Hier das Protokoll des Combofix-Scan. Combofix hat über Avira gemeckert, obwohl ich Avira vor dem Start von Combofix deaktiviert hatte Code:
ComboFix 13-10-16.02 - msi 17.10.2013 12:37:07.1.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.49.1031.18.3070.1768 [GMT 2:00]
ausgeführt von:: c:\users\msi\Desktop\ComboFix.exe
AV: Avira Desktop *Enabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
SP: Avira Desktop *Enabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Neuer Wiederherstellungspunkt wurde erstellt
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files\Google\Desktop\Install
c:\program files\Google\Desktop\Install\{d9fdbf9b-63c2-12b2-a2b0-be7f676a1d32}\0103~1\7154~1\CFFE~1\{d9fdbf9b-63c2-12b2-a2b0-be7f676a1d32}\@
c:\program files\Google\Desktop\Install\{d9fdbf9b-63c2-12b2-a2b0-be7f676a1d32}\0103~1\7154~1\CFFE~1\{d9fdbf9b-63c2-12b2-a2b0-be7f676a1d32}\GoogleUpdate.exe
c:\program files\Google\Desktop\Install\{d9fdbf9b-63c2-12b2-a2b0-be7f676a1d32}\0103~1\7154~1\CFFE~1\{d9fdbf9b-63c2-12b2-a2b0-be7f676a1d32}\U\00000004.@
c:\program files\Google\Desktop\Install\{d9fdbf9b-63c2-12b2-a2b0-be7f676a1d32}\0103~1\7154~1\CFFE~1\{d9fdbf9b-63c2-12b2-a2b0-be7f676a1d32}\U\00000008.@
c:\program files\Google\Desktop\Install\{d9fdbf9b-63c2-12b2-a2b0-be7f676a1d32}\0103~1\7154~1\CFFE~1\{d9fdbf9b-63c2-12b2-a2b0-be7f676a1d32}\U\000000cb.@
c:\program files\Google\Desktop\Install\{d9fdbf9b-63c2-12b2-a2b0-be7f676a1d32}\0103~1\7154~1\CFFE~1\{d9fdbf9b-63c2-12b2-a2b0-be7f676a1d32}\U\80000032.@
c:\programdata\Roaming
c:\programdata\Roaming\Intel\Wireless\Settings\Settings.ini
c:\users\msi\AppData\Local\assembly\tmp
c:\users\msi\AppData\Local\Google\Desktop\Install
c:\users\msi\AppData\Local\Google\Desktop\Install\{d9fdbf9b-63c2-12b2-a2b0-be7f676a1d32}\C3C1~1\01C8~1\CFFE~1\{d9fdbf9b-63c2-12b2-a2b0-be7f676a1d32}\@
c:\users\msi\AppData\Local\Google\Desktop\Install\{d9fdbf9b-63c2-12b2-a2b0-be7f676a1d32}\C3C1~1\01C8~1\CFFE~1\{d9fdbf9b-63c2-12b2-a2b0-be7f676a1d32}\GoogleUpdate.exe
c:\windows\~GLC0001.TMP
c:\windows\~GLC0002.TMP
c:\windows\~GLC0003.TMP
c:\windows\IsUn0407.exe
c:\windows\PFRO.log
c:\windows\unin0407.exe
.
.
((((((((((((((((((((((( Dateien erstellt von 2013-09-17 bis 2013-10-17 ))))))))))))))))))))))))))))))
.
.
2013-10-16 20:39 . 2013-10-16 20:39 -------- d-----w- C:\FRST
2013-10-16 14:37 . 2013-10-16 14:37 -------- d-----w- c:\users\msi\AppData\Roaming\Malwarebytes
2013-10-16 14:36 . 2013-10-16 14:36 -------- d-----w- c:\programdata\Malwarebytes
2013-10-16 14:36 . 2013-04-04 12:50 22856 ----a-w- c:\windows\system32\drivers\mbam.sys
2013-10-16 14:11 . 2013-10-16 14:11 -------- d-----w- c:\program files\Google
2013-10-16 14:11 . 2013-10-16 14:11 -------- d-----w- c:\users\msi\AppData\Local\Google
2013-10-12 10:16 . 2013-10-12 10:17 -------- d-----w- c:\program files\Mozilla Firefox 4.0 Beta 9
2013-10-09 13:37 . 2013-07-20 10:44 102608 ----a-w- c:\windows\system32\PresentationCFFRasterizerNative_v0300.dll
2013-10-09 13:36 . 2013-07-03 02:33 35328 ----a-w- c:\windows\system32\drivers\usbscan.sys
2013-10-09 13:36 . 2013-07-03 02:10 25472 ----a-w- c:\windows\system32\drivers\hidparse.sys
2013-10-03 12:20 . 2013-10-03 12:20 -------- d-----w- c:\users\msi\AppData\Local\LogMeIn
2013-10-03 12:20 . 2013-10-03 12:20 -------- d-----w- c:\programdata\LogMeIn
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-10-09 15:32 . 2012-04-06 13:51 692616 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2013-10-09 15:32 . 2011-05-17 20:16 71048 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2013-10-01 10:11 . 2013-04-20 06:32 89376 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2013-10-01 10:11 . 2013-04-20 06:32 37352 ----a-w- c:\windows\system32\drivers\avkmgr.sys
2013-10-01 10:11 . 2013-04-20 06:32 137208 ----a-w- c:\windows\system32\drivers\avipbb.sys
2013-09-24 03:07 . 2013-10-10 10:09 53760 ----a-w- c:\windows\apppatch\iebrshim.dll
2013-08-13 17:18 . 2013-08-13 17:18 94632 ----a-w- c:\windows\system32\WindowsAccessBridge.dll
2013-08-13 17:18 . 2012-09-07 06:15 867240 ----a-w- c:\windows\system32\npdeployJava1.dll
2013-08-13 17:18 . 2010-04-23 09:13 789416 ----a-w- c:\windows\system32\deployJava1.dll
2013-08-02 04:09 . 2013-08-28 04:31 1548288 ----a-w- c:\windows\system32\WMVDECOD.DLL
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952]
"DAEMON Tools Lite"="d:\daemon tools lite\daemon.exe" [2009-04-23 691656]
"Sony PC Companion"="c:\program files\Sony\Sony PC Companion\PCCompanion.exe" [2013-05-29 449248]
"Pando Media Booster"="c:\program files\Pando Networks\Media Booster\PMB.exe" [2013-02-27 3093624]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="RtHDVCpl.exe" [2008-05-28 6144000]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2008-04-16 178712]
"ITSecMng"="c:\program files\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe" [2007-09-28 75136]
"MGSysCtrl"="c:\program files\System Control Manager\MGSysCtrl.exe" [2008-05-21 794624]
"SMSERIAL"="c:\program files\Motorola\SMSERIAL\sm56hlpr.exe" [2007-10-26 671744]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-05-29 13543968]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-05-29 92704]
"Skytel"="Skytel.exe" [2007-11-20 1826816]
"QuickTime Task"="d:\quicktime\QTTask.exe" [2009-11-10 417792]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-11-12 141600]
"PDFPrint"="d:\pdf24\pdf24.exe" [2011-02-01 220552]
"DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2011-03-21 1230704]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-04-04 958576]
"BCSSync"="c:\program files\Microsoft Office\Office14\BCSSync.exe" [2010-03-13 91520]
"avgnt"="d:\avira\AntiVir Desktop\avgnt.exe" [2013-10-01 681032]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2013-03-12 253816]
"LogMeIn Hamachi Ui"="d:\logmein hamachi\hamachi-2-ui.exe" [2013-10-01 2345296]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Bluetooth Manager.lnk - c:\program files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe [2008-2-22 2938184]
VPN Client.lnk - c:\windows\Installer\{1CE60928-8325-49A8-8B06-633E48DD2B67}\Icon3E5562ED7.ico -user_logon [2011-11-25 6144]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
.
R2 ABBYY.Licensing.FineReader.Sprint.9.0;ABBYY FineReader 9.0 Sprint Licensing Service;c:\program files\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe [2009-05-14 759048]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - WINRING0_1_2_0
*NewlyCreated* - WS2IFSL
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
.
Inhalt des "geplante Tasks" Ordners
.
2013-10-17 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-06 15:32]
.
2013-10-17 c:\windows\Tasks\User_Feed_Synchronization-{73E21EEE-2D11-4265-9EF7-AAB1D4E482C6}.job
- c:\windows\system32\msfeedssync.exe [2008-01-21 02:24]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = about:blank
uInternet Settings,ProxyOverride = *.local
IE: An OneNote s&enden - c:\progra~1\MICROS~2\Office14\ONBttnIE.dll/105
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Nach Microsoft E&xcel exportieren - c:\progra~1\MICROS~2\Office14\EXCEL.EXE/3000
IE: {{7644E42D-B096-457F-8B5B-901238FC81AE} - d:\icq7.6\ICQ.exe
FF - ProfilePath - c:\users\msi\AppData\Roaming\Mozilla\Firefox\Profiles\gks2329g.default\
FF - prefs.js: network.proxy.ftp - 84.22.61.145
FF - prefs.js: network.proxy.ftp_port - 3128
FF - prefs.js: network.proxy.http - 84.22.61.145
FF - prefs.js: network.proxy.http_port - 3128
FF - prefs.js: network.proxy.socks - 84.22.61.145
FF - prefs.js: network.proxy.socks_port - 3128
FF - prefs.js: network.proxy.ssl - 84.22.61.145
FF - prefs.js: network.proxy.ssl_port - 3128
FF - prefs.js: network.proxy.type - 0
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
HKCU-Run-PlayNC Launcher - (no file)
SafeBoot-WudfPf
SafeBoot-WudfRd
AddRemove-AIM_6 - c:\program files\AIM6\uninst.exe
AddRemove-DAEMON Tools Toolbar - c:\program files\DAEMON Tools Toolbar\uninst.exe
AddRemove-Google Chrome - c:\program files\Google\Chrome\Application\17.0.963.66\Installer\setup.exe
AddRemove-Seven Kingdoms AA - c:\windows\IsUn0407.exe
AddRemove-Seven Kingdoms II - c:\windows\IsUn0407.exe
AddRemove-Silkroad - d:\silkroad\Remove.Exe
AddRemove-Theme Park World - c:\windows\IsUn0407.exe
AddRemove-{7B63B2922B174135AFC0E1377DD81EC2} - d:\divx\DivXCodecUninstall.exe
AddRemove-Advanced IM Password Recovery - d:\advanced im password recovery\uninstall.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2013-10-17 12:50
Windows 6.0.6002 Service Pack 2 NTFS
.
Scanne versteckte Prozesse...
.
Scanne versteckte Autostarteinträge...
.
Scanne versteckte Dateien...
.
Scan erfolgreich abgeschlossen
versteckte Dateien: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\npggsvc]
"ImagePath"="c:\windows\system32\GameMon.des -service"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\S-1-5-21-2312104630-3827830867-2223051950-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*®7]
@Class="Shell"
@Allowed: (Read) (RestrictedCode)
.
[HKEY_USERS\S-1-5-21-2312104630-3827830867-2223051950-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*®7\OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"
.
[HKEY_USERS\S-1-5-21-2312104630-3827830867-2223051950-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs\.*®7]
@Allowed: (Read) (RestrictedCode)
"0"=hex:48,3a,5c,54,77,6f,20,61,6e,64,20,61,20,68,61,6c,66,20,6d,65,6e,5c,53,
74,61,66,66,65,6c,20,34,5c,54,77,6f,20,61,6e,64,20,61,20,68,61,6c,66,20,4d,\
"MRUListEx"=hex:00,00,00,00,ff,ff,ff,ff
.
[HKEY_USERS\S-1-5-21-2312104630-3827830867-2223051950-1000\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
@Allowed: (Read) (RestrictedCode)
"??"=hex:8b,97,c2,97,35,40,bc,d0,3c,a1,e6,98,e8,75,90,78,ce,05,f3,cc,2c,be,7d,
9c,4f,f9,f1,0d,d5,75,34,34,4b,13,d3,62,9b,98,19,cd,2c,93,98,07,b1,2b,2f,91,\
"??"=hex:7d,8d,98,f3,e3,bf,13,8d,2c,df,04,04,25,13,4c,c5
.
[HKEY_USERS\S-1-5-21-2312104630-3827830867-2223051950-1000\Software\SecuROM\License information*]
"datasecu"=hex:58,b1,3b,72,fc,17,0d,1f,d1,ce,8a,3e,86,ae,81,14,08,c7,a1,c1,a0,
3c,f5,6c,ec,78,39,c4,7d,a6,55,d6,0a,02,79,58,0f,9b,06,11,db,ae,41,6e,77,f3,\
"rkeysecu"=hex:df,c2,28,f7,f3,73,8a,b0,6e,56,29,3e,c2,a1,ae,b9
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\windows\system32\nvvsvc.exe
c:\windows\system32\rundll32.exe
c:\windows\system32\WLANExt.exe
d:\avira\AntiVir Desktop\sched.exe
c:\windows\System32\lpksetup.exe
d:\openhardwaremonitor\OpenHardwareMonitor.exe
c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe
d:\avira\AntiVir Desktop\avguard.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
d:\vpn client\cvpnd.exe
c:\program files\Intel\WiFi\bin\EvtEng.exe
c:\program files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
d:\malwarebytes' anti-malware\mbamscheduler.exe
d:\malwarebytes' anti-malware\mbamservice.exe
c:\program files\System Control Manager\MSIService.exe
c:\program files\Common Files\Intel\WirelessCommon\RegSrvc.exe
c:\program files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
d:\malwarebytes' anti-malware\mbamgui.exe
d:\logmein hamachi\hamachi-2.exe
d:\logmein hamachi\LMIGuardianSvc.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
d:\logmein hamachi\LMIGuardianSvc.exe
d:\avira\AntiVir Desktop\avshadow.exe
c:\windows\servicing\TrustedInstaller.exe
c:\windows\system32\conime.exe
c:\\?\c:\windows\system32\wbem\WMIADAP.EXE
.
**************************************************************************
.
Zeit der Fertigstellung: 2013-10-17 12:56:12 - PC wurde neu gestartet
ComboFix-quarantined-files.txt 2013-10-17 10:56
.
Vor Suchlauf: 820.584.448 Bytes frei
Nach Suchlauf: 5.047.083.008 Bytes frei
.
- - End Of File - - 9C7AF68BCDF5BA2D735C161A337920DA
64B1E91C5C6C2157642651010728F90F
|
FRST 32-Bit | FRST 64-Bit
Malwarebytes Anti-Malware 
AdwCleaner auf deinen Desktop.
SecurityCheck und:
WARNUNG an die MITLESER: 
