-06-02 22:19 . 2012-06-22 05:59        577048        ----a-w-        c:\windows\system32\wuapi.dll

2012-06-02 22:19 . 2012-06-22 06:00        1933848        ----a-w-        c:\windows\system32\wuaueng.dll

2012-06-02 22:12 . 2012-06-22 06:00        2422272        ----a-w-        c:\windows\system32\wucltux.dll

2012-06-02 22:12 . 2012-06-22 05:59        88576        ----a-w-        c:\windows\system32\wudriver.dll

2012-06-02 13:19 . 2012-06-22 05:59        171904        ----a-w-        c:\windows\system32\wuwebv.dll

2012-06-02 13:12 . 2012-06-22 05:59        33792        ----a-w-        c:\windows\system32\wuapp.exe

2012-06-02 04:45 . 2012-07-11 06:55        67440        ----a-w-        c:\windows\system32\drivers\ksecdd.sys

2012-06-02 04:45 . 2012-07-11 06:55        134000        ----a-w-        c:\windows\system32\drivers\ksecpkg.sys

2012-06-02 04:40 . 2012-07-11 06:55        369336        ----a-w-        c:\windows\system32\drivers\cng.sys

2012-06-02 04:40 . 2012-07-11 06:55        225280        ----a-w-        c:\windows\system32\schannel.dll

2012-06-02 04:39 . 2012-07-11 06:55        219136        ----a-w-        c:\windows\system32\ncrypt.dll

2012-05-31 10:25 . 2011-07-22 13:59        237072        ------w-        c:\windows\system32\MpSigStub.exe

2012-08-12 09:32 . 2012-08-12 09:32        266720        ----a-w-        c:\program files\mozilla firefox\components\browsercomps.dll

.

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveBlacklistedOverlay]

@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42}"

[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42}]

2012-07-20 13:17        556376        ----a-w-        c:\program files\Google\Drive\googledrivesync32.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedOverlay]

@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43}"

[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43}]

2012-07-20 13:17        556376        ----a-w-        c:\program files\Google\Drive\googledrivesync32.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSyncedOverlay]

@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}"

[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}]

2012-07-20 13:17        556376        ----a-w-        c:\program files\Google\Drive\googledrivesync32.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSyncingOverlay]

@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41}"

[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41}]

2012-07-20 13:17        556376        ----a-w-        c:\program files\Google\Drive\googledrivesync32.dll

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"GoogleDriveSync"="c:\program files\Google\Drive\googledrivesync.exe" [2012-07-20 12218904]

"Spotify Web Helper"="c:\users\Roland\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe" [2012-07-21 1192664]

"dradio-RecorderTimer"="c:\program files\dradio-Recorder\phonostarTimer.exe" [2012-04-03 41472]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"AMD AVT"="start AMD Accelerated Video Transcoding device initialization" [X]

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712]

"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2012-08-09 348664]

"Windows Mobile Device Center"="c:\windows\WindowsMobile\wmdc.exe" [2007-05-31 648072]

"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-01-17 252296]

"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2012-06-11 641704]

.

c:\users\Roland\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

OpenOffice.org 3.3.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2010-12-13 1198592]

Yahoo! Widgets.lnk - c:\program files\Yahoo!\Widgets\YahooWidgets.exe [2008-3-19 4742184]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 5 (0x5)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableUIADesktopToggle"= 0 (0x0)

.

R2 gupdate;Google Update-Dienst (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [x]

R2 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [x]

R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [x]

R3 gupdatem;Google Update-Dienst (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [x]

R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files\Mozilla Maintenance Service\maintenanceservice.exe [x]

R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]

S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys [x]

S2 AAV UpdateService;AAV UpdateService;c:\program files\AAVUpdateManager\aavus.exe [x]

S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe [x]

S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x]

S2 AMD FUEL Service;AMD FUEL Service;c:\program files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [x]

S2 AntiVirSchedulerService;Avira Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [x]

S2 Skype C2C Service;Skype C2C Service;c:\programdata\Skype\Toolbars\Skype C2C Service\c2c_service.exe [x]

S3 amdiox86;AMD IO Driver;c:\windows\system32\DRIVERS\amdiox86.sys [x]

S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [x]

S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [x]

S3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW73.sys [x]

.

.

--- Andere Dienste/Treiber im Speicher ---

.

*NewlyCreated* - WS2IFSL

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

WindowsMobile        REG_MULTI_SZ           wcescomm rapimgr

LocalServiceRestricted        REG_MULTI_SZ           WcesComm RapiMgr

.

Inhalt des "geplante Tasks" Ordners

.

2012-08-14 c:\windows\Tasks\Adobe Flash Player Updater.job

- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-03-31 07:32]

.

2012-08-15 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files\Google\Update\GoogleUpdate.exe [2012-03-26 09:19]

.

2012-08-14 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files\Google\Update\GoogleUpdate.exe [2012-03-26 09:19]

.

.

------- Zusätzlicher Suchlauf -------

.

uStart Page = hxxp://www.google.com

IE: Free YouTube to MP3 Converter - c:\users\Roland\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm

TCP: DhcpNameServer = 83.169.186.161 83.169.186.225

FF - ProfilePath - c:\users\Roland\AppData\Roaming\Mozilla\Firefox\Profiles\135r9kpp.default\

FF - prefs.js: browser.startup.homepage - about:home

.

- - - - Entfernte verwaiste Registrierungseinträge - - - -

.

AddRemove-Canon ScanGear Toolbox 3.1 - c:\windows\IsUn0407.exe

.

.

.

--------------------- Gesperrte Registrierungsschluessel ---------------------

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

------------------------ Weitere laufende Prozesse ------------------------

.

c:\windows\system32\atieclxx.exe

c:\program files\Avira\AntiVir Desktop\avguard.exe

c:\windows\system32\taskhost.exe

c:\program files\Avira\AntiVir Desktop\avshadow.exe

c:\windows\system32\conhost.exe

c:\windows\system32\conhost.exe

c:\program files\OpenOffice.org 3\program\soffice.exe

c:\program files\OpenOffice.org 3\program\soffice.bin

c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe

c:\program files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe

c:\program files\Windows Media Player\wmpnetwk.exe

c:\windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe

c:\program files\windows defender\MpCmdRun.exe

.

**************************************************************************

.

Zeit der Fertigstellung: 2012-08-15  09:23:17 - PC wurde neu gestartet

ComboFix-quarantined-files.txt  2012-08-15 07:23

.

Vor Suchlauf: 10 Verzeichnis(se), 356.501.880.832 Bytes frei

Nach Suchlauf: 16 Verzeichnis(se), 357.217.341.440 Bytes frei

.

- - End Of File - - 712AEAEF3B0ECA5EC13E204D3B95ABEE
--- --- ---