Trojaner-Board - Trojan Downloader über Video, bin ich infiziert?

Die Analyse hat ergeben:

asutl8.dll
No malicious code was found in this file.

Habe die Datei einfach wieder in den Ordner gepackt, wo sie her kam. Habe Combofix auf Anweisung rüberlaufen lassen:

ComboFix 10-02-12.01 - xxx 16.02.2010 20:32:39.1.4 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.49.1031.18.3582.2468 [GMT 1:00]
ausgeführt von:: c:\users\xxx\Desktop\ComboFix.exe
SP: Spybot - Search and Destroy *disabled* (Updated) {ED588FAF-1B8F-43B4-ACA8-8E3C85DADBE9}
SP: Windows-Defender *disabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.
ADS - Windows: deleted 24 bytes in 1 streams.

(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\$recycle.bin\S-1-5-21-2152478756-3922319563-605102323-500
c:\$recycle.bin\S-1-5-21-3949726345-2052250809-806689871-1001
c:\$recycle.bin\S-1-5-21-3949726345-2052250809-806689871-1009
C:\install.exe
c:\program files\Cheat Engine\dbk32.sys
c:\programdata\hpe477A.dll
c:\users\xxx\AppData\Roaming\.#
c:\windows\PCGWIN32.LI5
c:\windows\system32\16720617.dll
c:\windows\system32\9347340.dll
c:\windows\system32\VB6KO.DLL
F:\Autorun.Inf

.
((((((((((((((((((((((( Dateien erstellt von 2010-01-16 bis 2010-02-16 ))))))))))))))))))))))))))))))
.

2010-02-16 19:29 . 2002-06-06 00:01 29696 ----a-w- c:\windows\system32\asutl8.dll
2010-02-15 14:51 . 2010-02-15 15:24 -------- d-----w- c:\programdata\Spybot - Search & Destroy
2010-02-15 14:51 . 2010-02-15 14:52 -------- d-----w- c:\program files\Spybot - Search & Destroy
2010-02-15 01:15 . 2010-02-15 01:15 -------- d-----w- c:\program files\Microsoft Network Monitor 3
2010-02-14 23:54 . 2010-02-14 23:56 -------- d-----w- c:\users\xxx\AppData\Roaming\Thunderbird
2010-02-14 22:30 . 2010-02-14 22:30 -------- d-----w- C:\archdb
2010-02-14 21:57 . 2010-02-14 21:57 360448 ----a-w- c:\users\xxx\AppData\Roaming\Notepad++\plugins\config\plugin_install_temp\plugin1\NppExec.dll
2010-02-14 21:03 . 2010-02-14 21:03 -------- d-----w- c:\program files\Common Files\xing shared
2010-02-14 20:55 . 2009-12-08 20:01 3600456 ----a-w- c:\windows\system32\ntkrnlpa.exe
2010-02-14 20:55 . 2009-12-08 20:01 3548216 ----a-w- c:\windows\system32\ntoskrnl.exe
2010-02-12 22:50 . 2010-02-12 22:58 -------- d-----w- C:\rsit
2010-02-11 20:58 . 2010-02-11 21:11 -------- d-----w- c:\users\xxx\AppData\Local\Temporary Projects
2010-02-11 19:26 . 2010-02-11 19:26 -------- d-----w- c:\users\xxx\AppData\Roaming\PeerNetworking
2010-02-02 22:20 . 2010-02-02 22:41 -------- d-----w- c:\program files\VstPlugins
2010-02-02 22:20 . 2010-02-02 22:20 -------- d-----w- c:\program files\Outsim
2010-02-02 22:17 . 2010-02-02 22:20 -------- d-----w- c:\program files\Image-Line
2010-02-02 01:16 . 2010-02-02 01:16 -------- d-----w- c:\program files\iPod
2010-02-02 01:16 . 2010-02-02 01:17 -------- d-----w- c:\program files\iTunes
2010-02-02 01:08 . 2010-02-02 01:08 72488 ----a-w- c:\programdata\Apple Computer\Installer Cache\iTunes 9.0.3.15\SetupAdmin.exe
2010-01-31 18:28 . 2010-01-31 18:28 -------- d-----w- c:\users\xxx\AppData\Roaming\Foxit
2010-01-31 01:26 . 2010-01-31 01:26 -------- d-----w- C:\OgreSDK
2010-01-30 23:25 . 2010-01-30 23:25 -------- d-----w- c:\program files\Common Files\Merge Modules
2010-01-29 01:33 . 2008-07-11 00:27 92184 ----a-w- c:\windows\system32\SQSRVRES.DLL
2010-01-27 19:46 . 2010-01-27 19:46 -------- d-----w- c:\users\xxx\AppData\Roaming\funkitron
2010-01-27 13:22 . 2010-01-27 13:22 88 ----a-w- c:\programdata\BOINC\slots\1\libfftw3f-3-1-1a_upx.dll
2010-01-27 13:22 . 2010-01-27 13:22 100 ----a-w- c:\programdata\BOINC\slots\1\setiathome_6.03_windows_intelx86.exe
2010-01-27 13:08 . 2010-01-30 12:00 88 ----a-w- c:\programdata\BOINC\slots\4\libfftw3f-3-1-1a_upx.dll
2010-01-27 13:08 . 2010-01-30 12:00 100 ----a-w- c:\programdata\BOINC\slots\4\setiathome_6.03_windows_intelx86.exe
2010-01-27 13:08 . 2010-01-27 13:08 88 ----a-w- c:\programdata\BOINC\slots\3\libfftw3f-3-1-1a_upx.dll
2010-01-27 13:08 . 2010-01-27 13:08 100 ----a-w- c:\programdata\BOINC\slots\3\setiathome_6.03_windows_intelx86.exe
2010-01-25 15:11 . 2010-01-25 15:12 -------- d-----w- c:\program files\NCsoft
2010-01-24 20:16 . 2010-01-24 21:41 -------- d-----w- c:\program files\Warcraft III
2010-01-23 21:48 . 2010-01-23 21:49 -------- d-----w- c:\users\xxx\AppData\Roaming\XLEHRBUCH
2010-01-23 21:45 . 2010-01-29 01:10 -------- d-----w- c:\users\xxx\AppData\Roaming\XProfanFree
2010-01-22 00:05 . 2010-01-22 00:05 -------- d-----w- C:\Mp3 Output
2010-01-21 18:10 . 2010-01-21 18:10 -------- d-----w- c:\program files\Common Files\eBay
2010-01-19 17:56 . 2010-01-19 18:02 -------- d-----w- c:\program files\Frets on Fire
2010-01-18 19:35 . 2010-01-18 19:35 -------- d-----w- c:\users\xxx\Library
2010-01-18 19:35 . 2010-01-18 19:35 -------- d-----w- c:\users\xxx\AppData\Roaming\com.adobe.ExMan

.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-02-16 19:43 . 2009-09-18 11:46 -------- d-----w- c:\program files\Cheat Engine
2010-02-16 19:25 . 2008-04-05 20:49 -------- d-----w- c:\users\xxx\AppData\Roaming\Orbit
2010-02-16 19:16 . 2010-01-04 16:54 -------- d-----w- c:\programdata\Kaspersky Lab
2010-02-16 19:15 . 2010-01-13 19:42 -------- d-----w- c:\program files\Common Files\Akamai
2010-02-16 19:15 . 2007-10-21 12:15 -------- d-----w- c:\programdata\NVIDIA
2010-02-16 16:23 . 2007-10-21 16:18 12 ----a-w- c:\windows\bthservsdp.dat
2010-02-15 21:36 . 2008-06-01 13:11 -------- d-----w- c:\programdata\Google Updater
2010-02-14 23:37 . 2008-03-01 17:24 -------- d-----w- c:\program files\Paragon Software
2010-02-14 22:26 . 2009-12-29 18:56 -------- d-----w- c:\programdata\Paragon
2010-02-14 21:03 . 2008-01-30 19:43 -------- d-----w- c:\program files\Common Files\Real
2010-02-12 23:26 . 2008-08-22 11:26 -------- d-----w- c:\users\xxx\AppData\Roaming\FileZilla
2010-02-12 19:42 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail
2010-02-12 16:27 . 2008-04-02 11:02 -------- d-----w- c:\program files\Common Files\Steam
2010-02-12 16:27 . 2008-09-12 19:02 -------- d-----w- c:\program files\Steam
2010-02-12 13:02 . 2007-11-05 18:07 -------- d-----w- c:\program files\Google
2010-02-11 19:24 . 2007-10-21 14:37 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-02-04 16:34 . 2008-12-22 23:46 1 ----a-w- c:\users\xxx\AppData\Roaming\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
2010-02-02 01:16 . 2007-10-21 19:48 -------- d-----w- c:\program files\Common Files\Apple
2010-02-02 01:13 . 2009-09-15 18:21 -------- d-----w- c:\program files\QuickTime
2010-01-31 18:47 . 2007-11-06 14:09 -------- d-----w- c:\program files\SlySoft
2010-01-30 23:26 . 2009-02-09 17:58 113216 ----a-w- c:\programdata\Microsoft\VCExpress\9.0\1031\ResourceCache.dll
2010-01-30 23:26 . 2007-10-31 11:52 -------- d-----w- c:\programdata\Microsoft Help
2010-01-30 23:26 . 2009-02-09 17:58 416 ----a-w- c:\programdata\Microsoft\MSDN\9.0\1031\ResourceCache.dll
2010-01-30 12:01 . 2009-09-27 19:14 -------- d-----w- c:\programdata\BOINC
2010-01-29 01:28 . 2009-02-09 17:59 -------- d-----w- c:\program files\Microsoft SQL Server
2010-01-28 12:10 . 2010-01-13 09:20 88 ----a-w- c:\programdata\BOINC\slots\2\libfftw3f-3-1-1a_upx.dll
2010-01-28 12:10 . 2010-01-13 09:20 100 ----a-w- c:\programdata\BOINC\slots\2\setiathome_6.03_windows_intelx86.exe
2010-01-24 20:20 . 2008-07-09 19:49 -------- d-----w- c:\program files\Common Files\Blizzard Entertainment
2010-01-24 18:21 . 2007-10-21 19:14 -------- d-----w- c:\program files\Mozilla Thunderbird
2010-01-22 23:00 . 2007-12-09 19:35 -------- d-----w- c:\programdata\Lavasoft
2010-01-22 14:16 . 2007-10-24 16:43 -------- d-----w- c:\program files\Common Files\Java
2010-01-22 14:16 . 2007-10-24 16:44 -------- d-----w- c:\program files\Java
2010-01-22 00:19 . 2007-11-07 16:49 -------- d-----w- c:\program files\Smallvideosoft
2010-01-22 00:16 . 2007-10-21 19:11 -------- d-----w- c:\program files\Common Files\DVDVIDEOSOFT
2010-01-22 00:16 . 2008-03-29 14:53 -------- d-----w- c:\program files\DVDVideoSoft
2010-01-21 18:10 . 2008-12-14 21:02 -------- d-----w- c:\program files\VDOWNLOADER
2010-01-20 15:05 . 2008-04-27 19:46 -------- d-----w- c:\program files\Microsoft Silverlight
2010-01-20 11:14 . 2009-07-04 11:57 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-01-20 11:14 . 2009-12-13 21:42 5115824 ----a-w- c:\programdata\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
2010-01-19 23:56 . 2007-10-21 19:41 -------- d-----w- c:\users\xxx\AppData\Roaming\Skype
2010-01-19 23:01 . 2008-04-01 18:09 -------- d-----w- c:\users\xxx\AppData\Roaming\skypePM
2010-01-19 20:00 . 2009-02-18 19:56 -------- d-----w- c:\program files\Lavasoft
2010-01-19 17:32 . 2007-10-22 09:51 -------- d-----w- c:\programdata\Messenger Plus!
2010-01-19 17:32 . 2007-10-21 19:30 -------- d-----w- c:\program files\Messenger Plus! Live
2010-01-18 19:45 . 2008-08-14 06:57 73312 ----a-w- c:\windows\system32\drivers\adfs.sys
2010-01-15 21:02 . 2008-05-04 18:25 -------- d-----w- c:\program files\Common Files\Adobe
2010-01-14 10:12 . 2009-10-02 17:38 181120 ------w- c:\windows\system32\MpSigStub.exe
2010-01-13 22:17 . 2007-10-21 11:51 75208 ----a-w- c:\users\xxx\AppData\Local\GDIPFONTCACHEV1.DAT
2010-01-13 22:02 . 2010-01-13 22:02 -------- d-----w- c:\program files\Common Files\Macrovision Shared
2010-01-13 20:39 . 2009-10-25 13:51 -------- d-----w- c:\program files\Macromedia
2010-01-13 20:38 . 2009-10-25 13:51 -------- d-----w- c:\program files\Common Files\Macromedia
2010-01-13 19:31 . 2010-01-13 19:31 1273592 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll
2010-01-13 09:48 . 2010-01-13 09:48 413696 ----a-w- c:\windows\system32\wrap_oal.dll
2010-01-13 09:48 . 2010-01-13 09:48 110592 ----a-w- c:\windows\system32\OpenAL32.dll
2010-01-13 09:48 . 2010-01-13 09:48 -------- d-----w- c:\program files\OpenAL
2010-01-08 23:18 . 2009-12-24 20:20 -------- d-----w- c:\program files\dcmsvc
2010-01-07 15:07 . 2009-07-04 11:57 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-01-07 15:07 . 2009-07-04 11:57 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-01-06 11:50 . 2009-12-24 18:36 -------- d-----w- c:\program files\lg_fwupdate
2010-01-04 18:27 . 2008-02-01 10:49 -------- d-----w- c:\program files\DNA
2010-01-04 18:20 . 2008-02-01 10:49 -------- d-----w- c:\users\xxx\AppData\Roaming\DNA
2010-01-04 16:59 . 2010-01-04 16:59 80400 ----a-w- c:\programdata\Kaspersky Lab\AVP9\Data\Updater\Temporary Files\rollback\patch\AutoPatches\kav9exec\9.0.0.736\fssync.dll
2010-01-04 16:59 . 2010-01-04 16:59 80400 ----a-w- c:\programdata\Kaspersky Lab\AVP9\Data\Updater\Temporary Files\temporaryFolder\AutoPatches\kav9exec\9.0.0.736\fssync.dll
2010-01-04 16:56 . 2010-01-04 16:56 95259 ----a-w- c:\windows\system32\drivers\klick.dat
2010-01-04 16:56 . 2010-01-04 16:56 108059 ----a-w- c:\windows\system32\drivers\klin.dat
2010-01-04 16:54 . 2010-01-04 16:54 -------- d-----w- c:\program files\Kaspersky Lab
2010-01-04 16:51 . 2010-01-04 16:51 -------- d-----w- c:\programdata\Kaspersky Lab Setup Files
2010-01-04 14:13 . 2009-12-29 18:49 40560 ----a-w- c:\windows\system32\drivers\hotcore3.sys
2010-01-03 15:19 . 2010-01-03 15:16 -------- d-----w- c:\program files\sges-v3
2010-01-03 15:16 . 2010-01-03 15:07 -------- d-----w- c:\program files\NetBeans 6.8
2010-01-02 06:38 . 2010-01-22 12:02 916480 ----a-w- c:\windows\system32\wininet.dll
2010-01-02 06:32 . 2010-01-22 12:02 71680 ----a-w- c:\windows\system32\iesetup.dll
2010-01-02 06:32 . 2010-01-22 12:02 109056 ----a-w- c:\windows\system32\iesysprep.dll
2010-01-02 04:57 . 2010-01-22 12:02 133632 ----a-w- c:\windows\system32\ieUnatt.exe
2010-01-01 23:32 . 2010-01-01 23:32 -------- d-----w- c:\users\xxx\AppData\Roaming\VitySoft
2010-01-01 23:15 . 2009-08-26 17:28 -------- d-----w- c:\program files\Orbitdownloader
2010-01-01 21:01 . 2007-10-21 19:23 -------- d-----w- c:\program files\DivX
2010-01-01 21:00 . 2009-04-10 22:29 -------- d-----w- c:\program files\Common Files\DivX Shared
2009-12-29 19:20 . 2009-12-29 19:20 439816 ----a-w- c:\users\xxx\AppData\Roaming\Real\Update\setup3.09\setup.exe
2009-12-29 19:13 . 2009-12-24 18:25 -------- d-----w- c:\programdata\CyberLink
2009-12-28 20:59 . 2009-12-28 20:54 -------- d-----w- c:\program files\Runtime Software
2009-12-28 20:32 . 2009-12-28 20:32 -------- d-----w- c:\program files\EASEUS
2009-12-28 17:34 . 2006-11-02 15:33 693522 ----a-w- c:\windows\system32\perfh007.dat
2009-12-28 17:34 . 2006-11-02 15:33 151252 ----a-w- c:\windows\system32\perfc007.dat
2009-12-24 20:19 . 2009-12-24 20:19 -------- d-----w- c:\users\xxx\AppData\Roaming\com.warnerbros.DigitalCopyManager.449F66ACC381FDC604DC2AA255FEECEEBBBEE1E5.1
2009-12-24 20:19 . 2009-12-24 20:19 -------- d-----w- c:\program files\Common Files\Adobe AIR
2009-12-24 20:19 . 2009-12-24 20:19 38784 ----a-w- c:\users\Default\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2009-12-24 19:29 . 2009-12-24 18:29 -------- d-----w- c:\users\xxx\AppData\Roaming\CyberLink
2009-12-24 19:01 . 2009-12-24 18:26 -------- d-----w- c:\program files\CyberLink
2009-12-24 18:37 . 2009-12-24 18:36 16384 ----a-w- c:\windows\system32\lgfwunis.exe
2009-12-24 18:36 . 2009-12-24 18:36 53319 ----a-w- c:\programdata\TEMP\{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}\PostBuild.exe
2009-12-24 18:34 . 2009-12-24 18:34 36864 ----a-w- c:\programdata\TEMP\{B7A0CE06-068E-11D6-97FD-0050BACBF861}\PostBuild.exe
2009-12-24 18:29 . 2009-12-24 18:29 36864 ----a-w- c:\programdata\TEMP\{40BF1E83-20EB-11D8-97C5-0009C5020658}\PostBuild.exe
2009-12-24 18:27 . 2009-12-24 18:27 36864 ----a-w- c:\programdata\TEMP\{80E158EA-7181-40FE-A701-301CE6BE64AB}\PostBuild.exe
2009-12-24 18:26 . 2009-12-24 18:26 -------- d-----w- c:\program files\Common Files\LightScribe
2009-12-24 18:24 . 2009-12-24 18:24 53319 ----a-w- c:\programdata\TEMP\{5DB1DF0C-AABC-4362-8A6D-CEFDFB036E41}\PostBuild.exe
2009-12-24 17:53 . 2008-04-15 13:02 -------- d-----w- c:\users\xxx\AppData\Roaming\Download Manager
2009-12-23 21:58 . 2007-11-05 11:02 -------- d-----w- c:\users\xxx\AppData\Roaming\Lionhead Studios
2009-12-21 13:54 . 2009-12-21 13:29 -------- d-----w- c:\program files\qml-edit2
2009-12-21 13:29 . 2009-12-21 10:27 1272320 ----a-r- c:\users\xxx\AppData\Roaming\Microsoft\Installer\{96349B99-2B01-11D6-A498-00C0CA17CB87}\MSXML4.exe
2007-12-14 17:33 . 2007-12-14 17:31 24 --sh--w- c:\windows\S7275A522.tmp
.

(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]
"Sony Ericsson PC Suite"="c:\program files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe" [2009-09-24 434176]
"VeohPlugin"="c:\program files\Veoh Networks\VeohWebPlayer\veohwebplayer.exe" [2009-10-06 2075384]
"LightScribe Control Panel"="c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe" [2008-07-30 2363392]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 202240]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"VC7Player"="c:\program files\HHVcdV7Sys\VC7Play.exe" [2005-11-24 237568]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-09-03 111936]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-01-11 246504]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-04-14 13687328]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-04-14 92704]
"UpdateLBPShortCut"="c:\program files\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe" [2008-02-21 222504]
"CLMLServer"="c:\program files\CyberLink\Power2Go\CLMLSvc.exe" [2008-07-18 104936]
"UpdateP2GoShortCut"="c:\program files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" [2008-09-24 210216]
"UpdatePPShortCut"="c:\program files\CyberLink\PowerProducer\MUITransfer\MUIStartMenu.exe" [2008-06-13 210216]
"UpdatePSTShortCut"="c:\program files\CyberLink\Blu-ray Disc Suite\MUITransfer\MUIStartMenu.exe" [2008-10-20 210216]
"BDRegion"="c:\program files\Cyberlink\Shared Files\brs.exe" [2009-09-04 75048]
"RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2009-04-16 87336]
"LanguageShortcut"="c:\program files\CyberLink\PowerDVD\Language\Language.exe" [2009-04-16 62760]
"AVP"="c:\program files\Kaspersky Lab\Kaspersky Anti-Virus 2010\avp.exe" [2009-10-20 340456]
"AdobeCS4ServiceManager"="c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" [2010-01-18 611712]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-11-10 417792]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-01-22 141608]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\progra~1\KASPER~1\KASPER~1\mzvkbd3.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux2"=wdmaud.drv

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LGODDFU]
2009-12-24 18:36 557056 ----a-w- c:\program files\lg_fwupdate\fwupdate.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PhonostarTimer]
2007-12-05 15:14 126976 ----a-w- c:\program files\phonostar\ps_timer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-disabled]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" -osboot
"NBKeyScan"="c:\program files\Nero\Nero BackItUp 4\NBKeyScan.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"VistaSp2"=hex(b):8a,0b,0b,d7,f5,fc,c9,01

R0 CLBStor;CyberLink InstantBurn UDF Reader Help Driver;c:\windows\System32\drivers\CLBStor.sys [24.12.2009 19:31 10368]
R0 hotcore3;Hotcore helper;c:\windows\System32\drivers\hotcore3.sys [29.12.2009 19:49 40560]
R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\System32\drivers\klbg.sys [14.10.2009 20:18 36880]
R1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter;c:\windows\System32\drivers\klim6.sys [03.11.2009 16:33 21520]
R1 nm3;Microsoft Network Monitor 3 Driver;c:\windows\System32\drivers\nm3.sys [14.04.2009 12:30 33624]
R1 VBoxDrv;VirtualBox Service;c:\windows\System32\drivers\VBoxDrv.sys [21.10.2007 20:45 33608]
R1 VBoxUSBMon;VirtualBox USB Monitor Driver;c:\windows\System32\drivers\VBoxUSBMon.sys [21.10.2007 20:45 28008]
R1 vdrv7000;vdrv7000;c:\windows\System32\drivers\vdrv7000.sys [27.11.2007 21:51 76672]
R2 Akamai;Akamai NetSession Interface;c:\windows\System32\svchost.exe -k Akamai [27.04.2008 10:54 21504]
R2 CLBUDFR;CyberLink UDF Filesystem;c:\windows\System32\drivers\CLBUDFR.sys [24.12.2009 19:31 154368]
R2 EmmaDevMgmtSvc;Emma Device Management;c:\program files\Common Files\Sony Ericsson\Emma Core\Services\EmmaDeviceMgmt.exe [29.10.2009 20:48 306296]
R2 EmmaUpdMgmtSvc;Emma Update Management;c:\program files\Common Files\Sony Ericsson\Emma Core\Services\EmmaUpdateMgmt.exe [29.10.2009 20:48 162936]
R2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [27.09.2009 16:48 240232]
R2 VC7SecS;Virtual CD v7 Management Service;c:\program files\HHVcdV7Sys\VC7SecS.exe [27.11.2007 21:51 106496]
R3 klmouflt;Kaspersky Lab KLMOUFLT;c:\windows\System32\drivers\klmouflt.sys [02.10.2009 18:39 19472]
R3 seehcri;Sony Ericsson seehcri Device Driver;c:\windows\System32\drivers\seehcri.sys [13.11.2009 19:18 27632]
R3 VCSVADHWSer;Avnex Virtual Audio Device (WDM);c:\windows\System32\drivers\vcsvad.sys [27.05.2009 20:49 17792]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [25.09.2009 22:48 133104]
S2 OMSI download service;Sony Ericsson OMSI download service;c:\program files\Sony Ericsson\Sony Ericsson PC Suite\SupServ.exe [13.11.2009 19:18 90112]
S3 ASPI;Advanced SCSI Programming Interface Driver;c:\windows\System32\drivers\ASPI32.SYS [17.06.2008 15:43 84832]
S3 ggflt;SEMC USB Flash Driver Filter;c:\windows\System32\drivers\ggflt.sys [06.04.2009 09:13 13224]
S3 s3017bus;Sony Ericsson Device 3017 driver (WDM);c:\windows\System32\drivers\s3017bus.sys [17.01.2009 23:14 83880]
S3 s3017mdfl;Sony Ericsson Device 3017 USB WMC Modem Filter;c:\windows\System32\drivers\s3017mdfl.sys [17.01.2009 23:15 15016]
S3 s3017mdm;Sony Ericsson Device 3017 USB WMC Modem Driver;c:\windows\System32\drivers\s3017mdm.sys [17.01.2009 23:15 110632]
S3 s3017mgmt;Sony Ericsson Device 3017 USB WMC Device Management Drivers (WDM);c:\windows\System32\drivers\s3017mgmt.sys [17.01.2009 23:16 104616]
S3 s3017nd5;Sony Ericsson Device 3017 USB Ethernet Emulation SEMC3017 (NDIS);c:\windows\System32\drivers\s3017nd5.sys [17.01.2009 23:17 25512]
S3 s3017obex;Sony Ericsson Device 3017 USB WMC OBEX Interface;c:\windows\System32\drivers\s3017obex.sys [17.01.2009 23:16 100648]
S3 s3017unic;Sony Ericsson Device 3017 USB Ethernet Emulation SEMC3017 (WDM);c:\windows\System32\drivers\s3017unic.sys [17.01.2009 23:17 110120]
S3 scramby_out;Scramby Output;c:\windows\System32\drivers\scramby_out.sys [08.08.2007 09:31 23840]
S3 SynasUSB;SynasUSB;c:\windows\System32\drivers\synasUSB.sys [19.08.2009 22:40 16896]
S3 VBoxUSB;VirtualBox USB;c:\windows\System32\drivers\VBoxUSB.sys [06.06.2007 00:19 30952]
S4 MSSQLServerADHelper100;SQL Server Hilfsdienst für Active Directory;c:\program files\Microsoft SQL Server\100\Shared\sqladhlp.exe [11.07.2008 01:27 47128]
S4 RsFx0103;RsFx0103 Driver;c:\windows\System32\drivers\RsFx0103.sys [30.03.2009 03:09 239336]
S4 SQLAgent$SQLEXPRESS;SQL Server-Agent (SQLEXPRESS);c:\program files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE [30.03.2009 03:23 366936]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs REG_MULTI_SZ BthServ
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
Akamai REG_MULTI_SZ Akamai

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2008-07-30 09:39 451872 ----a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe
.
Inhalt des "geplante Tasks" Ordners

2010-02-16 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-06-01 15:49]

2010-02-16 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-09-25 21:48]

2010-02-16 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-09-25 21:48]

2010-02-16 c:\windows\Tasks\User_Feed_Synchronization-{6AFC9B1B-7251-4D1B-8B2A-6D94805AE7C2}.job
- c:\windows\system32\msfeedssync.exe [2010-01-22 04:56]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.google.de/
uInternet Settings,ProxyOverride = *.local
IE: &Download by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/201
IE: &Grab video by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/204
IE: Do&wnload selected by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/203
IE: Down&load all by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/202
LSP: c:\windows\system32\wpclsp.dll
DPF: {162247AF-26A7-44FC-A93A-69506EA244F3} - hxxps://account.maxdome.de/presentation/script/HWTest.CAB
FF - ProfilePath - c:\users\xxx\AppData\Roaming\Mozilla\Firefox\Profiles\qdzn91ob.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF - prefs.js: browser.startup.homepage - hxxp://www.onlinetvrecorder.com/
FF - component: c:\program files\Mozilla Firefox\extensions\linkfilter@kaspersky.ru\components\KavLinkFilter.dll
FF - plugin: c:\program files\DivX\DivX Plus Web Player\npdivx32.dll
FF - plugin: c:\program files\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll
FF - plugin: c:\program files\Google\Update\1.2.183.13\npGoogleOneClick8.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npbittorrent.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npPandoWebInst.dll
FF - plugin: c:\program files\Photosynth\npPhotosynthMozilla.dll
FF - plugin: c:\program files\Veoh Networks\VeohWebPlayer\npWebPlayerVideoPluginATL.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX Richtlinien ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-02-16 20:44
Windows 6.0.6002 Service Pack 2 NTFS

Scanne versteckte Prozesse...

Scanne versteckte Autostarteinträge...

Scanne versteckte Dateien...

Scan erfolgreich abgeschlossen
versteckte Dateien: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\{95808DC4-FA4A-4C74-92FE-5B863F82066B}]
"ImagePath"="\??\c:\program files\CyberLink\PowerDVD\000.fcl"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------

[HKEY_USERS\S-1-5-21-3949726345-2052250809-806689871-1000\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
@Allowed: (Read) (RestrictedCode)
"??"=hex:a8,c2,2f,b6,eb,cf,cd,b7,6e,f7,80,2c,10,ff,8e,98,1e,fd,d6,cd,3c,63,47,
97,8e,a9,33,3a,d6,82,4e,d3,fb,7f,34,90,5b,3e,3e,5b,1b,f9,24,bc,cb,19,33,f4,\
"??"=hex:ca,f1,45,1b,92,f6,63,7f,71,79,b8,2a,b3,2b,7f,7c

[HKEY_USERS\S-1-5-21-3949726345-2052250809-806689871-1000\Software\SecuROM\License information*]
"datasecu"=hex:b2,fe,e6,30,35,6f,4b,34,03,d1,b8,2b,e0,50,aa,f4,04,d1,5b,a8,6d,
29,7c,a5,78,f7,e0,d2,f6,ce,88,d0,a4,76,0c,b2,54,87,3d,b2,f9,ad,4a,66,47,0d,\
"rkeysecu"=hex:68,c8,0f,b1,57,f4,e6,60,ee,81,80,0c,bf,d1,8c,35

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0005\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0006\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0007\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0008\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0009\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0010\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0011\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Zeit der Fertigstellung: 2010-02-16 20:48:23
ComboFix-quarantined-files.txt 2010-02-16 19:48

Vor Suchlauf: 37 Verzeichnis(se), 16.241.147.904 Bytes frei
Nach Suchlauf: 41 Verzeichnis(se), 16.124.370.944 Bytes frei

Current=1 Default=1 Failed=0 LastKnownGood=5 Sets=1,2,3,4,5,6
- - End Of File - - A803DA572C39F92E3D5ABC40F777DB20