Trojaner-Board - Google leitet auf falsche Seite weiter

Hallo,

anbei das Combofix.log:

Combofix Logfile:
Code:
ComboFix 11-03-01.03 - H 02.03.2011  13:50:34.1.2 - x86

Microsoft Windows 7 Professional   6.1.7600.0.1252.49.1031.18.3539.2677 [GMT 1:00]

ausgeführt von:: c:\users\H\Desktop\ComboFix.exe

AV: AntiVir Desktop *Disabled/Outdated* {090F9C29-64CE-6C6F-379C-5901B49A85B7}

SP: AntiVir Desktop *Disabled/Outdated* {B26E7DCD-42F4-63E1-0D2C-6273CF1DCF0A}

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.
 

(((((((((((((((((((((((   Dateien erstellt von 2011-02-02 bis 2011-03-02  ))))))))))))))))))))))))))))))

.
 

2011-03-02 12:55 . 2011-03-02 12:55        --------        d-----w-        c:\users\Default\AppData\Local\temp

2011-03-01 19:42 . 2011-03-01 19:42        --------        d-----w-        c:\program files\ERUNT

2011-03-01 19:36 . 2011-03-01 19:36        --------        d-----w-        c:\users\H\AppData\Roaming\Malwarebytes

2011-03-01 19:36 . 2010-12-20 17:09        38224        ----a-w-        c:\windows\system32\drivers\mbamswissarmy.sys

2011-03-01 19:36 . 2011-03-01 19:36        --------        d-----w-        c:\programdata\Malwarebytes

2011-03-01 19:36 . 2011-03-01 19:36        --------        d-----w-        c:\program files\Malwarebytes' Anti-Malware

2011-03-01 19:36 . 2010-12-20 17:08        20952        ----a-w-        c:\windows\system32\drivers\mbam.sys

2011-03-01 10:45 . 2011-02-11 06:54        5943120        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{71589CE8-191A-497B-9DC0-AB348C2DE548}\mpengine.dll

2011-02-23 16:44 . 2010-09-14 06:07        276992        ----a-w-        c:\windows\system32\wcncsvc.dll

2011-02-23 16:40 . 2011-02-23 16:40        --------        d-----w-        c:\windows\CheckSur

2011-02-23 09:45 . 2011-01-07 07:31        442880        ----a-w-        c:\windows\system32\XpsPrint.dll

2011-02-23 09:45 . 2011-01-07 07:31        288256        ----a-w-        c:\windows\system32\XpsGdiConverter.dll

2011-02-09 13:21 . 2011-01-05 03:37        2329088        ----a-w-        c:\windows\system32\win32k.sys

2011-02-09 13:21 . 2010-12-18 05:29        541184        ----a-w-        c:\windows\system32\kerberos.dll

2011-02-09 13:21 . 2011-01-05 05:37        428032        ----a-w-        c:\windows\system32\vbscript.dll

2011-02-08 11:02 . 1998-01-23 11:22        304128        ----a-w-        c:\windows\IsUninst.exe
 

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2011-02-02 16:11 . 2010-09-15 16:13        222080        ------w-        c:\windows\system32\MpSigStub.exe

2010-12-20 22:34 . 2010-09-15 16:06        135096        ----a-w-        c:\windows\system32\drivers\avipbb.sys

.
 

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4
 

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]

@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]

2009-12-09 01:19        94208        ----a-w-        c:\users\H\AppData\Roaming\Dropbox\bin\DropboxExt.13.dll
 

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]

@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]

2009-12-09 01:19        94208        ----a-w-        c:\users\H\AppData\Roaming\Dropbox\bin\DropboxExt.13.dll
 

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]

@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]

2009-12-09 01:19        94208        ----a-w-        c:\users\H\AppData\Roaming\Dropbox\bin\DropboxExt.13.dll
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2010-11-05 281768]

"AdobeCS5ServiceManager"="c:\program files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" [2010-02-22 406992]

"SwitchBoard"="c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]

"Adobe Acrobat Speed Launcher"="c:\program files\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe" [2008-06-12 37232]

"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-09-24 421160]

"IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2010-07-21 1797008]

"IgfxTray"="c:\windows\system32\igfxtray.exe" [2010-08-25 136216]

"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2010-08-25 171032]

"Persistence"="c:\windows\system32\igfxpers.exe" [2010-08-25 170520]
 

c:\users\H\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

Dropbox.lnk - c:\users\H\AppData\Roaming\Dropbox\bin\Dropbox.exe [2010-2-26 21979992]
 

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 5 (0x5)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableUIADesktopToggle"= 0 (0x0)
 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"aux1"=wdmaud.drv
 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acrobat Assistant 8.0]

2008-06-11 20:43        640376        ----a-w-        c:\program files\Adobe\Acrobat 9.0\Acrobat\acrotray.exe
 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeAAMUpdater-1.0]

2010-03-06 01:44        500208        ------w-        c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\updaterstartuputility.exe
 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DivXUpdate]

2010-09-01 06:39        1164584        ----a-w-        c:\program files\DivX\DivX Update\DivXUpdate.exe
 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]

2010-09-08 09:17        421888        ----a-w-        c:\program files\QuickTime\QTTask.exe
 

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]

R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4640000]

R3 SwitchBoard;SwitchBoard;c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]

S2 AntiVirSchedulerService;Avira AntiVir Planer;c:\program files\Avira\AntiVir Desktop\sched.exe [2010-11-05 135336]

S2 cvhsvc;Client Virtualization Handler;c:\program files\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [2010-02-28 821664]

S2 sftlist;Application Virtualization Client;c:\program files\Microsoft Application Virtualization Client\sftlist.exe [2010-04-23 483688]

S3 netw5v32;Intel(R) Wireless WiFi Link 5000-Serie - Adaptertreiber für Windows Vista 32 Bit;c:\windows\system32\DRIVERS\netw5v32.sys [2009-07-13 4231168]

S3 Sftfs;Sftfs;c:\windows\system32\DRIVERS\Sftfslh.sys [2010-04-23 550760]

S3 Sftplay;Sftplay;c:\windows\system32\DRIVERS\Sftplaylh.sys [2010-04-23 195944]

S3 Sftredir;Sftredir;c:\windows\system32\DRIVERS\Sftredirlh.sys [2010-04-23 21864]

S3 Sftvol;Sftvol;c:\windows\system32\DRIVERS\Sftvollh.sys [2010-04-23 19304]

S3 sftvsa;Application Virtualization Service Agent;c:\program files\Microsoft Application Virtualization Client\sftvsa.exe [2010-04-23 209768]
 

.

.

------- Zusätzlicher Suchlauf -------

.

IE: An OneNote s&enden - c:\progra~1\MICROS~2\Office14\ONBttnIE.dll/105

IE: An vorhandene PDF-Datei anfügen - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html

IE: In Adobe PDF konvertieren - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html

IE: Linkziel an vorhandene PDF-Datei anhängen - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html

IE: Linkziel in Adobe PDF konvertieren - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html

IE: Nach Microsoft E&xcel exportieren - c:\progra~1\MICROS~2\Office14\EXCEL.EXE/3000

TCP: {99FC0C7F-F92A-4A44-A1E0-78B5422571FA} = 213.191.92.86 62.109.123.7

Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - c:\program files\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL

FF - ProfilePath - c:\users\H\AppData\Roaming\Mozilla\Firefox\Profiles\nn49tqnn.default\

FF - prefs.js: browser.startup.homepage - www.google.de

FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

FF - Ext: Skype extension: {AB2CE124-6272-4b12-94A9-7303C7397BD1} - c:\program files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}

FF - Ext: FireTorrent: firetorrent@radicalsoft.com - %profile%\extensions\firetorrent@radicalsoft.com

FF - Ext: Adblock Plus: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} - %profile%\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}

.

- - - - Entfernte verwaiste Registrierungseinträge - - - -
 

HKCU-Run-UYPZGBVWZK - c:\users\H\AppData\Roaming\msinfo32X.dll
 
 

.

--------------------- Gesperrte Registrierungsschluessel ---------------------
 

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

--------------------- Durch laufende Prozesse gestartete DLLs ---------------------
 

- - - - - - - > 'Explorer.exe'(3528)

c:\users\H\AppData\Roaming\Dropbox\bin\DropboxExt.13.dll

.

Zeit der Fertigstellung: 2011-03-02  13:57:29

ComboFix-quarantined-files.txt  2011-03-02 12:57
 

Vor Suchlauf: 9 Verzeichnis(se), 20.562.862.080 Bytes frei

Nach Suchlauf: 15 Verzeichnis(se), 20.456.554.496 Bytes frei
 

- - End Of File - - 8E4C0BF4B459252A6C7E5E281C849C52
--- --- ---