Trojaner TR/Injection.aqu laut Antivir‏ eingefangen durch zip Datei einer angeblichen Mahnung von Amazon

ComboFix 13-02-18.02 - Pia 19.02.2013  19:10:23.1.1 - x86
Microsoft® Windows Vista™ Home Premium   6.0.6002.2.1252.49.1031.18.2047.1146 [GMT 1:00]
ausgeführt von:: c:\users\Pia\Desktop\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Jonas\P-7-78-8964-9648-3874
c:\users\Pia\LegoStarwars.exe
c:\windows\IsUn0407.exe
c:\windows\security\Database\tmp.edb
c:\windows\unin0407.exe
.
.
(((((((((((((((((((((((   Dateien erstellt von 2013-01-19 bis 2013-02-19  ))))))))))))))))))))))))))))))
.
.
2013-02-19 18:20 . 2013-02-19 18:20	--------	d-----w-	c:\users\Saskia\AppData\Local\temp
2013-02-19 18:20 . 2013-02-19 18:20	--------	d-----w-	c:\users\Lars\AppData\Local\temp
2013-02-19 18:20 . 2013-02-19 18:20	--------	d-----w-	c:\users\Jonas\AppData\Local\temp
2013-02-19 18:20 . 2013-02-19 18:20	--------	d-----w-	c:\users\Default\AppData\Local\temp
2013-02-14 06:32 . 2013-02-14 06:32	--------	d-----w-	c:\users\Pia\AppData\Roaming\OpenOffice.org
2013-02-14 06:24 . 2013-02-14 06:24	--------	d-----w-	c:\program files\OpenOffice.org 3
2013-02-13 22:54 . 2013-01-08 22:01	768000	----a-w-	c:\program files\Common Files\Microsoft Shared\vgx\VGX.dll
2013-02-13 22:49 . 2013-01-04 11:28	905576	----a-w-	c:\windows\system32\drivers\tcpip.sys
2013-02-13 22:49 . 2013-01-05 05:26	3550072	----a-w-	c:\windows\system32\ntoskrnl.exe
2013-02-13 22:49 . 2013-01-05 05:26	3602808	----a-w-	c:\windows\system32\ntkrnlpa.exe
2013-02-13 22:48 . 2013-01-04 01:38	2048512	----a-w-	c:\windows\system32\win32k.sys
2013-02-13 22:48 . 2012-11-08 03:48	1314816	----a-w-	c:\windows\system32\quartz.dll
2013-02-11 19:47 . 2013-02-11 19:47	--------	d-----w-	C:\_OTL
2013-02-10 21:20 . 2013-02-10 21:20	--------	d-----w-	c:\users\Pia\AppData\Roaming\Malwarebytes
2013-02-10 21:19 . 2013-02-10 21:19	--------	d-----w-	c:\programdata\Malwarebytes
2013-02-10 21:19 . 2013-02-10 21:20	--------	d-----w-	c:\program files\Malwarebytes' Anti-Malware
2013-02-10 21:19 . 2012-12-14 15:49	21104	----a-w-	c:\windows\system32\drivers\mbam.sys
2013-02-10 18:35 . 2013-02-10 18:35	--------	d-----w-	c:\users\Jonas\AppData\Roaming\Avira
2013-02-09 17:20 . 2013-02-09 17:20	--------	d-----w-	c:\users\Pia\AppData\Roaming\Avira
2013-02-09 17:14 . 2012-11-27 09:01	83944	----a-w-	c:\windows\system32\drivers\avgntflt.sys
2013-02-09 17:14 . 2012-11-22 14:51	36552	----a-w-	c:\windows\system32\drivers\avkmgr.sys
2013-02-09 17:14 . 2012-11-22 14:50	134336	----a-w-	c:\windows\system32\drivers\avipbb.sys
2013-02-09 17:13 . 2013-02-09 17:13	--------	d-----w-	c:\program files\Avira
2013-02-09 13:35 . 2013-01-08 04:57	6991832	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{44487A15-4B87-43E6-B8FC-10D60E2B935B}\mpengine.dll
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-02-14 16:52 . 2011-01-19 13:34	3325208	----a-w-	c:\windows\RXSUnins.exe
2013-02-14 16:52 . 2011-01-19 13:34	3325208	----a-w-	c:\windows\RXCUnins.exe
2013-02-09 13:40 . 2012-05-06 08:35	697712	----a-w-	c:\windows\system32\FlashPlayerApp.exe
2013-02-09 13:40 . 2011-05-18 14:01	74096	----a-w-	c:\windows\system32\FlashPlayerCPLApp.cpl
2013-01-17 00:28 . 2009-10-03 09:51	232336	------w-	c:\windows\system32\MpSigStub.exe
2012-12-16 13:12 . 2012-12-21 10:59	34304	----a-w-	c:\windows\system32\atmlib.dll
2012-12-16 10:50 . 2012-12-21 10:59	293376	----a-w-	c:\windows\system32\atmfd.dll
2013-02-10 17:02 . 2013-02-10 17:02	262552	----a-w-	c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]
"rfxsrvtray"="c:\program files\Tobit Radio.fx\Client\rfx-tray.exe" [2013-02-07 1838872]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 202240]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"="SOUNDMAN.EXE" [2009-04-14 604704]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-03-03 61440]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2006-12-10 49152]
"4StoryPrePatch"="d:\program files\Gameforge4D\4Story\PrePatch.exe" [2011-01-10 319488]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-01-07 253672]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-12-03 946352]
"WPCUMI"="c:\windows\system32\WpcUmi.exe" [2006-11-02 176128]
"LifeCam"="c:\program files\Microsoft LifeCam\LifeExp.exe" [2010-12-13 135536]
"LogMeIn Hamachi Ui"="d:\program files\LogMeIn Hamachi\hamachi-2-ui.exe" [2012-12-10 2254768]
"SSDMonitor"="c:\program files\Common Files\PC Tools\sMonitor\SSDMonitor.exe" [2012-08-21 105120]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2013-02-12 385248]
.
c:\users\Pia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OpenOffice.org 3.4.1.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2012-8-13 1199104]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2007-1-2 210520]
McAfee Security Scan Plus.lnk - c:\program files\McAfee Security Scan\3.0.318\SSScheduler.exe [2013-2-5 272248]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [1999-2-18 65588]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-3991110739-168063462-2197672951-1000]
"EnableNotificationsRef"=dword:00000002
.
S2 ACEDRV08;ACEDRV08;c:\windows\system32\drivers\ACEDRV08.sys [x]
S2 ACEDRV09;ACEDRV09;c:\windows\system32\drivers\ACEDRV09.sys [x]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation	REG_MULTI_SZ   	FontCache
HPZ12	REG_MULTI_SZ   	Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt	REG_MULTI_SZ   	hpqcxs08 hpqddsvc
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2013-02-02 15:04	1607120	----a-w-	c:\program files\Google\Chrome\Application\24.0.1312.57\Installer\chrmstp.exe
.
Inhalt des "geplante Tasks" Ordners
.
2013-02-19 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-05-06 13:40]
.
2013-02-19 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-05-30 09:09]
.
2013-02-19 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-05-30 09:09]
.
2013-02-13 c:\windows\Tasks\Norton Security Scan for Pia.job
- c:\program files\Norton Security Scan\Engine\2.7.3.34\Nss.exe [2011-01-12 00:27]
.
2013-02-19 c:\windows\Tasks\RMAutoUpdate.job
- c:\program files\PC Tools Registry Mechanic\SULauncher.exe [2013-01-14 21:59]
.
2013-02-19 c:\windows\Tasks\RMSchedule.job
- c:\program files\PC Tools Registry Mechanic\RegMech.exe [2013-01-14 21:59]
.
2013-02-19 c:\windows\Tasks\User_Feed_Synchronization-{EECA17A8-2B96-4E3A-96B7-2314357E76AF}.job
- c:\windows\system32\msfeedssync.exe [2011-06-11 10:10]
.
2013-02-17 c:\windows\Tasks\WebReg Photosmart C4100 series.job
- c:\program files\HP\Digital Imaging\bin\hpqwrg.exe [2006-12-10 20:36]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.google.com
IE: Free YouTube Download - c:\users\Pia\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm
IE: Free YouTube to MP3 Converter - c:\users\Pia\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm
IE: Nach Microsoft &Excel exportieren - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
LSP: c:\windows\system32\wpclsp.dll
LSP: c:\program files\Avira\AntiVir Desktop\avsda.dll
Trusted Zone: eidosweb.de\download
Trusted Zone: microsoft.com\*.update
Trusted Zone: microsoft.com\download
Trusted Zone: microsoft.com\update
Trusted Zone: microsoft.com\www
Trusted Zone: rapidshare.com\rs653tg2
Trusted Zone: windowsupdate.com\download
FF - ProfilePath - c:\users\Pia\AppData\Roaming\Mozilla\Firefox\Profiles\ec6bzlgo.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - ExtSQL: !HIDDEN! 2009-06-24 19:23; {20a82645-c095-46ed-80e3-08825760534b}; c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
HKCU-Run-EA Core - c:\program files\Electronic Arts\EADM\Core.exe
Notify-AtiExtEvent - (no file)
SafeBoot-WudfPf
SafeBoot-WudfRd
AddRemove-82A44D22-9452-49FB-00FB-CEC7DCAF7E23 - c:\program files\EA SPORTS\EA SPORTS online\EASOUNInstaller.exe
AddRemove-Adobe Acrobat 5.0 - c:\windows\ISUN0407.EXE
AddRemove-ClassicSolitaire - c:\program files\ClassicSolitaire\uninstall.exe
AddRemove-FantasticHorse_is1 - c:\program files\FantasticHorse\unins000.exe
AddRemove-Flu's_Follies - c:\program files\Flu's_Follies\uninstall.exe
AddRemove-Hugo - Diamantenfieber - c:\progra~1\HUGO-D~1\UNWISE.EXE
AddRemove-LEGO Racers - c:\windows\IsUn0407.exe
AddRemove-Monopoly Star Wars - c:\windows\IsUn0407.exe
AddRemove-S4Uninst - c:\windows\IsUn0407.exe
AddRemove-SimCity 3000 - c:\windows\IsUn0407.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2013-02-19 19:21
Windows 6.0.6002 Service Pack 2 NTFS
.
Scanne versteckte Prozesse... 
.
Scanne versteckte Autostarteinträge... 
.
Scanne versteckte Dateien... 
.
.
c:\users\Pia\AppData\Local\Temp\catchme.dll 53248 bytes executable
.
Scan erfolgreich abgeschlossen
versteckte Dateien: 1
.
**************************************************************************
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\S-1-5-21-3991110739-168063462-2197672951-1000\Software\SecuROM\License information*]
"datasecu"=hex:3a,2a,aa,4d,e2,19,d9,d1,d0,39,22,6e,7a,e4,c0,b9,f4,c6,a0,e4,3c,
   22,21,f0,1d,fc,0d,fb,a9,ea,61,3a,34,6a,fc,03,25,bb,fd,a9,ec,43,32,bb,43,c1,\
"rkeysecu"=hex:b4,03,8c,03,18,56,56,99,b8,97,74,dd,50,e1,a5,64
.
[HKEY_USERS\S-1-5-21-3991110739-168063462-2197672951-1004\Software\SecuROM\License information*]
"datasecu"=hex:24,cf,66,62,8b,a3,b4,4a,c3,ca,34,16,4b,06,2d,e0,2d,6f,88,dc,d1,
   44,8e,fc,26,c5,38,1a,ed,25,d3,6a,d2,30,6c,b2,43,a8,72,07,ac,6f,14,aa,01,28,\
"rkeysecu"=hex:77,64,f5,a7,0d,5a,28,0d,1d,a4,1d,f7,45,b5,89,15
.
Zeit der Fertigstellung: 2013-02-19  19:24:52
ComboFix-quarantined-files.txt  2013-02-19 18:24
.
Vor Suchlauf: 13 Verzeichnis(se), 31.238.225.920 Bytes frei
Nach Suchlauf: 18 Verzeichnis(se), 35.317.710.848 Bytes frei
.
- - End Of File - - B6A7FA0F92588FD1FBD0DD6B67755324