TrojanDownloader.Mufanom/A

ComboFix 11-07-31.04 - NAME 01.08.2011  16:34:39.2.2 - x86
Microsoft Windows XP Professional  5.1.2600.3.1252.49.1031.18.3327.2436 [GMT 2:00]
ausgeführt von:: c:\dokumente und einstellungen\NAME\Desktop\Setup\ComboFix.exe
Benutzte Befehlsschalter :: c:\dokumente und einstellungen\NAME\Desktop\Setup\CFScript.txt
AV: AntiVir Desktop *Disabled/Updated* {AD166499-45F9-482A-A743-FDD3350758C7}
AV: Lavasoft Ad-Watch Live! Virenschutz *Disabled/Updated* {A1C4F2E0-7FDE-4917-AFAE-013EFC3EDE33}
.
.
(((((((((((((((((((((((   Dateien erstellt von 2011-07-01 bis 2011-08-01  ))))))))))))))))))))))))))))))
.
.
2011-08-01 13:36 . 2011-08-01 13:36	--------	d-----w-	C:\_OTL
2011-07-31 15:39 . 2011-07-31 15:39	--------	d-----w-	c:\programme\ESET
2011-07-08 16:08 . 2011-07-08 16:13	--------	d-----w-	c:\dokumente und einstellungen\NAME\Anwendungsdaten\ts3overlay
2011-07-05 18:22 . 2011-07-05 18:22	296448	----a-w-	c:\windows\system32\DePbo.dll
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-07-19 02:34 . 2010-04-07 00:52	706566	----a-w-	c:\programme\unins000.exe
2011-07-18 16:41 . 2009-04-11 23:21	22328	----a-w-	c:\windows\system32\drivers\PnkBstrK.sys
2011-07-18 16:41 . 2009-04-11 23:21	107832	----a-w-	c:\windows\system32\PnkBstrB.exe
2011-07-06 17:52 . 2010-07-29 16:36	41272	----a-w-	c:\windows\system32\drivers\mbamswissarmy.sys
2011-07-06 17:52 . 2010-07-29 16:36	22712	----a-w-	c:\windows\system32\drivers\mbam.sys
2011-06-30 16:01 . 2010-07-29 18:29	138192	----a-w-	c:\windows\system32\drivers\avipbb.sys
2011-06-30 16:01 . 2009-03-20 21:49	66616	----a-w-	c:\windows\system32\drivers\avgntflt.sys
2011-06-01 13:23 . 2011-06-01 13:23	53248	----a-r-	c:\dokumente und einstellungen\NAME\Anwendungsdaten\Microsoft\Installer\{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}\ARPPRODUCTICON.exe
2011-06-01 13:23 . 2011-06-01 13:23	16400	----a-w-	c:\windows\system32\drivers\LNonPnP.sys
.
.
------- Sigcheck -------
Note: Unsigned files aren't necessarily malware.
.
[-] 2008-06-20 . B4D6D344EACDA356D4AAAC7757955F0C . 407040 . . [5.1.2600.5582] . . c:\windows\system32\netlogon.dll
.
[-] 2008-06-20 09:56 . C51B4A5C05A5475708E3C81C7765B71D . 27136 . . [11.0.5721.5145] . . c:\windows\system32\mspmsnsv.dll
.
[-] 2008-06-20 . 39247D93BE13E0C67A996A837EAB8E02 . 177152 . . [5.1.2600.5582] . . c:\windows\system32\w32time.dll
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [2008-05-16 16862720]
"Ad-Watch"="c:\programme\Lavasoft\Ad-Aware\AAWTray.exe" [2011-05-13 1191216]
"avgnt"="c:\programme\Avira\AntiVir Desktop\avgnt.exe" [2010-11-02 281768]
"StartCCC"="c:\programme\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2010-11-25 98304]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2009-06-17 55824]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nltide_2"="shell32" [X]
"nltide_3"="advpack.dll" [2010-05-04 124928]
.
c:\dokumente und einstellungen\All Users\Startmen�\Programme\Autostart\
SetPointII.lnk - c:\programme\Logitech\SetPoint II\SetpointII.exe [2009-7-21 323584]
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute	REG_MULTI_SZ   	OODBS\0lsdelete\0autocheck autochk *
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mapdisk]
2011-02-09 02:03	62	----a-w-	d:\programme\Bohemia Interactive\Tools\ArmAWork\mapdisk.bat
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StartCCC]
2010-11-25 20:32	98304	----a-w-	c:\programme\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2009-07-25 03:23	149280	----a-w-	c:\programme\Java\jre6\bin\jusched.exe
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Programme\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"d:\\Programme\\TerraTec Home Cinema\\tvtvSetup\\tvtv_Wizard.exe"=
"d:\\Programme\\TerraTec Home Cinema\\CinergyDvr.exe"=
"d:\\Programme\\TerraTec Home Cinema\\InstTool.exe"=
"d:\\Games\\Faces of War\\facesofwar.exe"=
"d:\\Programme\\RouterControl\\RouterControl.exe"=
"c:\\Programme\\DNA\\btdna.exe"=
"c:\\Programme\\Marvell\\61xx\\Apache2\\bin\\Apache.exe"=
"d:\\Games\\MassEffect\\Binaries\\MassEffect.exe"=
"d:\\Games\\MassEffect\\MassEffectLauncher.exe"=
"d:\\Games\\Assassin's Creed\\AssassinsCreed_Dx9.exe"=
"d:\\Games\\Assassin's Creed\\AssassinsCreed_Dx10.exe"=
"d:\\Games\\Assassin's Creed\\AssassinsCreed_Launcher.exe"=
"d:\\Games\\Rome - Total War\\Deutsch\\RomeTW.exe"=
"d:\\Programme\\Steam\\Steam.exe"=
"c:\\Programme\\Gemeinsame Dateien\\Adobe\\CS4ServiceManager\\CS4ServiceManager.exe"=
"d:\\Games\\Assassin's Creed II\\AssassinsCreedIIGame.exe"=
"d:\\Games\\Assassin's Creed II\\AssassinsCreedII.exe"=
"d:\\Games\\Assassin's Creed II\\UPlayBrowser.exe"=
"d:\\Programme\\Tunngle\\tnglctrl.exe"=
"d:\\Programme\\Tunngle\\tunngle.exe"=
"d:\\Programme\\Miranda IM\\miranda32.exe"=
"c:\\Programme\\Java\\jre6\\bin\\javaw.exe"=
"d:\\Games\\StarCraft II\\StarCraft II.exe"=
"d:\\Games\\StarCraft II\\Versions\\Base15405\\SC2.exe"=
"c:\\Programme\\Google\\Google Earth\\plugin\\geplugin.exe"=
"c:\\Programme\\Mozilla Firefox\\firefox.exe"=
"d:\\Games\\Lock On\\LockOn.exe"=
"d:\\Games\\Call of Duty - Black Ops\\BlackOps.exe"=
"d:\\Games\\ArmA 2\\arma2.exe"=
"c:\\Programme\\Ubisoft\\Ubisoft Game Launcher\\UbisoftGameLauncher.exe"=
"d:\\Games\\Silent Hunter 5\\sh5.exe"=
"d:\\Programme\\Orbitdownloader\\orbitdm.exe"=
"d:\\Programme\\Orbitdownloader\\orbitnet.exe"=
"d:\\Games\\ArmA 2\\arma2OA.exe"=
"d:\\Programme\\Skype\\Phone\\Skype.exe"=
"c:\\Programme\\SiSoftware\\SiSoftware Sandra Lite 2011.SP2\\RpcAgentSrv.exe"=
"c:\\Programme\\SiSoftware\\SiSoftware Sandra Lite 2011.SP2\\WNt500x86\\RpcSandraSrv.exe"=
"d:\\Games\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"=
"d:\\Games\\Men of War\\outfront_mp.exe"=
"d:\\Games\\Men of War\\mow.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5353:TCP"= 5353:TCP:Adobe CSI CS4
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)
.
R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [20.03.2009 17:33 64288]
R0 mv61xx;mv61xx;c:\windows\system32\drivers\mv61xx.sys [21.03.2009 00:14 68736]
R2 {B154377D-700F-42cc-9474-23858FBDF4BD};Power Control [2009/07/19 22:48];d:\programme\PowerDVD9\PowerDVD9\000.fcl [28.02.2009 19:40 87536]
R2 AntiVirSchedulerService;Avira AntiVir Planer;c:\programme\Avira\AntiVir Desktop\sched.exe [29.07.2010 20:29 136360]
R2 Hamachi2Svc;LogMeIn Hamachi 2.0 Tunneling Engine;d:\programme\Hamachi\hamachi-2.exe -s --> d:\programme\Hamachi\hamachi-2.exe -s [?]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\programme\Lavasoft\Ad-Aware\AAWService.exe [12.07.2010 10:55 2151128]
R2 LBeepKE;Logitech Beep Suppression Driver;c:\windows\system32\drivers\LBeepKE.sys [02.05.2011 18:03 10448]
R2 Marvell RAID;Marvell RAID Event Agent;c:\programme\Marvell\61xx\svc\mvraidsvc.exe [26.07.2006 01:39 114688]
R2 MRUWebService;MRU Web Service;c:\programme\Marvell\61xx\Apache2\bin\Apache.exe [26.06.2006 23:16 20541]
R2 TunngleService;TunngleService;d:\programme\Tunngle\TnglCtrl.exe [14.04.2010 23:15 716024]
R3 tap0901t;TAP-Win32 Adapter V9 (Tunngle);c:\windows\system32\drivers\tap0901t.sys [14.04.2010 23:15 27136]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [18.03.2010 13:16 130384]
S2 gupdate;Google Update Service (gupdate);c:\programme\Google\Update\GoogleUpdate.exe [11.05.2010 14:04 136176]
S3 gupdatem;Google Update-Dienst (gupdatem);c:\programme\Google\Update\GoogleUpdate.exe [11.05.2010 14:04 136176]
S3 Lavasoft Kernexplorer;Lavasoft helper driver;c:\programme\Lavasoft\Ad-Aware\kernexplorer.sys [12.08.2010 15:02 15232]
S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [29.07.2010 18:36 41272]
S3 SaiK0836;SaiK0836;c:\windows\system32\drivers\SaiK0836.sys [12.09.2008 09:32 107008]
S3 SandraAgentSrv;SiSoftware Deployment Agent Service;c:\programme\SiSoftware\SiSoftware Sandra Lite 2011.SP2\RpcAgentSrv.exe [02.05.2011 17:28 93848]
S3 USBMULCD;USB Multi-Channel Audio Device Interface;c:\windows\system32\drivers\CM106.sys [17.02.2010 15:23 1504256]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [18.03.2010 13:16 753504]
S4 sptd;sptd;\SystemRoot\\SystemRoot\System32\Drivers\sptd.sys --> \SystemRoot\\SystemRoot\System32\Drivers\sptd.sys [?]
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - 22864041
*Deregistered* - 22864041
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12	REG_MULTI_SZ   	Pml Driver HPZ12 Net Driver HPZ12
.
Inhalt des "geplante Tasks" Ordners
.
2011-08-01 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\programme\Google\Update\GoogleUpdate.exe [2010-05-11 12:04]
.
2011-08-01 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\programme\Google\Update\GoogleUpdate.exe [2010-05-11 12:04]
.
.
------- Zusätzlicher Suchlauf -------
.
IE: &Download by Orbit - d:\programme\Orbitdownloader\orbitmxt.dll/201
IE: &Grab video by Orbit - d:\programme\Orbitdownloader\orbitmxt.dll/204
IE: Do&wnload selected by Orbit - d:\programme\Orbitdownloader\orbitmxt.dll/203
IE: Down&load all by Orbit - d:\programme\Orbitdownloader\orbitmxt.dll/202
IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~1\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 213.168.112.60 81.173.194.77
FF - ProfilePath - c:\dokumente und einstellungen\NAME\Anwendungsdaten\Mozilla\Firefox\Profiles\tddszfgp.default\
FF - prefs.js: browser.search.defaulturl - 
FF - prefs.js: browser.search.selectedEngine - 
FF - prefs.js: browser.startup.homepage - hxxp://www.google.de/firefox
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\programme\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} - c:\programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} - c:\programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}
FF - Ext: Aero Fox XL: {5c8bfb7c-9a54-11dc-8314-0800200c9a66} - %profile%\extensions\{5c8bfb7c-9a54-11dc-8314-0800200c9a66}
FF - Ext: Adblock Plus: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} - %profile%\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
FF - Ext: Forecastfox Weather: {0538E3E3-7E9B-4d49-8831-A227C80A7AD3} - %profile%\extensions\{0538E3E3-7E9B-4d49-8831-A227C80A7AD3}
FF - Ext: Java Quick Starter: jqs@sun.com - c:\programme\Java\jre6\lib\deploy\jqs\ff
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF - user.js: network.cookie.cookieBehavior - 0
FF - user.js: privacy.clearOnShutdown.cookies - false
FF - user.js: security.warn_viewing_mixed - false
FF - user.js: security.warn_viewing_mixed.show_once - false
FF - user.js: security.warn_submit_insecure - false
FF - user.js: security.warn_submit_insecure.show_once - false
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover
Rootkit scan 2011-08-01 16:36
Windows 5.1.2600 Service Pack 3 NTFS
.
Scanne versteckte Prozesse... 
.
Scanne versteckte Autostarteinträge... 
.
Scanne versteckte Dateien... 
.
Scan erfolgreich abgeschlossen
versteckte Dateien: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\{B154377D-700F-42cc-9474-23858FBDF4BD}]
"ImagePath"="\??\d:\programme\PowerDVD9\PowerDVD9\000.fcl"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\S-1-5-21-2025429265-1659004503-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{5CE10E2C-A54E-FE10-45AC-A6BFB8E59770}*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
"namibokhpppmhgopggpjmeblfakl"=hex:69,61,68,67,6e,63,6f,66,61,63,6d,65,67,6c,
   6f,6d,6b,68,00,00
"magjdanjmcgnoaemdgjloibepi"=hex:6a,61,69,67,65,65,63,6f,66,6e,6d,6e,63,6f,6c,
   66,65,69,67,6a,00,00
"iamibokhpppmhgopgg"=hex:6a,61,6a,67,67,61,65,61,6d,6e,6e,66,6c,6b,70,6f,69,65,
   6d,6d,00,02
"hagjdanjmcgnoaem"=hex:69,61,6e,66,70,66,61,6a,70,69,66,6f,6a,6b,70,6c,69,6a,
   00,00
.
[HKEY_USERS\S-1-5-21-2025429265-1659004503-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{894EFBF1-24CD-8AB3-F859-68F4BBE44FDA}*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
"iagebkhodgbjeodbbp"=hex:69,61,62,6a,6b,69,65,66,65,6f,6f,6f,66,62,64,6a,64,6d,
   00,00
"haahhnkfdilojbki"=hex:6a,61,64,6a,6a,6e,63,6d,63,66,6b,6b,6e,70,66,64,61,65,
   6b,69,00,00
.
[HKEY_USERS\S-1-5-21-2025429265-1659004503-682003330-1003\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
"??"=hex:00,de,7a,64,9c,39,e1,35,8b,0f,0a,a2,ce,48,0a,c1,e6,ca,6e,bc,cf,46,ae,
   ee,1b,2b,99,64,8c,24,16,94,9e,55,98,7e,2c,74,d6,96,90,9f,bc,11,a0,88,9c,5d,\
"??"=hex:a7,b6,13,cd,df,db,81,2e,fd,fe,e3,eb,5b,61,7f,02
.
[HKEY_USERS\S-1-5-21-2025429265-1659004503-682003330-1003\Software\SecuROM\License information*]
"datasecu"=hex:83,bf,da,1d,0f,ff,fc,06,fd,5d,06,8e,7c,09,46,43,d3,30,69,77,56,
   57,f4,88,5a,79,e4,6e,71,59,c0,cd,3b,b2,bc,9e,9b,23,ed,66,41,ef,0c,a4,e4,dd,\
"rkeysecu"=hex:db,13,a6,68,21,b0,c1,7e,e7,81,22,20,f3,c7,55,ba
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\System*]
"OODEFRAG11.00.00.01WORKSTATION"="2C6E5ED8FEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA6A0AC4980AC7933A6A0AC4980AC7933A2D97226D213B555A2D97226D213B555FE57421B9DA288EA706788EE8C8A6399C4DB0BA41B8E8083F46EB3B736562FFBC57FC71EA3070EEF895D9AB44D710D716E5250F5928DF21A588E30FD34C7783DD5DB09EC441FF4641CA0A086348E96A392B2B8ACE5CBAD39F6031DAC51D207FB0687CED14241D51FBD0BACD09686323DABB63DFE985C9B424A00FC5BE5951C116ED5426A64B96D8BC92C31D7CA71B36074C83C72B3444B2C8EED3578C824A067EECCF429744899ACDE4608312CDC15426D897664447E6D80466A11C2D9061D7E2923D85242225F1462D06DC99B4B71ABD9CA9104DBF9595E3545BE5078B3C2E80349458120EDE76CF77600DD7C2F0CF8C21596D50D958777650451088CA0624FA660F62364487C708E13460236F2481E752574AF722A9712A4DC3DA9FEABF46B82BB0C79E8C10F70D2BB289C34F3AE1E7F677ABF28024908823EDEC33CAD940D4967889A0FDD32D0B7367168E503ED9237835E044E588449D54974BB37F17F18EF9FD3EEB5941F8AF57DD2F2406455A8B34D3B5109E15256B5CF9ECA66371982B15639B54752312908BFE0213AD1DA2351518DCE02445F4701DC667D41B068590C3067012C76E64DACDE9328CE7796D531CFB5F766970044D7AC34B4470418BA4109F2B5D255E62BE671C7937DF7C52AB53D7A1EE4EBA80D20AD5624784DF6D9D6EBD28D2FB6F68B00C33E42CAE64A1E88BE84633442F3F2830701555C9CF77E989BE216B75704C800529A653F4E27429431E0400C919E5DED10C9A5FBF23304130D613266E69D56B850E486642A06BC8A24028029C18BC511552A45E3C9E1D899E9F196390A77B5BBA40BFD4BEBB4C5DE5B3D444CB4403A6197813926096301C1909DCD35D76980DFE9DBFB07F922AA494D4BFD3A38E75E194B9159D9913B93E511CD355EDBF0E2C16D8D03AFABE4CDC526C9F63A154EE6B41881D396B78F3C243253FEC1172B1CBFB33668614D36A395453ACA9A84E59EF55CDAA8FB3F2CB9DD6DE0AFECFDDD82FCF154D93A23F1363C3F03E72C3446E4E0A60DAC2AE57FDFBA6F0D22717771FB619247535F5E182181D96B93C2C6A62ABFBD698947591B15A41AD48567DF6F8616B4D22977AA50177292A16537D1E6F52097A73BFCBD3855488217D869088A328CAA2102AD25615D5D16B848655F09615162E091F829B0AF18731772953394A276FA3D58345CB8CCD8CAA37CAFED329C6AFE15B2EDA683C74B697CFD0F198610CB5F987A3C576753BAC7BC95F9EEABE7C20024170F3653D45C17D1777B677C484848868CFD0F227121D6C27C2CC8E41C7930D60C18C8672108E08732863CB5A9E856BF04"
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------
.
- - - - - - - > 'winlogon.exe'(1000)
c:\windows\system32\Ati2evxx.dll
c:\windows\system32\atiadlxx.dll
c:\programme\Gemeinsame Dateien\Adobe\Adobe Drive CS4\AdobeDriveCS4_NP.dll
.
- - - - - - - > 'explorer.exe'(4820)
c:\progra~1\WINDOW~3\wmpband.dll
c:\windows\system32\msi.dll
c:\windows\system32\wpdshserviceobj.dll
c:\windows\system32\portabledevicetypes.dll
c:\windows\system32\portabledeviceapi.dll
.
Zeit der Fertigstellung: 2011-08-01  16:37:12
ComboFix-quarantined-files.txt  2011-08-01 14:37
ComboFix2.txt  2011-08-01 14:07
.
Vor Suchlauf: 1.934.475.264 Bytes frei
Nach Suchlauf: 1.917.669.376 Bytes frei
.
- - End Of File - - 0E6E0B076B4B069A8ACCF5CB09711DD4