Trojaner-Board - http://www1.mpnrs.com/tracker/...........

Der LOG:
Code:
ComboFix 11-01-03.04 - Ayhan 04.01.2011  14:40:57.5.1 - x86

Microsoft Windows XP Professional  5.1.2600.3.1252.49.1031.18.1407.998 [GMT 1:00]

ausgeführt von:: c:\dokumente und einstellungen\Ayhan\Desktop\cofi.exe

Benutzte Befehlsschalter :: c:\dokumente und einstellungen\Ayhan\Desktop\CFScript.txt

AV: AntiVir Desktop *Disabled/Updated* {AD166499-45F9-482A-A743-FDD3350758C7}
 

file zipped: c:\windows\system32\adcycjaprudkvgvh.exe

file zipped: c:\windows\system32\dbaywilwzsczzybb.exe

file zipped: c:\windows\system32\eyxbcqzadspoxqhl.exe

file zipped: c:\windows\system32\obyiqxrdirkwoykj.exe

.
 

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.
 

c:\windows\system32\adcycjaprudkvgvh.exe

c:\windows\system32\dbaywilwzsczzybb.exe

c:\windows\system32\eyxbcqzadspoxqhl.exe

c:\windows\system32\obyiqxrdirkwoykj.exe

c:\windows\system32\SWCTL.DLL
 

.

(((((((((((((((((((((((   Dateien erstellt von 2010-12-04 bis 2011-01-04  ))))))))))))))))))))))))))))))

.
 

2011-01-04 13:38 . 2011-01-04 13:39        --------        d-----w-        C:\cofi

2011-01-04 13:35 . 2010-12-14 13:00        29504        ----a-w-        c:\windows\system32\uxtuneup.dll

2010-12-30 10:28 . 2010-09-18 06:52        953856        -c----w-        c:\windows\system32\dllcache\mfc40u.dll

2010-12-30 10:28 . 2010-09-18 06:52        974848        -c----w-        c:\windows\system32\dllcache\mfc42.dll

2010-12-30 10:27 . 2010-08-23 16:11        617472        -c----w-        c:\windows\system32\dllcache\comctl32.dll

2010-12-30 10:25 . 2010-11-02 15:17        40960        -c----w-        c:\windows\system32\dllcache\ndproxy.sys

2010-12-30 10:24 . 2009-08-13 15:15        512000        -c----w-        c:\windows\system32\dllcache\jscript.dll

2010-12-29 13:21 . 2010-12-29 13:21        --------        d-----w-        c:\programme\MSXML 6.0

2010-12-29 09:54 . 2009-07-31 09:02        1372672        -c----w-        c:\windows\system32\dllcache\msxml6.dll

2010-12-29 09:54 . 2008-04-14 01:57        93184        -c----w-        c:\windows\system32\dllcache\msxml6r.dll

2010-12-29 09:54 . 2008-04-14 02:22        10752        ------w-        c:\windows\system32\smtpapi.dll

2010-12-29 09:54 . 2008-04-14 02:22        9728        ------w-        c:\windows\system32\rwnh.dll

2010-12-29 09:54 . 2008-04-14 02:21        102912        -c----w-        c:\windows\system32\dllcache\dpcdll.dll

2010-12-29 09:54 . 2008-04-14 02:20        24064        -c----w-        c:\windows\system32\dllcache\pidgen.dll

2010-12-29 09:50 . 2010-08-26 13:39        357248        -c----w-        c:\windows\system32\dllcache\srv.sys

2010-12-29 09:50 . 2010-02-24 13:11        455680        -c----w-        c:\windows\system32\dllcache\mrxsmb.sys

2010-12-29 09:50 . 2009-11-21 15:54        471552        -c----w-        c:\windows\system32\dllcache\aclayers.dll

2010-12-29 09:49 . 2010-04-28 18:11        2192256        -c----w-        c:\windows\system32\dllcache\ntoskrnl.exe

2010-12-29 09:49 . 2009-03-06 14:19        286720        -c----w-        c:\windows\system32\dllcache\pdh.dll

2010-12-29 09:49 . 2009-02-09 11:21        111104        -c----w-        c:\windows\system32\dllcache\services.exe

2010-12-29 09:49 . 2009-02-09 10:51        401408        -c----w-        c:\windows\system32\dllcache\rpcss.dll

2010-12-29 09:49 . 2009-06-25 08:25        737792        -c----w-        c:\windows\system32\dllcache\lsasrv.dll

2010-12-29 09:49 . 2009-02-09 10:51        678400        -c----w-        c:\windows\system32\dllcache\advapi32.dll

2010-12-29 09:49 . 2009-02-09 10:51        740352        -c----w-        c:\windows\system32\dllcache\ntdll.dll

2010-12-29 09:49 . 2010-04-28 05:41        2148864        -c----w-        c:\windows\system32\dllcache\ntkrnlmp.exe

2010-12-29 09:49 . 2010-04-28 05:41        2027008        -c----w-        c:\windows\system32\dllcache\ntkrpamp.exe

2010-12-29 09:47 . 2010-06-14 07:41        1172480        -c----w-        c:\windows\system32\dllcache\msxml3.dll

2010-12-29 09:44 . 2010-08-27 08:01        119808        -c----w-        c:\windows\system32\dllcache\t2embed.dll

2010-12-29 09:44 . 2009-10-15 16:28        81920        -c----w-        c:\windows\system32\dllcache\fontsub.dll

2010-12-29 09:36 . 2008-10-15 16:35        337408        -c----w-        c:\windows\system32\dllcache\netapi32.dll

2010-12-29 00:25 . 2008-04-14 02:22        11325        ------w-        c:\windows\system32\drivers\vchnt5.dll

2010-12-29 00:23 . 2010-08-23 16:11        617472        ----a-w-        c:\windows\system32\comctl32.dll

2010-12-29 00:04 . 2001-08-18 10:00        9216        -c--a-w-        c:\windows\system32\dllcache\wamps51.dll

2010-12-29 00:04 . 2001-08-18 10:00        41600        -c--a-w-        c:\windows\system32\dllcache\weitekp9.dll

2010-12-29 00:04 . 2001-08-18 10:00        31360        -c--a-w-        c:\windows\system32\dllcache\weitekp9.sys

2010-12-29 00:04 . 2001-08-18 10:00        74240        -c--a-w-        c:\windows\system32\dllcache\w3ext.dll

2010-12-29 00:04 . 2001-08-18 10:00        5632        -c--a-w-        c:\windows\system32\dllcache\w3svapi.dll

2010-12-29 00:04 . 2001-08-18 10:00        48256        -c--a-w-        c:\windows\system32\dllcache\w32.dll

2010-12-29 00:04 . 2001-08-18 10:00        4608        -c--a-w-        c:\windows\system32\dllcache\w3ctrs51.dll

2010-12-29 00:04 . 2001-08-18 10:00        14336        -c--a-w-        c:\windows\system32\dllcache\tsprof.exe

2010-12-29 00:02 . 2001-08-18 10:00        57856        -c--a-w-        c:\windows\system32\dllcache\esuimgd.dll

2010-12-28 23:55 . 2008-04-14 02:22        851968        ----a-w-        c:\programme\Gemeinsame Dateien\Microsoft Shared\VGX\vgx.dll

2010-12-28 23:54 . 2008-04-14 02:22        282624        ----a-w-        c:\programme\Windows NT\Pinball\pinball.exe

2010-12-28 23:54 . 2008-04-14 02:23        70656        ----a-w-        c:\windows\system32\access.cpl

2010-12-28 23:54 . 2008-04-14 02:23        133120        ----a-w-        c:\windows\system32\sndrec32.exe

2010-12-28 23:54 . 2008-04-14 02:22        124928        ----a-w-        c:\windows\system32\mplay32.exe

2010-12-28 23:54 . 2008-04-14 02:22        188928        ----a-w-        c:\windows\system32\accwiz.exe

2010-12-28 23:54 . 2008-04-14 02:22        356352        ----a-w-        c:\windows\system32\hypertrm.dll

2010-12-28 23:54 . 2008-04-14 02:22        545280        ----a-w-        c:\programme\Windows NT\dialer.exe

2010-12-28 23:52 . 2009-08-06 18:24        217816        ----a-w-        c:\windows\system32\wuaucpl.cpl

2010-12-28 23:52 . 2008-04-14 02:23        380928        ----a-w-        c:\windows\system32\irprops.cpl

2010-12-28 23:51 . 2010-12-29 10:40        --------        d-----w-        c:\windows\ServicePackFiles

2010-12-28 23:47 . 2008-04-14 02:23        129536        ----a-w-        c:\windows\system32\ksproxy.ax

2010-12-28 23:47 . 2008-04-14 02:22        4096        ----a-w-        c:\windows\system32\ksuser.dll

2010-12-28 23:46 . 2010-10-26 14:05        1853440        ----a-w-        c:\windows\system32\win32k.sys

2010-12-28 23:46 . 2009-06-10 06:14        132096        ----a-w-        c:\windows\system32\wkssvc.dll

2010-12-28 23:46 . 2008-04-14 02:23        146944        ----a-w-        c:\windows\system32\winspool.drv

2010-12-28 23:46 . 2008-04-14 02:22        102400        ----a-w-        c:\windows\system32\win32spl.dll

2010-12-28 23:46 . 2008-04-13 19:17        83072        ----a-w-        c:\windows\system32\drivers\wdmaud.sys

2010-12-28 23:46 . 2008-04-13 18:46        19200        ----a-w-        c:\windows\system32\drivers\wstcodec.sys

2010-12-28 23:46 . 2010-12-28 23:46        --------        d-s---w-        c:\dokumente und einstellungen\Default User\Eigene Dateien

2010-12-28 23:42 . 2008-04-14 02:22        741376        ----a-w-        c:\programme\Gemeinsame Dateien\Microsoft Shared\Speech\sapi.dll

2010-12-28 23:42 . 2008-04-14 02:23        146944        ----a-w-        c:\windows\system\winspool.drv

2010-12-28 23:42 . 2001-08-18 10:00        24661        -c--a-w-        c:\windows\system32\dllcache\spxcoins.dll

2010-12-28 23:42 . 2001-08-18 10:00        24661        ----a-w-        c:\windows\system32\spxcoins.dll

2010-12-28 23:42 . 2001-08-18 10:00        13824        -c--a-w-        c:\windows\system32\dllcache\irclass.dll

2010-12-28 23:42 . 2001-08-18 10:00        13824        ----a-w-        c:\windows\system32\irclass.dll

2010-12-28 23:42 . 2008-04-14 02:22        76288        ----a-w-        c:\windows\system32\storprop.dll

2010-12-28 23:20 . 2001-08-18 03:55        99865        -c--a-w-        c:\windows\system32\dllcache\xlog.exe

2010-12-28 23:20 . 2001-08-18 03:55        4608        -c--a-w-        c:\windows\system32\dllcache\xrxflnch.exe

2010-12-28 23:20 . 2001-08-18 03:55        27648        -c--a-w-        c:\windows\system32\dllcache\xrxftplt.exe

2010-12-28 23:20 . 2001-08-18 03:54        23040        -c--a-w-        c:\windows\system32\dllcache\xrxwbtmp.dll

2010-12-28 23:20 . 2001-08-17 11:11        16970        -c--a-w-        c:\windows\system32\dllcache\xem336n5.sys

2010-12-28 23:20 . 2001-08-18 03:24        35402        -c--a-w-        c:\windows\system32\dllcache\wlandrv2.sys

2010-12-28 23:20 . 2001-08-17 12:28        771581        -c--a-w-        c:\windows\system32\dllcache\winacisa.sys

2010-12-28 23:20 . 2001-08-18 03:54        87040        -c--a-w-        c:\windows\system32\dllcache\wiafbdrv.dll

2010-12-28 23:20 . 2001-08-18 03:54        54272        -c--a-w-        c:\windows\system32\dllcache\wiamsmud.dll

2010-12-28 23:20 . 2001-08-17 12:28        701386        -c--a-w-        c:\windows\system32\dllcache\wdhaalba.sys

2010-12-28 23:20 . 2001-08-17 11:10        35871        -c--a-w-        c:\windows\system32\dllcache\wbfirdma.sys

2010-12-28 23:18 . 2001-08-17 11:12        37563        -c--a-w-        c:\windows\system32\dllcache\rlnet5.sys

2010-12-28 23:17 . 2001-08-17 12:52        17280        -c--a-w-        c:\windows\system32\dllcache\mraid35x.sys

2010-12-28 23:16 . 2001-08-17 12:28        50751        -c--a-w-        c:\windows\system32\dllcache\hsf_tone.sys

2010-12-28 23:15 . 2001-08-18 03:53        87552        -c--a-w-        c:\windows\system32\dllcache\dc240usd.dll

2010-12-28 23:14 . 2001-08-18 03:52        66048        -c--a-w-        c:\windows\system32\dllcache\s3legacy.dll

2010-12-28 13:59 . 2010-12-28 23:54        --------        d-----w-        c:\windows\Cursors

2010-12-28 13:59 . 2010-12-28 13:59        --------        d-----w-        c:\windows\Config

2010-12-25 19:22 . 2010-12-29 17:54        --------        d-----w-        c:\programme\Cheat Engine

2010-12-25 19:22 . 2009-11-03 13:07        679936        ----a-w-        c:\windows\system32\D3DX81ab.dll

2010-12-25 19:22 . 2009-11-03 13:07        1970176        ----a-w-        c:\windows\system32\d3dx9.dll

2010-12-16 09:15 . 2010-12-16 09:15        --------        d-----w-        c:\dokumente und einstellungen\Ayhan\Lokale Einstellungen\Anwendungsdaten\GamersFirst LIVE!

2010-12-11 16:48 . 2010-12-11 16:48        --------        d-----w-        c:\dokumente und einstellungen\Ayhan\Lokale Einstellungen\Anwendungsdaten\Unity

2010-12-10 16:25 . 2010-12-14 13:05        31552        ----a-w-        c:\windows\system32\TURegOpt.exe

2010-12-10 16:25 . 2011-01-04 13:35        --------        d-----w-        c:\programme\TuneUp Utilities 2011

2010-12-10 16:23 . 2010-12-10 16:23        --------        d-sh--w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\{24036256-BFDB-4CD3-BE8A-A3D6160F2E16}
 

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2010-12-21 14:04 . 2010-08-23 11:51        135096        ----a-w-        c:\windows\system32\drivers\avipbb.sys

2010-12-20 17:09 . 2010-08-19 08:38        38224        ----a-w-        c:\windows\system32\drivers\mbamswissarmy.sys

2010-12-20 17:08 . 2010-08-19 08:38        20952        ----a-w-        c:\windows\system32\drivers\mbam.sys

2010-11-22 16:41 . 2010-08-23 11:51        61960        ----a-w-        c:\windows\system32\drivers\avgntflt.sys

2010-11-18 18:12 . 2010-03-19 12:51        86016        ----a-w-        c:\windows\system32\isign32.dll

2010-11-12 17:53 . 2010-04-21 17:12        472808        ----a-w-        c:\windows\system32\deployJava1.dll

2010-11-12 15:34 . 2010-04-21 17:12        73728        ----a-w-        c:\windows\system32\javacpl.cpl

2010-11-12 00:44 . 2010-11-12 00:44        94208        ----a-w-        c:\windows\system32\dpl100.dll

2010-11-08 22:57 . 2010-11-08 22:57        353592        ----a-w-        c:\windows\system32\DivXControlPanelApplet.cpl

2010-11-07 14:37 . 2010-11-07 14:37        1199179        ----a-w-        c:\windows\unins002.exe

2010-11-07 14:37 . 2010-11-07 14:37        709719        ----a-w-        c:\windows\unins001.exe

2010-11-07 14:37 . 2010-11-07 14:37        1199175        ----a-w-        c:\windows\unins000.exe

2010-11-05 05:04 . 2001-08-18 10:00        672768        ----a-w-        c:\windows\system32\wininet.dll

2010-10-28 13:12 . 2001-08-18 10:00        290048        ----a-w-        c:\windows\system32\atmfd.dll

2010-10-08 07:54 . 2010-10-08 07:54        113216        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\Microsoft\VCExpress\9.0\1031\ResourceCache.dll

2010-10-08 07:53 . 2010-10-08 07:53        416        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\Microsoft\MSDN\9.0\1031\ResourceCache.dll

.
 

(((((((((((((((((((((((((((((   SnapShot_2011-01-03_11.46.11   )))))))))))))))))))))))))))))))))))))))))

.

+ 2011-01-04 13:23 . 2011-01-04 13:23        16384              c:\windows\temp\Perflib_Perfdata_114.dat

+ 2010-11-19 15:49 . 2010-11-19 15:49        29504              c:\windows\Installer\$PatchCache$\Managed\65263042BDFB3DC4EBA83A6D61F0E261\10.0.2020\uxtuneupx86.dll

+ 2010-11-19 15:49 . 2010-11-19 15:49        11584              c:\windows\Installer\$PatchCache$\Managed\65263042BDFB3DC4EBA83A6D61F0E261\10.0.2020\tux64thk.exe

+ 2010-11-19 15:53 . 2010-11-19 15:53        57664              c:\windows\Installer\$PatchCache$\Managed\65263042BDFB3DC4EBA83A6D61F0E261\10.0.2020\TUUnInstallHelper.exe

+ 2010-11-19 15:55 . 2010-11-19 15:55        59712              c:\windows\Installer\$PatchCache$\Managed\65263042BDFB3DC4EBA83A6D61F0E261\10.0.2020\TURatingSynch.exe

+ 2010-11-19 15:54 . 2010-11-19 15:54        86848              c:\windows\Installer\$PatchCache$\Managed\65263042BDFB3DC4EBA83A6D61F0E261\10.0.2020\TUMessages.exe

+ 2010-11-19 15:49 . 2010-11-19 15:49        29504              c:\windows\Installer\$PatchCache$\Managed\65263042BDFB3DC4EBA83A6D61F0E261\10.0.2020\SDShelEx86.dll

+ 2010-11-19 15:54 . 2010-11-19 15:54        96576              c:\windows\Installer\$PatchCache$\Managed\65263042BDFB3DC4EBA83A6D61F0E261\10.0.2020\RegWiz.exe

+ 2010-11-19 15:54 . 2010-11-19 15:54        15680              c:\windows\Installer\$PatchCache$\Managed\65263042BDFB3DC4EBA83A6D61F0E261\10.0.2020\RegistryDefragHelper.exe

+ 2010-11-19 15:54 . 2010-11-19 15:54        31552              c:\windows\Installer\$PatchCache$\Managed\65263042BDFB3DC4EBA83A6D61F0E261\10.0.2020\PMLauncher.exe

+ 2010-11-19 15:49 . 2010-11-19 15:49        25920              c:\windows\Installer\$PatchCache$\Managed\65263042BDFB3DC4EBA83A6D61F0E261\10.0.2020\DseShExtx86.dll

+ 2010-11-19 15:53 . 2010-11-19 15:53        31552              c:\windows\Installer\$PatchCache$\Managed\65263042BDFB3DC4EBA83A6D61F0E261\10.0.2020\C_TURegOpt.exe

+ 2010-11-19 15:49 . 2010-11-19 15:49        21312              c:\windows\Installer\$PatchCache$\Managed\65263042BDFB3DC4EBA83A6D61F0E261\10.0.2020\authuitu_x86.dll

+ 2010-11-19 15:55 . 2010-11-19 15:55        228424              c:\windows\Installer\$PatchCache$\Managed\AA06C4D56E48A1E4A8869679D083B71E\10.0.2020\ProductInfo.dat

+ 2010-11-19 15:54 . 2010-11-19 15:54        921408              c:\windows\Installer\$PatchCache$\Managed\65263042BDFB3DC4EBA83A6D61F0E261\10.0.2020\WinStyler.exe

+ 2010-11-19 15:54 . 2010-11-19 15:54        251200              c:\windows\Installer\$PatchCache$\Managed\65263042BDFB3DC4EBA83A6D61F0E261\10.0.2020\UpdateWizard.exe

+ 2010-11-19 15:54 . 2010-11-19 15:54        249664              c:\windows\Installer\$PatchCache$\Managed\65263042BDFB3DC4EBA83A6D61F0E261\10.0.2020\UninstallManager.exe

+ 2010-11-19 15:54 . 2010-11-19 15:54        191296              c:\windows\Installer\$PatchCache$\Managed\65263042BDFB3DC4EBA83A6D61F0E261\10.0.2020\Undelete.exe

+ 2010-11-19 15:54 . 2010-11-19 15:54        544064              c:\windows\Installer\$PatchCache$\Managed\65263042BDFB3DC4EBA83A6D61F0E261\10.0.2020\TUSqlDB32.dll

+ 2010-11-19 15:55 . 2010-11-19 15:55        113984              c:\windows\Installer\$PatchCache$\Managed\65263042BDFB3DC4EBA83A6D61F0E261\10.0.2020\TurboConfig.exe

+ 2010-11-19 15:54 . 2010-11-19 15:54        241472              c:\windows\Installer\$PatchCache$\Managed\65263042BDFB3DC4EBA83A6D61F0E261\10.0.2020\TuneUpSystemStatusCheck.exe

+ 2010-11-19 15:54 . 2010-11-19 15:54        212288              c:\windows\Installer\$PatchCache$\Managed\65263042BDFB3DC4EBA83A6D61F0E261\10.0.2020\TUInstallHelper.exe

+ 2010-11-19 15:53 . 2010-11-19 15:53        179008              c:\windows\Installer\$PatchCache$\Managed\65263042BDFB3DC4EBA83A6D61F0E261\10.0.2020\TUAnalyzeInfo.dll

+ 2010-11-19 15:54 . 2010-11-19 15:54        272192              c:\windows\Installer\$PatchCache$\Managed\65263042BDFB3DC4EBA83A6D61F0E261\10.0.2020\SystemInformation.exe

+ 2010-11-19 15:54 . 2010-11-19 15:54        104256              c:\windows\Installer\$PatchCache$\Managed\65263042BDFB3DC4EBA83A6D61F0E261\10.0.2020\SystemControl.exe

+ 2010-11-19 15:54 . 2010-11-19 15:54        123200              c:\windows\Installer\$PatchCache$\Managed\65263042BDFB3DC4EBA83A6D61F0E261\10.0.2020\Stiderc.dll

+ 2010-11-19 15:54 . 2010-11-19 15:54        488256              c:\windows\Installer\$PatchCache$\Managed\65263042BDFB3DC4EBA83A6D61F0E261\10.0.2020\StartupOptimizer.exe

+ 2010-11-19 15:54 . 2010-11-19 15:54        313152              c:\windows\Installer\$PatchCache$\Managed\65263042BDFB3DC4EBA83A6D61F0E261\10.0.2020\StartUpManager.exe

+ 2010-11-19 15:54 . 2010-11-19 15:54        133952              c:\windows\Installer\$PatchCache$\Managed\65263042BDFB3DC4EBA83A6D61F0E261\10.0.2020\Shredder.exe

+ 2010-11-19 15:54 . 2010-11-19 15:54        226624              c:\windows\Installer\$PatchCache$\Managed\65263042BDFB3DC4EBA83A6D61F0E261\10.0.2020\ShortcutCleaner.exe

+ 2010-11-19 15:54 . 2010-11-19 15:54        167232              c:\windows\Installer\$PatchCache$\Managed\65263042BDFB3DC4EBA83A6D61F0E261\10.0.2020\RescueCenter.exe

+ 2010-11-19 15:54 . 2010-11-19 15:54        127808              c:\windows\Installer\$PatchCache$\Managed\65263042BDFB3DC4EBA83A6D61F0E261\10.0.2020\Report.exe

+ 2010-11-19 15:54 . 2010-11-19 15:54        131904              c:\windows\Installer\$PatchCache$\Managed\65263042BDFB3DC4EBA83A6D61F0E261\10.0.2020\RepairWizard.exe

+ 2010-11-19 15:54 . 2010-11-19 15:54        296256              c:\windows\Installer\$PatchCache$\Managed\65263042BDFB3DC4EBA83A6D61F0E261\10.0.2020\RegistryEditor.exe

+ 2010-11-19 15:54 . 2010-11-19 15:54        173888              c:\windows\Installer\$PatchCache$\Managed\65263042BDFB3DC4EBA83A6D61F0E261\10.0.2020\RegistryDefrag.exe

+ 2010-11-19 15:54 . 2010-11-19 15:54        290112              c:\windows\Installer\$PatchCache$\Managed\65263042BDFB3DC4EBA83A6D61F0E261\10.0.2020\RegistryCleaner.exe

+ 2010-11-19 15:54 . 2010-11-19 15:54        321856              c:\windows\Installer\$PatchCache$\Managed\65263042BDFB3DC4EBA83A6D61F0E261\10.0.2020\ProgramDeactivator.exe

+ 2010-11-19 15:54 . 2010-11-19 15:54        348480              c:\windows\Installer\$PatchCache$\Managed\65263042BDFB3DC4EBA83A6D61F0E261\10.0.2020\ProcessManager.exe

+ 2010-11-19 15:55 . 2010-11-19 15:55        528192              c:\windows\Installer\$PatchCache$\Managed\65263042BDFB3DC4EBA83A6D61F0E261\10.0.2020\PerformanceOptimizer.exe

+ 2010-11-19 15:54 . 2010-11-19 15:54        138560              c:\windows\Installer\$PatchCache$\Managed\65263042BDFB3DC4EBA83A6D61F0E261\10.0.2020\OneClickStarter.exe

+ 2010-11-19 15:54 . 2010-11-19 15:54        583488              c:\windows\Installer\$PatchCache$\Managed\65263042BDFB3DC4EBA83A6D61F0E261\10.0.2020\OneClick.exe

+ 2010-11-19 15:54 . 2010-11-19 15:54        177472              c:\windows\Installer\$PatchCache$\Managed\65263042BDFB3DC4EBA83A6D61F0E261\10.0.2020\MsStyles.dll

+ 2010-11-19 15:55 . 2010-11-19 15:55        211264              c:\windows\Installer\$PatchCache$\Managed\65263042BDFB3DC4EBA83A6D61F0E261\10.0.2020\LiveOptimizer.exe

+ 2010-11-19 15:54 . 2010-11-19 15:54        237888              c:\windows\Installer\$PatchCache$\Managed\65263042BDFB3DC4EBA83A6D61F0E261\10.0.2020\DriveDefrag.exe

+ 2010-11-19 15:54 . 2010-11-19 15:54        417088              c:\windows\Installer\$PatchCache$\Managed\65263042BDFB3DC4EBA83A6D61F0E261\10.0.2020\DiskExplorer.exe

+ 2010-11-19 15:54 . 2010-11-19 15:54        120640              c:\windows\Installer\$PatchCache$\Managed\65263042BDFB3DC4EBA83A6D61F0E261\10.0.2020\DiskDoctor.exe

+ 2010-12-14 13:11 . 2010-12-14 13:11        2192384              c:\windows\Installer\ae386.msp

+ 2010-12-14 13:12 . 2010-12-14 13:12        1153536              c:\windows\Installer\ae29d.msp

+ 2010-11-19 15:54 . 2010-11-19 15:54        1132864              c:\windows\Installer\$PatchCache$\Managed\65263042BDFB3DC4EBA83A6D61F0E261\10.0.2020\SilentUpdater.exe

+ 2010-11-19 15:54 . 2010-11-19 15:54        1051456              c:\windows\Installer\$PatchCache$\Managed\65263042BDFB3DC4EBA83A6D61F0E261\10.0.2020\Integrator.exe

+ 2010-11-19 15:55 . 2010-11-19 15:55        11516718              c:\windows\Installer\$PatchCache$\Managed\65263042BDFB3DC4EBA83A6D61F0E261\10.0.2020\TUData.dat

.

-- Snapshot auf jetziges Datum zurückgesetzt --

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4
 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"CCWinTray"="c:\windows\tray\wintmr.exe" [2001-08-18 5500568]
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"NvCplDaemon"="c:\windows\System32\NvCpl.dll" [2005-10-10 7286784]

"nwiz"="nwiz.exe" [2005-10-10 1519616]

"SkyTel"="SkyTel.EXE" [2006-05-16 2879488]

"SunJavaUpdateSched"="c:\programme\Gemeinsame Dateien\Java\Java Update\jusched.exe" [2010-05-14 248552]

"avgnt"="c:\programme\Avira\AntiVir Desktop\avgnt.exe" [2010-11-02 281768]

"ChicoSys"="c:\windows\system32\cc32\webtmr.exe" [2001-08-18 5525656]

"NvMediaCenter"="c:\windows\System32\NvMcTray.dll" [2005-10-10 86016]

"RTHDCPL"="RTHDCPL.EXE" [2006-06-28 16248320]

"Malwarebytes' Anti-Malware"="c:\programme\Malwarebytes' Anti-Malware\mbamgui.exe" [2010-12-20 443728]
 

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]

"tscuninstall"="c:\windows\system32\tscupgrd.exe" [2004-08-03 44544]
 

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]

"NoCommonGroups"= 0 (0x0)
 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ksupmgr]

@="Service"
 

[HKLM\~\startupfolder\C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^HP Digital Imaging Monitor.lnk]

path=c:\dokumente und einstellungen\All Users\Startmenü\Programme\Autostart\HP Digital Imaging Monitor.lnk

backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup
 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ChicoSys]

2001-08-18 10:00        5525656        ----a-w-        c:\windows\system32\cc32\webtmr.exe
 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]

2010-04-01 09:16        357696        ----a-w-        c:\programme\DAEMON Tools Lite\DTLite.exe
 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DivX Download Manager]

2010-12-08 21:15        63360        ----a-w-        c:\programme\DivX\DivX Plus Web Player\DDMService.exe
 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DivXUpdate]

2010-12-09 19:28        1226608        ----a-w-        c:\programme\DivX\DivX Update\DivXUpdate.exe
 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]

2010-06-09 18:55        49208        ----a-w-        c:\programme\HP\HP Software Update\hpwuschd2.exe
 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Malwarebytes' Anti-Malware]

2010-12-20 17:08        443728        ----a-w-        c:\programme\Malwarebytes' Anti-Malware\mbamgui.exe
 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]

2009-07-26 14:44        3883840        ----a-w-        c:\programme\Windows Live\Messenger\msnmsgr.exe
 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Pando Media Booster]

2010-11-19 21:58        2937528        ----a-w-        c:\programme\Pando Networks\Media Booster\PMB.exe
 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]

2010-09-08 09:17        421888        ----a-w-        c:\programme\QuickTime\QTTask.exe
 

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]

"H/PC Connection Agent"="c:\programme\Microsoft ActiveSync\wcescomm.exe"
 

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]

"Adobe ARM"="c:\programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe"

"Adobe Reader Speed Launcher"="c:\programme\Adobe\Reader 9.0\Reader\Reader_sl.exe"

"QuickTime Task"="c:\programme\QuickTime\QTTask.exe" -atboottime
 

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"AntiVirusOverride"=dword:00000001
 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Programme\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=

"c:\\Programme\\Windows Live\\Messenger\\wlcsdk.exe"=

"c:\\Programme\\Windows Live\\Messenger\\msnmsgr.exe"=

"c:\\Programme\\HP\\Digital Imaging\\bin\\hpqste08.exe"=

"c:\\Programme\\HP\\Digital Imaging\\bin\\hposid01.exe"=

"c:\\Programme\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=

"c:\\Programme\\HP\\Digital Imaging\\bin\\hpfcCopy.exe"=

"c:\\Programme\\HP\\Digital Imaging\\bin\\hpoews01.exe"=

"c:\\Programme\\HP\\Digital Imaging\\bin\\hpiscnapp.exe"=

"c:\\Programme\\HP\\Digital Imaging\\bin\\hpqgplgtupl.exe"=

"c:\\Programme\\HP\\Digital Imaging\\bin\\hpqgpc01.exe"=

"c:\\Programme\\HP\\Digital Imaging\\bin\\hpqusgm.exe"=

"c:\\Programme\\HP\\Digital Imaging\\bin\\hpqusgh.exe"=

"c:\\Programme\\HP\\HP Software Update\\HPWUCli.exe"=

"c:\\Programme\\HP\\Digital Imaging\\smart web printing\\SmartWebPrintExe.exe"=

"c:\\Programme\\uTorrent\\uTorrent.exe"=

"c:\programme\Microsoft ActiveSync\rapimgr.exe"= c:\programme\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager

"c:\programme\Microsoft ActiveSync\wcescomm.exe"= c:\programme\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager

"c:\programme\Microsoft ActiveSync\WCESMgr.exe"= c:\programme\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application

"c:\\Programme\\Pando Networks\\Media Booster\\PMB.exe"=
 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service

"45682:TCP"= 45682:TCP:µTorrent

"58750:TCP"= 58750:TCP:Pando Media Booster

"58750:UDP"= 58750:UDP:Pando Media Booster
 

R2 AntiVirSchedulerService;Avira AntiVir Planer;c:\programme\Avira\AntiVir Desktop\sched.exe [23.08.2010 12:51 135336]

R2 MBAMService;MBAMService;c:\programme\Malwarebytes' Anti-Malware\mbamservice.exe [19.08.2010 09:38 363344]

R2 TuneUp.UtilitiesSvc;TuneUp Utilities Service;c:\programme\TuneUp Utilities 2011\TuneUpUtilitiesService32.exe [14.12.2010 14:03 1517376]

R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [19.08.2010 09:38 20952]

R3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;c:\programme\TuneUp Utilities 2011\TuneUpUtilitiesDriver32.sys [07.10.2010 12:34 10064]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [18.03.2010 12:16 130384]

S2 gupdate;Google Update Service (gupdate);c:\programme\Google\Update\GoogleUpdate.exe [01.06.2010 20:33 136176]

S2 ksupmgr;File-/Update-Service V1.0;c:\windows\system32\ksupmgr.exe [30.03.2010 16:12 765592]

S3 Lavasoft Kernexplorer;Lavasoft helper driver; [x]

S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [18.03.2010 12:16 753504]

S3 zlportio;zlportio; [x]

S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [03.04.2010 10:13 691696]
 

--- Andere Dienste/Treiber im Speicher ---
 

*NewlyCreated* - TUNEUP.UTILITIESSVC

*NewlyCreated* - UXTUNEUP

*Deregistered* - Chico
 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

HPZ12        REG_MULTI_SZ           Pml Driver HPZ12 Net Driver HPZ12

hpdevmgmt        REG_MULTI_SZ           hpqcxs08 hpqddsvc
 

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost  - NetSvcs

UxTuneUp

.

Inhalt des "geplante Tasks" Ordners
 

2010-12-11 c:\windows\Tasks\AppleSoftwareUpdate.job

- c:\programme\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]
 

2010-12-31 c:\windows\Tasks\Automatische Wartung.job

- c:\programme\TuneUp Utilities 2011\OneClickStarter.exe [2010-12-14 13:06]

.

.

------- Zusätzlicher Suchlauf -------

.

uStart Page = hxxp://www.google.de/

uInternet Settings,ProxyOverride = local

IE: Free YouTube to Mp3 Converter - c:\dokumente und einstellungen\Ayhan\Anwendungsdaten\DVDVideoSoftIEHelpers\youtubetomp3.htm

FF - ProfilePath - c:\dokumente und einstellungen\Ayhan\Anwendungsdaten\Mozilla\Firefox\Profiles\qvvsicqd.default\

FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2431245&SearchSource=3&q={searchTerms}

FF - prefs.js: browser.startup.homepage - hxxp://www.google.de/firefox

FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\programme\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - c:\programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} - c:\programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}

FF - Ext: Java Quick Starter: jqs@sun.com - c:\programme\Java\jre6\lib\deploy\jqs\ff

FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension

FF - Ext: DivX Plus Web Player HTML5 &lt;video&gt;: {23fcfd51-4958-4f00-80a3-ae97e717ed8b} - c:\programme\DivX\DivX Plus Web Player\firefox\html5video

FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}

FF - Ext: TVU Web Player: firefox@tvunetworks.com - %profile%\extensions\firefox@tvunetworks.com

FF - Ext: Adblock Plus: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} - %profile%\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}

FF - Ext: DVDVideoSoft Menu: {ACAA314B-EEBA-48e4-AD47-84E31C44796C} - %profile%\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}

FF - Ext: ReloadEvery: {888d99e7-e8b5-46a3-851e-1ec45da1e644} - %profile%\extensions\{888d99e7-e8b5-46a3-851e-1ec45da1e644}

FF - user.js: browser.cache.memory.capacity - 65536

FF - user.js: browser.chrome.favicons - false

FF - user.js: browser.display.show_image_placeholders - true

FF - user.js: browser.turbo.enabled - true

FF - user.js: browser.urlbar.autocomplete.enabled - true

FF - user.js: browser.urlbar.autofill - true

FF - user.js: browser.xul.error_pages.enabled - true

FF - user.js: content.interrupt.parsing - true

FF - user.js: content.max.tokenizing.time - 1800000

FF - user.js: content.maxtextrun - 8191

FF - user.js: content.notify.backoffcount - 5

FF - user.js: content.notify.interval - 600000

FF - user.js: content.notify.ontimer - true

FF - user.js: content.switch.threshold - 600000

FF - user.js: network.http.max-connections - 32

FF - user.js: network.http.max-connections-per-server - 8

FF - user.js: network.http.max-persistent-connections-per-proxy - 8

FF - user.js: network.http.max-persistent-connections-per-server - 4

FF - user.js: network.http.pipelining - true

FF - user.js: network.http.pipelining.firstrequest - true

FF - user.js: network.http.pipelining.maxrequests - 8

FF - user.js: network.http.proxy.pipelining - true

FF - user.js: network.http.request.max-start-delay - 0

FF - user.js: nglayout.initialpaint.delay - 600

FF - user.js: plugin.expose_full_path - true

FF - user.js: ui.submenuDelay - 0

.
 

**************************************************************************
 

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2011-01-04 14:45

Windows 5.1.2600 Service Pack 3 NTFS
 

Scanne versteckte Prozesse... 
 

Scanne versteckte Autostarteinträge... 
 

Scanne versteckte Dateien... 
 

Scan erfolgreich abgeschlossen

versteckte Dateien: 0
 

**************************************************************************

.

--------------------- Gesperrte Registrierungsschluessel ---------------------
 

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10j_ActiveX.exe,-101"
 

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]

"Enabled"=dword:00000001
 

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]

@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10j_ActiveX.exe"
 

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
 

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]

@Denied: (A 2) (Everyone)

@="IFlashBroker4"
 

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"
 

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

Zeit der Fertigstellung: 2011-01-04  14:47:16

ComboFix-quarantined-files.txt  2011-01-04 13:47

ComboFix2.txt  2011-01-03 11:50

ComboFix3.txt  2010-09-19 16:18

ComboFix4.txt  2010-09-09 18:19
 

Vor Suchlauf: 11 Verzeichnis(se), 47.275.831.296 Bytes frei

Nach Suchlauf: 13 Verzeichnis(se), 47.260.848.128 Bytes frei
 

Current=1 Default=1 Failed=0 LastKnownGood=6 Sets=1,2,3,4,5,6

- - End Of File - - D63339E0D6FDE0269B53CEE921BB3218