Combofix Logfile: Code:
ComboFix 10-08-12.03 - Steffen 14.08.2010 0:36.1.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.49.1031.18.3066.1831 [GMT 2:00]
ausgeführt von:: c:\users\Steffen\Downloads\ComboFix.exe
SP: SUPERAntiSpyware *disabled* (Updated) {222A897C-5018-402e-943F-7E7AC8560DA7}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\system32\%appdata%
.
((((((((((((((((((((((( Dateien erstellt von 2010-07-13 bis 2010-08-13 ))))))))))))))))))))))))))))))
.
2010-08-13 22:43 . 2010-08-13 22:46 -------- d-----w- c:\users\Steffen\AppData\Local\temp
2010-08-13 22:43 . 2010-08-13 22:43 -------- d-----w- c:\users\Default\AppData\Local\temp
2010-08-13 22:09 . 2010-08-13 22:20 -------- d-----w- C:\_OTL
2010-08-13 19:48 . 2010-08-13 19:48 -------- d-----w- c:\programdata\WindowsSearch
2010-08-13 19:35 . 2010-08-13 19:35 -------- d-----w- c:\users\Steffen\AppData\Roaming\SUPERAntiSpyware.com
2010-08-13 19:35 . 2010-08-13 19:35 -------- d-----w- c:\programdata\SUPERAntiSpyware.com
2010-08-13 19:35 . 2010-08-13 19:35 -------- d-----w- c:\program files\SUPERAntiSpyware
2010-08-13 19:32 . 2010-08-13 19:32 -------- d-----w- c:\users\Steffen\AppData\Roaming\Malwarebytes
2010-08-13 19:32 . 2010-04-29 10:19 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-08-13 19:32 . 2010-08-13 19:32 -------- d-----w- c:\programdata\Malwarebytes
2010-08-13 19:32 . 2010-08-13 19:32 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-08-13 19:32 . 2010-04-29 10:19 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-08-13 00:43 . 2010-08-13 00:43 -------- d-----w- c:\programdata\TomTom
2010-08-13 00:43 . 2010-08-13 00:43 -------- d-----w- c:\users\Steffen\AppData\Roaming\TomTom
2010-08-13 00:43 . 2010-08-13 00:43 -------- d-----w- c:\users\Steffen\AppData\Local\TomTom
2010-08-13 00:43 . 2010-08-13 00:43 -------- d-----w- c:\program files\TomTom International B.V
2010-08-13 00:43 . 2010-08-13 00:43 -------- d-----w- c:\program files\TomTom HOME 2
2010-08-13 00:42 . 2010-08-13 00:42 -------- d-----w- c:\program files\TomTom DesktopSuite
2010-08-03 00:22 . 2010-08-03 00:22 -------- d-----w- c:\users\Steffen\AppData\Local\Apps
2010-07-26 18:18 . 2010-07-26 18:18 -------- d-----w- c:\program files\Microsoft FrontPage
2010-07-26 11:07 . 2010-07-26 11:07 -------- d-----w- c:\users\Default\AppData\Local\Microsoft Help
2010-07-26 00:23 . 2010-07-26 00:23 -------- d-----w- c:\users\Steffen\AppData\Roaming\Microsoft Web Folders
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-08-13 22:22 . 2008-01-21 07:15 628742 ----a-w- c:\windows\system32\perfh007.dat
2010-08-13 22:22 . 2008-01-21 07:15 126454 ----a-w- c:\windows\system32\perfc007.dat
2010-08-13 19:36 . 2010-08-13 19:36 63488 ----a-w- c:\users\Steffen\AppData\Roaming\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10006.dll
2010-08-13 19:36 . 2010-08-13 19:36 52224 ----a-w- c:\users\Steffen\AppData\Roaming\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10005.dll
2010-08-13 19:36 . 2010-08-13 19:36 117760 ----a-w- c:\users\Steffen\AppData\Roaming\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2010-08-13 19:27 . 2009-06-10 19:02 2528 ----a-w- c:\users\Steffen\AppData\Roaming\wklnhst.dat
2010-08-11 20:38 . 2008-11-20 10:24 -------- d-----w- c:\program files\Microsoft Works
2010-08-11 20:34 . 2008-11-20 10:27 -------- d-----w- c:\programdata\Microsoft Help
2010-08-11 20:34 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail
2010-08-10 21:49 . 2008-11-20 09:32 -------- d-----w- c:\program files\Common Files\Java
2010-08-10 21:49 . 2008-11-20 09:33 -------- d-----w- c:\program files\Java
2010-08-02 18:12 . 2010-04-15 20:35 1 ----a-w- c:\users\Steffen\AppData\Roaming\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
2010-07-28 00:28 . 2010-02-16 18:35 -------- d-----w- c:\program files\PokerStars.NET
2010-07-27 08:31 . 2009-05-20 17:14 89456 ----a-w- c:\users\Steffen\AppData\Local\GDIPFONTCACHEV1.DAT
2010-07-25 00:12 . 2009-05-21 17:45 -------- d-----w- c:\program files\Mozilla
2010-07-17 03:00 . 2010-06-22 14:19 423656 ----a-w- c:\windows\system32\deployJava1.dll
2010-07-03 21:33 . 2008-11-20 10:28 -------- d-----w- c:\program files\Microsoft.NET
2010-07-03 17:55 . 2010-07-03 17:55 -------- d-----w- c:\users\Steffen\AppData\Roaming\DVDVideoSoftIEHelpers
2010-07-03 17:54 . 2009-05-30 20:01 -------- d-----w- c:\program files\Common Files\DVDVideoSoft
2010-06-28 20:57 . 2010-06-29 14:21 38848 ----a-w- c:\windows\avastSS.scr
2010-06-28 20:57 . 2010-06-20 09:15 165032 ----a-w- c:\windows\system32\aswBoot.exe
2010-06-28 20:37 . 2010-06-20 09:16 46672 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2010-06-28 20:37 . 2010-06-20 09:16 165456 ----a-w- c:\windows\system32\drivers\aswSP.sys
2010-06-28 20:33 . 2010-06-20 09:16 23376 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2010-06-28 20:32 . 2010-06-20 09:16 50256 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2010-06-28 20:32 . 2010-06-20 09:16 17744 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2010-06-28 12:04 . 2010-06-28 09:43 -------- d-----w- c:\users\Steffen\AppData\Roaming\Verbindungsassistent
2010-06-28 09:41 . 2010-06-28 09:41 -------- d-----w- c:\program files\Verbindungsassistent
2010-06-28 09:41 . 2010-06-28 09:42 621056 ----a-w- c:\windows\system32\drivers\mod7700.sys
2010-06-28 09:41 . 2010-06-28 09:42 23424 ----a-w- c:\windows\system32\drivers\ewdcsc.sys
2010-06-26 06:05 . 2010-08-11 20:32 916480 ----a-w- c:\windows\system32\wininet.dll
2010-06-26 06:02 . 2010-08-11 20:32 71680 ----a-w- c:\windows\system32\iesetup.dll
2010-06-26 06:02 . 2010-08-11 20:32 109056 ----a-w- c:\windows\system32\iesysprep.dll
2010-06-26 04:25 . 2010-08-11 20:32 133632 ----a-w- c:\windows\system32\ieUnatt.exe
2010-06-23 07:15 . 2010-06-23 07:15 680 ----a-w- c:\users\Steffen\AppData\Local\d3d9caps.dat
2010-06-21 13:37 . 2010-08-11 20:32 2037760 ----a-w- c:\windows\system32\win32k.sys
2010-06-20 09:15 . 2010-06-20 09:15 -------- d-----w- c:\programdata\Alwil Software
2010-06-20 09:15 . 2009-05-21 19:38 -------- d-----w- c:\program files\Alwil Software
2010-06-20 09:10 . 2010-01-18 01:28 -------- d-----w- c:\program files\a-squared Free
2010-06-18 17:31 . 2010-08-11 20:32 36864 ----a-w- c:\windows\system32\rtutils.dll
2010-06-18 15:04 . 2010-08-11 20:32 302080 ----a-w- c:\windows\system32\drivers\srv.sys
2010-06-18 15:04 . 2010-08-11 20:32 144896 ----a-w- c:\windows\system32\drivers\srv2.sys
2010-06-16 16:04 . 2010-08-11 20:32 905088 ----a-w- c:\windows\system32\drivers\tcpip.sys
2010-06-11 16:16 . 2010-08-11 20:32 274944 ----a-w- c:\windows\system32\schannel.dll
2010-06-11 16:15 . 2010-08-11 20:32 1248768 ----a-w- c:\windows\system32\msxml3.dll
2010-06-08 17:35 . 2010-08-11 20:32 3548040 ----a-w- c:\windows\system32\ntoskrnl.exe
2010-06-08 17:35 . 2010-08-11 20:32 3600768 ----a-w- c:\windows\system32\ntkrnlpa.exe
2010-05-27 20:08 . 2010-08-11 20:32 81920 ----a-w- c:\windows\system32\iccvid.dll
2010-05-26 17:06 . 2010-07-03 21:30 34304 ----a-w- c:\windows\system32\atmlib.dll
2010-05-26 14:47 . 2010-07-03 21:30 289792 ----a-w- c:\windows\system32\atmfd.dll
2010-05-21 12:14 . 2009-10-03 15:44 221568 ------w- c:\windows\system32\MpSigStub.exe
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2009-08-24 7719456]
"TPwrMain"="c:\program files\TOSHIBA\Power Saver\TPwrMain.EXE" [2008-08-18 431456]
"Apoint"="c:\program files\Apoint2K\Apoint.exe" [2007-12-15 184320]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-21 1008184]
"Toshiba TEMPO"="c:\program files\Toshiba TEMPRO\Toshiba.Tempo.UI.TrayApplication.exe" [2008-08-26 103824]
"topi"="c:\program files\TOSHIBA\Toshiba Online Product Information\topi.exe" [2007-07-10 581632]
"SVPWUTIL"="c:\program files\TOSHIBA\Utilities\SVPWUTIL.exe" [2007-09-19 438272]
"SmoothView"="c:\program files\Toshiba\SmoothView\SmoothView.exe" [2008-06-24 509816]
"Skytel"="c:\program files\Realtek\Audio\HDA\Skytel.exe" [2009-08-24 1833504]
"NDSTray.exe"="NDSTray.exe" [BU]
"ITSecMng"="c:\program files\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe" [2007-09-28 75136]
"HWSetup"="c:\program files\TOSHIBA\Utilities\HWSetup.exe" [2007-04-16 421888]
"HSON"="c:\program files\TOSHIBA\TBS\HSON.exe" [2007-10-31 54608]
"HDMICtrlMan"="c:\program files\TOSHIBA\HDMICtrlMan\HDMICtrlMan.exe" [2008-05-20 716800]
"00TCrdMain"="c:\program files\TOSHIBA\FlashCards\TCrdMain.exe" [2008-09-24 727608]
"DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2010-06-03 1144104]
"avast5"="c:\progra~1\ALWILS~1\Avast5\avastUI.exe" [2010-06-28 2837864]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Bluetooth Manager.lnk - c:\program files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe [2008-4-15 2979144]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [1999-2-17 65588]
c:\users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
TRDCReminder.lnk - c:\program files\Toshiba\TRDCReminder\TRDCReminder.exe [2008-3-5 393216]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^AutoStart IR.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\AutoStart IR.lnk
backup=c:\windows\pss\AutoStart IR.lnk.CommonStartup
backupExtension=.CommonStartup
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^VPN Client.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\VPN Client.lnk
backup=c:\windows\pss\VPN Client.lnk.CommonStartup
backupExtension=.CommonStartup
[HKLM\~\startupfolder\C:^Users^Steffen^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk]
path=c:\users\Steffen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk
backup=c:\windows\pss\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk.Startup
backupExtension=.Startup
[HKLM\~\startupfolder\C:^Users^Steffen^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OpenOffice.org 3.2.lnk]
path=c:\users\Steffen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.2.lnk
backup=c:\windows\pss\OpenOffice.org 3.2.lnk.Startup
backupExtension=.Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2008-01-11 21:16 39792 ----a-w- c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Camera Assistant Software]
2008-09-26 12:22 417792 ----a-w- c:\program files\Camera Assistant Software for Toshiba\traybar.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KeNotify]
2006-11-06 16:14 34352 ----a-w- c:\program files\Toshiba\Utilities\KeNotify.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Malwarebytes Anti-Malware (reboot)]
2010-04-29 10:19 1090952 ----a-w- c:\program files\Malwarebytes' Anti-Malware\mbam.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SUPERAntiSpyware]
2010-07-19 17:50 2403568 ----a-w- c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TomTomHOME.exe]
2010-06-24 14:41 247144 ----a-w- c:\program files\TomTom HOME 2\TomTomHOMERunner.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Toshiba Registration]
2008-01-11 02:07 574864 ----a-w- c:\program files\Toshiba\Registration\ToshibaRegistration.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VeohPlugin]
2009-12-23 19:18 2642168 ----a-w- c:\program files\Veoh Networks\VeohWebPlayer\veohwebplayer.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"VistaSp2"=hex(b):d0,96,90,1c,0b,e1,c9,01
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R3 gtstusbser;Option210 USB Device for Legacy Serial Communication;c:\windows\system32\DRIVERS\gtstusbser.sys [x]
R3 hcw95bda;Hauppauge MOD7700 Tuner Driver;c:\windows\system32\Drivers\hcw95bda.sys [2008-09-09 562176]
R3 hcw95rc;Hauppauge MOD7700 IR Driver;c:\windows\system32\DRIVERS\hcw95rc.sys [2008-09-09 15616]
R3 JMCR;JMCR;c:\windows\system32\DRIVERS\jmcr.sys [2008-09-09 99216]
R3 PDNMp50;PDNMp50 NDIS Protocol Driver;c:\windows\system32\drivers\PDNMp50.sys [2006-11-28 28224]
R3 PDNSp50;PDNSp50 NDIS Protocol Driver;c:\windows\system32\drivers\PDNSp50.sys [2006-11-28 27072]
R3 TpChoice;Touch Pad Detection Filter driver;c:\windows\system32\DRIVERS\TpChoice.sys [x]
R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
R4 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-05-15 136176]
S1 aswSP;aswSP; [x]
S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [2010-02-17 12872]
S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2010-05-10 67656]
S2 aswFsBlk;aswFsBlk; [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2010-06-28 50256]
S2 ConfigFree Service;ConfigFree Service;c:\program files\TOSHIBA\ConfigFree\CFSvcs.exe [2008-09-05 40960]
S2 TempoMonitoringService;Notebook Performance Tuning Service ;c:\program files\Toshiba TEMPRO\TempoSVC.exe [2008-08-26 99720]
S2 TomTomHOMEService;TomTomHOMEService;c:\program files\TomTom HOME 2\TomTomHOMEService.exe [2010-06-24 92008]
S2 TOSHIBA SMART Log Service;TOSHIBA SMART Log Service;c:\program files\TOSHIBA\SMARTLogService\TosIPCSrv.exe [2008-07-15 106496]
S2 WTGService;WTGService;c:\program files\Verbindungsassistent\WTGService.exe [2009-03-03 296400]
S3 NETw5v32;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;c:\windows\system32\DRIVERS\NETw5v32.sys [2008-11-17 3668480]
S3 SmartFaceVWatchSrv;SmartFaceVWatchSrv;c:\program files\Toshiba\SmartFaceV\SmartFaceVWatchSrv.exe [2008-08-25 77824]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
.
Inhalt des "geplante Tasks" Ordners
2010-08-13 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-05-15 22:01]
2010-08-13 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-05-15 22:01]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT2102572
mStart Page = hxxp://www.google.com/ig/redirectdomain?brand=TSEA&bmod=TSEA
IE: Free YouTube to Mp3 Converter - c:\users\Steffen\AppData\Roaming\DVDVideoSoftIEHelpers\youtubetomp3.htm
IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
IE: {{76577871-04EC-495E-A12B-91F7C3600AFA} - hxxp://rover.ebay.com/rover/1/707-44556-9400-3/4
IE: {{8A918C1D-E123-4E36-B562-5C1519E434CE} - hxxp://www.amazon.de/exec/obidos/redirect-home?tag=Toshibadebholink-21&site=home
IE: {{FA9B9510-9FCB-4ca0-818C-5D0987B47C4D} - c:\program files\PokerStars.NET\PokerStarsUpdate.exe
TCP: {04302E6D-D44C-4A31-9610-60813B57E014} = 213.191.92.87 62.109.123.197
FF - ProfilePath - c:\users\Steffen\AppData\Roaming\Mozilla\Firefox\Profiles\8j74ji9b.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.de/
FF - plugin: c:\program files\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\Google\Update\1.2.183.23\npGoogleOneClick8.dll
FF - plugin: c:\program files\Java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\Microsoft\Office Live\npOLW.dll
FF - plugin: c:\program files\Mozilla\plugins\np-mswmp.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
---- FIREFOX Richtlinien ----
FF - user.js: network.cookie.cookieBehavior - 0
FF - user.js: privacy.clearOnShutdown.cookies - false
FF - user.js: security.warn_viewing_mixed - false
FF - user.js: security.warn_viewing_mixed.show_once - false
FF - user.js: security.warn_submit_insecure - false
FF - user.js: security.warn_submit_insecure.show_once - false
c:\program files\Mozilla\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla\greprefs\all.js - pref("network.IDN.whitelist.lu", true);
c:\program files\Mozilla\greprefs\all.js - pref("network.IDN.whitelist.nu", true);
c:\program files\Mozilla\greprefs\all.js - pref("network.IDN.whitelist.nz", true);
c:\program files\Mozilla\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);
c:\program files\Mozilla\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
c:\program files\Mozilla\greprefs\all.js - pref("network.IDN.whitelist.xn--p1ai", true);
c:\program files\Mozilla\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbayh7gpa", true);
c:\program files\Mozilla\greprefs\all.js - pref("network.IDN.whitelist.tel", true);
c:\program files\Mozilla\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla\greprefs\all.js - pref("network.proxy.type", 5);
c:\program files\Mozilla\greprefs\all.js - pref("network.buffer.cache.count", 24);
c:\program files\Mozilla\greprefs\all.js - pref("network.buffer.cache.size", 4096);
c:\program files\Mozilla\greprefs\all.js - pref("dom.ipc.plugins.timeoutSecs", 45);
c:\program files\Mozilla\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla\greprefs\all.js - pref("accelerometer.enabled", true);
c:\program files\Mozilla\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\Mozilla\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\Mozilla\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.nptest.dll", true);
c:\program files\Mozilla\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npswf32.dll", true);
c:\program files\Mozilla\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npctrl.dll", true);
c:\program files\Mozilla\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npqtplugin.dll", true);
c:\program files\Mozilla\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
HKCU-Run-TOSCDSPD - TOSCDSPD.EXE
HKLM-Run-WinCast - f:\cdsetup\setup.exe
MSConfigStartUp-cfFncEnabler - cfFncEnabler.exe
MSConfigStartUp-Google Desktop Search - c:\program files\Google\Google Desktop Search\GoogleDesktop.exe
MSConfigStartUp-Google EULA Launcher - c:\program files\Google\Google EULA\GoogleEULALauncher.exe
MSConfigStartUp-mcagent_exe - c:\program files\McAfee.com\Agent\mcagent.exe
MSConfigStartUp-NotebookHardwareControl - c:\program files\Notebook Hardware Control\nhc.exe
MSConfigStartUp-swg - c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
AddRemove-{7B63B2922B174135AFC0E1377DD81EC2} - c:\program files\DivX\DivXCodecUninstall.exe
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2010-08-14 00:46
Windows 6.0.6002 Service Pack 2 NTFS
Scanne versteckte Prozesse...
Scanne versteckte Autostarteinträge...
Scanne versteckte Dateien...
Scan erfolgreich abgeschlossen
versteckte Dateien: 0
**************************************************************************
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
[HKEY_USERS\S-1-5-21-3750558958-722459407-3709898320-1000\Software\SecuROM\License information*]
"datasecu"=hex:22,00,93,a2,83,da,b5,7d,22,0f,8c,a0,21,de,d8,96,44,bc,9d,1b,c1,
95,7f,9e,09,c8,97,29,00,9c,da,55,fe,ea,8b,a8,a3,a0,00,c1,26,37,13,c6,58,a5,\
"rkeysecu"=hex:26,94,47,22,e6,0d,f2,27,0c,3e,b9,07,10,8f,f4,0a
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
c:\windows\system32\Ati2evxx.exe
c:\windows\system32\Ati2evxx.exe
c:\program files\Alwil Software\Avast5\AvastSvc.exe
c:\windows\system32\agrsmsvc.exe
c:\program files\Cisco Systems\VPN Client\cvpnd.exe
c:\program files\CDBurnerXP\NMSAccessU.exe
c:\program files\Toshiba\TOSHIBA DVD PLAYER\TNaviSrv.exe
c:\windows\system32\TODDSrv.exe
c:\program files\Toshiba\Power Saver\TosCoSrv.exe
c:\program files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe
c:\program files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
c:\windows\system32\conime.exe
c:\program files\Toshiba\ConfigFree\NDSTray.exe
c:\program files\Alwil Software\Avast5\AvastUI.exe
c:\program files\Toshiba\TOSCDSPD\TOSCDSPD.exe
c:\windows\ehome\ehmsas.exe
c:\program files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe
c:\program files\Toshiba\ConfigFree\CFSwMgr.exe
c:\program files\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe
c:\program files\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe
c:\program files\Toshiba\HDMICtrlMan\HCMSoundChanger.exe
c:\windows\servicing\TrustedInstaller.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2010-08-14 00:54:02 - PC wurde neu gestartet
ComboFix-quarantined-files.txt 2010-08-13 22:53
Vor Suchlauf: 11 Verzeichnis(se), 68.529.229.824 Bytes frei
Nach Suchlauf: 15 Verzeichnis(se), 68.240.838.656 Bytes frei
Current=1 Default=1 Failed=0 LastKnownGood=10 Sets=1,2,3,4,5,6,7,8,9,10
- - End Of File - - 90838FC44F19C6E0102C57C1B964E05E
--- --- ---
Datei hochgeladen! |
