Trojaner-Board - SystemTool 2011

Combofix Logfile:
Code:
ComboFix 11-01-10.04 - Brandon 10.01.2011  18:44:16.1.2 - x86

Microsoft® Windows Vista™ Home Premium   6.0.6002.2.1252.49.1031.18.2813.1651 [GMT 1:00]

ausgeführt von:: c:\users\Brandon\Desktop\ComboFix.exe

AV: G Data AntiVirus 2011 *Disabled/Updated* {54ACC2FC-837E-E665-7A92-5352D560D5EF}

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.
 

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.
 

c:\_otl\MovedFiles\01092011_201324\C_Users\Brandon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tool

c:\windows\system32\drivers\FSC__PI__AMILO Pa 3515   __   _P1   __Ver 1.00PARTTBL_FSC - 6040000_V1.13   __ATI Radeon HD 3200 Graphics .MRK

c:\windows\system32\drivers\rlmbcdil.sys
 

.

(((((((((((((((((((((((((((((((((((((((   Treiber/Dienste   )))))))))))))))))))))))))))))))))))))))))))))))))

.
 

-------\Service_ggfteb
 
 

(((((((((((((((((((((((   Dateien erstellt von 2010-12-10 bis 2011-01-10  ))))))))))))))))))))))))))))))

.
 

2011-01-10 14:53 . 2011-01-10 14:53        --------        d-----w-        c:\users\Brandon\AppData\Roaming\Malwarebytes

2011-01-10 14:53 . 2010-12-20 17:09        38224        ----a-w-        c:\windows\system32\drivers\mbamswissarmy.sys

2011-01-10 14:53 . 2011-01-10 14:53        --------        d-----w-        c:\programdata\Malwarebytes

2011-01-10 14:53 . 2011-01-10 17:09        --------        d-----w-        c:\program files\Malwarebytes' Anti-Malware

2011-01-10 14:53 . 2010-12-20 17:08        20952        ----a-w-        c:\windows\system32\drivers\mbam.sys

2011-01-09 21:19 . 2010-10-19 04:27        7680        ----a-w-        c:\program files\Internet Explorer\iecompat.dll

2011-01-09 21:16 . 2009-03-08 11:32        72704        ----a-w-        c:\windows\system32\admparse.dll

2011-01-09 20:39 . 2008-01-12 18:30        8704        ----a-r-        c:\users\Brandon\AppData\Roaming\Microsoft\Installer\{9A3BC157-B94F-4EFD-ABA9-1E56DEB00655}\Icon9A3BC1573.exe

2011-01-09 20:38 . 2011-01-10 15:04        --------        d-----w-        c:\users\Brandon\AppData\Roaming\skypePM

2011-01-09 20:38 . 2006-11-02 12:37        --------        d-----w-        c:\users\Brandon\AppData\Roaming\Media Center Programs

2011-01-09 19:16 . 2011-01-09 19:16        --------        d-----w-        c:\users\Brandon\AppData\Roaming\ATI

2011-01-09 19:16 . 2011-01-10 18:00        --------        d-----w-        c:\users\Brandon\AppData\Roaming\Skype

2011-01-09 19:16 . 2011-01-10 14:52        --------        d-----w-        c:\users\Brandon\AppData\Roaming\Spyware Terminator

2011-01-09 19:13 . 2011-01-09 19:28        --------        d-----w-        C:\_OTL

2011-01-09 16:44 . 2011-01-09 16:44        142592        ----a-w-        c:\windows\system32\drivers\sp_rsdrv2.sys

2011-01-09 16:44 . 2011-01-10 14:14        --------        d-----w-        c:\programdata\Spyware Terminator

2011-01-09 16:44 . 2011-01-09 21:51        --------        d-----w-        c:\program files\Spyware Terminator

2011-01-09 15:29 . 2011-01-09 19:13        --------        d-----w-        c:\programdata\eFjBp01804

2011-01-09 14:58 . 2011-01-09 14:58        --------        d-----w-        c:\programdata\Blizzard Entertainment

2011-01-09 14:45 . 2011-01-09 14:45        --------        d-----w-        c:\program files\Common Files\Blizzard Entertainment

2011-01-09 09:54 . 2011-01-09 09:54        --------        d-----w-        c:\program files\Common Files\Skype

2011-01-09 09:54 . 2011-01-09 09:54        --------        d-----r-        c:\program files\Skype

2011-01-09 09:54 . 2011-01-09 09:54        --------        d-----w-        c:\programdata\Skype

2011-01-09 08:31 . 2009-08-24 11:36        377344        ----a-w-        c:\windows\system32\winhttp.dll

2011-01-09 08:31 . 2010-09-06 16:20        125952        ----a-w-        c:\windows\system32\srvsvc.dll

2011-01-09 08:31 . 2010-09-06 16:19        17920        ----a-w-        c:\windows\system32\netevent.dll

2011-01-09 08:31 . 2010-09-06 13:45        304128        ----a-w-        c:\windows\system32\drivers\srv.sys

2011-01-09 08:31 . 2010-09-06 13:45        145408        ----a-w-        c:\windows\system32\drivers\srv2.sys

2011-01-09 08:31 . 2010-09-06 13:45        102400        ----a-w-        c:\windows\system32\drivers\srvnet.sys

2011-01-09 08:31 . 2010-05-27 20:08        739328        ----a-w-        c:\windows\system32\inetcomm.dll

2011-01-09 08:26 . 2010-11-16 11:01        6273872        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{23BB9415-F2ED-40D0-BC8C-F8C832E72B73}\mpengine.dll

2011-01-09 08:09 . 2011-01-09 08:09        --------        d-----w-        c:\program files\Windows Portable Devices

2010-12-26 17:13 . 2009-09-10 02:00        92672        ----a-w-        c:\windows\system32\UIAnimation.dll

2010-12-26 17:13 . 2009-09-10 02:01        3023360        ----a-w-        c:\windows\system32\UIRibbon.dll

2010-12-26 17:13 . 2009-09-10 02:00        1164800        ----a-w-        c:\windows\system32\UIRibbonRes.dll

2010-12-26 17:11 . 2009-10-01 01:02        30208        ----a-w-        c:\windows\system32\WPDShextAutoplay.exe

2010-12-26 17:11 . 2009-10-01 01:02        31232        ----a-w-        c:\windows\system32\BthMtpContextHandler.dll

2010-12-26 17:11 . 2009-10-01 01:01        81920        ----a-w-        c:\windows\system32\wpdbusenum.dll

2010-12-26 17:11 . 2009-10-01 01:01        60928        ----a-w-        c:\windows\system32\PortableDeviceConnectApi.dll

2010-12-26 17:11 . 2009-10-01 01:02        2537472        ----a-w-        c:\windows\system32\wpdshext.dll

2010-12-26 17:11 . 2009-10-01 01:02        334848        ----a-w-        c:\windows\system32\PortableDeviceApi.dll

2010-12-26 17:11 . 2009-10-01 01:02        87552        ----a-w-        c:\windows\system32\WPDShServiceObj.dll

2010-12-26 17:11 . 2009-10-01 01:01        546816        ----a-w-        c:\windows\system32\wpd_ci.dll

2010-12-26 17:11 . 2009-10-01 01:01        160256        ----a-w-        c:\windows\system32\PortableDeviceTypes.dll

2010-12-26 17:11 . 2009-10-01 01:01        100864        ----a-w-        c:\windows\system32\PortableDeviceClassExtension.dll

2010-12-26 17:11 . 2009-10-01 01:01        350208        ----a-w-        c:\windows\system32\WPDSp.dll

2010-12-26 17:11 . 2009-10-01 01:01        196608        ----a-w-        c:\windows\system32\PortableDeviceWMDRM.dll

2010-12-26 17:11 . 2009-10-01 01:01        227840        ----a-w-        c:\windows\system32\drivers\UMDF\WpdFs.dll

2010-12-26 17:09 . 2009-10-08 21:08        555520        ----a-w-        c:\windows\system32\UIAutomationCore.dll

2010-12-26 17:09 . 2009-10-08 21:08        234496        ----a-w-        c:\windows\system32\oleacc.dll

2010-12-26 17:09 . 2009-10-08 21:07        4096        ----a-w-        c:\windows\system32\oleaccrc.dll

2010-12-26 16:50 . 2009-11-08 09:55        99176        ----a-w-        c:\windows\system32\PresentationHostProxy.dll

2010-12-26 16:50 . 2009-11-08 09:55        49472        ----a-w-        c:\windows\system32\netfxperf.dll

2010-12-26 16:50 . 2009-11-08 09:55        297808        ----a-w-        c:\windows\system32\mscoree.dll

2010-12-26 16:50 . 2009-11-08 09:55        295264        ----a-w-        c:\windows\system32\PresentationHost.exe

2010-12-26 16:50 . 2009-11-08 09:55        1130824        ----a-w-        c:\windows\system32\dfshim.dll

2010-12-26 16:48 . 2010-02-12 10:32        293376        ----a-w-        c:\windows\system32\browserchoice.exe

2010-12-26 16:47 . 2010-12-26 16:47        --------        d-----w-        c:\users\Default\AppData\Local\Microsoft Help

2010-12-26 16:30 . 2010-02-20 23:06        24064        ----a-w-        c:\windows\system32\nshhttp.dll

2010-12-26 16:30 . 2010-02-20 23:05        30720        ----a-w-        c:\windows\system32\httpapi.dll

2010-12-26 16:30 . 2010-02-20 20:53        411648        ----a-w-        c:\windows\system32\drivers\http.sys

2010-12-26 16:29 . 2010-12-26 16:29        --------        d-----w-        c:\program files\MSXML 4.0

2010-12-26 15:21 . 2010-08-17 14:11        128000        ----a-w-        c:\windows\system32\spoolsv.exe

2010-12-26 15:20 . 2010-11-04 18:55        270336        ----a-w-        c:\windows\system32\taskcomp.dll

2010-12-26 14:55 . 2009-12-23 11:33        172032        ----a-w-        c:\windows\system32\wintrust.dll

2010-12-26 14:54 . 2010-01-13 17:34        98304        ----a-w-        c:\windows\system32\cabview.dll

2010-12-26 14:50 . 2010-10-19 09:41        222080        ------w-        c:\windows\system32\MpSigStub.exe

2010-12-25 21:09 . 2010-12-26 15:27        29992        ----a-w-        c:\windows\system32\drivers\GRD.sys

2010-12-25 20:54 . 2011-01-09 19:24        --------        d-----w-        c:\program files\IZArc
 

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

.
 

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4
 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Picasa Media Detector"="c:\program files\Picasa2\PicasaMediaDetector.exe" [2008-02-26 443968]

"Skype"="c:\program files\Skype\Phone\Skype.exe" [2011-01-03 15028104]

"SpywareTerminatorUpdate"="c:\program files\Spyware Terminator\SpywareTerminatorUpdate.exe" [2011-01-09 3318784]
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-01-21 61440]

"RtHDVCpl"="RtHDVCpl.exe" [2008-06-13 6183456]

"SynTPStart"="c:\program files\Synaptics\SynTP\SynTPStart.exe" [2007-08-17 102400]

"HotkeyApp"="c:\program files\Launch Manager\HotkeyApp.exe" [2008-05-23 192512]

"WisKeyState"="c:\program files\Launch Manager\WisKeyState.exe" [2008-03-07 208896]

"LMgrVolOSD"="c:\program files\Launch Manager\OSD.exe" [2008-03-03 258048]

"LMgrOSD"="c:\program files\Launch Manager\OSDCtrl.exe" [2007-12-25 241664]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]

"FSCRecovery"="c:\program files\Fujitsu Siemens Computers\Fujitsu Siemens Computers Recovery\FSCRecoveryReminder.exe" [2008-06-18 268096]

"RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2007-10-28 72736]

"LanguageShortcut"="c:\program files\CyberLink\PowerDVD\Language\Language.exe" [2007-10-11 62760]

"Google EULA Launcher"="c:\program files\Google\Google EULA\GoogleEULALauncher.exe" [2008-05-28 20480]

"G Data AntiVirus Tray Application"="c:\program files\G Data\AntiVirus\AVKTray\AVKTray.exe" [2010-08-27 996936]

"Skytel"="Skytel.exe" [2007-11-20 1826816]

"SpywareTerminator"="c:\program files\Spyware Terminator\SpywareTerminatorShield.exe" [2011-01-09 2216960]

"Malwarebytes' Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2010-12-20 963976]
 

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"Picasa Media Detector"="c:\program files\Picasa2\PicasaMediaDetector.exe" [2008-02-26 443968]
 

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"EnableUIADesktopToggle"= 0 (0x0)
 

S0 GDBehave;GDBehave;c:\windows\system32\drivers\GDBehave.sys [2008-01-12 33480]

S1 GDMnIcpt;GDMnIcpt;c:\windows\system32\drivers\MiniIcpt.sys [2008-01-12 62024]

S1 gdwfpcd;G DATA WFP CD;c:\windows\system32\drivers\gdwfpcd32.sys [2008-01-12 40904]

S1 GRD;G Data Rootkit Detector Driver;c:\windows\system32\drivers\GRD.sys [2010-12-26 29992]

S1 HookCentre;HookCentre;c:\windows\system32\drivers\HookCentre.sys [2008-01-12 38856]

S1 sp_rsdrv2;Spyware Terminator Driver 2;c:\windows\system32\drivers\sp_rsdrv2.sys [2011-01-09 142592]

S2 AVKProxy;G Data AntiVirus Proxy;c:\program files\Common Files\G Data\AVKProxy\AVKProxy.exe [2010-08-27 1178184]

S2 AVKService;G Data Scheduler;c:\program files\G Data\AntiVirus\AVK\AVKService.exe [2010-08-27 410696]

S2 AVKWCtl;G Data Dateisystem Wächter;c:\program files\G Data\AntiVirus\AVK\AVKWCtl.exe [2010-08-27 1330792]

S2 FSCLBaseUpdaterService;FSCLBaseUpdaterService;c:\program files\Fujitsu Siemens Computers\FSCLounge\FSCWBaseUpdaterService\2\FSCWBaseUpdaterService.exe [2007-06-04 65536]

S3 GDScan;G Data Scanner;c:\program files\Common Files\G Data\GDScan\GDScan.exe [2010-08-26 340552]

S3 JMCR;JMCR;c:\windows\system32\DRIVERS\jmcr.sys [2008-04-11 84240]

S3 WisLMSvc;WisLMSvc;c:\program files\Launch Manager\WisLMSvc.exe [2008-01-15 118784]
 
 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

LocalServiceAndNoImpersonation        REG_MULTI_SZ           FontCache

.

.

------- Zusätzlicher Suchlauf -------

.

uStart Page = hxxp://www.google.com/ig/redirectdomain?brand=FUJD&bmod=FUJD

mStart Page = hxxp://www.google.com/ig/redirectdomain?brand=FUJD&bmod=FUJD

IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000

FF - ProfilePath - c:\users\Brandon\AppData\Roaming\Mozilla\Firefox\Profiles\wb3p44e5.default\

FF - prefs.js: browser.startup.homepage - hxxp://www.google.de/

FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

FF - Ext: Skype extension: {AB2CE124-6272-4b12-94A9-7303C7397BD1} - c:\program files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}

FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension

FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}

.

- - - - Entfernte verwaiste Registrierungseinträge - - - -
 

HKU-Default-Run-fsc-reg - c:\fsc-reg\fscreg.exe
 
 
 

**************************************************************************
 

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net

Rootkit scan 2011-01-10 18:59

Windows 6.0.6002 Service Pack 2 NTFS
 

Scanne versteckte Prozesse... 
 

Scanne versteckte Autostarteinträge... 
 

Scanne versteckte Dateien... 
 

Scan erfolgreich abgeschlossen

versteckte Dateien: 0
 

**************************************************************************

.

------------------------ Weitere laufende Prozesse ------------------------

.

c:\windows\system32\Ati2evxx.exe

c:\windows\system32\Ati2evxx.exe

c:\program files\Nero\Nero8\Nero BackItUp\NBService.exe

c:\windows\system32\IoctlSvc.exe

c:\program files\Spyware Terminator\sp_rsser.exe

c:\program files\Fujitsu Siemens Computers\SystemDiagnostics\OnlineDiagnostic\TestManager\TestHandler.exe

c:\windows\system32\conime.exe

c:\windows\RtHDVCpl.exe

c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe

c:\program files\Synaptics\SynTP\SynTPEnh.exe

c:\program files\Skype\Plugin Manager\skypePM.exe

c:\\?\c:\windows\system32\wbem\WMIADAP.EXE

.

**************************************************************************

.

Zeit der Fertigstellung: 2011-01-10  19:03:08 - PC wurde neu gestartet

ComboFix-quarantined-files.txt  2011-01-10 18:03
 

Vor Suchlauf: 17 Verzeichnis(se), 160.571.695.104 Bytes frei

Nach Suchlauf: 22 Verzeichnis(se), 160.115.187.712 Bytes frei
 

- - End Of File - - EAF13FBB43A82717A8497CA948CD44C7
--- --- ---