Trojaner-Board - kennt jemand den trojan.gen.2

Hallo Arne,

hier die CF Log-Datei.

Combofix Logfile:
Code:
ComboFix 11-02-06.02 - tse 07.02.2011  10:25:28.2.2 - x86

Microsoft Windows 7 Professional   6.1.7600.0.1252.49.1031.18.2046.1135 [GMT 1:00]

ausgeführt von:: c:\users\tse.SEI-COM\Desktop\MFTools\CoFi.exe

AV: Symantec Endpoint Protection *Disabled/Updated* {88C95A36-8C3B-2F2C-1B8B-30FCCFDC4855}

FW: Symantec Endpoint Protection *Disabled* {B0F2DB13-C654-2E74-30D4-99C9310F0F2E}

SP: Symantec Endpoint Protection *Disabled/Updated* {33A8BBD2-AA01-20A2-213B-0B8EB45B02E8}

SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.
 

(((((((((((((((((((((((   Dateien erstellt von 2011-01-07 bis 2011-02-07  ))))))))))))))))))))))))))))))

.
 

2011-02-07 09:32 . 2011-02-07 09:32        --------        d-----w-        c:\windows\system32\config\systemprofile\AppData\Local\temp

2011-02-07 09:32 . 2011-02-07 09:32        --------        d-----w-        c:\users\Default\AppData\Local\temp

2011-02-04 16:22 . 2011-02-04 16:22        --------        d-----w-        c:\programdata\HP Product Assistant

2011-02-04 16:20 . 2011-02-04 16:20        --------        d-----w-        c:\program files\Common Files\HP

2011-02-03 16:44 . 2011-02-03 16:44        --------        d-----w-        C:\_OTL

2011-02-02 15:40 . 2011-02-02 18:15        --------        d-----w-        c:\programdata\Norton

2011-01-31 14:36 . 2011-01-31 14:37        --------        d-----w-        c:\program files\ERUNT

2011-01-31 14:30 . 2011-01-31 14:30        --------        d-----w-        c:\users\tse.SEI-COM\AppData\Roaming\Malwarebytes

2011-01-31 14:30 . 2010-12-20 17:09        38224        ----a-w-        c:\windows\system32\drivers\mbamswissarmy.sys

2011-01-31 14:30 . 2011-01-31 14:30        --------        d-----w-        c:\programdata\Malwarebytes

2011-01-31 14:30 . 2010-12-20 17:08        20952        ----a-w-        c:\windows\system32\drivers\mbam.sys

2011-01-31 14:30 . 2011-01-31 14:32        --------        d-----w-        c:\program files\Malwarebytes' Anti-Malware

2011-01-28 11:16 . 2011-01-28 11:16        --------        d-----w-        c:\windows\system32\%LOCALAPPDATA%

2011-01-28 11:16 . 2011-01-28 11:16        --------        d---a-w-        c:\users\Default\favoriten

2011-01-28 11:16 . 2011-01-28 11:16        --------        d-sh--w-        c:\windows\system32\%APPDATA%

2011-01-28 11:16 . 2011-01-28 11:16        --------        d-----w-        C:\Symantec

2011-01-28 11:15 . 2011-02-07 09:17        --------        d-----w-        c:\users\TEMP

2011-01-11 19:31 . 2011-01-11 19:31        --------        d-----w-        c:\users\tse.SEI-COM\AppData\Local\Nero

2011-01-11 19:16 . 2011-01-11 19:17        --------        d-----w-        c:\program files\Common Files\Nero

2011-01-11 18:37 . 2010-10-14 21:28        307748864        ----a-w-        c:\temp\Nero 10.0.13.exe

2011-01-11 16:50 . 2011-01-11 16:50        --------        d-----w-        c:\users\tse.SEI-COM\AppData\Roaming\Nero

2011-01-10 18:52 . 2011-01-10 18:54        --------        d-----w-        c:\users\tse.SEI-COM\AppData\Roaming\PeaceCraft2

2011-01-10 14:47 . 2011-01-10 14:47        --------        d-----w-        c:\programdata\LightScribe

2011-01-10 14:46 . 2011-01-11 09:22        --------        d-----w-        c:\program files\Common Files\LightScribe

2011-01-10 14:46 . 2011-01-10 14:47        --------        d-----w-        c:\users\tse.SEI-COM\AppData\Local\Ahead

2011-01-10 14:45 . 2011-01-11 15:40        --------        d-----w-        c:\users\tse.SEI-COM\AppData\Roaming\Ahead

2011-01-10 14:42 . 2011-01-11 19:22        --------        d-----w-        c:\program files\Nero

2011-01-10 14:42 . 2011-01-11 18:17        --------        d-----w-        c:\programdata\Nero

2011-01-10 13:35 . 2011-01-10 13:35        --------        d-----w-        c:\users\tse.SEI-COM\AppData\Roaming\AVS4YOU

2011-01-10 13:35 . 2011-01-10 13:35        --------        d-----w-        c:\programdata\AVS4YOU

2011-01-10 12:37 . 2011-01-10 14:39        --------        d-----w-        c:\program files\Common Files\AVSMedia

2011-01-10 12:37 . 2011-01-10 14:39        --------        d-----w-        c:\program files\AVS4YOU

2011-01-10 12:36 . 2011-01-10 12:36        43322248        ----a-w-        c:\temp\AVSVideoReMaker.exe

2011-01-09 16:23 . 2011-01-09 16:23        --------        d-----w-        c:\users\tse.SEI-COM\AppData\Roaming\BigFishv1002

2011-01-09 16:04 . 2011-01-09 16:04        --------        d-----w-        c:\program files\Escape Rosecliff Island

2011-01-09 16:00 . 2011-01-09 16:00        --------        d-----w-        c:\program files\My Kingdom for the Princess II

2011-01-09 15:38 . 2011-01-09 15:45        --------        d-----w-        c:\users\tse.SEI-COM\AppData\Roaming\Peace Craft

2011-01-09 15:37 . 2011-01-09 15:37        --------        d-----w-        c:\program files\Mein Koenigreich fuer die Prinzessin

2011-01-09 15:32 . 2011-01-09 15:32        --------        d-----w-        c:\program files\bfgclient

2011-01-09 15:31 . 2011-01-09 15:37        --------        d-----w-        C:\BigFishGamesCache
 

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2011-02-04 15:54 . 2011-02-04 15:54        252222        ----a-w-        C:\_OTL.zip

2011-01-12 08:36 . 2010-09-28 16:22        2516        --sha-w-        c:\programdata\KGyGaAvL.sys

2011-01-09 15:28 . 2010-11-13 13:53        167936        ----a-w-        c:\windows\system32\drivers\wpshelper.sys

2010-12-22 15:22 . 2010-12-22 15:22        271360        ----a-w-        c:\windows\system32\drivers\atksgt.sys

2010-12-22 15:21 . 2010-12-22 15:21        18048        ----a-w-        c:\windows\system32\drivers\lirsgt.sys

2010-11-13 13:52 . 2010-11-13 13:52        124976        ----a-w-        c:\windows\system32\drivers\SYMEVENT.SYS

2010-11-13 12:47 . 2010-11-13 12:47        87368        ----a-w-        c:\windows\system32\FwsVpn.dll

2010-11-13 12:47 . 2010-11-13 12:47        43336        ----a-w-        c:\windows\system32\drivers\WPSDRVnt.sys

2010-11-13 12:47 . 2010-11-13 12:47        353608        ----a-w-        c:\windows\system32\sysfer.dll

2010-11-13 12:47 . 2010-11-13 12:47        107848        ----a-w-        c:\windows\system32\SymVPN.dll

2010-11-13 12:47 . 2010-11-13 12:47        43696        ----a-w-        c:\windows\system32\drivers\srtspx.sys

2010-11-13 12:47 . 2010-11-13 12:47        320944        ----a-w-        c:\windows\system32\drivers\srtspl.sys

2010-11-13 12:47 . 2010-11-13 12:47        283184        ----a-w-        c:\windows\system32\drivers\srtsp.sys

2010-11-13 12:47 . 2010-11-13 13:52        97096        ----a-w-        c:\windows\system32\drivers\SysPlant.sys

2010-11-13 12:47 . 2010-11-13 12:47        67472        ----a-w-        c:\windows\system32\drivers\Teefer2.sys

2010-11-13 12:47 . 2010-11-13 12:47        39856        ----a-w-        c:\windows\system32\drivers\symids.sys

2010-11-13 12:47 . 2010-11-13 12:47        38448        ----a-w-        c:\windows\system32\drivers\symndisv.sys

2010-11-13 12:47 . 2010-11-13 12:47        26416        ----a-w-        c:\windows\system32\drivers\symredrv.sys

2010-11-13 12:47 . 2010-11-13 12:47        188080        ----a-w-        c:\windows\system32\drivers\symtdi.sys

2010-11-13 12:47 . 2010-11-13 12:47        145968        ----a-w-        c:\windows\system32\drivers\symfw.sys

2010-11-13 12:47 . 2010-11-13 12:47        12720        ----a-w-        c:\windows\system32\drivers\symdns.sys

.
 

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4
 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Kalender"="c:\program files\Kalender\Kalender.exe" [2009-07-11 933888]
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"hpqSRMon"="c:\program files\HP\Digital Imaging\bin\hpqSRMon.exe" [2008-07-22 150528]
 

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2009-9-20 270336]
 

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 0 (0x0)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableLUA"= 0 (0x0)

"EnableUIADesktopToggle"= 0 (0x0)

"PromptOnSecureDesktop"= 0 (0x0)
 

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]

"HideLogonScripts"= 0 (0x0)
 

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-2216260222-2881205745-3982873180-1109\Scripts\Logon\0\0]

"Script"=Logon_tse.bat
 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ccEvtMgr]

@="Service"
 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ccSetMgr]

@="Service"
 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Symantec Antivirus]

@="Service"
 

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Adobe Acrobat - Schnellstart.lnk]

path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Acrobat - Schnellstart.lnk

backup=c:\windows\pss\Adobe Acrobat - Schnellstart.lnk.CommonStartup

backupExtension=.CommonStartup
 

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Adobe Reader - Schnellstart.lnk]

path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Reader - Schnellstart.lnk

backup=c:\windows\pss\Adobe Reader - Schnellstart.lnk.CommonStartup

backupExtension=.CommonStartup
 

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Adobe Reader Synchronizer.lnk]

path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Reader Synchronizer.lnk

backup=c:\windows\pss\Adobe Reader Synchronizer.lnk.CommonStartup

backupExtension=.CommonStartup
 

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]

path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk

backup=c:\windows\pss\HP Digital Imaging Monitor.lnk.CommonStartup

backupExtension=.CommonStartup
 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acrobat Assistant 8.0]

2010-09-23 12:36        624056        ----a-w-        c:\program files\Adobe\Acrobat 8.0\Acrobat\acrotray.exe
 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]

2010-09-21 18:37        932288        ----a-w-        c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]

2010-11-10 11:49        35736        ----a-w-        c:\program files\Adobe\Reader 10.0\Reader\reader_sl.exe
 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BCSSync]

2010-03-13 13:54        91520        ----a-w-        c:\program files\Microsoft Office\Office14\BCSSync.exe
 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]

2007-05-08 14:24        54840        ----a-w-        c:\program files\HP\HP Software Update\hpwuSchd2.exe
 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LexwareInfoService]

2008-11-03 11:21        339240        ----a-w-        c:\program files\Common Files\Lexware\Update Manager\LxUpdateManager.exe
 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]

2010-02-18 09:43        248040        ----a-w-        c:\program files\Common Files\Java\Java Update\jusched.exe
 

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]

"DisableMonitoring"=dword:00000001
 

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]

R3 cpudrv;cpudrv;c:\program files\SystemRequirementsLab\cpudrv.sys [2009-12-18 11336]

R3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files\Microsoft Office\Office14\GROOVE.EXE [2010-03-25 30969208]

R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4640000]

R4 NAUpdate;Nero Update;c:\program files\Nero\Update\NASvc.exe [2010-03-25 490280]

S2 SBSDWSCService;SBSD Security Center Service;c:\program files\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368]

S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2010-10-16 369256]

S3 ElgTaDrv;T-Concept X USB System Driver;c:\windows\system32\Drivers\ElgTaDrv.sys [2002-07-15 73660]

S3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2010-11-13 102448]

S3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda32v.sys [2010-09-07 123496]
 
 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

HPZ12        REG_MULTI_SZ           Pml Driver HPZ12 Net Driver HPZ12

WindowsMobile        REG_MULTI_SZ           wcescomm rapimgr

LocalServiceRestricted        REG_MULTI_SZ           WcesComm RapiMgr

HPService        REG_MULTI_SZ           HPSLPSVC

hpdevmgmt        REG_MULTI_SZ           hpqcxs08 hpqddsvc

.

.

------- Zusätzlicher Suchlauf -------

.

uStart Page = about:blank

uInternet Settings,ProxyOverride = *.local

IE: An OneNote s&enden - c:\progra~1\MICROS~1\Office14\ONBttnIE.dll/105

IE: An vorhandenes PDF anfügen - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

IE: Ausgewählte Verknüpfungen in Adobe PDF konvertieren - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html

IE: Ausgewählte Verknüpfungen in vorhandene PDF-Datei konvertieren - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html

IE: Auswahl in Adobe PDF konvertieren - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

IE: Auswahl in vorhandene PDF-Datei konvertieren - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

IE: In Adobe PDF konvertieren - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

IE: Nach Microsoft E&xcel exportieren - c:\progra~1\MICROS~1\Office14\EXCEL.EXE/3000

IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~1\Office12\EXCEL.EXE/3000

IE: Verknüpfungsziel in Adobe PDF konvertieren - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

IE: Verknüpfungsziel in vorhandene PDF-Datei konvertieren - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - c:\program files\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL

.

.

--------------------- Gesperrte Registrierungsschluessel ---------------------
 

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe,-101"
 

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]

"Enabled"=dword:00000001
 

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]

@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe"
 

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
 

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]

@Denied: (A 2) (Everyone)

@="IFlashBroker4"
 

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"
 

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"
 

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

--------------------- Durch laufende Prozesse gestartete DLLs ---------------------
 

- - - - - - - > 'lsass.exe'(516)

c:\program files\Bonjour\mdnsNSP.dll

.

Zeit der Fertigstellung: 2011-02-07  10:35:11

ComboFix-quarantined-files.txt  2011-02-07 09:35

ComboFix2.txt  2011-02-07 09:17
 

Vor Suchlauf: 16 Verzeichnis(se), 268.093.829.120 Bytes frei

Nach Suchlauf: 17 Verzeichnis(se), 268.013.068.288 Bytes frei
 

- - End Of File - - C8E4138D2454D9835AB5AEB3F1060A06
--- --- ---

CC Cleaner ist auch abgearbeitet.

Bisher ist es ruhig, was den Plagegeist angeht.
Konntest du eigentlich was konkretes feststellen?

Groß
Tom