Trojaner-Board - Auswertung GMER Log

hier ises :) :

ComboFix 10-01-29.09 - Brauklaus 30.01.2010 15:10:51.1.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.49.1031.18.1023.511 [GMT 1:00]
ausgeführt von:: c:\users\Brauklaus\Desktop\cofi.exe
AV: Avira AntiVir PersonalEdition *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
AV: Norton Internet Security *On-access scanning enabled* (Outdated) {E10A9785-9598-4754-B552-92431C1C35F8}
FW: Norton Internet Security *disabled* {7C21A4C9-F61F-4AC4-B722-A6E19C16F220}
SP: Avira AntiVir PersonalEdition *enabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
SP: Norton Internet Security *disabled* (Outdated) {CBB7EE13-8244-4DAB-8B55-D5C7AA91E59A}
SP: Windows-Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.

(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\$recycle.bin\S-1-5-21-2152478756-3922319563-605102323-500
c:\$recycle.bin\S-1-5-21-3397284669-303795151-4152830902-500
c:\$recycle.bin\S-1-5-21-827534902-3014078745-1921890862-500
c:\program files\ICQ6.5\ICQLRun.exe

.
((((((((((((((((((((((( Dateien erstellt von 2009-12-28 bis 2010-01-30 ))))))))))))))))))))))))))))))
.

2010-01-30 14:22 . 2010-01-30 14:22 -------- d-----w- c:\users\Brauklaus\AppData\Local\temp
2010-01-30 14:22 . 2010-01-30 14:22 -------- d-----w- c:\users\Default\AppData\Local\temp
2010-01-30 13:50 . 2010-01-30 13:50 -------- d-----w- c:\program files\CCleaner
2010-01-28 17:00 . 2010-01-28 17:00 -------- d-----w- c:\program files\trend micro
2010-01-28 17:00 . 2010-01-28 17:00 -------- d-----w- C:\rsit
2010-01-28 12:49 . 2010-01-28 12:52 -------- d-----w- C:\Lop SD
2010-01-28 09:37 . 2010-01-28 09:37 -------- d-----w- c:\users\Brauklaus\AppData\Roaming\Malwarebytes
2010-01-28 09:37 . 2010-01-07 15:07 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-01-28 09:37 . 2010-01-28 09:37 -------- d-----w- c:\programdata\Malwarebytes
2010-01-28 09:37 . 2010-01-07 15:07 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-01-28 09:37 . 2010-01-28 09:37 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-01-27 19:28 . 2010-01-27 19:28 -------- d-----w- c:\program files\Windows Portable Devices
2010-01-27 19:24 . 2009-10-01 01:02 30208 ----a-w- c:\windows\system32\WPDShextAutoplay.exe
2010-01-27 19:23 . 2009-10-08 21:07 4096 ----a-w- c:\windows\system32\oleaccrc.dll
2010-01-27 19:23 . 2009-10-08 21:08 555520 ----a-w- c:\windows\system32\UIAutomationCore.dll
2010-01-27 19:23 . 2009-10-08 21:08 234496 ----a-w- c:\windows\system32\oleacc.dll
2010-01-27 14:32 . 2010-01-27 14:32 -------- d-----w- c:\program files\Sophos
2010-01-27 13:30 . 2010-01-27 13:34 -------- d-----w- c:\program files\a-squared Free
2010-01-27 13:09 . 2010-01-27 13:10 -------- d-----w- c:\windows\system32\ca-ES
2010-01-27 13:09 . 2010-01-27 13:10 -------- d-----w- c:\windows\system32\eu-ES
2010-01-27 13:09 . 2010-01-27 13:10 -------- d-----w- c:\windows\system32\vi-VN
2010-01-27 12:28 . 2010-01-27 12:28 -------- d-----w- c:\windows\system32\EventProviders
2010-01-22 06:52 . 2009-12-16 11:44 834048 ----a-w- c:\windows\system32\wininet.dll
2010-01-22 06:52 . 2009-12-18 13:01 78336 ----a-w- c:\windows\system32\ieencode.dll
2010-01-14 18:03 . 2010-01-14 18:03 1273592 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll
2010-01-13 10:38 . 2009-10-19 13:38 156672 ----a-w- c:\windows\system32\t2embed.dll
2010-01-13 10:38 . 2009-10-19 13:35 72704 ----a-w- c:\windows\system32\fontsub.dll

.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-30 14:21 . 2009-07-16 12:31 -------- d-----w- c:\program files\ICQ6.5
2010-01-30 13:28 . 2008-04-08 11:32 -------- d-----w- c:\users\Brauklaus\AppData\Roaming\ICQ
2010-01-29 16:31 . 2009-12-10 12:54 -------- d-----w- c:\users\Brauklaus\AppData\Roaming\uTorrent
2010-01-28 16:58 . 2007-12-11 17:32 -------- d-----w- c:\programdata\Spybot - Search & Destroy
2010-01-27 19:39 . 2007-01-10 19:20 675412 ----a-w- c:\windows\system32\perfh007.dat
2010-01-27 19:39 . 2007-01-10 19:20 146294 ----a-w- c:\windows\system32\perfc007.dat
2010-01-27 19:39 . 2007-04-22 17:35 -------- d-----w- c:\program files\World of Warcraft
2010-01-27 19:28 . 2006-11-02 10:25 665600 ----a-w- c:\windows\inf\drvindex.dat
2010-01-27 19:28 . 2010-01-27 19:28 0 ---ha-w- c:\windows\system32\drivers\Msft_User_WpdMtpDr_01_07_00.Wdf
2010-01-27 19:27 . 2010-01-27 19:27 0 ---ha-w- c:\windows\system32\drivers\Msft_User_WpdFs_01_07_00.Wdf
2010-01-27 13:11 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Calendar
2010-01-27 13:11 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail
2010-01-27 13:11 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Sidebar
2010-01-27 13:11 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Collaboration
2010-01-27 13:11 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Journal
2010-01-27 13:11 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Photo Gallery
2010-01-27 13:11 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Defender
2010-01-27 13:06 . 2010-01-27 13:06 0 ---ha-w- c:\windows\system32\drivers\Msft_User_WpdMtpDr_01_00_00.Wdf
2010-01-27 12:58 . 2007-09-27 16:33 -------- d-----w- c:\program files\Common Files\Adobe
2010-01-27 06:43 . 2007-12-11 17:32 -------- d-----w- c:\program files\Spybot - Search & Destroy
2010-01-20 19:32 . 2007-12-01 14:32 -------- d-----w- c:\users\Brauklaus\AppData\Roaming\teamspeak2
2010-01-14 10:12 . 2009-10-03 07:59 181120 ------w- c:\windows\system32\MpSigStub.exe
2009-12-20 09:53 . 2009-12-20 09:53 234016 ----a-w- c:\windows\system32\drivers\Rtlh86.sys
2009-12-16 18:19 . 2009-12-16 18:19 586106 ----a-w- c:\programdata\Avira\AntiVir PersonalEdition Classic\TEMP\AVUPDATE_4b2924bb\ave2\aescript.dll
2009-12-16 18:19 . 2009-12-16 18:19 237943 ----a-w- c:\programdata\Avira\AntiVir PersonalEdition Classic\TEMP\AVUPDATE_4b2924bb\ave2\aehelp.dll
2009-12-16 18:19 . 2009-12-16 18:19 369014 ----a-w- c:\programdata\Avira\AntiVir PersonalEdition Classic\TEMP\AVUPDATE_4b2924bb\ave2\aegen.dll
2009-12-15 08:34 . 2009-12-15 08:34 -------- d-----w- c:\program files\OpenXML-ODF Translator
2009-12-15 08:32 . 2009-12-15 08:32 -------- d-----w- c:\program files\Classic Menu for Office
2009-12-10 18:03 . 2007-05-19 14:49 -------- d-----w- c:\programdata\eMule
2009-12-10 12:56 . 2009-12-10 12:56 -------- d-----w- c:\program files\uTorrent
2009-12-03 08:27 . 2009-12-03 08:27 80416 ----a-w- c:\windows\system32\RtNicProp32.dll
2009-12-03 08:27 . 2009-12-03 08:27 100896 ----a-w- c:\windows\system32\RTNUninst32.dll
2009-11-24 20:15 . 2009-11-24 20:00 5562672 ----a-w- c:\users\Brauklaus\AppData\Roaming\TVU Networks\AutoUpgrade\TVUPlayer2.4.9.1.exe
2009-11-09 12:31 . 2009-12-10 06:41 24064 ----a-w- c:\windows\system32\nshhttp.dll
2009-11-09 12:30 . 2009-12-10 06:41 30720 ----a-w- c:\windows\system32\httpapi.dll
2009-11-09 10:36 . 2009-12-10 06:41 411648 ----a-w- c:\windows\system32\drivers\http.sys
2009-05-27 14:01 . 2007-11-14 12:31 67688 ----a-w- c:\program files\mozilla firefox\components\jar50.dll
2009-05-27 14:01 . 2007-11-14 12:31 54368 ----a-w- c:\program files\mozilla firefox\components\jsd3250.dll
2009-05-27 14:01 . 2007-11-14 12:31 34944 ----a-w- c:\program files\mozilla firefox\components\myspell.dll
2009-05-27 14:01 . 2007-11-14 12:31 46712 ----a-w- c:\program files\mozilla firefox\components\spellchk.dll
2009-05-27 14:01 . 2007-11-14 12:31 172136 ----a-w- c:\program files\mozilla firefox\components\xpinstal.dll
2009-05-01 21:02 . 2009-05-01 21:02 1044480 ----a-w- c:\program files\mozilla firefox\plugins\libdivx.dll
2009-05-01 21:02 . 2009-05-01 21:02 200704 ----a-w- c:\program files\mozilla firefox\plugins\ssldivx.dll
1999-05-06 06:22 . 2007-01-10 19:12 224150 --sha-r- c:\windows\ConfigSetRoot\IO.SYS
1999-05-06 06:22 . 2007-01-10 19:12 1026 --sha-r- c:\windows\ConfigSetRoot\MSDOS.SYS
2000-06-21 20:22 . 2007-01-10 19:12 0 --sha-w- c:\windows\ConfigSetRoot\DOS\EBD.SYS
.

(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 90112]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 202240]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"c:\windows\system32\V0350Ext.ax"="c:\windows\system32\V0350Ext.ax" [X]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-19 1008184]
"RtHDVCpl"="RtHDVCpl.exe" [2006-12-01 4186112]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-11-22 815104]
"avgnt"="c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-07-17 266497]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2009-12-18 40368]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-12-11 948672]
"V0350Mon.exe"="c:\windows\V0350Mon.exe" [2007-08-23 28672]
"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2010-01-07 1394000]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"ehTray.exe"=c:\windows\ehome\ehTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"VistaSp2"=hex(b):c7,da,36,80,53,9f,ca,01

R1 IDSvix86;Symantec Intrusion Prevention Driver;c:\progra~2\Symantec\DEFINI~1\SymcData\idsdefs\20061025.029\IDSvix86.sys [06.04.2007 15:32 202872]
R2 MZCCntrl;T-Online WLAN Adapter Steuerungsdienst;c:\program files\Common Files\Marmiko Shared\MZCCntrl.exe [22.04.2007 17:51 61440]
R3 SYMNDISV;SYMNDISV;c:\windows\System32\drivers\symndisv.sys [24.10.2006 13:39 37008]
S2 gupdate1ca0ae8ae8cdfe5;Google Update Service (gupdate1ca0ae8ae8cdfe5);c:\program files\Google\Update\GoogleUpdate.exe [22.07.2009 17:22 133104]
S3 a2free;a-squared Free Service;c:\program files\a-squared Free\a2service.exe [27.01.2010 14:30 1858144]
S3 FontCache;Windows-Dienst für Schriftartencache;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [06.06.2008 15:36 21504]
S3 MACNDIS5;MACNDIS5 NDIS Protocol Driver;c:\progra~1\COMMON~1\MARMIK~1\MACNDIS5.SYS [22.04.2007 17:51 17280]
S3 MTOnlPktAlyX;MTOnlPktAlyX NDIS Protocol Driver;c:\progra~1\T-Online\T-ONLI~1\BASIS-~1\Basis1\MTOnlPktAlyX.SYS [22.04.2007 17:49 17664]
S3 VF0350Afx;VF0350 Audio FX;c:\windows\System32\drivers\V0350Afx.sys [09.01.2008 19:39 142656]
S3 VF0350Vfx;VF0350 Video FX;c:\windows\System32\drivers\V0350Vfx.sys [09.01.2008 19:39 7424]
S3 VF0350Vid;Live! Cam Video IM (VF0350);c:\windows\System32\drivers\V0350Vid.sys [09.01.2008 19:39 170368]
S3 WCPU;WCPU;c:\program files\P4G\WCPU.sys [06.04.2007 15:22 11120]

--- Andere Dienste/Treiber im Speicher ---

*NewlyCreated* - COMHOST

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs REG_MULTI_SZ BthServ
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
Inhalt des "geplante Tasks" Ordners

2010-01-30 c:\windows\Tasks\1-Klick-Wartung.job
- c:\program files\TuneUp Utilities 2008\OneClickStarter.exe [2008-02-18 03:36]

2010-01-30 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-07-22 16:22]

2010-01-30 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-07-22 16:22]

2010-01-30 c:\windows\Tasks\User_Feed_Synchronization-{8D8A6358-CDDD-4536-BD61-E992DE1BAF44}.job
- c:\windows\system32\msfeedssync.exe [2008-06-06 07:33]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://google.mini20.com
mStart Page = hxxp://www.arcor.de
mWindow Title = Arcor AG & Co. KG
uInternet Settings,ProxyOverride = <local>
FF - ProfilePath - c:\users\Brauklaus\AppData\Roaming\Mozilla\Firefox\Profiles\gc79ya55.default\
FF - component: c:\program files\Mozilla Firefox\components\xpinstal.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX Richtlinien ----
FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: content.max.tokenizing.time - 200000
FF - user.js: content.notify.interval - 100000
FF - user.js: content.switch.threshold - 650000
FF - user.js: nglayout.initialpaint.delay - 300
FF - user.js: yahoo.homepage.dontask - truec:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.allow_platform_file_picker", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.cookie.p3plevel", 1); // 0=low, 1=medium, 2=high, 3=custom
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.enablePad", false); // Allow client to do proxy autodiscovery
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.search.param.Google.1.default", "chrome://branding/content/searchconfig.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.search.param.Google.1.custom", "chrome://branding/content/searchconfig.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("signon.prefillForms", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.safebrowsing.enabled", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.safebrowsing.remoteLookups", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.safebrowsing.provider.0.updateURL", "http://sb.google.com/safebrowsing/update?client={moz:client}&appver={moz:version}&");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.safebrowsing.provider.0.lookupURL", "http://sb.google.com/safebrowsing/lookup?sourceid=firefox-antiphish&features=TrustRank&client={moz:client}&appver={moz:version}&");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.safebrowsing.provider.0.reportURL", "http://sb.google.com/safebrowsing/report?");
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -

ActiveSetup-ccc-core-static - msiexec

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-01-30 15:22
Windows 6.0.6002 Service Pack 2 NTFS

Scanne versteckte Prozesse...

Scanne versteckte Autostarteinträge...

Scanne versteckte Dateien...

Scan erfolgreich abgeschlossen
versteckte Dateien: 0

**************************************************************************
.
--------------------- Gesperrte Registrierungsschluessel ---------------------

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
.
Zeit der Fertigstellung: 2010-01-30 15:28:26
ComboFix-quarantined-files.txt 2010-01-30 14:28

Vor Suchlauf: 3.984.990.208 Bytes frei
Nach Suchlauf: 3.930.570.752 Bytes frei

- - End Of File - - B05675014C84D32B6CEC9F58AE7352E9