Trojaner-Board - Weiterleitung über andere Adresse im Browser

Super, dann werde ich deine Liste mal abarbeiten. :)

Vielen Dank nochmal für deine tolle Hilfe!

Edit:
Wollte gerade Combofix deinstallieren und habe mit Win+R das "Ausführen" Fenster geöffnet und combofix / uninstall eingegeben.
Anstatt es zu deinstallieren ist das Programm nochmal gestartet und hat einen Scan durchgeführt. Da man ja währenddessen nichts machen soll, habe ich es laufen lassen.

Hier das Log was Combofix danach gemacht hat:
Code:
ComboFix 13-03-12.02 - Ash 14.03.2013  16:33:16.3.2 - x86

Microsoft® Windows Vista™ Home Premium   6.0.6001.1.1252.49.1031.18.1918.972 [GMT 1:00]

ausgeführt von:: c:\users\Ash\Desktop\ComboFix.exe

Benutzte Befehlsschalter :: / uninstall

AV: Norton Internet Security *Disabled/Updated* {63DF5164-9100-186D-2187-8DC619EFD8BF}

FW: Norton Internet Security *Disabled* {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}

SP: Norton Internet Security *Enabled/Updated* {D8BEB080-B73A-17E3-1B37-B6B462689202}

SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

c:\windows\iun6002.exe

c:\windows\wininit.ini

.

.

(((((((((((((((((((((((   Dateien erstellt von 2013-02-14 bis 2013-03-14  ))))))))))))))))))))))))))))))

.

.

2013-03-14 15:45 . 2013-03-14 15:45        --------        d-----w-        c:\users\Ash\AppData\Local\temp

2013-03-14 15:45 . 2013-03-14 15:45        --------        d-----w-        c:\users\UpdatusUser\AppData\Local\temp

2013-03-14 15:45 . 2013-03-14 15:45        --------        d-----w-        c:\users\Public\AppData\Local\temp

2013-03-14 15:45 . 2013-03-14 15:45        --------        d-----w-        c:\users\Default\AppData\Local\temp

2013-03-13 11:07 . 2013-03-13 11:07        --------        d-----w-        c:\windows\ERUNT

2013-03-13 11:06 . 2013-03-13 11:06        --------        d-----w-        C:\JRT

2013-03-12 15:23 . 2013-03-12 15:23        --------        d-----w-        C:\TDSSKiller_Quarantine

2013-03-12 06:50 . 2013-03-12 07:14        --------        d-----w-        c:\program files\Mozilla Thunderbird

2013-03-09 16:51 . 2013-03-09 16:51        --------        d-----w-        c:\users\Ash\AppData\Roaming\QuickScan

2013-03-06 05:39 . 2013-03-06 05:39        --------        d-----w-        c:\programdata\Sophos

2013-03-06 05:39 . 2013-03-06 05:39        73728        ----a-r-        c:\users\Ash\AppData\Roaming\Microsoft\Installer\{B829E117-D072-41EA-9606-9826A38D34C1}\SVRTgui.exe1_810EDD9E2F0A4E2BACF86673C38D9F48.exe

2013-03-06 05:39 . 2013-03-06 05:39        73728        ----a-r-        c:\users\Ash\AppData\Roaming\Microsoft\Installer\{B829E117-D072-41EA-9606-9826A38D34C1}\SVRTgui.exe_810EDD9E2F0A4E2BACF86673C38D9F48.exe

2013-03-06 05:39 . 2013-03-06 05:39        73728        ----a-r-        c:\users\Ash\AppData\Roaming\Microsoft\Installer\{B829E117-D072-41EA-9606-9826A38D34C1}\ARPPRODUCTICON.exe

2013-03-06 05:38 . 2013-03-06 05:38        --------        d-----w-        c:\program files\Sophos

2013-02-27 03:51 . 2013-03-06 05:28        --------        d-----w-        c:\windows\system32\drivers\NIS\1403000.024

2013-02-24 11:22 . 2013-02-24 11:28        --------        d-----w-        c:\users\Ash\AppData\Roaming\ActivePresenter

2013-02-24 11:22 . 2013-02-24 11:22        --------        d-----w-        c:\program files\ATOMI

2013-02-24 10:20 . 2013-02-24 10:42        --------        d-----w-        C:\Fraps

2013-02-22 13:52 . 2013-02-22 14:11        --------        d-----w-        c:\users\Ash\AppData\Roaming\Broad Intelligence

2013-02-22 13:52 . 2013-02-22 14:11        --------        d-----w-        c:\program files\MediaCoder

2013-02-17 07:27 . 2013-02-17 07:27        --------        d-----w-        c:\users\Ash\AppData\Roaming\IObit

2013-02-17 07:19 . 2013-02-17 07:19        --------        d-----w-        c:\windows\system32\IO

2013-02-17 07:03 . 2011-05-13 12:16        493056        ----a-w-        c:\windows\system32\dhRichClient3.dll

2013-02-17 07:03 . 2011-03-25 20:42        338432        ----a-w-        c:\windows\system32\sqlite36_engine.dll

2013-02-17 07:03 . 2013-02-17 07:03        --------        d-----w-        c:\programdata\DNSErrorHelper

2013-02-16 08:31 . 2013-02-16 08:31        --------        d-----w-        c:\program files\Microsoft CAPICOM 2.1.0.2

2013-02-16 08:29 . 2013-02-16 08:29        --------        d-----w-        c:\program files\MSXML 4.0

2013-02-15 18:58 . 2013-02-15 18:58        106088        ----a-w-        c:\program files\Internet Explorer\Plugins\nppdf32.dll

2013-02-15 12:53 . 2013-02-15 12:54        --------        d-----w-        c:\programdata\MAGIX

2013-02-15 12:53 . 2013-02-15 12:53        --------        d-----w-        c:\program files\MAGIX

2013-02-15 12:47 . 2013-02-15 12:54        --------        d-----w-        c:\users\Ash\AppData\Roaming\MAGIX

2013-02-15 11:54 . 2013-02-15 11:54        --------        d-----w-        c:\users\Ash\AppData\Local\Logitech® Webcam-Software

2013-02-15 11:50 . 2013-02-15 11:50        --------        d-----w-        c:\users\Ash\AppData\Roaming\Leadertech

2013-02-15 11:50 . 2013-02-15 11:50        53248        ----a-r-        c:\users\Ash\AppData\Roaming\Microsoft\Installer\{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}\ARPPRODUCTICON.exe

2013-02-15 11:48 . 2013-02-15 11:48        --------        d-----w-        c:\programdata\Logitech

2013-02-15 11:48 . 2013-02-15 11:48        --------        d-----w-        c:\program files\Common Files\LWS

2013-02-15 11:48 . 2013-02-15 11:51        --------        d-----w-        c:\program files\Common Files\LogiShrd

2013-02-15 11:48 . 2013-02-15 11:48        --------        d-----w-        c:\programdata\LogiShrd

2013-02-15 11:48 . 2013-02-15 11:50        --------        d-----w-        c:\program files\Logitech

.

.

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2013-03-13 08:07 . 2012-07-27 15:09        693976        ----a-w-        c:\windows\system32\FlashPlayerApp.exe

2013-03-13 08:07 . 2011-06-17 04:11        73432        ----a-w-        c:\windows\system32\FlashPlayerCPLApp.cpl

2013-01-20 08:17 . 2010-05-08 08:56        142496        ----a-w-        c:\windows\system32\drivers\SYMEVENT.SYS

2012-12-14 15:49 . 2012-11-22 13:22        21104        ----a-w-        c:\windows\system32\drivers\mbam.sys

2013-03-08 12:08 . 2013-03-08 12:08        263064        ----a-w-        c:\program files\mozilla firefox\components\browsercomps.dll

.

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2009-01-20 6711840]

"WarReg_PopUp"="c:\program files\eMachines\WR_PopUp\WarReg_PopUp.exe" [2008-11-04 57344]

"DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2011-07-28 1259376]

"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-10-11 59280]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2012-12-19 41208]

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-12-03 946352]

"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2012-10-25 421888]

"LWS"="c:\program files\Logitech\LWS\Webcam Software\LWS.exe" [2011-11-11 205336]

.

c:\users\Ash\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

Warner Bros.lnk - c:\program files\Warner Bros. Digital Copy Manager\Warner Bros. Digital Copy Manager.exe [N/A]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"EnableUIADesktopToggle"= 0 (0x0)

.

R2 AddonsHelper;AddonsHelper;c:\users\Ash\AppData\Local\Temp\OCS\Downloads\0674e23d6502b36621d489f1b4fbd22a\8a2438a7aa1e858526caff1f4deab159\AddonsHelper.exe [x]

.

.

Inhalt des "geplante Tasks" Ordners

.

2013-03-14 c:\windows\Tasks\Adobe Flash Player Updater.job

- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-07-27 08:07]

.

2013-03-14 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files\Google\Update\GoogleUpdate.exe [2010-05-08 09:19]

.

2013-03-14 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files\Google\Update\GoogleUpdate.exe [2010-05-08 09:19]

.

2013-03-14 c:\windows\Tasks\User_Feed_Synchronization-{18774119-C679-4AA5-B698-E5A37E721850}.job

- c:\windows\system32\msfeedssync.exe [2008-01-21 02:24]

.

.

------- Zusätzlicher Suchlauf -------

.

uStart Page = hxxp://de.search.yahoo.com/web?fr=vc_trans_de_8197&type=ds2hp&d

mStart Page = hxxp://homepage.emachines.com/rdr.aspx?b=ACEW&l=0407&s=1&o=vp32&d=0809&m=et1300

IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000

IE: {{71BFC818-0CED-42D6-9C87-5142918957EE} - c:\program files\ICQ7.1\ICQ.exe

TCP: DhcpNameServer = 192.168.2.1

FF - ProfilePath - c:\users\Ash\AppData\Roaming\Mozilla\Firefox\Profiles\ukqv6mwg.default\

FF - prefs.js: browser.search.selectedEngine - amazon+ (co.uk)

FF - prefs.js: browser.startup.homepage - www.movie-infos.net

FF - ExtSQL: 2013-01-16 04:46; {73a6fe31-595d-460b-a920-fcc0f8843232}; c:\users\Ash\AppData\Roaming\Mozilla\Firefox\Profiles\ukqv6mwg.default\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi

FF - ExtSQL: 2013-03-09 17:51; {e001c731-5e37-4538-a5cb-8168736a2360}; c:\users\Ash\AppData\Roaming\Mozilla\Firefox\Profiles\ukqv6mwg.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}

FF - ExtSQL: 2013-03-12 09:36; {2D3F3651-74B9-4795-BDEC-6DA2F431CB62}; c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.1.2\coFFPlgn

.

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net

Rootkit scan 2013-03-14 16:45

Windows 6.0.6001 Service Pack 1 NTFS

.

Scanne versteckte Prozesse... 

.

Scanne versteckte Autostarteinträge... 

.

Scanne versteckte Dateien... 

.

Scan erfolgreich abgeschlossen

versteckte Dateien: 0

.

**************************************************************************

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\NIS]

"ImagePath"="\"c:\program files\Norton Internet Security\Engine\20.3.0.36\ccSvcHst.exe\" /s \"NIS\" /m \"c:\program files\Norton Internet Security\Engine\20.3.0.36\diMaster.dll\" /prefetch:1"

.

Zeit der Fertigstellung: 2013-03-14  16:47:36

ComboFix-quarantined-files.txt  2013-03-14 15:47

ComboFix2.txt  2013-03-13 07:20

.

Vor Suchlauf: 19 Verzeichnis(se), 138.109.997.056 Bytes frei

Nach Suchlauf: 20 Verzeichnis(se), 138.083.131.392 Bytes frei

.

- - End Of File - - 172BC53ACA50D1028598E23BF62339F9