| tuxfan283 | 04.08.2009 15:08 |
System Security 2009 erfolgreich abgeblockt?
Hi,
ich war gestern auf einer Seite, wo man Anime Serien gucken kann. Auf einmal hat mein Antivir verrückt gespielt. Ich habe alles was Antivir gemelder hatte in die Quarantänge geschoben. So wie andere im Internet berichtet haben, dass unten immer so ein Balken kommt mit "you are infected" kam nie. Also ich denke die Suite ist nie aktiv geworden.
Hier mein ComboFix Code:
ComboFix 09-08-03.04 - Renate & Wolfgang 04.08.2009 0:03.1.2 - NTFSx86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.49.1031.18.3070.1835 [GMT 2:00]
ausgeführt von:: c:\users\Renate & Wolfgang\Downloads\ComboFix.exe
SP: Spybot - Search and Destroy *disabled* (Outdated) {ED588FAF-1B8F-43B4-ACA8-8E3C85DADBE9}
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\Installer\55c64.msi
.
((((((((((((((((((((((( Dateien erstellt von 2009-07-03 bis 2009-08-03 ))))))))))))))))))))))))))))))
.
2009-08-03 21:51 . 2009-08-03 21:51 3942048 ----a-w- c:\programdata\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
2009-08-03 19:12 . 2009-08-03 19:12 5550 ----a-r- c:\users\Renate & Wolfgang\AppData\Roaming\Microsoft\Installer\{F1BFD15D-9EEC-4072-942D-240BA0B99467}\_6FEFF9B68218417F98F549.exe
2009-08-03 19:12 . 2009-08-03 19:12 -------- d-----w- c:\program files\COMPUTERBILD-Abzockschutz
2009-07-31 08:12 . 2009-07-31 08:12 -------- d-----w- c:\windows\system32\ca-ES
2009-07-31 08:12 . 2009-07-31 08:12 -------- d-----w- c:\windows\system32\eu-ES
2009-07-31 08:12 . 2009-07-31 08:12 -------- d-----w- c:\windows\system32\vi-VN
2009-07-31 08:09 . 2009-07-31 08:09 -------- d-----w- c:\windows\system32\SPReview
2009-07-31 08:00 . 2009-04-10 21:28 928768 ----a-w- c:\windows\system32\scavenge.dll
2009-07-31 08:00 . 2009-04-10 21:27 57856 ----a-w- c:\windows\system32\compcln.exe
2009-07-31 07:58 . 2009-04-10 21:32 245736 ----a-w- c:\windows\system32\clfs.sys
2009-07-31 07:56 . 2009-07-31 07:56 -------- d-----w- c:\windows\system32\EventProviders
2009-07-29 15:30 . 2009-07-29 15:30 -------- d-----w- c:\programdata\F-Secure
2009-07-27 20:11 . 2009-08-03 16:53 -------- d-----w- c:\users\Renate & Wolfgang\Tracing
2009-07-27 20:01 . 2009-07-27 20:01 -------- d-----w- c:\program files\Microsoft
2009-07-27 20:00 . 2009-07-27 20:00 -------- d-----w- c:\program files\Windows Live SkyDrive
2009-07-27 19:58 . 2009-07-27 19:58 -------- d-----w- c:\program files\Common Files\Windows Live
2009-07-27 19:56 . 2008-07-27 18:03 41984 ----a-w- c:\windows\system32\netfxperf.dll
2009-07-27 19:54 . 2009-03-08 11:32 72704 ----a-w- c:\windows\system32\admparse.dll
2009-07-27 19:54 . 2009-03-08 11:31 48128 ----a-w- c:\windows\system32\mshtmler.dll
2009-07-26 13:30 . 2009-07-26 13:30 -------- d-----w- c:\users\Renate & Wolfgang\AppData\Roaming\Malwarebytes
2009-07-26 13:30 . 2009-08-03 11:36 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-07-26 13:30 . 2009-08-03 11:36 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-07-26 13:30 . 2009-07-26 13:30 -------- d-----w- c:\programdata\Malwarebytes
2009-07-26 13:30 . 2009-08-03 21:51 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-07-26 08:03 . 2009-07-26 08:03 1080072 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll
2009-07-19 15:58 . 2009-07-19 15:58 -------- d-----w- c:\program files\Microsoft.NET
2009-07-19 15:56 . 2009-07-19 15:56 -------- d-----w- c:\users\Renate & Wolfgang\AppData\Local\Microsoft Help
2009-07-19 15:55 . 2009-07-19 15:55 -------- d--h--r- C:\MSOCache
2009-07-19 15:52 . 2009-07-19 15:52 -------- d-----w- c:\programdata\DAEMON Tools Lite
2009-07-19 15:52 . 2009-07-19 15:52 -------- d-----w- c:\program files\DAEMON Tools Toolbar
2009-07-19 15:52 . 2009-07-19 15:52 -------- d-----w- c:\program files\DAEMON Tools Lite
2009-07-19 15:51 . 2009-07-26 14:44 680 ----a-w- c:\users\Renate & Wolfgang\AppData\Local\d3d9caps.dat
2009-07-19 15:48 . 2009-07-19 15:48 721904 ----a-w- c:\windows\system32\drivers\sptd.sys
2009-07-19 15:48 . 2009-07-19 15:53 -------- d-----w- c:\users\Renate & Wolfgang\AppData\Roaming\DAEMON Tools Lite
2009-07-19 14:40 . 2009-06-15 14:53 156672 ----a-w- c:\windows\system32\t2embed.dll
2009-07-19 14:40 . 2009-06-15 14:52 72704 ----a-w- c:\windows\system32\fontsub.dll
2009-07-19 14:40 . 2009-06-15 12:42 289792 ----a-w- c:\windows\system32\atmfd.dll
2009-07-19 14:40 . 2009-06-15 14:52 23552 ----a-w- c:\windows\system32\lpk.dll
2009-07-19 14:40 . 2009-06-15 14:51 10240 ----a-w- c:\windows\system32\dciman32.dll
2009-07-19 14:40 . 2009-04-11 06:28 34304 ----a-w- c:\windows\system32\atmlib.dll
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-08-03 17:00 . 2008-01-21 07:15 664282 ----a-w- c:\windows\system32\perfh007.dat
2009-08-03 17:00 . 2008-01-21 07:15 142622 ----a-w- c:\windows\system32\perfc007.dat
2009-08-03 16:53 . 2008-05-11 11:17 -------- d-----w- c:\programdata\Google Updater
2009-08-03 09:03 . 2008-02-26 04:21 12 ----a-w- c:\windows\bthservsdp.dat
2009-08-01 08:32 . 2008-06-15 10:18 -------- d-----w- c:\program files\Microsoft Silverlight
2009-07-31 08:12 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Calendar
2009-07-31 08:12 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail
2009-07-31 08:12 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Sidebar
2009-07-31 08:12 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Journal
2009-07-31 08:12 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Collaboration
2009-07-31 08:12 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Photo Gallery
2009-07-31 08:12 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Defender
2009-07-31 08:12 . 2006-11-02 10:25 665600 ----a-w- c:\windows\inf\drvindex.dat
2009-07-31 08:08 . 2006-11-02 12:37 37665 ----a-w- c:\windows\Fonts\GlobalUserInterface.CompositeFont
2009-07-27 20:00 . 2008-05-06 20:22 -------- d-----w- c:\program files\Windows Live
2009-07-26 20:11 . 2008-05-07 18:35 -------- d-----w- c:\users\Renate & Wolfgang\AppData\Roaming\Skype
2009-07-21 21:52 . 2009-07-28 19:09 915456 ----a-w- c:\windows\system32\wininet.dll
2009-07-21 21:47 . 2009-07-28 19:09 109056 ----a-w- c:\windows\system32\iesysprep.dll
2009-07-21 21:47 . 2009-07-28 19:09 71680 ----a-w- c:\windows\system32\iesetup.dll
2009-07-21 20:13 . 2009-07-28 19:09 133632 ----a-w- c:\windows\system32\ieUnatt.exe
2009-07-21 17:58 . 2008-02-26 05:32 -------- d-----w- c:\programdata\Microsoft Help
2009-07-21 17:05 . 2008-04-28 10:07 120416 ----a-w- c:\users\Renate & Wolfgang\AppData\Local\GDIPFONTCACHEV1.DAT
2009-07-19 15:58 . 2008-02-26 05:27 -------- d-----w- c:\program files\Microsoft Works
2009-08-02 19:42 . 2008-06-17 19:33 137208 ----a-w- c:\program files\mozilla firefox\components\brwsrcmp.dll
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{353e2a48-6254-4bd3-88f4-3b51a0ca7870}"= "mscoree.dll" [2009-03-29 278848]
[HKEY_CLASSES_ROOT\clsid\{353e2a48-6254-4bd3-88f4-3b51a0ca7870}]
[HKEY_CLASSES_ROOT\CBAbzockschutz.CBAbzockschutz]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-10 1233920]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-02-06 3885408]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-05-11 68856]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2009-04-23 691656]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-21 1008184]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2007-10-03 178712]
"SynTPStart"="c:\program files\Synaptics\SynTP\SynTPStart.exe" [2007-08-31 102400]
"PLFSetL"="c:\windows\PLFSetL.exe" [2007-07-05 94208]
"LaunchAp"="c:\program files\Launch Manager\LaunchAp.exe" [2007-09-01 32768]
"HotkeyApp"="c:\program files\Launch Manager\HotkeyApp.exe" [2007-09-06 188416]
"LMgrOSD"="c:\program files\Launch Manager\OSD.exe" [2006-12-26 180224]
"Wbutton"="c:\program files\Launch Manager\Wbutton.exe" [2007-09-07 86016]
"OmniPass"="c:\program files\Softex\OmniPass\scureapp.exe" [2007-11-02 2564096]
"LanguageShortcut"="c:\program files\HomeCinema\PowerDVD\Language\Language.exe" [2007-01-08 52256]
"UCam_Menu"="c:\program files\HomeCinema\YouCam\MUITransfer\MUIStartMenu.exe" [2007-09-13 222504]
"TVBroadcast"="c:\program files\Sceneo\AbsolutTV\SERVICES\ODSBC\ODSBCApp.exe" [2007-08-07 797696]
"NvSvc"="c:\windows\system32\nvsvc.dll" [2007-12-20 86016]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-12-20 8501792]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-12-20 81920]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-01-05 413696]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"RtHDVCpl"="RtHDVCpl.exe" - c:\windows\RtHDVCpl.exe [2007-12-17 4718592]
"Skytel"="Skytel.exe" - c:\windows\SkyTel.exe [2007-11-20 1826816]
c:\users\Renate & Wolfgang\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
milch.vbs [2009-8-2 186]
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
BTTray.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2007-12-4 727592]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\progra~1\Google\GOOGLE~2\GoogleDesktopNetwork3.dll
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Google Updater.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Google Updater.lnk
backup=c:\windows\pss\Google Updater.lnk.CommonStartup
backupExtension=.CommonStartup
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"VistaSp2"=hex(b):d3,d7,0c,42,b7,11,ca,01
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{01A165AB-D9A5-41CB-A196-1709CEC1537C}"= c:\program files\HomeCinema\MakeDisc\MakeDisc.exe:CyberLink MakeDisc
"{687B5CEF-BC5F-4893-A514-A606B79C2497}"= c:\program files\HomeCinema\PowerDirector\PDR.EXE:CyberLink PowerDirector
"{CC62E603-FA70-43F0-916F-B22ABF1ED8FC}"= c:\program files\HomeCinema\PowerDVD\PowerDVD.EXE:CyberLink PowerDVD
"{1E353877-3252-4D17-B1FC-9A03929001D4}"= c:\program files\Skype\Phone\Skype.exe:Skype
"TCP Query User{53387E2B-488B-4BBD-AC0A-EAF6CAC50264}c:\\program files\\team6 game studios\\fsr demo\\game.exe"= UDP:c:\program files\team6 game studios\fsr demo\game.exe:Game
"UDP Query User{408EDF4B-6C87-442D-8F85-9CBD3ADFDAB0}c:\\program files\\team6 game studios\\fsr demo\\game.exe"= TCP:c:\program files\team6 game studios\fsr demo\game.exe:Game
"TCP Query User{A6F7B843-19FB-4014-9CDE-35999C91EFC4}c:\\program files\\mozilla firefox\\firefox.exe"= UDP:c:\program files\mozilla firefox\firefox.exe:Firefox
"UDP Query User{74F92334-DA59-4C96-8A83-83B9FF0D7BAF}c:\\program files\\mozilla firefox\\firefox.exe"= TCP:c:\program files\mozilla firefox\firefox.exe:Firefox
R0 Si3531;SiI-3531 SATA Controller;c:\windows\System32\drivers\Si3531.sys [08.02.2008 16:33 210736]
R2 AntiVirSchedulerService;Avira AntiVir Planer;c:\program files\Avira\AntiVir Desktop\sched.exe [19.03.2009 13:18 108289]
R2 GnabService;GnabService;c:\program files\Common Files\Gnab\Service\ServiceController.exe [26.02.2008 08:17 36864]
R2 SBSDWSCService;SBSD Security Center Service;c:\program files\Spybot - Search & Destroy\SDWinSec.exe [19.06.2008 23:09 809296]
R2 SmartSurferManager;SmartSurfer Manager;c:\program files\WEB.DE\WEB.DE SmartSurfer\SmurfService.exe [18.12.2007 11:13 132560]
R2 srvcPVR;Sceneo PVR Service;c:\program files\Sceneo\AbsolutTV\Services\PVR\pvrservice.exe [29.02.2008 07:19 1681408]
R3 netr28;Ralink 802.11n Wireless Driver for Windows Vista;c:\windows\System32\drivers\netr28.sys [26.02.2008 05:54 327168]
R3 WisLMSvc;WisLMSvc;c:\program files\Launch Manager\WisLMSvc.exe [26.02.2008 06:07 118784]
R3 X10Hid;X10 Hid Device;c:\windows\System32\drivers\x10hid.sys [26.02.2008 06:03 13976]
S3 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance;c:\program files\ALDI Foto Service Nord\Common\Database\bin\fbserver.exe [01.03.2008 11:30 1527900]
S3 PhilCap;NXP service;c:\windows\System32\drivers\PhilCap.sys [08.02.2008 16:34 908896]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs REG_MULTI_SZ BthServ
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\System32\rundll32.exe" "c:\windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Inhalt des "geplante Tasks" Ordners
2009-08-03 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-03-01 12:00]
2009-08-03 c:\windows\Tasks\User_Feed_Synchronization-{BB6350BB-5619-4F40-BEEC-76D8ECCDAFD8}.job
- c:\windows\system32\msfeedssync.exe [2009-07-28 20:13]
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
HKLM-Run-snp2uvc - c:\windows\vsnp2uvc.exe
HKLM-Run-CtrlVol - c:\program files\Launch Manager\CtrlVol.exe
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.aldi.com/
IE: Bild an &Bluetooth-Gerät senden... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
IE: Seite an &Bluetooth-Gerät senden... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
IE: {{0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - http://rover.ebay.com/rover/1/707-37276-17534-25/4
FF - ProfilePath - c:\users\Renate & Wolfgang\AppData\Roaming\Mozilla\Firefox\Profiles\a9x9wv6r.default\
FF - prefs.js: network.proxy.http - 80.148.23.25:80
FF - prefs.js: network.proxy.type - 1
FF - plugin: c:\program files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
---- FIREFOX Richtlinien ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.enforce_same_site_origin", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.cache_size", 51200);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.ogg.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.wave.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.autoplay.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.urlbar.autocomplete.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("capability.policy.mailnews.*.wholeText", "noAccess");
c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.storage.default_quota", 5120);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("content.sink.event_probe_rate", 3);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.http.prompt-temp-redirect", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("layout.css.dpi", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("layout.css.devPixelsPerPx", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("gestures.enable_single_finger_input", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.max_chrome_script_run_time", 0);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.tcp.sendbuffer", 131072);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("geo.enabled", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.remember_cert_checkbox_default_setting", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr", "moz35");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-cjkt", "moz35");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.blocklist.level", 2);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.restrict.typed", "~");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.default.behavior", 0);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.history", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.formdata", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.passwords", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.downloads", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cookies", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cache", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.sessions", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.offlineApps", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.siteSettings", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.history", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.formdata", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.passwords", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.downloads", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cookies", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cache", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.sessions", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.offlineApps", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.siteSettings", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.sanitize.migrateFx3Prefs", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.ssl_override_behavior", 2);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("security.alternate_certificate_error_page", "certerror");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.autostart", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.dont_prompt_on_enter", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("geo.wifi.uri", "https://www.google.com/loc/json");
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-08-04 00:08
Windows 6.0.6002 Service Pack 2 NTFS
Scanne versteckte Prozesse...
Scanne versteckte Autostarteinträge...
Scanne versteckte Dateien...
Scan erfolgreich abgeschlossen
versteckte Dateien: 0
**************************************************************************
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000001
"MSCurrentCountry"=dword:000000b5
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Zeit der Fertigstellung: 2009-08-03 0:10
ComboFix-quarantined-files.txt 2009-08-03 22:10
Vor Suchlauf: 8 Verzeichnis(se), 250.638.495.744 Bytes frei
Nach Suchlauf: 8 Verzeichnis(se), 250.977.894.400 Bytes frei
258 --- E O F --- 2009-07-31 17:00
Ich denke, er ist sauber, oder?
Danke schonmal für eure Hilfe.
TuxFan283 |
