Trojaner-Board
Seite 1 von 2 1 2
100 Beiträge dieses Themas auf einer Seite anzeigen

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   nach Security Tool eigenständiges öffnen v. webseiten und java (https://www.trojaner-board.de/91206-security-tool-eigenstaendiges-oeffnen-v-webseiten-java.html)

surftim 27.09.2010 15:10
nach Security Tool eigenständiges öffnen v. webseiten und java
 
Hallo liebes Forum!

Ich habe mir irgendwie Security Tool eingefangen. Habe versucht, dies nach der Anleitung hier im Forum zu deinstallieren. Allerding: Die angegebenen Dateien und Registry-Einträge existieren komischerweise nicht. Das Security Tool scheint auch plötzlich weg zu sein.

Malwarebytes hatte trotzdem etwas gefunden und entfernt.

Nun habe ich gelegentlich den Fall, dass sich einfach in Firefox ein neuer Tab öffnet und irgendeine Webseite aufruft, die oft nur wirre Zeichen enthält. Gleichzeitig wird Java gestartet. Ich habe also garantiert noch irgendwas bösartiges im System.
--> Während dem verfassen dieses Beitrags ging folgender Link auf:
h**p://de.ask.com/web?qsrc=999&siteid=3101&l=dis&mirago=trojaner-board&qenc=2&q=trend+antivirus
Ich benutze nie ask.com und habe auch nie nach "trend antivirus" gesucht.

Hab Malwarebytes nochmal laufen lassen, es wurden 2 Sachen gefunden. Gehe nun also nicht davon aus, dass alles weg ist. Log im Anhang.

Hab auch OTL gemacht. Ist standardmäßig alles auf "Use Safe-List" eingestellt, war das korrekt? In der Anleitung steht ja nur zu Extra-Registry, dass man Use Safelist wählen soll. Logs im Anhang.

--> Beim Abschicken des Beitrags mit Logs im Text hängt sich Firefox auf. Hochladen der Logs geht auch nicht. Mit IE klappt es jetzt!

Würde mich über Hilfe von den Experten freuen! :)

Viele Grüße, Tim.

Nachtrag:
Die Firefox-Abstürze häufen sich, hier mal ne detaillierte Fehlermeldung des Browsers:
---
Problem signature:
Problem Event Name: BEX
Application Name: firefox.exe
Application Version: 1.9.2.3743
Application Timestamp: 4bb4be02
Fault Module Name: AcroFF.dll
Fault Module Version: 0.0.0.0
Fault Module Timestamp: 4c2092c6
Exception Offset: 00003817
Exception Code: c0000409
Exception Data: 00000000
OS Version: 6.1.7600.2.0.0.256.48
Locale ID: 1031
Additional Information 1: d7ce
Additional Information 2: d7ceb41e8574af94675e54560e3d11b4
Additional Information 3: 4703
Additional Information 4: 4703ffca7911cfa94049e75f717cc580

Read our privacy statement online:
hxxp://go.microsoft.com/fwlink/?linkid=104288&clcid=0x0409

If the online privacy statement is not available, please read our privacy statement offline:
C:\Windows\system32\en-US\erofflps.txt
---

cosinus 28.09.2010 13:40
Hallo,

Zitat:
Database version: 4696
So ganz aktuell war MBAM aber nicht...
Hast Du davor schonmal mit MBAM gescannt? Wenn ja bitte alle Logs posten.

surftim 28.09.2010 16:03
Hallo cosinus!

Ja, ich habe davor schon einmal gescannt, allerdings quick soweit ich mich erinnere.
Ich habe in den malwarebytes Logs nachgesehen:

Code:
Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Database version: 4696

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

26.09.2010 05:28:36
mbam-log-2010-09-26 (05-28-36).txt

Scan type: Quick scan
Objects scanned: 142796
Time elapsed: 8 minute(s), 44 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 1
Registry Keys Infected: 4
Registry Values Infected: 2
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 7

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
C:\Users\***\AppData\Local\rentkro.dll (Trojan.Hiloti) -> Delete on reboot.

Registry Keys Infected:
HKEY_CLASSES_ROOT\linkrdr.aiebho (Trojan.Banker) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{f22c37fd-2bcb-40b6-a12e-77dda1fbdd88} (Trojan.Banker) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{f22c37fd-2bcb-40b6-a12e-77dda1fbdd88} (Trojan.Banker) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\linkrdr.aiebho.1 (Trojan.Banker) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mrefax (Trojan.Hiloti) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gciwugiyarikomem (Trojan.Agent.U) -> Delete on reboot.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\Users\***\AppData\Local\rentkro.dll (Trojan.Hiloti) -> Delete on reboot.
C:\Users\***\AppData\Roaming\AcroIEHelpe.dll (Trojan.Banker) -> Quarantined and deleted successfully.
C:\Users\***\AppData\Local\Temp\ATlkRuMukm.exe (Trojan.Hiloti) -> Quarantined and deleted successfully.
C:\Users\***\AppData\Local\Temp\ECF0.tmp (Rootkit.TDSS) -> Quarantined and deleted successfully.
C:\Users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Security Tool.LNK (Rogue.SecurityTool) -> Quarantined and deleted successfully.
C:\Users\***\AppData\Local\Temp\0.1950727297468715.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Users\***\AppData\Local\oqezopes.dll (Trojan.Agent.U) -> Delete on reboot.

cosinus 28.09.2010 17:56
Zitat:
Database version: 4696
Mach nochmal ein Update und anschließenden Vollscan mit Malwarebytes.

surftim 28.09.2010 20:19
Malwarebytes kann nichts finden.
Hier der Scan nach Update:

Code:
Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Database version: 4712

Windows 6.1.7600
Internet Explorer 8.0.7600.16385

28.09.2010 21:17:10
mbam-log-2010-09-28 (21-17-10).txt

Scan type: Full scan (C:\|D:\|)
Objects scanned: 254138
Time elapsed: 1 hour(s), 25 minute(s), 33 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

cosinus 28.09.2010 21:00
Beende alle Programme, starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)

Hinweis: Falls Du Deinen Benutzernamen unkenntlich gemacht hast, musst Du die Punkte in Deinen richtigen Benutzernamen wieder verwandeln, sonst funktioniert das Script nicht!!

Code:
:OTL
[2010.09.26 04:35:05 | 000,000,000 | ---D | C] -- C:\xmldm
[2010.09.26 04:34:53 | 000,000,000 | ---D | C] -- C:\Users\...\AppData\Roaming\5005
[2010.09.26 04:34:00 | 000,000,000 | ---D | C] -- C:\Users\...\AppData\Roaming\xmldm
[2010.09.26 04:33:47 | 000,000,000 | ---D | C] -- C:\Users\...\AppData\Roaming\cock
[2010.09.26 02:28:56 | 000,000,000 | ---D | C] -- C:\Users\...\AppData\Local\{F83758C0-2ED6-4D86-85C0-1EE543AEA9D2}
[2010.09.10 12:45:22 | 000,000,000 | ---D | C] -- C:\Users\...\Desktop\AAm2crackfix-srw
[2010.09.10 11:04:43 | 000,000,000 | ---D | C] -- C:\Users\...\Desktop\mafia_crckv3_new
[2010.09.26 05:06:07 | 000,000,120 | ---- | M] () -- C:\Users\...\AppData\Local\Omizegef.dat
[2010.09.26 02:28:59 | 000,000,000 | ---- | M] () -- C:\Users\...\AppData\Local\Wqipusezejoheraf.bin
[2010.09.24 12:12:31 | 018,249,508 | ---- | M] () -- C:\Users\...\Desktop\mafia_patch_1-2_ger.exe
[2010.09.10 12:42:12 | 016,449,980 | ---- | M] () -- C:\Users\...\Desktop\AAm2crackfix-srw.rar
:Commands
[purity]
[resethosts]
[emptytemp]
Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

surftim 28.09.2010 21:54
Liste der Anhänge anzeigen (Anzahl: 1)
Hallo,
eben ist es wieder passiert, neue Firefoxseite, Java öffnet sich und Panda reagiert sofort. Hier ein Screenshot des Panda-Logs im Anhang.

Hier die OTL Logdatei:
Code:
All processes killed
========== OTL ==========
Folder C:\xmldm\ not found.
C:\Users\Tim\AppData\Roaming\5005\components folder moved successfully.
C:\Users\Tim\AppData\Roaming\5005 folder moved successfully.
C:\Users\Tim\AppData\Roaming\xmldm folder moved successfully.
C:\Users\Tim\AppData\Roaming\cock folder moved successfully.
C:\Users\Tim\AppData\Local\{F83758C0-2ED6-4D86-85C0-1EE543AEA9D2}\chrome\content folder moved successfully.
C:\Users\Tim\AppData\Local\{F83758C0-2ED6-4D86-85C0-1EE543AEA9D2}\chrome folder moved successfully.
C:\Users\Tim\AppData\Local\{F83758C0-2ED6-4D86-85C0-1EE543AEA9D2} folder moved successfully.
C:\Users\Tim\Desktop\AAm2crackfix-srw\Mafia.II.Crackfix-SKIDROW\dlcs\cnt_made_man\sds\wardrobe folder moved successfully.
C:\Users\Tim\Desktop\AAm2crackfix-srw\Mafia.II.Crackfix-SKIDROW\dlcs\cnt_made_man\sds\player folder moved successfully.
C:\Users\Tim\Desktop\AAm2crackfix-srw\Mafia.II.Crackfix-SKIDROW\dlcs\cnt_made_man\sds\cars folder moved successfully.
C:\Users\Tim\Desktop\AAm2crackfix-srw\Mafia.II.Crackfix-SKIDROW\dlcs\cnt_made_man\sds folder moved successfully.
C:\Users\Tim\Desktop\AAm2crackfix-srw\Mafia.II.Crackfix-SKIDROW\dlcs\cnt_made_man folder moved successfully.
C:\Users\Tim\Desktop\AAm2crackfix-srw\Mafia.II.Crackfix-SKIDROW\dlcs folder moved successfully.
C:\Users\Tim\Desktop\AAm2crackfix-srw\Mafia.II.Crackfix-SKIDROW folder moved successfully.
C:\Users\Tim\Desktop\AAm2crackfix-srw folder moved successfully.
C:\Users\Tim\Desktop\mafia_crckv3_new folder moved successfully.
C:\Users\Tim\AppData\Local\Omizegef.dat moved successfully.
C:\Users\Tim\AppData\Local\Wqipusezejoheraf.bin moved successfully.
C:\Users\Tim\Desktop\mafia_patch_1-2_ger.exe moved successfully.
C:\Users\Tim\Desktop\AAm2crackfix-srw.rar moved successfully.
========== COMMANDS ==========
C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully
 
[EMPTYTEMP]
 
User: All Users
 
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: Public
 
User: Tim
->Temp folder emptied: 88375 bytes
->Temporary Internet Files folder emptied: 33482 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 14266487 bytes
->Flash cache emptied: 456 bytes
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 3690 bytes
RecycleBin emptied: 0 bytes
 
Total Files Cleaned = 14,00 mb
 
 
OTL by OldTimer - Version 3.2.14.1 log created on 09282010_224727

Files\Folders moved on Reboot...
File\Folder C:\Users\Tim\AppData\Local\Temp\izishMyKPx.exe.nanflmrkxtns not found!
File\Folder C:\Users\Tim\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\MJFG4D2K\setup[1].exe.nanflmrkxtns not found!

Registry entries deleted on Reboot...

cosinus 28.09.2010 22:00
Zitat:
C:\Users\Tim\Desktop\AAm2crackfix-srw\Mafia.II.Crackfix-SKIDROW
Sry aber ich habs mir fast gedacht, dass da was Illegales im Spiel ist :stirn:

Die (Be)nutzung von Cracks, Serials und Keygens ist illegal, somit gibt es im Trojaner-Board keinen weiteren Support mehr.

Für Dich geht es hier weiter => Neuaufsetzen des Systems
Bitte auch alle Passwörter abändern (für E-Mail-Konten, StudiVZ, Ebay...einfach alles!) da nicht selten in dieser dubiosen Software auch Keylogger und Backdoorfunktionen stecken.

Danach nie wieder sowas anrühren!

surftim 28.09.2010 22:05
Hallo cosinus,

dieser crackfix für Mafia II behebt nur diverse Fehler (Absturz bei Start, fehlender Ton etc.) die das Spiel mit speziellen Hardwarekonfigurationen als PC-Version hat.

Ich besitze die Originalversion des Spiels und habe diesen crakcfix nur installiert da der offizielle Patch die Probleme bisher nicht behebt und ich unbedingt spielen wollte da ich fast 50 Euro dafür bezahlt habe :(

Ich finde eure Hilfe wirklich toll aber ich finde es etwas schade, dass man sofort als kriminell abgestempelt wird :(

cosinus 28.09.2010 22:42
Bitte was? Du musst auf was möglicherweise Illegales zurückgreifen, damit das Spiel normal funktioniert weil der Hersteller das selbst nicht in den Griff bekommt? :wtf:

surftim 28.09.2010 22:53
Also ich geh davon aus, dass es bald einen neuen Patch gibt aber ich wollte weder darauf warten noch das Spiel zurückschicken.

Das habe ich jetzt davon... :schrei: :killpc:

Bekomm ich wirklich keine Hilfe mehr von euch? :(

cosinus 29.09.2010 09:07
Ok, da muss ich aber schon zwei Augen zudrücken ;) ;)

Dann bitte jetzt CF ausführen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix
  • Lade dir ComboFix hier herunter auf deinen Desktop. Benenne es beim Runterladen um in cofi.exe.
http://saved.im/mtm0nzyzmzd5/cofi.jpg
  • Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.
  • Starte cofi.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
    Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.
  • Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.
Wichtiger Hinweis:
Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

surftim 29.09.2010 14:49
Super, danke! :)

Also hier die Log-Datei.
Die meisten Sachen kenne ich.

Was mir gar nicht bekannt vorkommt ist
Zitat:
c:\users\Tim\AppData\Roaming\SurfSecret Privacy Suite
Code:
ComboFix 10-09-28.03 - Tim 29.09.2010  14:44:44.1.2 - x86
Microsoft Windows 7 Professional  6.1.7600.0.1252.49.1033.18.3070.2358 [GMT 2:00]
ausgeführt von:: c:\users\Tim\Desktop\cofi.exe
SP: Spybot - Search and Destroy *disabled* (Outdated) {ED588FAF-1B8F-43B4-ACA8-8E3C85DADBE9}
.

((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\users\Tim\AppData\Local\Riot
c:\users\Tim\AppData\Local\Riot\Riot-external-tools.ini
c:\users\Tim\AppData\Local\Riot\Riot.ini
c:\users\Tim\TeamViewer_Setup.exe
c:\windows\system32\ui

Infizierte Kopie von c:\windows\system32\drivers\rdpencdd.sys wurde gefunden und desinfiziert
Kopie von - Kitty ate it :p wurde wiederhergestellt
.
(((((((((((((((((((((((  Dateien erstellt von 2010-08-28 bis 2010-09-29  ))))))))))))))))))))))))))))))
.

2010-09-29 13:20 . 2010-09-29 13:20        --------        d-----w-        c:\users\Default\AppData\Local\temp
2010-09-29 12:39 . 2010-09-29 12:39        --------        d-----w-        C:\Device
2010-09-29 11:55 . 2010-09-29 11:57        --------        d-----w-        C:\32788R22FWJFW
2010-09-28 22:41 . 2010-09-28 22:41        --------        d-----w-        c:\program files\RecoveryFix for Excel Demo
2010-09-28 21:59 . 2010-09-28 22:02        --------        d-----w-        c:\program files\PowerDataRecovery
2010-09-28 21:31 . 2010-09-28 21:31        --------        d-----w-        c:\program files\Convar
2010-09-28 20:37 . 2010-09-28 20:37        --------        d-----w-        C:\_OTL
2010-09-28 20:23 . 2010-09-28 20:23        --------        d-----w-        c:\program files\MunSoft
2010-09-28 19:43 . 2010-09-28 19:43        --------        d-----w-        c:\program files\Avira
2010-09-28 17:40 . 2010-09-28 17:40        --------        d-----w-        c:\program files\Recuva
2010-09-27 17:22 . 2010-09-27 17:22        --------        d-----w-        c:\programdata\SUPERAntiSpyware.com
2010-09-26 23:43 . 2010-09-26 23:43        --------        d-----w-        c:\programdata\Norton
2010-09-26 23:43 . 2010-09-26 23:55        --------        d-----w-        c:\users\Tim\AppData\Local\NPE
2010-09-26 20:04 . 2010-09-26 20:04        12300688        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{BCB89EDE-64A0-4EAB-9DAA-4F8576D9F5B5}\mpasbase.vdm
2010-09-26 20:04 . 2010-09-25 16:02        292752        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{BCB89EDE-64A0-4EAB-9DAA-4F8576D9F5B5}\mpasdlta.vdm
2010-09-26 07:43 . 2010-09-26 07:43        323840        ----a-w-        c:\programdata\Panda Security\Panda Cloud Antivirus\Download\0x04015000\nanoconfig_0200000000_20100923_104900.dat
2010-09-26 07:43 . 2010-09-26 07:43        323840        ----a-w-        c:\programdata\Panda Security\Panda Cloud Antivirus\Download\0x04015000\GlobalExe.exe
2010-09-26 03:59 . 2010-09-26 03:59        --------        d-----w-        c:\users\Tim\AppData\Roaming\SurfSecret Privacy Suite
2010-09-26 03:57 . 2010-09-26 03:57        264        ----a-w-        c:\windows\system32\PSUNCpl.dat
2010-09-26 03:47 . 2010-01-14 14:08        59664        ----a-w-        c:\windows\system32\drivers\TfSysMon.sys
2010-09-26 03:47 . 2010-01-14 14:08        51984        ----a-w-        c:\windows\system32\drivers\TfFsMon.sys
2010-09-26 03:47 . 2010-01-14 14:08        33552        ----a-w-        c:\windows\system32\drivers\TfNetMon.sys
2010-09-26 03:47 . 2010-09-26 03:47        --------        d-----w-        c:\program files\ThreatFire
2010-09-26 03:47 . 2010-09-26 03:47        --------        d-----w-        c:\programdata\PC Tools
2010-09-26 03:13 . 2010-09-26 03:13        --------        d-----w-        c:\users\Tim\AppData\Roaming\Malwarebytes
2010-09-26 03:13 . 2010-04-29 10:19        38224        ----a-w-        c:\windows\system32\drivers\mbamswissarmy.sys
2010-09-26 03:13 . 2010-09-26 03:13        --------        d-----w-        c:\programdata\Malwarebytes
2010-09-26 03:13 . 2010-09-26 03:13        --------        d-----w-        c:\program files\Malwarebytes' Anti-Malware
2010-09-26 03:13 . 2010-04-29 10:19        20952        ----a-w-        c:\windows\system32\drivers\mbam.sys
2010-09-25 22:39 . 2010-09-25 22:39        --------        d-----w-        c:\program files\ESET
2010-09-24 09:24 . 2010-09-24 10:18        --------        d-----w-        c:\program files\Mafia
2010-09-15 20:54 . 2010-05-09 09:15        279552        ----a-w-        c:\windows\system32\XpsGdiConverter.dll
2010-09-15 20:54 . 2010-05-09 09:15        135168        ----a-w-        c:\windows\system32\XpsRasterService.dll
2010-09-15 20:54 . 2010-06-26 05:14        1495040        ----a-w-        c:\windows\system32\ExplorerFrame.dll
2010-09-15 20:44 . 2010-05-23 10:15        1619456        ----a-w-        c:\windows\system32\WMVDECOD.DLL
2010-09-15 20:44 . 2010-05-23 10:11        196608        ----a-w-        c:\windows\system32\mfreadwrite.dll
2010-09-15 20:44 . 2010-05-23 10:11        3181568        ----a-w-        c:\windows\system32\mf.dll
2010-09-15 20:42 . 2010-08-16 06:15        804864        ----a-w-        c:\windows\system32\FntCache.dll
2010-09-15 20:42 . 2010-08-16 06:14        1076224        ----a-w-        c:\windows\system32\DWrite.dll
2010-09-15 20:42 . 2010-08-16 06:14        218624        ----a-w-        c:\windows\system32\d3d10_1core.dll
2010-09-15 20:42 . 2010-08-16 06:14        1172480        ----a-w-        c:\windows\system32\d3d10warp.dll
2010-09-15 20:42 . 2010-08-16 06:14        737280        ----a-w-        c:\windows\system32\d2d1.dll
2010-09-15 20:30 . 2010-09-15 20:58        --------        d-----w-        c:\windows\system32\MpEngineStore
2010-09-15 20:23 . 2009-11-25 10:47        99176        ----a-w-        c:\windows\system32\PresentationHostProxy.dll
2010-09-15 20:23 . 2009-11-25 10:47        49472        ----a-w-        c:\windows\system32\netfxperf.dll
2010-09-15 20:23 . 2009-11-25 10:47        297808        ----a-w-        c:\windows\system32\mscoree.dll
2010-09-15 20:23 . 2009-11-25 10:47        295264        ----a-w-        c:\windows\system32\PresentationHost.exe
2010-09-15 20:23 . 2009-11-25 10:47        1130824        ----a-w-        c:\windows\system32\dfshim.dll
2010-09-15 20:06 . 2010-09-15 20:06        --------        d-----w-        c:\program files\Feedback Tool
2010-09-14 19:58 . 2010-09-20 15:42        46592        ---ha-w-        c:\windows\fltMburn.dll
2010-09-10 10:47 . 2010-09-10 10:47        --------        d-----w-        c:\users\Tim\AppData\Local\2K Games
2010-09-10 10:40 . 2010-09-10 10:40        --------        d-----w-        c:\program files\NVIDIA Corporation
2010-09-10 10:39 . 2010-09-10 10:39        --------        d-----w-        c:\program files\Common Files\Wise Installation Wizard
2010-09-10 10:28 . 2010-09-10 10:28        --------        d-----w-        c:\program files\2K Games
2010-09-10 10:27 . 2010-09-10 10:28        --------        d-----w-        c:\program files\DAEMON Tools Lite
2010-09-10 10:24 . 2010-09-10 10:24        --------        d-----w-        c:\users\Tim\AppData\Roaming\DAEMON Tools Net
2010-09-09 20:22 . 2010-09-09 20:20        185640        ----a-w-        c:\programdata\DivX\Setup\finishPlugin.dll
2010-09-09 20:22 . 2010-09-09 20:22        56765        ----a-w-        c:\programdata\DivX\DivXPlusShortcuts\Uninstaller.exe
2010-09-09 20:22 . 2010-09-09 20:22        53600        ----a-w-        c:\programdata\DivX\Update\Uninstaller.exe
2010-09-09 20:20 . 2010-09-09 20:20        144696        ----a-w-        c:\programdata\DivX\RunAsUser\RUNASUSERPROCESS.exe
2010-09-09 02:57 . 2010-09-28 22:25        --------        d-----w-        c:\users\Tim\AppData\Roaming\Vyxiza

.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-09-29 13:23 . 2010-02-28 15:52        --------        d-----w-        c:\users\Tim\AppData\Roaming\Dropbox
2010-09-29 11:42 . 2009-11-26 14:46        --------        d-----w-        c:\users\Tim\AppData\Roaming\Skype
2010-09-29 08:04 . 2009-11-26 15:01        --------        d-----w-        c:\users\Tim\AppData\Roaming\skypePM
2010-09-28 22:25 . 2010-01-24 21:51        --------        d-----w-        c:\users\Tim\AppData\Roaming\Kydi
2010-09-27 16:30 . 2010-01-07 19:54        --------        d-----w-        c:\programdata\Spybot - Search & Destroy
2010-09-27 16:27 . 2010-07-09 21:55        --------        d-----w-        c:\program files\CCleaner
2010-09-26 03:58 . 2010-06-08 20:49        --------        d-----w-        c:\program files\Panda Security
2010-09-26 02:34 . 2010-09-26 02:34        112        ----a-w-        c:\users\Tim\AppData\Roaming\srvblck2.tmp
2010-09-24 22:36 . 2009-12-18 00:41        --------        d-----w-        c:\users\Tim\AppData\Roaming\ICQ
2010-09-21 23:55 . 2009-11-01 19:55        --------        d-----w-        c:\users\Tim\AppData\Roaming\vlc
2010-09-21 21:31 . 2009-11-10 20:28        --------        d-----w-        c:\users\Tim\AppData\Roaming\uTorrent
2010-09-15 20:22 . 2009-11-01 14:41        --------        d-----w-        c:\programdata\Microsoft Help
2010-09-11 03:45 . 2010-02-28 19:46        --------        d-----w-        c:\programdata\CyberLink
2010-09-09 20:22 . 2010-06-08 12:57        57344        ----a-w-        c:\programdata\DivX\RunAsUser\RUNASUSERPROCESS.dll
2010-09-09 20:22 . 2010-06-08 12:29        --------        d-----w-        c:\programdata\DivX
2010-09-09 20:22 . 2009-12-25 12:55        --------        d-----w-        c:\program files\DivX
2010-09-09 20:20 . 2010-06-08 12:57        1062184        ----a-w-        c:\programdata\DivX\Setup\Resource.dll
2010-09-09 20:20 . 2010-06-08 12:57        850200        ----a-w-        c:\programdata\DivX\Setup\DivXSetup.exe
2010-09-09 20:10 . 2009-11-10 20:29        --------        d-----w-        c:\program files\uTorrent
2010-09-09 15:46 . 2009-12-04 13:26        528272        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\Backup\mpasdlta.vdm
2010-08-19 08:25 . 2009-12-04 13:26        12120464        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\Backup\mpasbase.vdm
2010-08-16 09:24 . 2010-08-16 09:24        --------        d-----w-        c:\program files\Auto Clicker
2010-08-16 09:23 . 2010-08-13 12:17        --------        d-----w-        c:\program files\Mouse Tractor
2010-08-09 15:56 . 2010-08-09 15:56        --------        d-----w-        c:\users\Tim\AppData\Roaming\pokerth
2010-08-09 15:53 . 2010-08-09 15:44        --------        d-----w-        c:\program files\LANPoker
2010-08-09 15:51 . 2010-08-09 15:51        --------        d-----w-        c:\program files\Infogrames
2010-08-09 08:49 . 2010-07-20 15:11        --------        d-----w-        c:\programdata\tmp
2010-08-09 08:15 . 2010-07-20 15:11        --------        d-----w-        c:\programdata\hps
2010-08-06 18:42 . 2010-07-20 15:06        --------        d-----w-        c:\program files\dm
2010-08-06 15:01 . 2010-08-06 15:01        --------        d-----w-        c:\program files\Google
2010-07-29 06:30 . 2010-08-12 13:51        197632        ----a-w-        c:\windows\system32\ir32_32.dll
2010-07-29 06:30 . 2010-08-12 13:51        82944        ----a-w-        c:\windows\system32\iccvid.dll
2010-07-09 22:39 . 2010-02-28 20:09        36864        ----a-w-        c:\programdata\Temp\{01FB4998-33C4-4431-85ED-079E3EEFE75D}\PostBuild.exe
2009-08-16 21:27 . 2009-08-16 21:27        37632        ----a-r-        c:\program files\mozilla firefox\plugins\HTSPSEH.dll
2009-06-10 21:26 . 2009-07-14 02:04        9633792        --sha-r-        c:\windows\Fonts\StaticCache.dat
2006-05-03 09:06 . 2009-12-05 20:21        163328        --sh--r-        c:\windows\System32\flvDX.dll
2007-02-21 10:47 . 2009-12-05 20:21        31232        --sh--r-        c:\windows\System32\msfDX.dll
2008-03-16 12:30 . 2009-12-05 20:21        216064        --sh--r-        c:\windows\System32\nbDX.dll
2009-07-14 01:14 . 2009-07-13 23:42        396800        --sha-w-        c:\windows\winsxs\x86_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7600.16385_none_f12e83abb108c86c\WinMail.exe
.

((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{B821BF60-5C2D-41EB-92DC-3E4CCD3A22E4}]
2010-06-15 13:46        86696        ----a-w-        c:\program files\Panda Security\Panda Security Toolbar\PandaSecurityDx.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{B821BF60-5C2D-41EB-92DC-3E4CCD3A22E4}"= "c:\program files\Panda Security\Panda Security Toolbar\PandaSecurityDx.dll" [2010-06-15 86696]

[HKEY_CLASSES_ROOT\clsid\{b821bf60-5c2d-41eb-92dc-3e4ccd3a22e4}]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2009-12-09 01:19        94208        ----a-w-        c:\users\Tim\AppData\Roaming\Dropbox\bin\DropboxExt.13.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2009-12-09 01:19        94208        ----a-w-        c:\users\Tim\AppData\Roaming\Dropbox\bin\DropboxExt.13.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2009-12-09 01:19        94208        ----a-w-        c:\users\Tim\AppData\Roaming\Dropbox\bin\DropboxExt.13.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Panda Malware Icon]
@="{F5D1CF73-C196-48F8-AAAC-B9181E22B4E6}"
[HKEY_CLASSES_ROOT\CLSID\{F5D1CF73-C196-48F8-AAAC-B9181E22B4E6}]
2010-05-14 13:04        320832        ----a-w-        c:\program files\Panda Security\Panda Cloud Antivirus\PSUNShell.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Panda Suspect Icon]
@="{9AE343CB-BA45-4618-AF6A-0230EE6FC793}"
[HKEY_CLASSES_ROOT\CLSID\{9AE343CB-BA45-4618-AF6A-0230EE6FC793}]
2010-05-14 13:04        320832        ----a-w-        c:\program files\Panda Security\Panda Cloud Antivirus\PSUNShell.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2008-01-22 152872]
"TomTomHOME.exe"="c:\program files\TomTom HOME 2\TomTomHOMERunner.exe" [2010-06-24 247144]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-03-28 1045800]
"QlbCtrl.exe"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2009-07-27 321080]
"SysTrayApp"="c:\program files\IDT\WDM\sttray.exe" [2009-07-21 458844]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-07-22 98304]
"FreePDF Assistant"="c:\program files\FreePDF_XP\fpassist.exe" [2009-09-05 385024]
"Windows Mobile Device Center"="c:\windows\WindowsMobile\wmdc.exe" [2007-05-31 648072]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-06-20 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-06-09 976832]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-03-17 421888]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2009-06-17 55824]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-04-28 142120]
"YouCam Mirage"="c:\program files\CyberLink\YouCam\YCMMirage.exe" [2010-01-25 136488]
"YouCam Tray"="c:\program files\CyberLink\YouCam\YouCam.exe" [2010-01-25 224352]
"DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2010-09-01 1164584]
"ThreatFire"="c:\program files\ThreatFire\TFTray.exe" [2010-01-14 378128]
"PSUNMain"="c:\program files\Panda Security\Panda Cloud Antivirus\PSUNMain.exe" [2010-05-14 406848]

c:\users\Tim\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dropbox.lnk - c:\users\Tim\AppData\Roaming\Dropbox\bin\Dropbox.exe [2010-2-26 21979992]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\SetPoint.exe [2009-12-29 813584]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
2009-07-20 11:28        72208        ----a-w-        c:\program files\Common Files\Logishrd\Bluetooth\LBTWLgn.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sr.sys]
@="FSFilter System Recovery"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Kernel and Hardware Abstraction Layer]
2009-06-17 16:55        55824        ----a-w-        c:\windows\KHALMNPR.Exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2008-05-28 07:27        570664        ----a-w-        c:\program files\Common Files\Ahead\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\phonostarTimer]
2009-10-07 10:02        37376        ----a-w-        c:\program files\phonostar-Player\phonostarTimer.exe

R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-08-06 136176]
R3 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance;c:\program files\Common Files\MAGIX Services\Database\bin\fbserver.exe [2008-08-07 3276800]
R3 JMCR;JMCR;c:\windows\system32\DRIVERS\jmcr.sys [2008-10-23 107360]
R3 KMWDFILTERx86;HIDServiceDesc;c:\windows\system32\DRIVERS\KMWDFILTER.sys [2009-04-29 25088]
R3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt86win7.sys [2009-03-01 139776]
R4 sptd;sptd;c:\windows\system32\Drivers\sptd.sys [2010-03-15 691696]
S0 Amddfltr;Amd Disk Lower Filter Driver;c:\windows\system32\DRIVERS\Amddfltr.sys [2008-01-08 15416]
S0 TfFsMon;TfFsMon;c:\windows\system32\drivers\TfFsMon.sys [2010-01-14 51984]
S0 TfSysMon;TfSysMon;c:\windows\system32\drivers\TfSysMon.sys [2010-01-14 59664]
S1 PSINKNC;PSINKNC;c:\windows\system32\DRIVERS\psinknc.sys [2010-05-04 125960]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-13 48128]
S2 AESTFilters;Andrea ST Filters Service;c:\windows\System32\DriverStore\FileRepository\stwrt.inf_x86_neutral_8e7d5b9d3a91d8c5\aestsrv.exe [2009-03-01 81920]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2009-07-22 176128]
S2 Fabs;FABS - Helping agent for MAGIX media database;c:\program files\Common Files\MAGIX Services\Database\bin\FABS.exe [2009-08-27 1253376]
S2 hpsrv;HP Service;c:\windows\system32\Hpservice.exe [2009-07-08 26168]
S2 NanoServiceMain;Panda Cloud Antivirus Service;c:\program files\Panda Security\Panda Cloud Antivirus\PSANHost.exe [2010-04-30 136448]
S2 PSINAflt;PSINAflt;c:\windows\system32\DRIVERS\PSINAflt.sys [2010-05-27 141384]
S2 PSINFile;PSINFile;c:\windows\system32\DRIVERS\PSINFile.sys [2010-04-30 99336]
S2 PSINProc;PSINProc;c:\windows\system32\DRIVERS\PSINProc.sys [2010-04-30 111112]
S2 PSINProt;PSINProt;c:\windows\system32\DRIVERS\PSINProt.sys [2010-05-12 111176]
S2 SBSDWSCService;SBSD Security Center Service;c:\program files\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368]
S2 ThreatFire;ThreatFire;c:\program files\ThreatFire\TFService.exe service [x]
S2 TomTomHOMEService;TomTomHOMEService;c:\program files\TomTom HOME 2\TomTomHOMEService.exe [2010-06-24 92008]
S3 clwvd;CyberLink WebCam Virtual Driver;c:\windows\system32\DRIVERS\clwvd.sys [2010-01-25 27504]
S3 Com4QLBEx;Com4QLBEx;c:\program files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe [2009-05-05 228408]
S3 enecir;ENE CIR Receiver;c:\windows\system32\DRIVERS\enecir.sys [2008-09-04 54784]
S3 TfNetMon;TfNetMon;c:\windows\system32\drivers\TfNetMon.sys [2010-01-14 33552]
S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [2009-07-13 14336]


[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
WindowsMobile        REG_MULTI_SZ          wcescomm rapimgr
LocalServiceRestricted        REG_MULTI_SZ          WcesComm RapiMgr

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2009-06-17 11:11        451872        ----a-w-        c:\program files\Common Files\LightScribe\LSRunOnce.exe
.
Inhalt des "geplante Tasks" Ordners

2010-09-29 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-08-06 15:01]

2010-09-29 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-08-06 15:01]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.google.de/
uInternet Settings,ProxyOverride = *.local
IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~1\Office12\EXCEL.EXE/3000
Trusted Zone: hts-admin.net\www
Trusted Zone: hts-online.net\www
Handler: htap - {83EC570E-9FFA-11D2-9559-006008594011} - c:\program files\Hogrefe\Common\HTSProtHandler.dll
FF - ProfilePath - c:\users\Tim\AppData\Roaming\Mozilla\Firefox\Profiles\xnm3v344.default\
FF - prefs.js: browser.startup.homepage - handelsblatt.de
FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?fr=panda&type=panda1_0yatb&p=
FF - component: c:\program files\Panda Security\Panda ID Protect\Firefox\components\FFKeypad.dll
FF - component: c:\users\Tim\AppData\Roaming\Mozilla\Firefox\Profiles\xnm3v344.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\components\FFExternalAlert.dll
FF - component: c:\users\Tim\AppData\Roaming\Mozilla\Firefox\Profiles\xnm3v344.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\components\RadioWMPCore.dll
FF - component: c:\users\Tim\AppData\Roaming\Mozilla\Firefox\Profiles\xnm3v344.default\extensions\{B821BF60-5C2D-41EB-92DC-3E4CCD3A22E4}\components\dtTransparency.dll
FF - component: c:\users\Tim\AppData\Roaming\Mozilla\Firefox\Profiles\xnm3v344.default\extensions\{B821BF60-5C2D-41EB-92DC-3E4CCD3A22E4}\components\dtTransparency3.5.dll
FF - component: c:\users\Tim\AppData\Roaming\Mozilla\Firefox\Profiles\xnm3v344.default\extensions\{B821BF60-5C2D-41EB-92DC-3E4CCD3A22E4}\components\dtTransparency3.6.dll
FF - plugin: c:\program files\DivX\DivX Plus Web Player\npdivx32.dll
FF - plugin: c:\program files\Google\Update\1.2.183.29\npGoogleOneClick8.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\nphtspse.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\nphtspst.dll
FF - plugin: c:\program files\Veetle\Player\npvlc.dll
FF - plugin: c:\program files\Veetle\plugins\npVeetle.dll
FF - plugin: c:\program files\Veetle\VLCBroadcast\npvbp.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
FF - plugin: c:\users\Tim\AppData\Roaming\Mozilla\Firefox\Profiles\xnm3v344.default\extensions\firefox@tvunetworks.com\plugins\npTVUAx.dll
FF - plugin: c:\users\Tim\AppData\Roaming\Mozilla\Firefox\Profiles\xnm3v344.default\extensions\moveplayer@movenetworks.com\platform\WINNT_x86-msvc\plugins\npmnqmp071303000004.dll
FF - plugin: c:\windows\system32\TVUAx\npTVUAx.dll
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -

SafeBoot-dmboot.sys
SafeBoot-dmio.sys
SafeBoot-dmload.sys
SafeBoot-dmadmin
SafeBoot-dmserver
SafeBoot-SRService



[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\ThreatFire]
"AlternateImagePath"=""
.
--------------------- Gesperrte Registrierungsschluessel ---------------------

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe,-101"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------

- - - - - - - > 'winlogon.exe'(812)
c:\program files\ThreatFire\TFWAH.dll

- - - - - - - > 'lsass.exe'(628)
c:\program files\ThreatFire\TFWAH.dll

- - - - - - - > 'Explorer.exe'(5244)
c:\program files\ThreatFire\TfWah.dll
c:\program files\Logitech\SetPoint\lgscroll.dll
c:\windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4927_none_d08a205e442db5b5\MSVCR80.dll
c:\users\Tim\AppData\Roaming\Dropbox\bin\DropboxExt.13.dll
c:\windows\system32\dbghelp.dll
c:\program files\Panda Security\Panda Cloud Antivirus\PSUNShell.DLL
c:\program files\Panda Security\Panda Cloud Antivirus\PSNCGP.dll
c:\program files\Panda Security\Panda Cloud Antivirus\PSNCIPC.dll
c:\windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4927_none_d08a205e442db5b5\MSVCP80.dll
c:\windows\system32\WINSPOOL.DRV
c:\windows\System32\netprofm.dll
c:\windows\System32\msxml3.dll
c:\windows\system32\MPR.dll
c:\program files\Common Files\Ahead\Lib\MediaLibraryNSE.dll
c:\program files\Common Files\Ahead\Lib\MFC71U.DLL
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\windows\System32\DriverStore\FileRepository\stwrt.inf_x86_neutral_8e7d5b9d3a91d8c5\STacSV.exe
c:\windows\system32\atieclxx.exe
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
c:\windows\system32\IoctlSvc.exe
c:\program files\ThreatFire\TFService.exe
c:\windows\system32\taskhost.exe
c:\windows\system32\conhost.exe
c:\program files\Synaptics\SynTP\SynTPHelper.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
c:\program files\Hewlett-Packard\Shared\hpqwmiex.exe
c:\program files\Common Files\Ahead\Lib\NMIndexingService.exe
c:\program files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
c:\program files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
c:\windows\system32\conhost.exe
c:\program files\iPod\bin\iPodService.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\\?\c:\windows\system32\wbem\WMIADAP.EXE
.
**************************************************************************
.
Zeit der Fertigstellung: 2010-09-29  15:40:47 - PC wurde neu gestartet
ComboFix-quarantined-files.txt  2010-09-29 13:40

Vor Suchlauf: 182.169.677.824 bytes free
Nach Suchlauf: 181.854.130.176 bytes free

- - End Of File - - A32C44E7AC811068CDCA94B3DAE33FD7

cosinus 30.09.2010 11:39
Combofix - Scripten

1. Starte das Notepad (Start / Ausführen / notepad[Enter])

2. Jetzt füge mit copy/paste den ganzen Inhalt der untenstehenden Codebox in das Notepad Fenster ein.

Code:
Folder::
c:\users\Tim\AppData\Roaming\Vyxiza
C:\32788R22FWJFW

File::
c:\users\Tim\AppData\Roaming\srvblck2.tmp
3. Speichere im Notepad als CFScript.txt auf dem Desktop.

4. Deaktivere den Guard Deines Antivirenprogramms und eine eventuell vorhandene Software Firewall.
(Auch Guards von Ad-, Spyware Programmen und den Tea Timer (wenn vorhanden) !)

5. Dann ziehe die CFScript.txt auf die cofi.exe, so wie es im unteren Bild zu sehen ist. Damit wird Combofix neu gestartet.

http://users.pandora.be/bluepatchy/m...s/CFScript.gif

6. Nach dem Neustart (es wird gefragt ob Du neustarten willst), poste bitte die folgenden Log Dateien:
Combofix.txt

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!

surftim 30.09.2010 16:22
Liste der Anhänge anzeigen (Anzahl: 1)
Automatisch angezeigt wurde "Log.txt", nicht "ComboFix.txt".
Ist das die richtige?

Panda hat heute wieder reagiert, siehe Screenshot im Anhang.

Log.txt:
Code:
ComboFix 10-09-29.04 - Tim 30.09.2010  16:15:37.2.2 - x86
Microsoft Windows 7 Professional  6.1.7600.0.1252.49.1033.18.3070.2113 [GMT 2:00]
ausgeführt von:: c:\users\Tim\Desktop\cofi.exe
Benutzte Befehlsschalter :: c:\users\Tim\Desktop\CFScript.txt
SP: Spybot - Search and Destroy *disabled* (Outdated) {ED588FAF-1B8F-43B4-ACA8-8E3C85DADBE9}

FILE ::
"c:\users\Tim\AppData\Roaming\srvblck2.tmp"
.

((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\users\Tim\AppData\Roaming\srvblck2.tmp
c:\users\Tim\AppData\Roaming\Vyxiza

.
(((((((((((((((((((((((  Dateien erstellt von 2010-08-28 bis 2010-09-30  ))))))))))))))))))))))))))))))
.

2010-09-30 14:39 . 2010-09-30 14:39        --------        d-----w-        c:\users\Public\AppData\Local\temp
2010-09-30 14:39 . 2010-09-30 14:39        --------        d-----w-        c:\users\Default\AppData\Local\temp
2010-09-29 12:39 . 2010-09-29 12:39        --------        d-----w-        C:\Device
2010-09-29 11:57 . 2010-09-29 13:41        --------        d-----w-        C:\cofi
2010-09-28 22:41 . 2010-09-28 22:41        --------        d-----w-        c:\program files\RecoveryFix for Excel Demo
2010-09-28 21:59 . 2010-09-28 22:02        --------        d-----w-        c:\program files\PowerDataRecovery
2010-09-28 21:31 . 2010-09-28 21:31        --------        d-----w-        c:\program files\Convar
2010-09-28 20:37 . 2010-09-28 20:37        --------        d-----w-        C:\_OTL
2010-09-28 20:23 . 2010-09-28 20:23        --------        d-----w-        c:\program files\MunSoft
2010-09-28 19:43 . 2010-09-28 19:43        --------        d-----w-        c:\program files\Avira
2010-09-28 17:40 . 2010-09-28 17:40        --------        d-----w-        c:\program files\Recuva
2010-09-27 17:22 . 2010-09-27 17:22        --------        d-----w-        c:\programdata\SUPERAntiSpyware.com
2010-09-26 23:43 . 2010-09-26 23:43        --------        d-----w-        c:\programdata\Norton
2010-09-26 23:43 . 2010-09-26 23:55        --------        d-----w-        c:\users\Tim\AppData\Local\NPE
2010-09-26 07:43 . 2010-09-26 07:43        323840        ----a-w-        c:\programdata\Panda Security\Panda Cloud Antivirus\Download\0x04015000\GlobalExe.exe
2010-09-26 03:59 . 2010-09-26 03:59        --------        d-----w-        c:\users\Tim\AppData\Roaming\SurfSecret Privacy Suite
2010-09-26 03:57 . 2010-09-26 03:57        264        ----a-w-        c:\windows\system32\PSUNCpl.dat
2010-09-26 03:13 . 2010-09-26 03:13        --------        d-----w-        c:\users\Tim\AppData\Roaming\Malwarebytes
2010-09-26 03:13 . 2010-04-29 10:19        38224        ----a-w-        c:\windows\system32\drivers\mbamswissarmy.sys
2010-09-26 03:13 . 2010-09-26 03:13        --------        d-----w-        c:\programdata\Malwarebytes
2010-09-26 03:13 . 2010-09-26 03:13        --------        d-----w-        c:\program files\Malwarebytes' Anti-Malware
2010-09-26 03:13 . 2010-04-29 10:19        20952        ----a-w-        c:\windows\system32\drivers\mbam.sys
2010-09-25 22:39 . 2010-09-25 22:39        --------        d-----w-        c:\program files\ESET
2010-09-24 09:24 . 2010-09-24 10:18        --------        d-----w-        c:\program files\Mafia
2010-09-15 20:54 . 2010-05-09 09:15        279552        ----a-w-        c:\windows\system32\XpsGdiConverter.dll
2010-09-15 20:54 . 2010-05-09 09:15        135168        ----a-w-        c:\windows\system32\XpsRasterService.dll
2010-09-15 20:54 . 2010-06-26 05:14        1495040        ----a-w-        c:\windows\system32\ExplorerFrame.dll
2010-09-15 20:44 . 2010-05-23 10:15        1619456        ----a-w-        c:\windows\system32\WMVDECOD.DLL
2010-09-15 20:44 . 2010-05-23 10:11        196608        ----a-w-        c:\windows\system32\mfreadwrite.dll
2010-09-15 20:44 . 2010-05-23 10:11        3181568        ----a-w-        c:\windows\system32\mf.dll
2010-09-15 20:42 . 2010-08-16 06:15        804864        ----a-w-        c:\windows\system32\FntCache.dll
2010-09-15 20:42 . 2010-08-16 06:14        1076224        ----a-w-        c:\windows\system32\DWrite.dll
2010-09-15 20:42 . 2010-08-16 06:14        218624        ----a-w-        c:\windows\system32\d3d10_1core.dll
2010-09-15 20:42 . 2010-08-16 06:14        1172480        ----a-w-        c:\windows\system32\d3d10warp.dll
2010-09-15 20:42 . 2010-08-16 06:14        737280        ----a-w-        c:\windows\system32\d2d1.dll
2010-09-15 20:30 . 2010-09-15 20:58        --------        d-----w-        c:\windows\system32\MpEngineStore
2010-09-15 20:23 . 2009-11-25 10:47        99176        ----a-w-        c:\windows\system32\PresentationHostProxy.dll
2010-09-15 20:23 . 2009-11-25 10:47        49472        ----a-w-        c:\windows\system32\netfxperf.dll
2010-09-15 20:23 . 2009-11-25 10:47        297808        ----a-w-        c:\windows\system32\mscoree.dll
2010-09-15 20:23 . 2009-11-25 10:47        295264        ----a-w-        c:\windows\system32\PresentationHost.exe
2010-09-15 20:23 . 2009-11-25 10:47        1130824        ----a-w-        c:\windows\system32\dfshim.dll
2010-09-15 20:06 . 2010-09-15 20:06        --------        d-----w-        c:\program files\Feedback Tool
2010-09-10 10:47 . 2010-09-10 10:47        --------        d-----w-        c:\users\Tim\AppData\Local\2K Games
2010-09-10 10:40 . 2010-09-10 10:40        --------        d-----w-        c:\program files\NVIDIA Corporation
2010-09-10 10:39 . 2010-09-10 10:39        --------        d-----w-        c:\program files\Common Files\Wise Installation Wizard
2010-09-10 10:28 . 2010-09-10 10:28        --------        d-----w-        c:\program files\2K Games
2010-09-10 10:27 . 2010-09-10 10:28        --------        d-----w-        c:\program files\DAEMON Tools Lite
2010-09-10 10:24 . 2010-09-10 10:24        --------        d-----w-        c:\users\Tim\AppData\Roaming\DAEMON Tools Net
2010-09-09 20:22 . 2010-09-09 20:20        185640        ----a-w-        c:\programdata\DivX\Setup\finishPlugin.dll
2010-09-09 20:22 . 2010-09-09 20:22        56765        ----a-w-        c:\programdata\DivX\DivXPlusShortcuts\Uninstaller.exe
2010-09-09 20:22 . 2010-09-09 20:22        53600        ----a-w-        c:\programdata\DivX\Update\Uninstaller.exe
2010-09-09 20:20 . 2010-09-09 20:20        144696        ----a-w-        c:\programdata\DivX\RunAsUser\RUNASUSERPROCESS.exe

.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-09-30 11:19 . 2010-02-28 15:52        --------        d-----w-        c:\users\Tim\AppData\Roaming\Dropbox
2010-09-30 00:19 . 2009-11-26 14:46        --------        d-----w-        c:\users\Tim\AppData\Roaming\Skype
2010-09-29 22:00 . 2009-11-26 15:01        --------        d-----w-        c:\users\Tim\AppData\Roaming\skypePM
2010-09-28 22:25 . 2010-01-24 21:51        --------        d-----w-        c:\users\Tim\AppData\Roaming\Kydi
2010-09-27 16:30 . 2010-01-07 19:54        --------        d-----w-        c:\programdata\Spybot - Search & Destroy
2010-09-27 16:27 . 2010-07-09 21:55        --------        d-----w-        c:\program files\CCleaner
2010-09-26 03:58 . 2010-06-08 20:49        --------        d-----w-        c:\program files\Panda Security
2010-09-24 22:36 . 2009-12-18 00:41        --------        d-----w-        c:\users\Tim\AppData\Roaming\ICQ
2010-09-21 23:55 . 2009-11-01 19:55        --------        d-----w-        c:\users\Tim\AppData\Roaming\vlc
2010-09-21 21:31 . 2009-11-10 20:28        --------        d-----w-        c:\users\Tim\AppData\Roaming\uTorrent
2010-09-15 20:22 . 2009-11-01 14:41        --------        d-----w-        c:\programdata\Microsoft Help
2010-09-11 03:45 . 2010-02-28 19:46        --------        d-----w-        c:\programdata\CyberLink
2010-09-09 20:22 . 2010-06-08 12:57        57344        ----a-w-        c:\programdata\DivX\RunAsUser\RUNASUSERPROCESS.dll
2010-09-09 20:22 . 2010-06-08 12:29        --------        d-----w-        c:\programdata\DivX
2010-09-09 20:22 . 2009-12-25 12:55        --------        d-----w-        c:\program files\DivX
2010-09-09 20:20 . 2010-06-08 12:57        1062184        ----a-w-        c:\programdata\DivX\Setup\Resource.dll
2010-09-09 20:20 . 2010-06-08 12:57        850200        ----a-w-        c:\programdata\DivX\Setup\DivXSetup.exe
2010-09-09 20:10 . 2009-11-10 20:29        --------        d-----w-        c:\program files\uTorrent
2010-08-16 09:24 . 2010-08-16 09:24        --------        d-----w-        c:\program files\Auto Clicker
2010-08-16 09:23 . 2010-08-13 12:17        --------        d-----w-        c:\program files\Mouse Tractor
2010-08-09 15:56 . 2010-08-09 15:56        --------        d-----w-        c:\users\Tim\AppData\Roaming\pokerth
2010-08-09 15:53 . 2010-08-09 15:44        --------        d-----w-        c:\program files\LANPoker
2010-08-09 15:51 . 2010-08-09 15:51        --------        d-----w-        c:\program files\Infogrames
2010-08-09 08:49 . 2010-07-20 15:11        --------        d-----w-        c:\programdata\tmp
2010-08-09 08:15 . 2010-07-20 15:11        --------        d-----w-        c:\programdata\hps
2010-08-06 18:42 . 2010-07-20 15:06        --------        d-----w-        c:\program files\dm
2010-08-06 15:01 . 2010-08-06 15:01        --------        d-----w-        c:\program files\Google
2010-07-29 06:30 . 2010-08-12 13:51        197632        ----a-w-        c:\windows\system32\ir32_32.dll
2010-07-29 06:30 . 2010-08-12 13:51        82944        ----a-w-        c:\windows\system32\iccvid.dll
2010-07-09 22:39 . 2010-02-28 20:09        36864        ----a-w-        c:\programdata\Temp\{01FB4998-33C4-4431-85ED-079E3EEFE75D}\PostBuild.exe
2009-08-16 21:27 . 2009-08-16 21:27        37632        ----a-r-        c:\program files\mozilla firefox\plugins\HTSPSEH.dll
2009-06-10 21:26 . 2009-07-14 02:04        9633792        --sha-r-        c:\windows\Fonts\StaticCache.dat
2006-05-03 09:06 . 2009-12-05 20:21        163328        --sh--r-        c:\windows\System32\flvDX.dll
2007-02-21 10:47 . 2009-12-05 20:21        31232        --sh--r-        c:\windows\System32\msfDX.dll
2008-03-16 12:30 . 2009-12-05 20:21        216064        --sh--r-        c:\windows\System32\nbDX.dll
.

((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{B821BF60-5C2D-41EB-92DC-3E4CCD3A22E4}]
2010-06-15 13:46        86696        ----a-w-        c:\program files\Panda Security\Panda Security Toolbar\PandaSecurityDx.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{B821BF60-5C2D-41EB-92DC-3E4CCD3A22E4}"= "c:\program files\Panda Security\Panda Security Toolbar\PandaSecurityDx.dll" [2010-06-15 86696]

[HKEY_CLASSES_ROOT\clsid\{b821bf60-5c2d-41eb-92dc-3e4ccd3a22e4}]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2009-12-09 01:19        94208        ----a-w-        c:\users\Tim\AppData\Roaming\Dropbox\bin\DropboxExt.13.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2009-12-09 01:19        94208        ----a-w-        c:\users\Tim\AppData\Roaming\Dropbox\bin\DropboxExt.13.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2009-12-09 01:19        94208        ----a-w-        c:\users\Tim\AppData\Roaming\Dropbox\bin\DropboxExt.13.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Panda Malware Icon]
@="{F5D1CF73-C196-48F8-AAAC-B9181E22B4E6}"
[HKEY_CLASSES_ROOT\CLSID\{F5D1CF73-C196-48F8-AAAC-B9181E22B4E6}]
2010-05-14 13:04        320832        ----a-w-        c:\program files\Panda Security\Panda Cloud Antivirus\PSUNShell.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Panda Suspect Icon]
@="{9AE343CB-BA45-4618-AF6A-0230EE6FC793}"
[HKEY_CLASSES_ROOT\CLSID\{9AE343CB-BA45-4618-AF6A-0230EE6FC793}]
2010-05-14 13:04        320832        ----a-w-        c:\program files\Panda Security\Panda Cloud Antivirus\PSUNShell.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2008-01-22 152872]
"TomTomHOME.exe"="c:\program files\TomTom HOME 2\TomTomHOMERunner.exe" [2010-06-24 247144]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-03-28 1045800]
"QlbCtrl.exe"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2009-07-27 321080]
"SysTrayApp"="c:\program files\IDT\WDM\sttray.exe" [2009-07-21 458844]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-07-22 98304]
"FreePDF Assistant"="c:\program files\FreePDF_XP\fpassist.exe" [2009-09-05 385024]
"Windows Mobile Device Center"="c:\windows\WindowsMobile\wmdc.exe" [2007-05-31 648072]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-06-20 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-06-09 976832]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-03-17 421888]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2009-06-17 55824]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-04-28 142120]
"YouCam Mirage"="c:\program files\CyberLink\YouCam\YCMMirage.exe" [2010-01-25 136488]
"YouCam Tray"="c:\program files\CyberLink\YouCam\YouCam.exe" [2010-01-25 224352]
"DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2010-09-01 1164584]
"PSUNMain"="c:\program files\Panda Security\Panda Cloud Antivirus\PSUNMain.exe" [2010-05-14 406848]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\SetPoint.exe [2009-12-29 813584]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
2009-07-20 11:28        72208        ----a-w-        c:\program files\Common Files\Logishrd\Bluetooth\LBTWLgn.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sr.sys]
@="FSFilter System Recovery"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Kernel and Hardware Abstraction Layer]
2009-06-17 16:55        55824        ----a-w-        c:\windows\KHALMNPR.Exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2008-05-28 07:27        570664        ----a-w-        c:\program files\Common Files\Ahead\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\phonostarTimer]
2009-10-07 10:02        37376        ----a-w-        c:\program files\phonostar-Player\phonostarTimer.exe

R0 TfFsMon;TfFsMon;c:\windows\system32\drivers\TfFsMon.sys [x]
R0 TfSysMon;TfSysMon;c:\windows\system32\drivers\TfSysMon.sys [x]
R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-08-06 136176]
R3 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance;c:\program files\Common Files\MAGIX Services\Database\bin\fbserver.exe [2008-08-07 3276800]
R3 KMWDFILTERx86;HIDServiceDesc;c:\windows\system32\DRIVERS\KMWDFILTER.sys [2009-04-29 25088]
R3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt86win7.sys [2009-03-01 139776]
R3 TfNetMon;TfNetMon;c:\windows\system32\drivers\TfNetMon.sys [x]
R4 sptd;sptd;c:\windows\system32\Drivers\sptd.sys [2010-03-15 691696]
S0 Amddfltr;Amd Disk Lower Filter Driver;c:\windows\system32\DRIVERS\Amddfltr.sys [2008-01-08 15416]
S1 PSINKNC;PSINKNC;c:\windows\system32\DRIVERS\psinknc.sys [2010-05-04 125960]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-13 48128]
S2 AESTFilters;Andrea ST Filters Service;c:\windows\System32\DriverStore\FileRepository\stwrt.inf_x86_neutral_8e7d5b9d3a91d8c5\aestsrv.exe [2009-03-01 81920]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2009-07-22 176128]
S2 Fabs;FABS - Helping agent for MAGIX media database;c:\program files\Common Files\MAGIX Services\Database\bin\FABS.exe [2009-08-27 1253376]
S2 hpsrv;HP Service;c:\windows\system32\Hpservice.exe [2009-07-08 26168]
S2 NanoServiceMain;Panda Cloud Antivirus Service;c:\program files\Panda Security\Panda Cloud Antivirus\PSANHost.exe [2010-04-30 136448]
S2 PSINAflt;PSINAflt;c:\windows\system32\DRIVERS\PSINAflt.sys [2010-05-27 141384]
S2 PSINFile;PSINFile;c:\windows\system32\DRIVERS\PSINFile.sys [2010-04-30 99336]
S2 PSINProc;PSINProc;c:\windows\system32\DRIVERS\PSINProc.sys [2010-04-30 111112]
S2 PSINProt;PSINProt;c:\windows\system32\DRIVERS\PSINProt.sys [2010-05-12 111176]
S2 SBSDWSCService;SBSD Security Center Service;c:\program files\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368]
S2 TomTomHOMEService;TomTomHOMEService;c:\program files\TomTom HOME 2\TomTomHOMEService.exe [2010-06-24 92008]
S3 clwvd;CyberLink WebCam Virtual Driver;c:\windows\system32\DRIVERS\clwvd.sys [2010-01-25 27504]
S3 Com4QLBEx;Com4QLBEx;c:\program files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe [2009-05-05 228408]
S3 enecir;ENE CIR Receiver;c:\windows\system32\DRIVERS\enecir.sys [2008-09-04 54784]
S3 JMCR;JMCR;c:\windows\system32\DRIVERS\jmcr.sys [2008-10-23 107360]
S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [2009-07-13 14336]


[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
WindowsMobile        REG_MULTI_SZ          wcescomm rapimgr
LocalServiceRestricted        REG_MULTI_SZ          WcesComm RapiMgr

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2009-06-17 11:11        451872        ----a-w-        c:\program files\Common Files\LightScribe\LSRunOnce.exe
.
Inhalt des "geplante Tasks" Ordners

2010-09-30 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-08-06 15:01]

2010-09-30 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-08-06 15:01]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.google.de/
uInternet Settings,ProxyOverride = *.local
IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~1\Office12\EXCEL.EXE/3000
Trusted Zone: hts-admin.net\www
Trusted Zone: hts-online.net\www
Handler: htap - {83EC570E-9FFA-11D2-9559-006008594011} - c:\program files\Hogrefe\Common\HTSProtHandler.dll
FF - ProfilePath - c:\users\Tim\AppData\Roaming\Mozilla\Firefox\Profiles\xnm3v344.default\
FF - prefs.js: browser.startup.homepage - handelsblatt.de
FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?fr=panda&type=panda1_0yatb&p=
FF - component: c:\program files\Panda Security\Panda ID Protect\Firefox\components\FFKeypad.dll
FF - component: c:\users\Tim\AppData\Roaming\Mozilla\Firefox\Profiles\xnm3v344.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\components\FFExternalAlert.dll
FF - component: c:\users\Tim\AppData\Roaming\Mozilla\Firefox\Profiles\xnm3v344.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\components\RadioWMPCore.dll
FF - component: c:\users\Tim\AppData\Roaming\Mozilla\Firefox\Profiles\xnm3v344.default\extensions\{B821BF60-5C2D-41EB-92DC-3E4CCD3A22E4}\components\dtTransparency.dll
FF - component: c:\users\Tim\AppData\Roaming\Mozilla\Firefox\Profiles\xnm3v344.default\extensions\{B821BF60-5C2D-41EB-92DC-3E4CCD3A22E4}\components\dtTransparency3.5.dll
FF - component: c:\users\Tim\AppData\Roaming\Mozilla\Firefox\Profiles\xnm3v344.default\extensions\{B821BF60-5C2D-41EB-92DC-3E4CCD3A22E4}\components\dtTransparency3.6.dll
FF - plugin: c:\program files\DivX\DivX Plus Web Player\npdivx32.dll
FF - plugin: c:\program files\Google\Update\1.2.183.29\npGoogleOneClick8.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\nphtspse.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\nphtspst.dll
FF - plugin: c:\program files\Veetle\Player\npvlc.dll
FF - plugin: c:\program files\Veetle\plugins\npVeetle.dll
FF - plugin: c:\program files\Veetle\VLCBroadcast\npvbp.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
FF - plugin: c:\users\Tim\AppData\Roaming\Mozilla\Firefox\Profiles\xnm3v344.default\extensions\firefox@tvunetworks.com\plugins\npTVUAx.dll
FF - plugin: c:\users\Tim\AppData\Roaming\Mozilla\Firefox\Profiles\xnm3v344.default\extensions\moveplayer@movenetworks.com\platform\WINNT_x86-msvc\plugins\npmnqmp071303000004.dll
FF - plugin: c:\windows\system32\TVUAx\npTVUAx.dll
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe,-101"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2010-09-30  16:56:41
ComboFix-quarantined-files.txt  2010-09-30 14:56
ComboFix2.txt  2010-09-29 13:40

Vor Suchlauf: 181.410.914.304 bytes free
Nach Suchlauf: 181.129.220.096 bytes free

- - End Of File - - 7AFD4D85D558D51A7008DB76E744ECFB


Alle Zeitangaben in WEZ +1. Es ist jetzt 19:49 Uhr.
Seite 1 von 2 1 2
100 Beiträge dieses Themas auf einer Seite anzeigen

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55