Trojaner-Board - Combofix Analyse

Bundestrojaner wurde mit Avira Rescue CD entfernet vor ein paar Wochen. Jetzt kommt "AntiVirus Antispyware 2011"

Hier die Combofix log Datei
Code:
ComboFix 11-05-11.01 - Ludwig 13.05.2011  16:36:11.1.2 - x86

Microsoft Windows 7 Home Premium   6.1.7600.0.1252.49.1031.18.2046.1515 [GMT 2:00]

ausgeführt von:: i:\tools\Anti Spyware\ComboFix.exe

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

C:\blyadstvoeb

C:\cleansweep.exe

c:\cleansweep.exe\config.bin

C:\fukkuukkkk.exe

c:\fukkuukkkk.exe\config.bin

C:\micenatxxx.exe

c:\micenatxxx.exe\config.bin

C:\msixxxxxxx.exe

c:\msixxxxxxx.exe\config.bin

C:\skdfhiosjhf

c:\skdfhiosjhf\config.bin

c:\users\Ludwig\AppData\Roaming\Abunmo

c:\users\Ludwig\AppData\Roaming\Abunmo\zaitb.wai

c:\users\Ludwig\AppData\Roaming\Adobe\Update\flacor.dat

c:\users\Ludwig\AppData\Roaming\Agpo

c:\users\Ludwig\AppData\Roaming\Agpo\edros.osc

c:\users\Ludwig\AppData\Roaming\AntiVirus AntiSpyware 2011

c:\users\Ludwig\AppData\Roaming\AntiVirus AntiSpyware 2011\IcoActivate.ico

c:\users\Ludwig\AppData\Roaming\AntiVirus AntiSpyware 2011\IcoHelp.ico

c:\users\Ludwig\AppData\Roaming\AntiVirus AntiSpyware 2011\IcoUninstall.ico

c:\users\Ludwig\AppData\Roaming\Atla

c:\users\Ludwig\AppData\Roaming\Atla\ybup.izb

c:\users\Ludwig\AppData\Roaming\Bekaiq

c:\users\Ludwig\AppData\Roaming\Bekaiq\atma.efg

c:\users\Ludwig\AppData\Roaming\Dovu\uvvap.exe

c:\users\Ludwig\AppData\Roaming\Ecpoe

c:\users\Ludwig\AppData\Roaming\Ecpoe\elefv.vyp

c:\users\Ludwig\AppData\Roaming\Efex

c:\users\Ludwig\AppData\Roaming\Efex\kigy.ewe

c:\users\Ludwig\AppData\Roaming\Egka

c:\users\Ludwig\AppData\Roaming\Egka\ygoq.zuu

c:\users\Ludwig\AppData\Roaming\Endao\iknak.exe

c:\users\Ludwig\AppData\Roaming\Eqwo

c:\users\Ludwig\AppData\Roaming\Eqwo\umryy.ruk

c:\users\Ludwig\AppData\Roaming\Gegiop

c:\users\Ludwig\AppData\Roaming\Gegiop\hyirm.uda

c:\users\Ludwig\AppData\Roaming\Ikkuro

c:\users\Ludwig\AppData\Roaming\Ikkuro\uslia.oqr

c:\users\Ludwig\AppData\Roaming\Ivehha

c:\users\Ludwig\AppData\Roaming\Ivehha\ogti.oxf

c:\users\Ludwig\AppData\Roaming\Lelaa\hixaf.exe

c:\users\Ludwig\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\AntiVirus AntiSpyware 2011.lnk

c:\users\Ludwig\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\AntiVirus AntiSpyware 2011

c:\users\Ludwig\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\AntiVirus AntiSpyware 2011.lnk

c:\users\Ludwig\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\AntiVirus AntiSpyware 2011\Activate AntiVirus AntiSpyware 2011.lnk

c:\users\Ludwig\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\AntiVirus AntiSpyware 2011\AntiVirus AntiSpyware 2011.lnk

c:\users\Ludwig\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\AntiVirus AntiSpyware 2011\Help AntiVirus AntiSpyware 2011.lnk

c:\users\Ludwig\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\AntiVirus AntiSpyware 2011\How to Activate AntiVirus AntiSpyware 2011.lnk

c:\users\Ludwig\AppData\Roaming\Ogqi\ortu.exe

c:\users\Ludwig\AppData\Roaming\Ogva

c:\users\Ludwig\AppData\Roaming\Ogva\aculp.nuo

c:\users\Ludwig\AppData\Roaming\Qifoad

c:\users\Ludwig\AppData\Roaming\Qifoad\uswo.leu

c:\users\Ludwig\AppData\Roaming\Qoon

c:\users\Ludwig\AppData\Roaming\Qoon\ocfy.uqe

c:\users\Ludwig\AppData\Roaming\Qoxau

c:\users\Ludwig\AppData\Roaming\Qoxau\ikop.iqa

c:\users\Ludwig\AppData\Roaming\Siif

c:\users\Ludwig\AppData\Roaming\Siif\aksyr.qai

c:\users\Ludwig\AppData\Roaming\Soha

c:\users\Ludwig\AppData\Roaming\Soha\fiin.oke

c:\users\Ludwig\AppData\Roaming\Tafyy

c:\users\Ludwig\AppData\Roaming\Tafyy\hiava.bic

c:\users\Ludwig\AppData\Roaming\TrusteerHelp

c:\users\Ludwig\AppData\Roaming\TrusteerHelp\spuninst.inf

c:\users\Ludwig\AppData\Roaming\Ulmil\isga.exe

c:\users\Ludwig\AppData\Roaming\Upepv\akwy.exe

c:\users\Ludwig\AppData\Roaming\usernt.dat

c:\users\Ludwig\AppData\Roaming\Utnoyg

c:\users\Ludwig\AppData\Roaming\Utnoyg\hieko.oqp

c:\users\Ludwig\AppData\Roaming\Uwwigo

c:\users\Ludwig\AppData\Roaming\Uwwigo\iqil.pax

c:\users\Ludwig\AppData\Roaming\Vidi

c:\users\Ludwig\AppData\Roaming\Vidi\izar.eso

c:\users\Ludwig\AppData\Roaming\Wivo

c:\users\Ludwig\AppData\Roaming\Wivo\isdo.hom

c:\users\Ludwig\AppData\Roaming\Wyax

c:\users\Ludwig\AppData\Roaming\Wyax\okqo.waq

c:\users\Ludwig\AppData\Roaming\Ymor

c:\users\Ludwig\AppData\Roaming\Ymor\duucy.xeh

c:\users\Ludwig\AppData\Roaming\Zezy

c:\users\Ludwig\AppData\Roaming\Zezy\ipar.tac

c:\windows\Tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job

.

.

(((((((((((((((((((((((   Dateien erstellt von 2011-04-13 bis 2011-05-13  ))))))))))))))))))))))))))))))

.

.

2011-05-13 14:39 . 2011-05-13 14:39    --------    d-----w-    c:\users\Ludwig\AppData\Local\temp

2011-05-13 14:39 . 2011-05-13 14:39    --------    d-----w-    c:\users\Default\AppData\Local\temp

2011-05-13 06:56 . 2011-04-11 07:04    7071056    ----a-w-    c:\programdata\Microsoft\Windows Defender\Definition Updates\{EAFB8690-E99A-4A8C-B945-763124259A6A}\mpengine.dll

2011-05-12 10:45 . 2011-04-09 06:13    3957632    ----a-w-    c:\windows\system32\ntkrnlpa.exe

2011-05-12 10:45 . 2011-04-09 06:13    3901824    ----a-w-    c:\windows\system32\ntoskrnl.exe

2011-05-10 18:11 . 2011-05-13 15:31    --------    d-----w-    c:\users\Ludwig\AppData\Roaming\6148514

2011-04-15 10:24 . 2011-02-23 05:05    309760    ----a-w-    c:\windows\system32\drivers\srv2.sys

2011-04-15 10:23 . 2011-03-03 03:31    2331136    ----a-w-    c:\windows\system32\win32k.sys

2011-04-15 10:23 . 2011-02-12 05:30    191488    ----a-w-    c:\windows\system32\FXSCOVER.exe

2011-04-15 10:23 . 2011-02-24 05:32    288256    ----a-w-    c:\windows\system32\XpsGdiConverter.dll

2011-04-15 10:22 . 2011-03-08 05:38    740864    ----a-w-    c:\windows\system32\inetcomm.dll

2011-04-15 10:19 . 2011-03-11 05:40    1137664    ----a-w-    c:\windows\system32\mfc42.dll

2011-04-15 10:19 . 2011-03-11 05:40    1164288    ----a-w-    c:\windows\system32\mfc42u.dll

2011-04-15 10:18 . 2011-02-23 05:05    221696    ----a-w-    c:\windows\system32\drivers\mrxsmb10.sys

2011-04-15 10:18 . 2011-02-23 05:05    95744    ----a-w-    c:\windows\system32\drivers\mrxsmb20.sys

2011-04-15 10:18 . 2011-02-23 05:05    123392    ----a-w-    c:\windows\system32\drivers\mrxsmb.sys

2011-04-15 10:18 . 2011-02-23 05:05    69632    ----a-w-    c:\windows\system32\drivers\bowser.sys

2011-04-14 01:39 . 2011-04-14 01:39    103864    ----a-w-    c:\program files\Mozilla Firefox\plugins\nppdf32.dll

.

.

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2011-05-13 06:56 . 2010-05-19 16:40    2300696    ----a-w-    c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup-2\markup.dll

2011-05-13 06:56 . 2010-05-19 16:40    42776    ----a-w-    c:\programdata\Microsoft\eHome\Packages\MCEClientUX\dSM\StartResources.dll

2011-05-13 06:56 . 2010-06-07 16:17    1152832    ----a-w-    c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight-2\SpotlightResources.dll

2011-02-23 18:09 . 2010-05-10 11:13    1220416    ----a-w-    c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll

2011-02-19 05:33 . 2011-03-09 10:25    802304    ----a-w-    c:\windows\system32\FntCache.dll

2011-02-19 05:32 . 2011-03-09 10:25    1074176    ----a-w-    c:\windows\system32\DWrite.dll

2011-02-19 05:32 . 2011-03-09 10:25    739840    ----a-w-    c:\windows\system32\d2d1.dll

.

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Objmfc"="c:\users\Ludwig\AppData\Roaming\Adobe\Update\mmcset.exe" [2010-10-26 4]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2010-04-06 8555040]

"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-01-31 35760]

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-20 932288]

.

c:\users\Ludwig\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

OpenOffice.org 3.2.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2009-12-15 384000]

.

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

McAfee Security Scan Plus.lnk - c:\program files\McAfee Security Scan\2.0.181\SSScheduler.exe [2010-1-15 255536]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 5 (0x5)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableUIADesktopToggle"= 0 (0x0)

.

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]

R3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\McAfee Security Scan\2.0.181\McCHSvc.exe [2010-01-15 227232]

S2 SBSDWSCService;SBSD Security Center Service;c:\program files\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368]

S3 k57nd60x;Broadcom NetLink (TM) Gigabit Ethernet - NDIS 6.0;c:\windows\system32\DRIVERS\k57nd60x.sys [2009-08-26 273960]

S3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda32v.sys [2010-01-28 68200]

.

.

--- Andere Dienste/Treiber im Speicher ---

.

*Deregistered* - avipbb

*Deregistered* - ssmdrv

.

.

------- Zusätzlicher Suchlauf -------

.

FF - ProfilePath - c:\users\Ludwig\AppData\Roaming\Mozilla\Firefox\Profiles\q4k7m4uc.default\

FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}

FF - Ext: Adblock Plus: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} - %profile%\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}

FF - user.js: network.cookie.cookieBehavior - 0

FF - user.js: privacy.clearOnShutdown.cookies - false

FF - user.js: security.warn_viewing_mixed - false

FF - user.js: security.warn_viewing_mixed.show_once - false

FF - user.js: security.warn_submit_insecure - false

FF - user.js: security.warn_submit_insecure.show_once - false

.

- - - - Entfernte verwaiste Registrierungseinträge - - - -

.

Toolbar-Locked - (no file)

HKCU-Run-Getdo - (no file)

HKCU-Run-{BF9A18E4-5843-5E4F-3ABF-C6EF18ADEFBF} - c:\users\Ludwig\AppData\Roaming\Endao\iknak.exe

HKCU-Run-{B817CF98-CB40-428B-465E-982776DD58AB} - c:\users\Ludwig\AppData\Roaming\Ulmil\isga.exe

HKCU-Run-{7F6C6926-B48D-01EF-DEAC-9EFEDEC60303} - c:\users\Ludwig\AppData\Roaming\Upepv\akwy.exe

HKCU-Run-{6F0FB030-3FF1-7317-F9A4-4B9D71C3402C} - c:\users\Ludwig\AppData\Roaming\Lelaa\hixaf.exe

HKCU-Run-{8F43634B-10DB-6FF4-EA69-4DEA6D0E16CC} - c:\users\Ludwig\AppData\Roaming\Ogqi\ortu.exe

HKCU-Run-{CF7670D9-9CF1-8C38-6D24-AEED12F68CBB} - c:\users\Ludwig\AppData\Roaming\Dovu\uvvap.exe

HKCU-Run-34D27A2BD4720CD8 - c:\skdfhiosjhf\skdfhiosjhf.exe

HKCU-Run-AntiVirus AntiSpyware 2011 - c:\users\Ludwig\AppData\Roaming\AntiVirus AntiSpyware 2011\AntiVirus AntiSpyware.exe

HKCU-Run-AntiVirus AntiSpyware 2011 Security - c:\users\Ludwig\AppData\Roaming\AntiVirus AntiSpyware 2011\securitymanager.exe

.

.

.

--------------------- Gesperrte Registrierungsschluessel ---------------------

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

Zeit der Fertigstellung: 2011-05-13  16:40:43

ComboFix-quarantined-files.txt  2011-05-13 14:40

.

Vor Suchlauf: 10 Verzeichnis(se), 471.364.673.536 Bytes frei

Nach Suchlauf: 14 Verzeichnis(se), 471.174.496.256 Bytes frei

.

- - End Of File - - 1DA83EEE196154E5BCF53D13A70303A2
Was empehlt ihr?

Vielen Dank