Windows Firewall Pop-up Meldung alle 5 Min.

frederic · 22.08.2008, 12:52

hallo
ich bin neue in diesem Forum. Bekomme seit ein paar Tagen immer ein Pop-up von Windows Firewall mit der Meldung von verschiedenen Trojan-Spy.html.bankfraud.dq etc. etc...immer wieder andere... habe Malewarebyte Antimalware laufen lassen und alles entfernt die infiziert waren. Leider besteht immer noch dasselbe Problem.

Habe noch nicht viel Erfahrung mit solchen Sachen. Habe daher mal ein HijackThis Protokoll erstellt. Wäre super, wenn jemand hilft!!

Vielen Dank im Voraus.

Frederic

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:09:29, on 21.08.2008
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Portrait Displays\Pivot Software\wpCtrl.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Portrait Displays\Pivot Software\floater.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\DELL\Dell Laser MFP 1600n\PSU\ScanToPc.exe
C:\Program Files\DELL\Dell Laser MFP 1600n\PaperPort\pptd40nt.exe
C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Picasa2\PicasaMediaDetector.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\ehome\ehmsas.exe
C:\Windows\System32\oruxiboj.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Windows\System32\mobsync.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Windows\System32\oruxiboj.exe
C:\Users\user\AppData\Local\Temp\VolumeControlVista[0].exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.de/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Yahoo! Toolbar mit Pop-Up-Blocker - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O1 - Hosts: ::1 localhost
O2 - BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [JMB36X IDE Setup] C:\Windows\RaidTool\xInsIDE.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [PivotSoftware] "C:\Program Files\Portrait Displays\Pivot Software\wpctrl.exe"
O4 - HKLM\..\Run: [DT HPW] C:\Program Files\Common Files\Portrait Displays\Shared\DT_startup.exe -HPW
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [P3000x_S2P] C:\PROGRAM FILES\DELL\DELL LASER MFP 1600N\PSU\ScanToPc.exe
O4 - HKLM\..\Run: [PaperPort PTD] C:\Program Files\DELL\Dell Laser MFP 1600n\PaperPort\pptd40nt.exe
O4 - HKLM\..\Run: [IndexSearch] C:\Program Files\DELL\Dell Laser MFP 1600n\PaperPort\IndexSearch.exe
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [infocomcfg] C:\Windows\system32\oruxiboj.exe
O4 - HKLM\..\Policies\Explorer\Run: [bQjswuPRKi] C:\Users\Public\Downloads\Downloads\AdobeFlashPlayerHD.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETZWERKDIENST')
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~1.0_0\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~1.0_0\bin\ssv.dll
O9 - Extra button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O13 - Gopher Prefix:
O17 - HKLM\System\CCS\Services\Tcpip\..\{00F90387-224B-4944-9606-3F28BB213408}: NameServer = 192.168.178.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{00F90387-224B-4944-9606-3F28BB213408}: NameServer = 192.168.178.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{00F90387-224B-4944-9606-3F28BB213408}: NameServer = 192.168.178.1
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL
O21 - SSODL: AppMonWeb - {15AE9D06-AB1D-51B7-576D-00568789334F} - C:\Program Files\oumgazc\AppMonWeb.dll
O23 - Service: Avira AntiVir Personal - Free Antivirus Planer (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Portrait Displays Display Tune Service (DTSRVC) - Unknown owner - C:\Program Files\Common Files\Portrait Displays\Shared\dtsrvc.exe
O23 - Service: Google Desktop Manager 5.7.806.10245 (GoogleDesktopManager-061008-081103) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HauppaugeTVServer - Hauppauge Computer Works - C:\PROGRA~1\WinTV\HCWTVS~1.EXE
O23 - Service: iPod-Dienst (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe

--
End of file - 7700 bytes

**Sunny** · 22.08.2008, 12:57

Hallo frederic und

Dateien Online überprüfen lassen:

Als erstes versteckte Dateien anzeigen lassen! (nur Punkt 1 durchführen!)

Suche die Seite Virtustotal auf, klicke auf den Button „Durchsuchen“ und suche folgende Datei/Dateien:

Code:

ATTFilter

C:\Program Files\oumgazc\AppMonWeb.dll

Lade nun nacheinander jede/alle Datei/Dateien hoch, und warte bis der Scan vorbei ist. (kann bis zu 2 Minuten dauern.)

Poste im Anschluss das Ergebnis der Auswertung, alles abkopieren und in einen Beitrag einfügen.

Wichtig: Auch die Größenangabe sowie den HASH mit kopieren!

ComboFix

Lade dir das Tool hier herunter auf den Desktop -> KLICK

Das Programm jedoch noch nicht starten sondern zuerst folgendes tun:

Schliesse alle Anwendungen und Programme, vor allem deine Antiviren-Software und andere Hintergrundwächter, sowie deinen Internetbrowser.
Vermeide es auch explizit während das Combofix läuft die Maus und Tastatur zu benutzen.

Dann folgende Anleitung durchlesen und abarbeiten -> CCleaner Systembereinigung

Starte nun die combofix.exe von deinem Desktop aus, bestätige die Warnmeldungen und lass dein System durchsuchen.

Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte abkopieren und in deinen Beitrag einfügen. Das log findest du außerdem unter: C:\ComboFix.txt.

Wichtiger Hinweis:

Combofix darf ausschließlich ausgeführt werden wenn ein Kompetenzler dies ausdrücklich empfohlen hat!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

Hinweis: Combofix verhindert die Autostart Funktion aller CD / DVD und USB - Laufwerken um so eine Verbeitung einzudämmen. Wenn es hierdurch zu Problemen kommt, diese im Thread posten.

(ausführliche Anleitung -> Ein Leitfaden und Tutorium zur Nutzung von ComboFix)

frederic · 22.08.2008, 14:03

Vielen Dank für die schnelle Antwort. Hier die Angaben:

Log.txt

ComboFix 08-08-21.02 - user 2008-08-22 14:47:26.1 - NTFSx86
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1031.18.2002 [GMT 2:00]
ausgeführt von:: C:\Users\user\Desktop\ComboFix.exe
* Neuer Wiederherstellungspunkt wurde erstellt
.

((((((((((((((((((((((( Dateien erstellt von 2008-07-22 bis 2008-08-22 ))))))))))))))))))))))))))))))
.

2008-08-21 23:09 . 2008-08-21 23:09 <DIR> d-------- C:\Program Files\Trend Micro
2008-08-21 20:44 . 2008-08-21 20:44 <DIR> d-------- C:\Users\user\AppData\Roaming\Malwarebytes
2008-08-21 20:44 . 2008-08-21 20:44 <DIR> d-------- C:\Users\All Users\Malwarebytes
2008-08-21 20:44 . 2008-08-21 20:44 <DIR> d-------- C:\ProgramData\Malwarebytes
2008-08-21 20:44 . 2008-08-21 23:05 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-08-21 20:44 . 2008-08-17 15:05 38,472 --a------ C:\Windows\System32\drivers\mbamswissarmy.sys
2008-08-21 20:44 . 2008-08-17 15:05 17,144 --a------ C:\Windows\System32\drivers\mbam.sys
2008-08-21 09:15 . 2008-08-21 13:14 <DIR> d-------- C:\Users\user\DoctorWeb
2008-08-21 08:54 . 2008-07-19 07:09 1,811,656 --a------ C:\Windows\System32\wuaueng.dll
2008-08-21 08:54 . 2008-07-19 05:44 1,524,736 --a------ C:\Windows\System32\wucltux.dll
2008-08-21 08:54 . 2008-07-19 07:09 563,912 --a------ C:\Windows\System32\wuapi.dll
2008-08-21 08:54 . 2008-07-18 22:08 163,904 --a------ C:\Windows\System32\wuwebv.dll
2008-08-21 08:54 . 2008-07-19 05:44 83,456 --a------ C:\Windows\System32\wudriver.dll
2008-08-21 08:54 . 2008-07-19 07:10 53,448 --a------ C:\Windows\System32\wuauclt.exe
2008-08-21 08:54 . 2008-07-19 07:10 45,768 --a------ C:\Windows\System32\wups2.dll
2008-08-21 08:54 . 2008-07-19 07:10 36,552 --a------ C:\Windows\System32\wups.dll
2008-08-21 08:54 . 2008-07-18 20:44 31,232 --a------ C:\Windows\System32\wuapp.exe
2008-08-20 15:17 . 2008-08-20 15:17 <DIR> d-------- C:\Users\All Users\udklelqx
2008-08-20 15:17 . 2008-08-20 15:17 <DIR> d-------- C:\Users\All Users\ozmhenif
2008-08-20 15:17 . 2008-08-20 15:17 <DIR> d-------- C:\ProgramData\udklelqx
2008-08-20 15:17 . 2008-08-20 15:17 <DIR> d-------- C:\ProgramData\ozmhenif
2008-08-20 15:17 . 2008-08-20 15:17 <DIR> d-------- C:\Program Files\oumgazc
2008-08-20 15:17 . 2008-08-20 15:17 77,824 --a------ C:\Windows\System32\oruxiboj.exe
2008-08-18 10:23 . 2008-08-18 10:23 <DIR> d-------- C:\Users\user\Documents
2008-08-18 10:14 . 2008-08-18 10:14 <DIR> d-------- C:\Program Files\Yahoo!
2008-08-18 10:14 . 2008-08-18 10:14 <DIR> d-------- C:\Program Files\CCleaner
2008-08-17 15:56 . 2008-08-17 15:57 <DIR> d-------- C:\Users\All Users\Adobe
2008-08-17 15:56 . 2008-08-17 15:57 <DIR> d-------- C:\Program Files\Common Files\Adobe
2008-08-15 23:06 . 2008-08-15 23:06 323,584 --a------ C:\Windows\System32\AUDIOGENIE2.DLL
2008-08-15 23:03 . 2008-08-15 23:03 <DIR> d-------- C:\Temp
2008-08-15 19:40 . 2008-08-15 19:40 <DIR> d-------- C:\Users\user\AppData\Roaming\DivX
2008-08-15 19:38 . 2008-08-15 19:38 <DIR> d-------- C:\Windows\Replay Media Catcher
2008-08-15 19:38 . 2008-08-15 19:38 <DIR> d-------- C:\Windows\Freecorder Toolbar
2008-08-15 19:38 . 2008-08-20 22:58 <DIR> d-------- C:\Program Files\Freecorder
2008-08-15 19:38 . 2008-08-15 19:38 <DIR> d-------- C:\Program Files\Conduit
2008-08-15 19:38 . 2008-08-15 19:38 2,788,800 --a------ C:\Program Files\FLV PlayerFCSetup.exe
2008-08-15 19:36 . 2008-08-15 23:08 <DIR> d-------- C:\Program Files\Replay Media Catcher
2008-08-15 19:36 . 2008-08-15 23:08 <DIR> d-------- C:\Program Files\Replay Converter
2008-08-15 19:36 . 2008-08-15 19:36 8,289,720 --a------ C:\Program Files\FLV PlayerRCATSetup.exe
2008-08-15 19:36 . 2007-03-04 13:55 1,936,528 --a------ C:\Windows\System32\ltmm15.dll
2008-08-15 19:36 . 2008-08-15 19:36 737,280 --a------ C:\Windows\iun6002.exe
2008-08-15 19:36 . 2007-03-04 13:55 135,168 --a------ C:\Windows\System32\DSKernel2.dll
2008-08-15 19:35 . 2008-08-15 19:36 <DIR> d-------- C:\Users\user\AppData\Roaming\GetRightToGo
2008-08-15 19:35 . 2008-08-15 19:35 411,248 --a------ C:\Program Files\FLV PlayerRCSetup.exe
2008-08-15 19:34 . 2008-08-15 19:34 <DIR> d-------- C:\Windows\Applian FLV Player
2008-08-15 19:34 . 2008-08-15 19:34 <DIR> d-------- C:\Program Files\FLV Player
2008-08-15 19:09 . 2008-08-21 20:12 <DIR> d-------- C:\Program Files\Common Files\PX Storage Engine
2008-08-15 19:08 . 2008-08-21 20:13 <DIR> d-------- C:\Program Files\DivX
2008-08-15 16:07 . 2008-08-15 16:07 <DIR> d-------- C:\Windows\Sun
2008-08-14 21:52 . 2008-08-14 21:52 <DIR> d-------- C:\Users\user\AppData\Roaming\Dexpot
2008-08-14 19:16 . 2008-08-14 19:16 <DIR> d-------- C:\Program Files\Common Files\IviSDK
2008-08-14 19:14 . 2008-08-14 19:16 6,247 --a------ C:\Windows\HCWPNP.INI
2008-08-14 18:49 . 2008-08-14 18:49 <DIR> d-------- C:\Users\All Users\LogiShrd
2008-08-14 18:49 . 2008-08-14 18:49 <DIR> d-------- C:\ProgramData\LogiShrd
2008-08-14 18:47 . 2008-08-14 18:47 0 --ah----- C:\Windows\System32\drivers\Msft_Kernel_LMouFilt_01005.Wdf
2008-08-14 18:45 . 2008-05-02 02:38 301,656 --a------ C:\Windows\System32\BtCoreIf.dll
2008-08-14 18:45 . 2008-05-02 02:39 170,512 --a------ C:\Windows\System32\kemutb.dll
2008-08-14 18:45 . 2008-05-02 02:39 145,936 --a------ C:\Windows\System32\KemUtil.dll
2008-08-14 18:45 . 2008-05-02 02:40 117,264 --a------ C:\Windows\System32\KemWnd.dll
2008-08-14 18:45 . 2008-05-02 02:40 84,496 --a------ C:\Windows\System32\KemXML.dll
2008-08-14 18:44 . 2008-08-14 18:44 <DIR> d-------- C:\Users\user\AppData\Roaming\InstallShield
2008-08-14 18:44 . 2008-08-14 18:44 <DIR> d-------- C:\Program Files\Logitech
2008-08-14 18:44 . 2008-08-14 18:45 <DIR> d-------- C:\Program Files\Common Files\Logishrd
2008-08-14 15:51 . 2008-07-16 03:32 2,048 --a------ C:\Windows\System32\tzres.dll
2008-08-14 15:19 . 2008-06-19 05:31 361,984 --a------ C:\Windows\System32\IPSECSVC.DLL
2008-08-14 15:13 . 2008-06-27 03:55 1,383,424 --a------ C:\Windows\System32\mshtml.tlb
2008-08-14 15:13 . 2008-06-27 06:15 827,392 --a------ C:\Windows\System32\wininet.dll
2008-08-14 15:13 . 2008-04-18 07:48 269,312 --a------ C:\Windows\System32\es.dll
2008-08-14 15:07 . 2008-04-10 07:12 738,304 --a------ C:\Windows\System32\inetcomm.dll
2008-08-10 09:59 . 2008-08-10 09:59 <DIR> dr------- C:\Users\user\Contacts
2008-08-10 09:50 . 2008-08-10 09:50 <DIR> d-------- C:\PerfLogs
2008-08-10 09:06 . 2008-01-19 09:33 8,139,264 --a------ C:\Windows\System32\ssBranded.scr
2008-08-10 09:05 . 2008-01-19 08:06 8,147,456 --a------ C:\Windows\System32\wmploc.DLL
2008-08-09 17:09 . 2008-08-09 17:09 <DIR> d-------- C:\Users\All Users\ScanSoft
2008-08-09 17:09 . 2008-08-09 17:09 <DIR> d-------- C:\ProgramData\ScanSoft
2008-08-09 17:09 . 2008-08-09 17:09 <DIR> d-------- C:\Program Files\Common Files\ScanSoft Shared
2008-08-09 17:09 . 2003-09-24 10:37 27,114 --a------ C:\Windows\maxlink.ini
2008-08-09 17:08 . 2008-08-09 17:08 <DIR> d-------- C:\Program Files\Common Files\SWF Studio
2008-08-09 17:08 . 2001-03-19 03:52 766 --a------ C:\Windows\Uninstall.ico
2008-08-09 17:07 . 2004-04-16 09:42 73,728 --------- C:\Windows\wiainst.exe
2008-08-09 17:07 . 2004-03-11 09:04 24,576 --------- C:\Windows\SvcCon.exe
2008-08-09 17:05 . 2004-03-23 10:10 13,227 --a------ C:\Windows\System32\DelR1LMK.DLL
2008-08-09 17:04 . 2004-04-01 15:39 151,552 --a------ C:\Windows\System32\VdSetup.Exe
2008-08-09 17:04 . 2004-03-05 13:59 53,248 --a------ C:\Windows\System32\VdSetup.dll
2008-08-09 17:04 . 2004-02-04 07:24 49,152 --a------ C:\Windows\System32\ssusbpn.dll
2008-08-09 17:02 . 2008-08-09 17:02 <DIR> d-------- C:\Program Files\DELL
2008-08-09 17:01 . 2004-03-23 12:13 65,536 --a------ C:\Windows\System32\ssdevm.dll
2008-08-09 15:08 . 2008-08-14 19:15 <DIR> d-------- C:\Program Files\WinTV
2008-08-09 11:37 . 2008-08-09 11:37 <DIR> d-------- C:\Program Files\Opera
2008-08-09 11:37 . 2008-08-09 11:37 <DIR> d-------- C:\Program Files\DVDVideoSoft
2008-08-09 11:37 . 2008-08-09 11:37 <DIR> d-------- C:\Program Files\Common Files\DVDVideoSoft
2008-08-09 11:37 . 2002-01-05 14:37 344,064 --a------ C:\Windows\System32\msvcr70.dll
2008-08-09 11:36 . 2008-08-09 11:36 <DIR> d-------- C:\Program Files\Java
2008-08-09 11:35 . 2008-08-09 11:35 <DIR> d-------- C:\Program Files\Common Files\Java
2008-08-09 11:33 . 2008-08-09 11:34 <DIR> d-------- C:\Program Files\LimeWire
2008-08-09 11:08 . 2008-08-09 11:08 <DIR> d-------- C:\Users\user\AppData\Roaming\Logitech
2008-08-09 11:08 . 2008-08-14 18:44 <DIR> d-------- C:\Users\All Users\Logitech
2008-08-09 11:08 . 2008-08-14 18:44 <DIR> d-------- C:\ProgramData\Logitech
2008-08-09 10:43 . 2008-08-09 10:43 <DIR> d-------- C:\Hauppauge
2008-08-09 10:43 . 2005-11-02 19:20 376,836 --a------ C:\Windows\System32\drivers\HcwFalcn.rom
2008-08-09 10:43 . 2007-02-06 15:27 185,728 --a------ C:\Windows\System32\drivers\hcwPP2.sys
2008-08-09 10:43 . 2006-09-08 14:40 139,264 --a------ C:\Windows\System32\hcwECPPP.ax
2008-08-09 10:43 . 2007-02-06 15:26 99,840 --a------ C:\Windows\System32\hcwCCnv2.ax
2008-08-09 10:43 . 2006-09-08 14:40 96,256 --a------ C:\Windows\System32\hcwCP.ax
2008-08-09 10:43 . 2007-02-06 15:26 95,232 --a------ C:\Windows\System32\hcwPrxA2.ax
2008-08-09 10:43 . 2006-07-21 16:50 66,048 --a------ C:\Windows\System32\hcwXDS.dll
2008-08-09 10:43 . 2007-01-15 09:43 16,382 --a------ C:\Windows\System32\drivers\HcwMakoC.rom
2008-08-09 10:43 . 2007-02-06 15:37 16,382 --a------ C:\Windows\System32\drivers\HcwMakoB.rom
2008-08-09 10:37 . 2008-08-09 11:03 <DIR> d-------- C:\Program Files\TWIXTEL
2008-08-09 09:06 . 2008-08-09 11:07 <DIR> d-------- C:\Windows\System32\Macromed
2008-08-09 09:01 . 2008-08-09 09:01 0 --------- C:\Windows\nsreg.dat
2008-08-08 23:41 . 2008-08-08 23:41 <DIR> d-------- C:\Program Files\Picasa2
2008-08-08 23:41 . 2006-10-05 04:42 2,560 --------- C:\Windows\System32\drivers\cdralw2k.sys
2008-08-08 23:41 . 2006-10-05 04:42 2,432 --------- C:\Windows\System32\drivers\cdr4_xp.sys
2008-08-08 23:14 . 2008-08-08 23:18 <DIR> d-------- C:\Users\user\AppData\Roaming\Apple Computer
2008-08-08 23:14 . 2008-08-08 23:14 <DIR> d-------- C:\Program Files\iTunes
2008-08-08 23:14 . 2008-08-08 23:14 <DIR> d-------- C:\Program Files\iPod
2008-08-08 23:13 . 2008-08-08 23:14 <DIR> d-------- C:\Users\All Users\Apple Computer
2008-08-08 23:13 . 2008-08-08 23:14 <DIR> d-------- C:\ProgramData\Apple Computer
2008-08-08 23:13 . 2008-08-08 23:13 <DIR> d-------- C:\Program Files\QuickTime
2008-08-08 23:12 . 2008-08-08 23:12 <DIR> d-------- C:\Users\All Users\Apple
2008-08-08 23:12 . 2008-08-08 23:12 <DIR> d-------- C:\ProgramData\Apple
2008-08-08 23:12 . 2008-08-08 23:12 <DIR> d-------- C:\Program Files\Common Files\Apple
2008-08-08 23:12 . 2008-08-08 23:12 <DIR> d-------- C:\Program Files\Apple Software Update
2008-08-08 22:59 . 2008-08-08 23:41 <DIR> d-------- C:\Program Files\Google

.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-14 13:50 --------- d-----w C:\Program Files\Windows Mail
2008-08-10 07:59 174 --sha-w C:\Program Files\desktop.ini
2008-08-10 07:52 --------- d-----w C:\Program Files\Windows Sidebar
2008-08-10 07:52 --------- d-----w C:\Program Files\Windows Photo Gallery
2008-08-10 07:52 --------- d-----w C:\Program Files\Windows Journal
2008-08-10 07:52 --------- d-----w C:\Program Files\Windows Defender
2008-08-10 07:52 --------- d-----w C:\Program Files\Windows Collaboration
2008-08-10 07:52 --------- d-----w C:\Program Files\Windows Calendar
2008-08-10 07:14 82,432 ----a-w C:\Windows\System32\axaltocm.dll
2008-08-10 07:14 101,888 ----a-w C:\Windows\System32\ifxcardm.dll
2008-08-08 17:09 540,672 ----a-w C:\Windows\AppPatch\AcLayers.dll
2008-08-08 17:09 458,752 ----a-w C:\Windows\AppPatch\AcSpecfc.dll
2008-08-08 17:09 2,560 ----a-w C:\Windows\AppPatch\AcRes.dll
2008-08-08 17:09 2,153,984 ----a-w C:\Windows\AppPatch\AcGenral.dll
2008-08-08 17:09 173,056 ----a-w C:\Windows\AppPatch\AcXtrnal.dll
2008-08-07 12:30 319,456 ------w C:\Windows\DIFxAPI.dll
2008-08-07 12:30 315,392 ------w C:\Windows\HideWin.exe
2008-08-07 12:20 --------- d-sh--w C:\ProgramData\Vorlagen
2008-08-07 12:20 --------- d-sh--w C:\ProgramData\Startmenü
2008-08-07 12:20 --------- d-sh--w C:\ProgramData\Favoriten
2008-08-07 12:20 --------- d-sh--w C:\ProgramData\Dokumente
2008-08-07 12:20 --------- d-sh--w C:\ProgramData\Anwendungsdaten
2008-08-07 12:20 --------- d-sh--w C:\Program Files\Gemeinsame Dateien
2008-05-29 15:00 806,985 ------w C:\Windows\System32\hcwtvwnd.dll
.

(((((((((((((((((((((((((((( Autostart Punkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Eintrage & legitime Standardeintrage werden nicht angezeigt.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray.exe"="C:\Windows\ehome\ehTray.exe" [2008-01-19 09:33 125952]
"Picasa Media Detector"="C:\Program Files\Picasa2\PicasaMediaDetector.exe" [2008-02-26 03:23 443968]
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 09:33 202240]
"infocomcfg"="C:\Windows\system32\oruxiboj.exe" [2008-08-20 15:17 77824]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"JMB36X IDE Setup"="C:\Windows\RaidTool\xInsIDE.exe" [2007-03-20 16:36 36864]
"avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 14:28 266497]
"PivotSoftware"="C:\Program Files\Portrait Displays\Pivot Software\wpctrl.exe" [2007-02-09 12:17 694008]
"DT HPW"="C:\Program Files\Common Files\Portrait Displays\Shared\DT_startup.exe" [2008-07-14 13:42 81920]
"Google Desktop Search"="C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" [2008-08-08 22:59 29744]
"AppleSyncNotifier"="C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-07-22 20:42 116040]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-05-27 10:50 413696]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-07-30 10:47 289064]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 04:27 144784]
"P3000x_S2P"="C:\PROGRAM FILES\DELL\DELL LASER MFP 1600N\PSU\ScanToPc.exe" [2004-04-02 12:11 57344]
"PaperPort PTD"="C:\Program Files\DELL\Dell Laser MFP 1600n\PaperPort\pptd40nt.exe" [2004-03-17 15:23 57393]
"IndexSearch"="C:\Program Files\DELL\Dell Laser MFP 1600n\PaperPort\IndexSearch.exe" [2004-03-17 15:44 40960]
"NvSvc"="C:\Windows\system32\nvsvc.dll" [2007-12-11 17:06 86016]
"NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [2007-12-11 17:06 8530464]
"NvMediaCenter"="C:\Windows\system32\NvMcTray.dll" [2007-12-11 17:06 81920]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 02:38 34672]
"RtHDVCpl"="RtHDVCpl.exe" [2007-03-23 21:04 4423680 C:\Windows\RtHDVCpl.exe]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2008-02-29 03:12 76304 C:\Windows\KHALMNPR.Exe]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\
Logitech SetPoint.lnk - C:\Program Files\Logitech\SetPoint\SetPoint.exe [2008-08-14 18:45:08 805392]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"AppMonWeb"= {15AE9D06-AB1D-51B7-576D-00568789334F} - C:\Program Files\oumgazc\AppMonWeb.dll [2008-08-20 15:17 98304]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{1905A6AF-3748-46AC-BF13-6B36F3F3DA1B}"= Disabled:UDP

:\fsetup.exe:AVM FSetup Application
"{DBBEF247-20FB-4426-9652-8631C84A2C14}"= Disabled:TCP

:\fsetup.exe:AVM FSetup Application
"{ED3117F9-8286-444E-AF6C-1D82578BDF72}"= UDP:C:\Program Files\Bonjour\mDNSResponder.exe:Bonjour
"{64A6C2B7-B822-4F34-9654-BB217D9F1A52}"= TCP:C:\Program Files\Bonjour\mDNSResponder.exe:Bonjour
"{5EA0E270-C60B-4B32-B8E7-E9A19162D72E}"= UDP:C:\Program Files\iTunes\iTunes.exe:iTunes
"{19F752A6-827F-48AE-867A-D3A9DC3329FA}"= TCP:C:\Program Files\iTunes\iTunes.exe:iTunes
"TCP Query User{B11B8E49-D74D-4B70-8DDF-464E6F501ADD}C:\\program files\\itunes\\itunes.exe"= UDP:C:\program files\itunes\itunes.exe:iTunes
"UDP Query User{A14D6088-A02F-46D3-8243-AD1D6B0BBDDB}C:\\program files\\itunes\\itunes.exe"= TCP:C:\program files\itunes\itunes.exe:iTunes
"TCP Query User{25103F96-8045-4E44-8A3E-F622B004EF59}C:\\program files\\internet explorer\\iexplore.exe"= UDP:C:\program files\internet explorer\iexplore.exe:Internet Explorer
"UDP Query User{53C42108-9BED-42E2-834B-0689B6F1432C}C:\\program files\\internet explorer\\iexplore.exe"= TCP:C:\program files\internet explorer\iexplore.exe:Internet Explorer
"TCP Query User{B2DFE3ED-7987-4D88-8434-6A01A2BBEDF6}C:\\program files\\mozilla firefox\\firefox.exe"= UDP:C:\program files\mozilla firefox\firefox.exe:Firefox
"UDP Query User{CD4B00E7-258C-427F-8DBE-7CF6418754B5}C:\\program files\\mozilla firefox\\firefox.exe"= TCP:C:\program files\mozilla firefox\firefox.exe:Firefox
"{12F35088-D41F-4D2B-9791-B97DA2E5BF75}"= Disabled:UDP

:\fsetup.exe:AVM FSetup Application
"{D826921B-061C-4263-B8F1-C97563130B20}"= Disabled:TCP

:\fsetup.exe:AVM FSetup Application

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
"EnableFirewall"= 0 (0x0)

R3 AtcL001;NDIS Miniport Driver for Attansic L1 Gigabit Ethernet Controller;C:\Windows\system32\DRIVERS\atl01v32.sys [2007-03-15 16:41]
S3 GoogleDesktopManager-061008-081103;Google Desktop Manager 5.7.806.10245;C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe [2008-08-08 22:59]
S3 HauppaugeTVServer;HauppaugeTVServer;C:\PROGRA~1\WinTV\HCWTVS~1.EXE [2008-06-02 15:55]

*Newly Created Service* - CATCHME
*Newly Created Service* - PROCEXP90
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -

HKLM-Explorer_Run-bQjswuPRKi - C:\Users\Public\Downloads\Downloads\AdobeFlashPlayerHD.exe

.
------- Zusätzlicher Scan -------
.
FireFox -: Profile - C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\cfsgk3be.default\
FireFox -: prefs.js - SEARCH.DEFAULTURL - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.blick.ch/|http://www.ricardo.ch/
FF -: plugin - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll
FF -: plugin - C:\Program Files\Mozilla Firefox\plugins\npGoogleGadgetPluginFirefoxWin.dll
FF -: plugin - C:\Program Files\Opera\program\plugins\npdivx32.dll
FF -: plugin - C:\Program Files\Yahoo!\Common\npyaxmpb.dll
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-22 14:49:25
Windows 6.0.6001 Service Pack 1 NTFS

Scanne versteckte Prozesse...

Scanne versteckte Autostart Einträge...

Scanne versteckte Dateien...

Scan erfolgreich abgeschlossen
versteckte Dateien: 0

**************************************************************************
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------

Prozess: C:\Windows\Explorer.exe
-> C:\Program Files\Portrait Displays\Pivot Software\winphook.dll
.
Zeit der Fertigstellung: 2008-08-22 14:50:48
ComboFix-quarantined-files.txt 2008-08-22 12:50:46

Pre-Run: 12 Verzeichnis(se), 322,013,409,280 Bytes frei
Post-Run: 20 Verzeichnis(se), 321,981,382,656 Bytes frei

253 --- E O F --- 2008-08-20 07:32:17
-

und noch der Virustotal:

Antivirus Version letzte aktualisierung Ergebnis
AhnLab-V3 2008.8.21.0 2008.08.22 -
AntiVir 7.8.1.23 2008.08.22 -
Authentium 5.1.0.4 2008.08.22 -
Avast 4.8.1195.0 2008.08.21 -
AVG 8.0.0.161 2008.08.22 Win32/Heur
BitDefender 7.2 2008.08.22 -
CAT-QuickHeal 9.50 2008.08.21 -
ClamAV 0.93.1 2008.08.22 -
DrWeb 4.44.0.09170 2008.08.22 -
eSafe 7.0.17.0 2008.08.21 -
eTrust-Vet 31.6.6040 2008.08.22 -
Ewido 4.0 2008.08.22 -
F-Prot 4.4.4.56 2008.08.21 -
F-Secure 7.60.13501.0 2008.08.22 -
Fortinet 3.14.0.0 2008.08.22 -
GData 2.0.7306.1023 2008.08.20 -
Ikarus T3.1.1.34.0 2008.08.22 -
K7AntiVirus 7.10.423 2008.08.21 -
Kaspersky 7.0.0.125 2008.08.22 -
McAfee 5367 2008.08.21 -
Microsoft 1.3807 2008.08.22 -
NOD32v2 3380 2008.08.22 -
Norman 5.80.02 2008.08.21 -
Panda 9.0.0.4 2008.08.22 -
PCTools 4.4.2.0 2008.08.21 -
Prevx1 V2 2008.08.22 -
Rising 20.58.42.00 2008.08.22 -
Sophos 4.32.0 2008.08.22 Mal/EncPk-DG
Sunbelt 3.1.1571.1 2008.08.22 -
Symantec 10 2008.08.22 -
TheHacker 6.3.0.6.058 2008.08.22 -
TrendMicro 8.700.0.1004 2008.08.22 -
VBA32 3.12.8.4 2008.08.21 -
ViRobot 2008.8.22.1346 2008.08.22 -
VirusBuster 4.5.11.0 2008.08.21 -
Webwasher-Gateway 6.6.2 2008.08.22 -

File size: 98304 bytes
MD5...: da349fc21287e4be12c799a921c6c770
SHA1..: 026253dd1ad5578905e7e80cba677c69b6a0ce06
SHA256: b30d8fafa8eaf2785251fb93c47864283c4b061abe98eef53247e92f8140d4b6
SHA512: 209ef4d26e5f5b452d606711604239c25453b0c10ef1b19510eabdf0988514ae
c71da05cc6a63ee1c7b706c34374f92ba0fc20087bf17fcac6ef39278dcfd6b3
PEiD..: -
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x10001246
timedatestamp.....: 0x48ac07f1 (Wed Aug 20 12:02:57 2008)
machinetype.......: 0x14c (I386)

( 4 sections )
name viradd virsiz rawdsiz ntrpy md5
.qdplp 0x1000 0x12f90 0x13000 6.82 1454084187e29d4d9020886e6d3a34b3
.hcyxzc 0x14000 0x692 0x1000 2.73 8e492c5c0b2f47c421b54aa38cb661a5
.gruxc 0x15000 0x1f70 0x1000 0.64 45ae24c9e2cabcd59bb4c286f6108bd3
.reloc 0x17000 0x191e 0x2000 5.98 54c775f4c204ffe7875db8e6bcee6d83

( 4 imports )
> KERNEL32.dll: GetCurrentThreadId, GetModuleHandleW, DuplicateHandle, CreateThread, GetProcAddress, FindFirstFileW, MultiByteToWideChar, WriteFile, CreateProcessW, GetCurrentProcess, LoadLibraryA, WaitForSingleObject, GlobalFree, GlobalDeleteAtom, GetDriveTypeW, SetFilePointer, WideCharToMultiByte, GetTickCount, GlobalAlloc, GetFileAttributesW, GlobalAddAtomW, GetPrivateProfileStringW, FindResourceW
> USER32.dll: RedrawWindow, CreateWindowExW, EndDialog, SetCursor, VkKeyScanW, UpdateWindow, RegisterHotKey, SystemParametersInfoW, SetCursorPos, ReleaseDC, GetWindowDC, LoadImageW, EnableWindow, RegisterWindowMessageW, SetWindowPos
> GDI32.dll: CreateFontIndirectW, SetMapMode, DeleteDC, StretchBlt, CreateCompatibleBitmap, DPtoLP, SelectObject
> ADVAPI32.dll: LookupAccountSidW, LookupPrivilegeValueW, GetUserNameW, RegDeleteValueW, RegQueryValueExW, RegOpenKeyExW, RegCloseKey

( 4 exports )
DllCanUnloadNow, DllGetClassObject, DllRegisterServer, DllUnregisterServer

**Sunny** · 22.08.2008, 14:12

Dateien Online überprüfen lassen:

Als erstes versteckte Dateien anzeigen lassen! (nur Punkt 1 durchführen!)

Suche die Seite Virtustotal auf, klicke auf den Button „Durchsuchen“ und suche folgende Datei/Dateien:

Code:

ATTFilter

C:\Program Files\Portrait Displays\Pivot Software\winphook.dll (kennst du dieses Programm?)

Lade nun nacheinander jede/alle Datei/Dateien hoch, und warte bis der Scan vorbei ist. (kann bis zu 2 Minuten dauern.)

Poste im Anschluss das Ergebnis der Auswertung, alles abkopieren und in einen Beitrag einfügen.

Wichtig: Auch die Größenangabe sowie den HASH mit kopieren!

Scripten mit Combofix

Öffne den Editor ( Start -> Zubehör -> Editor ) kopiere nun folgenden Text in das weiße Feld:

Code:

ATTFilter

Registry::
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"infocomcfg"=-

FILE::
C:\Windows\System32\oruxiboj.exe
C:\Users\user\AppData\Local\Temp\VolumeControlVista[0].exe
C:\Users\Public\Downloads\Downloads\AdobeFlashPlayerHD.exe
C:\Program Files\oumgazc\AppMonWeb.dll

FOLDER::
C:\Program Files\oumgazc

Speichere diese Datei nun auf dem Desktop unter -> cfscript.txt

Nun die Datei cfscript.txt mit der rechten Maustaste auf das Sysmbol von Combofix ziehen!

Danach das Combofix nochmal ausführen, das System neu starten und das Log von Combofix posten

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann

Malwarebytes' Anti-Malware

Lies dir die Entfernungsanleitung durch und lass alles entfernen was gefunden wurde:

Download von Malwarebytes' Anti-Malware

frederic · 22.08.2008, 18:51

Vielen Dank für die nette und schnelle Unterstützung. Es scheint, dass alles behoben werden konnte. Anbei noch die Files:

log.txt

ComboFix 08-08-21.02 - user 2008-08-22 16:21:05.2 - NTFSx86
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1031.18.2207 [GMT 2:00]
ausgeführt von:: C:\Users\user\Desktop\ComboFix.exe
Command switches used :: C:\Users\user\Desktop\cfscript.txt
* Neuer Wiederherstellungspunkt wurde erstellt

FILE ::
C:\Program Files\oumgazc\AppMonWeb.dll
C:\Users\Public\Downloads\Downloads\AdobeFlashPlayerHD.exe
C:\Users\user\AppData\Local\Temp\VolumeControlVista[0].exe
C:\Windows\System32\oruxiboj.exe
.

(((((((((((((((((((((((((((((((((((( Weitere L”schungen ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Program Files\oumgazc
C:\Program Files\oumgazc\AppMonWeb.dll
C:\Users\user\AppData\Local\Temp\VolumeControlVista[0].exe
C:\Windows\System32\oruxiboj.exe

.
((((((((((((((((((((((( Dateien erstellt von 2008-07-22 bis 2008-08-22 ))))))))))))))))))))))))))))))
.

2008-08-21 23:09 . 2008-08-21 23:09 <DIR> d-------- C:\Program Files\Trend Micro
2008-08-21 20:44 . 2008-08-21 20:44 <DIR> d-------- C:\Users\user\AppData\Roaming\Malwarebytes
2008-08-21 20:44 . 2008-08-21 20:44 <DIR> d-------- C:\Users\All Users\Malwarebytes
2008-08-21 20:44 . 2008-08-21 20:44 <DIR> d-------- C:\ProgramData\Malwarebytes
2008-08-21 20:44 . 2008-08-21 23:05 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-08-21 20:44 . 2008-08-17 15:05 38,472 --a------ C:\Windows\System32\drivers\mbamswissarmy.sys
2008-08-21 20:44 . 2008-08-17 15:05 17,144 --a------ C:\Windows\System32\drivers\mbam.sys
2008-08-21 09:15 . 2008-08-21 13:14 <DIR> d-------- C:\Users\user\DoctorWeb
2008-08-21 08:54 . 2008-07-19 07:09 1,811,656 --a------ C:\Windows\System32\wuaueng.dll
2008-08-21 08:54 . 2008-07-19 05:44 1,524,736 --a------ C:\Windows\System32\wucltux.dll
2008-08-21 08:54 . 2008-07-19 07:09 563,912 --a------ C:\Windows\System32\wuapi.dll
2008-08-21 08:54 . 2008-07-18 22:08 163,904 --a------ C:\Windows\System32\wuwebv.dll
2008-08-21 08:54 . 2008-07-19 05:44 83,456 --a------ C:\Windows\System32\wudriver.dll
2008-08-21 08:54 . 2008-07-19 07:10 53,448 --a------ C:\Windows\System32\wuauclt.exe
2008-08-21 08:54 . 2008-07-19 07:10 45,768 --a------ C:\Windows\System32\wups2.dll
2008-08-21 08:54 . 2008-07-19 07:10 36,552 --a------ C:\Windows\System32\wups.dll
2008-08-21 08:54 . 2008-07-18 20:44 31,232 --a------ C:\Windows\System32\wuapp.exe
2008-08-20 15:17 . 2008-08-20 15:17 <DIR> d-------- C:\Users\All Users\udklelqx
2008-08-20 15:17 . 2008-08-20 15:17 <DIR> d-------- C:\Users\All Users\ozmhenif
2008-08-20 15:17 . 2008-08-20 15:17 <DIR> d-------- C:\ProgramData\udklelqx
2008-08-20 15:17 . 2008-08-20 15:17 <DIR> d-------- C:\ProgramData\ozmhenif
2008-08-18 10:23 . 2008-08-18 10:23 <DIR> d-------- C:\Users\user\Documents
2008-08-18 10:14 . 2008-08-18 10:14 <DIR> d-------- C:\Program Files\Yahoo!
2008-08-18 10:14 . 2008-08-18 10:14 <DIR> d-------- C:\Program Files\CCleaner
2008-08-17 15:56 . 2008-08-17 15:57 <DIR> d-------- C:\Users\All Users\Adobe
2008-08-17 15:56 . 2008-08-17 15:57 <DIR> d-------- C:\Program Files\Common Files\Adobe
2008-08-15 23:06 . 2008-08-15 23:06 323,584 --a------ C:\Windows\System32\AUDIOGENIE2.DLL
2008-08-15 23:03 . 2008-08-15 23:03 <DIR> d-------- C:\Temp
2008-08-15 19:40 . 2008-08-15 19:40 <DIR> d-------- C:\Users\user\AppData\Roaming\DivX
2008-08-15 19:38 . 2008-08-15 19:38 <DIR> d-------- C:\Windows\Replay Media Catcher
2008-08-15 19:38 . 2008-08-15 19:38 <DIR> d-------- C:\Windows\Freecorder Toolbar
2008-08-15 19:38 . 2008-08-20 22:58 <DIR> d-------- C:\Program Files\Freecorder
2008-08-15 19:38 . 2008-08-15 19:38 <DIR> d-------- C:\Program Files\Conduit
2008-08-15 19:38 . 2008-08-15 19:38 2,788,800 --a------ C:\Program Files\FLV PlayerFCSetup.exe
2008-08-15 19:36 . 2008-08-15 23:08 <DIR> d-------- C:\Program Files\Replay Media Catcher
2008-08-15 19:36 . 2008-08-15 23:08 <DIR> d-------- C:\Program Files\Replay Converter
2008-08-15 19:36 . 2008-08-15 19:36 8,289,720 --a------ C:\Program Files\FLV PlayerRCATSetup.exe
2008-08-15 19:36 . 2007-03-04 13:55 1,936,528 --a------ C:\Windows\System32\ltmm15.dll
2008-08-15 19:36 . 2008-08-15 19:36 737,280 --a------ C:\Windows\iun6002.exe
2008-08-15 19:36 . 2007-03-04 13:55 135,168 --a------ C:\Windows\System32\DSKernel2.dll
2008-08-15 19:35 . 2008-08-15 19:36 <DIR> d-------- C:\Users\user\AppData\Roaming\GetRightToGo
2008-08-15 19:35 . 2008-08-15 19:35 411,248 --a------ C:\Program Files\FLV PlayerRCSetup.exe
2008-08-15 19:34 . 2008-08-15 19:34 <DIR> d-------- C:\Windows\Applian FLV Player
2008-08-15 19:34 . 2008-08-15 19:34 <DIR> d-------- C:\Program Files\FLV Player
2008-08-15 19:09 . 2008-08-21 20:12 <DIR> d-------- C:\Program Files\Common Files\PX Storage Engine
2008-08-15 19:08 . 2008-08-21 20:13 <DIR> d-------- C:\Program Files\DivX
2008-08-15 16:07 . 2008-08-15 16:07 <DIR> d-------- C:\Windows\Sun
2008-08-14 21:52 . 2008-08-14 21:52 <DIR> d-------- C:\Users\user\AppData\Roaming\Dexpot
2008-08-14 19:16 . 2008-08-14 19:16 <DIR> d-------- C:\Program Files\Common Files\IviSDK
2008-08-14 19:14 . 2008-08-14 19:16 6,247 --a------ C:\Windows\HCWPNP.INI
2008-08-14 18:49 . 2008-08-14 18:49 <DIR> d-------- C:\Users\All Users\LogiShrd
2008-08-14 18:49 . 2008-08-14 18:49 <DIR> d-------- C:\ProgramData\LogiShrd
2008-08-14 18:47 . 2008-08-14 18:47 0 --ah----- C:\Windows\System32\drivers\Msft_Kernel_LMouFilt_01005.Wdf
2008-08-14 18:45 . 2008-05-02 02:38 301,656 --a------ C:\Windows\System32\BtCoreIf.dll
2008-08-14 18:45 . 2008-05-02 02:39 170,512 --a------ C:\Windows\System32\kemutb.dll
2008-08-14 18:45 . 2008-05-02 02:39 145,936 --a------ C:\Windows\System32\KemUtil.dll
2008-08-14 18:45 . 2008-05-02 02:40 117,264 --a------ C:\Windows\System32\KemWnd.dll
2008-08-14 18:45 . 2008-05-02 02:40 84,496 --a------ C:\Windows\System32\KemXML.dll
2008-08-14 18:44 . 2008-08-14 18:44 <DIR> d-------- C:\Users\user\AppData\Roaming\InstallShield
2008-08-14 18:44 . 2008-08-14 18:44 <DIR> d-------- C:\Program Files\Logitech
2008-08-14 18:44 . 2008-08-14 18:45 <DIR> d-------- C:\Program Files\Common Files\Logishrd
2008-08-14 15:51 . 2008-07-16 03:32 2,048 --a------ C:\Windows\System32\tzres.dll
2008-08-14 15:19 . 2008-06-19 05:31 361,984 --a------ C:\Windows\System32\IPSECSVC.DLL
2008-08-14 15:13 . 2008-06-27 03:55 1,383,424 --a------ C:\Windows\System32\mshtml.tlb
2008-08-14 15:13 . 2008-06-27 06:15 827,392 --a------ C:\Windows\System32\wininet.dll
2008-08-14 15:13 . 2008-04-18 07:48 269,312 --a------ C:\Windows\System32\es.dll
2008-08-14 15:07 . 2008-04-10 07:12 738,304 --a------ C:\Windows\System32\inetcomm.dll
2008-08-10 09:59 . 2008-08-10 09:59 <DIR> dr------- C:\Users\user\Contacts
2008-08-10 09:50 . 2008-08-10 09:50 <DIR> d-------- C:\PerfLogs
2008-08-10 09:06 . 2008-01-19 09:33 8,139,264 --a------ C:\Windows\System32\ssBranded.scr
2008-08-10 09:05 . 2008-01-19 08:06 8,147,456 --a------ C:\Windows\System32\wmploc.DLL
2008-08-09 17:09 . 2008-08-09 17:09 <DIR> d-------- C:\Users\All Users\ScanSoft
2008-08-09 17:09 . 2008-08-09 17:09 <DIR> d-------- C:\ProgramData\ScanSoft
2008-08-09 17:09 . 2008-08-09 17:09 <DIR> d-------- C:\Program Files\Common Files\ScanSoft Shared
2008-08-09 17:09 . 2003-09-24 10:37 27,114 --a------ C:\Windows\maxlink.ini
2008-08-09 17:08 . 2008-08-09 17:08 <DIR> d-------- C:\Program Files\Common Files\SWF Studio
2008-08-09 17:08 . 2001-03-19 03:52 766 --a------ C:\Windows\Uninstall.ico
2008-08-09 17:07 . 2004-04-16 09:42 73,728 --------- C:\Windows\wiainst.exe
2008-08-09 17:07 . 2004-03-11 09:04 24,576 --------- C:\Windows\SvcCon.exe
2008-08-09 17:05 . 2004-03-23 10:10 13,227 --a------ C:\Windows\System32\DelR1LMK.DLL
2008-08-09 17:04 . 2004-04-01 15:39 151,552 --a------ C:\Windows\System32\VdSetup.Exe
2008-08-09 17:04 . 2004-03-05 13:59 53,248 --a------ C:\Windows\System32\VdSetup.dll
2008-08-09 17:04 . 2004-02-04 07:24 49,152 --a------ C:\Windows\System32\ssusbpn.dll
2008-08-09 17:02 . 2008-08-09 17:02 <DIR> d-------- C:\Program Files\DELL
2008-08-09 17:01 . 2004-03-23 12:13 65,536 --a------ C:\Windows\System32\ssdevm.dll
2008-08-09 15:08 . 2008-08-14 19:15 <DIR> d-------- C:\Program Files\WinTV
2008-08-09 11:37 . 2008-08-09 11:37 <DIR> d-------- C:\Program Files\Opera
2008-08-09 11:37 . 2008-08-09 11:37 <DIR> d-------- C:\Program Files\DVDVideoSoft
2008-08-09 11:37 . 2008-08-09 11:37 <DIR> d-------- C:\Program Files\Common Files\DVDVideoSoft
2008-08-09 11:37 . 2002-01-05 14:37 344,064 --a------ C:\Windows\System32\msvcr70.dll
2008-08-09 11:36 . 2008-08-09 11:36 <DIR> d-------- C:\Program Files\Java
2008-08-09 11:35 . 2008-08-09 11:35 <DIR> d-------- C:\Program Files\Common Files\Java
2008-08-09 11:33 . 2008-08-09 11:34 <DIR> d-------- C:\Program Files\LimeWire
2008-08-09 11:08 . 2008-08-09 11:08 <DIR> d-------- C:\Users\user\AppData\Roaming\Logitech
2008-08-09 11:08 . 2008-08-14 18:44 <DIR> d-------- C:\Users\All Users\Logitech
2008-08-09 11:08 . 2008-08-14 18:44 <DIR> d-------- C:\ProgramData\Logitech
2008-08-09 10:43 . 2008-08-09 10:43 <DIR> d-------- C:\Hauppauge
2008-08-09 10:43 . 2005-11-02 19:20 376,836 --a------ C:\Windows\System32\drivers\HcwFalcn.rom
2008-08-09 10:43 . 2007-02-06 15:27 185,728 --a------ C:\Windows\System32\drivers\hcwPP2.sys
2008-08-09 10:43 . 2006-09-08 14:40 139,264 --a------ C:\Windows\System32\hcwECPPP.ax
2008-08-09 10:43 . 2007-02-06 15:26 99,840 --a------ C:\Windows\System32\hcwCCnv2.ax
2008-08-09 10:43 . 2006-09-08 14:40 96,256 --a------ C:\Windows\System32\hcwCP.ax
2008-08-09 10:43 . 2007-02-06 15:26 95,232 --a------ C:\Windows\System32\hcwPrxA2.ax
2008-08-09 10:43 . 2006-07-21 16:50 66,048 --a------ C:\Windows\System32\hcwXDS.dll
2008-08-09 10:43 . 2007-01-15 09:43 16,382 --a------ C:\Windows\System32\drivers\HcwMakoC.rom
2008-08-09 10:43 . 2007-02-06 15:37 16,382 --a------ C:\Windows\System32\drivers\HcwMakoB.rom
2008-08-09 10:37 . 2008-08-09 11:03 <DIR> d-------- C:\Program Files\TWIXTEL
2008-08-09 09:06 . 2008-08-09 11:07 <DIR> d-------- C:\Windows\System32\Macromed
2008-08-09 09:01 . 2008-08-09 09:01 0 --------- C:\Windows\nsreg.dat
2008-08-08 23:41 . 2008-08-08 23:41 <DIR> d-------- C:\Program Files\Picasa2
2008-08-08 23:41 . 2006-10-05 04:42 2,560 --------- C:\Windows\System32\drivers\cdralw2k.sys
2008-08-08 23:41 . 2006-10-05 04:42 2,432 --------- C:\Windows\System32\drivers\cdr4_xp.sys
2008-08-08 23:14 . 2008-08-08 23:18 <DIR> d-------- C:\Users\user\AppData\Roaming\Apple Computer
2008-08-08 23:14 . 2008-08-08 23:14 <DIR> d-------- C:\Program Files\iTunes
2008-08-08 23:14 . 2008-08-08 23:14 <DIR> d-------- C:\Program Files\iPod
2008-08-08 23:13 . 2008-08-08 23:14 <DIR> d-------- C:\Users\All Users\Apple Computer
2008-08-08 23:13 . 2008-08-08 23:14 <DIR> d-------- C:\ProgramData\Apple Computer
2008-08-08 23:13 . 2008-08-08 23:13 <DIR> d-------- C:\Program Files\QuickTime
2008-08-08 23:12 . 2008-08-08 23:12 <DIR> d-------- C:\Users\All Users\Apple
2008-08-08 23:12 . 2008-08-08 23:12 <DIR> d-------- C:\ProgramData\Apple
2008-08-08 23:12 . 2008-08-08 23:12 <DIR> d-------- C:\Program Files\Common Files\Apple
2008-08-08 23:12 . 2008-08-08 23:12 <DIR> d-------- C:\Program Files\Apple Software Update
2008-08-08 22:59 . 2008-08-08 23:41 <DIR> d-------- C:\Program Files\Google
2008-08-08 21:29 . 2008-08-08 21:29 <DIR> d-------- C:\Users\user\AppData\Roaming\DisplayTune
2008-08-08 21:18 . 2003-06-18 17:31 17,920 --a------ C:\Windows\System32\mdimon.dll

.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-14 13:50 --------- d-----w C:\Program Files\Windows Mail
2008-08-10 07:59 174 --sha-w C:\Program Files\desktop.ini
2008-08-10 07:52 --------- d-----w C:\Program Files\Windows Sidebar
2008-08-10 07:52 --------- d-----w C:\Program Files\Windows Photo Gallery
2008-08-10 07:52 --------- d-----w C:\Program Files\Windows Journal
2008-08-10 07:52 --------- d-----w C:\Program Files\Windows Defender
2008-08-10 07:52 --------- d-----w C:\Program Files\Windows Collaboration
2008-08-10 07:52 --------- d-----w C:\Program Files\Windows Calendar
2008-08-08 17:09 540,672 ----a-w C:\Windows\AppPatch\AcLayers.dll
2008-08-08 17:09 458,752 ----a-w C:\Windows\AppPatch\AcSpecfc.dll
2008-08-08 17:09 2,560 ----a-w C:\Windows\AppPatch\AcRes.dll
2008-08-08 17:09 2,153,984 ----a-w C:\Windows\AppPatch\AcGenral.dll
2008-08-08 17:09 173,056 ----a-w C:\Windows\AppPatch\AcXtrnal.dll
2008-08-07 12:30 319,456 ------w C:\Windows\DIFxAPI.dll
2008-08-07 12:30 315,392 ------w C:\Windows\HideWin.exe
2008-08-07 12:20 --------- d-sh--w C:\ProgramData\Vorlagen
2008-08-07 12:20 --------- d-sh--w C:\ProgramData\Startmenü
2008-08-07 12:20 --------- d-sh--w C:\ProgramData\Favoriten
2008-08-07 12:20 --------- d-sh--w C:\ProgramData\Dokumente
2008-08-07 12:20 --------- d-sh--w C:\ProgramData\Anwendungsdaten
2008-08-07 12:20 --------- d-sh--w C:\Program Files\Gemeinsame Dateien
.

((((((((((((((((((((((((((((( snapshot@2008-08-22_14.50.06.59 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-08-22 10:28:08 262,144 --sha-w C:\Windows\ServiceProfiles\LocalService\NTUSER.DAT
+ 2008-08-22 14:24:12 262,144 --sha-w C:\Windows\ServiceProfiles\LocalService\NTUSER.DAT
- 2008-08-22 11:04:57 262,144 --sha-w C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT
+ 2008-08-22 14:24:11 262,144 --sha-w C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT
+ 2008-08-22 14:24:11 262,144 ---ha-w C:\Windows\ServiceProfiles\NetworkService\ntuser.dat.LOG1
- 2008-08-22 12:43:25 16,384 --sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2008-08-22 12:52:13 16,384 --sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2008-08-22 12:43:25 32,768 --sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2008-08-22 12:52:13 32,768 --sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2008-08-22 12:43:25 16,384 --sha-w C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2008-08-22 12:52:13 16,384 --sha-w C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2008-08-21 20:28:46 255,032 ----a-w C:\Windows\System32\WDI\SuspendPerformanceDiagnostics_SystemData_FastS4.bin
+ 2008-08-22 14:09:14 255,480 ----a-w C:\Windows\System32\WDI\SuspendPerformanceDiagnostics_SystemData_FastS4.bin
.
(((((((((((((((((((((((((((( Autostart Punkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Eintrage & legitime Standardeintrage werden nicht angezeigt.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray.exe"="C:\Windows\ehome\ehTray.exe" [2008-01-19 09:33 125952]
"Picasa Media Detector"="C:\Program Files\Picasa2\PicasaMediaDetector.exe" [2008-02-26 03:23 443968]
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 09:33 202240]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"JMB36X IDE Setup"="C:\Windows\RaidTool\xInsIDE.exe" [2007-03-20 16:36 36864]
"avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 14:28 266497]
"PivotSoftware"="C:\Program Files\Portrait Displays\Pivot Software\wpctrl.exe" [2007-02-09 12:17 694008]
"DT HPW"="C:\Program Files\Common Files\Portrait Displays\Shared\DT_startup.exe" [2008-07-14 13:42 81920]
"Google Desktop Search"="C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" [2008-08-08 22:59 29744]
"AppleSyncNotifier"="C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-07-22 20:42 116040]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-05-27 10:50 413696]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-07-30 10:47 289064]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 04:27 144784]
"P3000x_S2P"="C:\PROGRAM FILES\DELL\DELL LASER MFP 1600N\PSU\ScanToPc.exe" [2004-04-02 12:11 57344]
"PaperPort PTD"="C:\Program Files\DELL\Dell Laser MFP 1600n\PaperPort\pptd40nt.exe" [2004-03-17 15:23 57393]
"IndexSearch"="C:\Program Files\DELL\Dell Laser MFP 1600n\PaperPort\IndexSearch.exe" [2004-03-17 15:44 40960]
"NvSvc"="C:\Windows\system32\nvsvc.dll" [2007-12-11 17:06 86016]
"NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [2007-12-11 17:06 8530464]
"NvMediaCenter"="C:\Windows\system32\NvMcTray.dll" [2007-12-11 17:06 81920]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 02:38 34672]
"RtHDVCpl"="RtHDVCpl.exe" [2007-03-23 21:04 4423680 C:\Windows\RtHDVCpl.exe]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2008-02-29 03:12 76304 C:\Windows\KHALMNPR.Exe]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\
Logitech SetPoint.lnk - C:\Program Files\Logitech\SetPoint\SetPoint.exe [2008-08-14 18:45:08 805392]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{1905A6AF-3748-46AC-BF13-6B36F3F3DA1B}"= Disabled:UDP

:\fsetup.exe:AVM FSetup Application
"{DBBEF247-20FB-4426-9652-8631C84A2C14}"= Disabled:TCP

:\fsetup.exe:AVM FSetup Application
"{ED3117F9-8286-444E-AF6C-1D82578BDF72}"= UDP:C:\Program Files\Bonjour\mDNSResponder.exe:Bonjour
"{64A6C2B7-B822-4F34-9654-BB217D9F1A52}"= TCP:C:\Program Files\Bonjour\mDNSResponder.exe:Bonjour
"{5EA0E270-C60B-4B32-B8E7-E9A19162D72E}"= UDP:C:\Program Files\iTunes\iTunes.exe:iTunes
"{19F752A6-827F-48AE-867A-D3A9DC3329FA}"= TCP:C:\Program Files\iTunes\iTunes.exe:iTunes
"TCP Query User{B11B8E49-D74D-4B70-8DDF-464E6F501ADD}C:\\program files\\itunes\\itunes.exe"= UDP:C:\program files\itunes\itunes.exe:iTunes
"UDP Query User{A14D6088-A02F-46D3-8243-AD1D6B0BBDDB}C:\\program files\\itunes\\itunes.exe"= TCP:C:\program files\itunes\itunes.exe:iTunes
"TCP Query User{25103F96-8045-4E44-8A3E-F622B004EF59}C:\\program files\\internet explorer\\iexplore.exe"= UDP:C:\program files\internet explorer\iexplore.exe:Internet Explorer
"UDP Query User{53C42108-9BED-42E2-834B-0689B6F1432C}C:\\program files\\internet explorer\\iexplore.exe"= TCP:C:\program files\internet explorer\iexplore.exe:Internet Explorer
"TCP Query User{B2DFE3ED-7987-4D88-8434-6A01A2BBEDF6}C:\\program files\\mozilla firefox\\firefox.exe"= UDP:C:\program files\mozilla firefox\firefox.exe:Firefox
"UDP Query User{CD4B00E7-258C-427F-8DBE-7CF6418754B5}C:\\program files\\mozilla firefox\\firefox.exe"= TCP:C:\program files\mozilla firefox\firefox.exe:Firefox
"{12F35088-D41F-4D2B-9791-B97DA2E5BF75}"= Disabled:UDP

:\fsetup.exe:AVM FSetup Application
"{D826921B-061C-4263-B8F1-C97563130B20}"= Disabled:TCP

:\fsetup.exe:AVM FSetup Application

R3 AtcL001;NDIS Miniport Driver for Attansic L1 Gigabit Ethernet Controller;C:\Windows\system32\DRIVERS\atl01v32.sys [2007-03-15 16:41]
S3 GoogleDesktopManager-061008-081103;Google Desktop Manager 5.7.806.10245;C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe [2008-08-08 22:59]
S3 HauppaugeTVServer;HauppaugeTVServer;C:\PROGRA~1\WinTV\HCWTVS~1.EXE [2008-06-02 15:55]
.
- - - - Entfernte verwaiste Registrierungseintr„ge - - - -

SSODL-AppMonWeb-{15AE9D06-AB1D-51B7-576D-00568789334F} - C:\Program Files\oumgazc\AppMonWeb.dll

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-22 16:24:14
Windows 6.0.6001 Service Pack 1 NTFS

Scanne versteckte Prozesse...

Scanne versteckte Autostart Eintr„ge...

Scanne versteckte Dateien...

Scan erfolgreich abgeschlossen
versteckte Dateien: 0

**************************************************************************
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------

Prozess: C:\Windows\Explorer.exe
-> C:\Program Files\Portrait Displays\Pivot Software\winphook.dll
.
------------------------ Weitere, laufende Prozesse ------------------------
.
C:\Windows\System32\audiodg.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Windows\System32\conime.exe
C:\Program Files\Portrait Displays\Pivot Software\Floater.exe
C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Common Files\Portrait Displays\Shared\DTSRVC.exe
C:\Windows\System32\WUDFHost.exe
C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\ehome\ehsched.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Windows\ehome\ehrecvr.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2008-08-22 16:27:56 - PC wurde neu gestartet
ComboFix-quarantined-files.txt 2008-08-22 14:27:48
ComboFix2.txt 2008-08-22 12:50:49

Pre-Run: 12 Verzeichnis(se), 320,355,610,624 Bytes frei
Post-Run: 20 Verzeichnis(se), 320,723,619,840 Bytes frei

283 --- E O F --- 2008-08-20 07:32:17

und das mbam-lof file

Malwarebytes' Anti-Malware 1.25
Datenbank Version: 1076
Windows 6.0.6001 Service Pack 1

19:44:19 22.08.2008
mbam-log-08-22-2008 (19-44-19).txt

Scan-Methode: Vollständiger Scan (C:\|F:\|)
Durchsuchte Objekte: 112533
Laufzeit: 55 minute(s), 46 second(s)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)

**Sunny** · 22.08.2008, 19:06

Es sind immer noch verschiedene schädliche Ordner vorhanden, daher noch ein Script:

Scripten mit Combofix

Öffne den Editor ( Start -> Zubehör -> Editor ) kopiere nun folgenden Text in das weiße Feld:

Code:

ATTFilter

FOLDER::
C:\Users\All Users\udklelqx
C:\Users\All Users\ozmhenif
C:\ProgramData\udklelqx
C:\ProgramData\ozmhenif

Speichere diese Datei nun auf dem Desktop unter -> cfscript.txt

Nun die Datei cfscript.txt mit der rechten Maustaste auf das Sysmbol von Combofix ziehen!

Danach das Combofix nochmal ausführen, das System neu starten und das Log von Combofix posten

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann

Combofix Deinstallieren

Klick auf Start -> Ausführen -> eintippen combofix /U

Damit ist Combofix und alle weiteren Programme entfernt wurden.

Dann sollte eigentlich alles wieder im Lot sein...

frederic · 23.08.2008, 09:43

so, habe alles gemacht. super service, vielen Dank und hier nochmals das letzte log.txt:

ComboFix 08-08-21.02 - user 2008-08-23 10:30:44.3 - NTFSx86
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1031.18.1984 [GMT 2:00]
ausgeführt von:: C:\Users\user\Desktop\ComboFix.exe
Command switches used :: C:\Users\user\Desktop\cfscript.txt
* Neuer Wiederherstellungspunkt wurde erstellt
.

(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\ProgramData\ozmhenif
C:\ProgramData\udklelqx

.
((((((((((((((((((((((( Dateien erstellt von 2008-07-23 bis 2008-08-23 ))))))))))))))))))))))))))))))
.

Keine neuen Dateien erstellt in diesem Zeitraum

.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-15 17:36 8,289,720 ----a-w C:\Program Files\FLV PlayerRCATSetup.exe
2008-08-15 17:36 737,280 ----a-w C:\Windows\iun6002.exe
2008-08-15 17:36 --------- d-----w C:\Users\user\AppData\Roaming\GetRightToGo
2008-08-15 17:35 411,248 ----a-w C:\Program Files\FLV PlayerRCSetup.exe
2008-08-15 17:34 --------- d-----w C:\Program Files\FLV Player
2008-08-14 19:52 --------- d-----w C:\Users\user\AppData\Roaming\Dexpot
2008-08-14 17:16 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-08-14 17:16 --------- d-----w C:\Program Files\Common Files\IviSDK
2008-08-14 17:15 --------- d-----w C:\Program Files\WinTV
2008-08-14 16:49 --------- d-----w C:\ProgramData\LogiShrd
2008-08-14 16:47 0 ---ha-w C:\Windows\system32\drivers\Msft_Kernel_LMouFilt_01005.Wdf
2008-08-14 16:45 --------- d-----w C:\Program Files\Common Files\Logishrd
2008-08-14 16:44 --------- d-----w C:\Users\user\AppData\Roaming\InstallShield
2008-08-14 16:44 --------- d-----w C:\ProgramData\Logitech
2008-08-14 16:44 --------- d-----w C:\Program Files\Logitech
2008-08-14 13:50 --------- d-----w C:\Program Files\Windows Mail
2008-08-10 08:00 --------- d-----w C:\ProgramData\NVIDIA
2008-08-10 07:59 174 --sha-w C:\Program Files\desktop.ini
2008-08-10 07:52 --------- d-----w C:\Program Files\Windows Sidebar
2008-08-10 07:52 --------- d-----w C:\Program Files\Windows Photo Gallery
2008-08-10 07:52 --------- d-----w C:\Program Files\Windows Journal
2008-08-08 21:12 --------- d-----w C:\ProgramData\Apple
2008-08-08 21:12 --------- d-----w C:\Program Files\Common Files\Apple
2008-08-08 21:12 --------- d-----w C:\Program Files\Apple Software Update
2008-08-08 19:29 --------- d-----w C:\Users\user\AppData\Roaming\DisplayTune
2008-08-08 19:17 --------- d-----w C:\Program Files\Microsoft.NET
2008-08-08 18:46 --------- d-----w C:\Program Files\MozBackup
2008-08-08 18:45 --------- d-----w C:\Program Files\Portrait Displays
2008-08-08 18:45 --------- d-----w C:\Program Files\Common Files\Portrait Displays
2008-08-08 18:37 --------- d-----w C:\ProgramData\Avira
2008-08-08 18:37 --------- d-----w C:\Program Files\Avira
2008-08-08 18:33 --------- d-----w C:\Program Files\FRITZ!BoxPrint
2008-08-08 18:33 --------- d-----w C:\Program Files\FRITZ!Box
2008-08-08 17:15 988,216 ----a-w C:\Windows\System32\winload.exe
2008-08-08 17:15 927,288 ----a-w C:\Windows\System32\winresume.exe
2008-08-08 17:15 615,992 ----a-w C:\Windows\System32\ci.dll
2008-08-08 17:15 6,656 ----a-w C:\Windows\System32\kbd106n.dll
2008-08-08 17:15 46,592 ----a-w C:\Windows\System32\setbcdlocale.dll
2008-08-08 17:15 40,960 ----a-w C:\Windows\System32\srclient.dll
2008-08-08 17:15 378,368 ----a-w C:\Windows\System32\srcore.dll
2008-08-08 17:15 318,464 ----a-w C:\Windows\System32\rstrui.exe
2008-08-08 17:15 19,000 ----a-w C:\Windows\System32\kd1394.dll
2008-08-08 17:15 14,848 ----a-w C:\Windows\System32\srdelayed.exe
2008-08-08 17:14 2,032,128 ----a-w C:\Windows\System32\win32k.sys
2008-08-08 17:13 295,936 ----a-w C:\Windows\System32\gdi32.dll
2008-08-08 17:10 14,848 ----a-w C:\Windows\System32\wshrm.dll
2008-08-08 17:10 113,664 ----a-w C:\Windows\system32\drivers\rmcast.sys
2008-08-08 17:09 540,672 ----a-w C:\Windows\AppPatch\AcLayers.dll
2008-08-08 17:09 458,752 ----a-w C:\Windows\AppPatch\AcSpecfc.dll
2008-08-08 17:09 4,240,384 ----a-w C:\Windows\System32\GameUXLegacyGDFs.dll
2008-08-08 17:09 2,560 ----a-w C:\Windows\AppPatch\AcRes.dll
2008-08-08 17:09 2,153,984 ----a-w C:\Windows\AppPatch\AcGenral.dll
2008-08-08 17:09 173,056 ----a-w C:\Windows\AppPatch\AcXtrnal.dll
2008-08-08 17:09 1,695,744 ----a-w C:\Windows\System32\gameux.dll
2008-08-08 17:05 1,314,816 ----a-w C:\Windows\System32\quartz.dll
2008-08-08 17:04 428,544 ----a-w C:\Windows\System32\EncDec.dll
2008-08-08 17:04 293,376 ----a-w C:\Windows\System32\psisdecd.dll
.

((((((((((((((((((((((((((((( snapshot@2008-08-22_14.50.06.59 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-08-23 08:30:34 6,230,016 ----a-w C:\Windows\erdnt\Hiv-backup\SCHEMA.DAT
- 2008-08-22 10:26:25 2,048 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2008-08-23 08:15:20 2,048 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
- 2008-08-22 10:26:25 2,048 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2008-08-23 08:15:20 2,048 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2008-08-22 14:40:38 16,384 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2008-08-22 14:40:38 32,768 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2008-08-22 14:40:38 16,384 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2008-08-22 10:28:08 262,144 --sha-w C:\Windows\ServiceProfiles\LocalService\NTUSER.DAT
+ 2008-08-23 08:16:11 262,144 --sha-w C:\Windows\ServiceProfiles\LocalService\NTUSER.DAT
+ 2008-08-23 08:16:11 262,144 ---ha-w C:\Windows\ServiceProfiles\LocalService\ntuser.dat.LOG1
- 2008-08-14 13:42:57 2,674,565 -c--a-w C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareLicensing\tokens.dat
+ 2008-08-23 08:16:00 2,674,565 -c--a-w C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareLicensing\tokens.dat
- 2008-08-22 11:04:57 262,144 --sha-w C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT
+ 2008-08-23 08:16:33 262,144 --sha-w C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT
+ 2008-08-23 08:16:33 262,144 ---ha-w C:\Windows\ServiceProfiles\NetworkService\ntuser.dat.LOG1
- 2008-01-19 07:34:37 1,671,168 ----a-w C:\Windows\System32\chsbrkr.dll
+ 2008-05-27 05:17:13 1,671,680 ----a-w C:\Windows\System32\chsbrkr.dll
- 2008-01-19 07:34:40 6,103,040 ----a-w C:\Windows\System32\chtbrkr.dll
+ 2008-05-27 05:17:16 6,103,040 ----a-w C:\Windows\System32\chtbrkr.dll
- 2008-08-22 12:43:25 16,384 --sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2008-08-23 08:25:41 16,384 --sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2008-08-22 12:43:25 32,768 --sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2008-08-23 08:25:41 32,768 --sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2008-08-22 12:43:25 16,384 --sha-w C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2008-08-23 08:25:41 16,384 --sha-w C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2008-01-19 07:34:42 42,496 ----a-w C:\Windows\System32\korwbrkr.dll
+ 2008-05-27 05:17:16 143,872 ----a-w C:\Windows\System32\korwbrkr.dll
- 2008-01-19 07:34:49 35,328 ----a-w C:\Windows\System32\mimefilt.dll
+ 2008-05-27 05:18:32 40,448 ----a-w C:\Windows\System32\mimefilt.dll
- 2008-01-19 07:35:12 23,552 ----a-w C:\Windows\System32\msscb.dll
+ 2008-05-27 05:17:42 34,816 ----a-w C:\Windows\System32\msscb.dll
- 2008-01-19 07:35:12 51,200 ----a-w C:\Windows\System32\msscntrs.dll
+ 2008-05-27 05:17:25 60,416 ----a-w C:\Windows\System32\msscntrs.dll
+ 2008-05-27 05:17:36 11,776 ----a-w C:\Windows\System32\msshooks.dll
- 2008-01-19 07:35:13 248,832 ----a-w C:\Windows\System32\msshsq.dll
+ 2008-05-27 05:18:32 231,936 ----a-w C:\Windows\System32\msshsq.dll
- 2008-01-19 07:35:13 98,304 ----a-w C:\Windows\System32\mssitlb.dll
+ 2008-05-27 05:17:25 87,552 ----a-w C:\Windows\System32\mssitlb.dll
- 2008-01-19 07:35:13 333,824 ----a-w C:\Windows\System32\mssph.dll
+ 2008-05-27 05:18:25 350,208 ----a-w C:\Windows\System32\mssph.dll
- 2008-01-19 07:35:13 167,936 ----a-w C:\Windows\System32\mssphtb.dll
+ 2008-05-27 05:18:55 203,776 ----a-w C:\Windows\System32\mssphtb.dll
- 2008-01-19 07:35:13 32,256 ----a-w C:\Windows\System32\mssprxy.dll
+ 2008-05-27 05:17:26 32,768 ----a-w C:\Windows\System32\mssprxy.dll
- 2008-01-19 07:36:08 1,400,832 ----a-w C:\Windows\System32\mssrch.dll
+ 2008-05-27 05:21:24 1,418,240 ----a-w C:\Windows\System32\mssrch.dll
- 2008-01-19 07:35:13 52,224 ----a-w C:\Windows\System32\msstrc.dll
+ 2008-05-27 05:18:40 44,032 ----a-w C:\Windows\System32\msstrc.dll
- 2008-01-19 07:35:13 1,696,768 ----a-w C:\Windows\System32\mssvp.dll
+ 2008-05-27 05:18:56 670,208 ----a-w C:\Windows\System32\mssvp.dll
- 2008-01-19 07:35:38 122,368 ----a-w C:\Windows\System32\nlhtml.dll
+ 2008-05-27 05:18:30 136,704 ----a-w C:\Windows\System32\nlhtml.dll
- 2008-01-19 07:36:00 194,560 ----a-w C:\Windows\System32\offfilt.dll
+ 2008-05-27 05:17:23 194,560 ----a-w C:\Windows\System32\offfilt.dll
- 2008-08-15 07:42:26 123,460 ----a-w C:\Windows\System32\perfc007.dat
+ 2008-08-23 08:15:40 123,460 ----a-w C:\Windows\System32\perfc007.dat
- 2008-08-15 07:42:26 621,692 ----a-w C:\Windows\System32\perfh007.dat
+ 2008-08-23 08:15:40 621,704 ----a-w C:\Windows\System32\perfh007.dat
- 2008-01-19 07:36:11 65,536 ----a-w C:\Windows\System32\propdefs.dll
+ 2008-05-27 05:18:06 71,680 ----a-w C:\Windows\System32\propdefs.dll
- 2008-01-19 07:36:11 750,080 ----a-w C:\Windows\System32\propsys.dll
+ 2008-05-27 05:17:46 754,176 ----a-w C:\Windows\System32\propsys.dll
- 2008-01-19 07:36:17 26,624 ----a-w C:\Windows\System32\rtffilt.dll
+ 2008-05-27 05:18:30 38,400 ----a-w C:\Windows\System32\rtffilt.dll
- 2008-01-19 07:33:28 76,800 ----a-w C:\Windows\System32\SearchFilterHost.exe
+ 2008-05-27 05:17:55 87,552 ----a-w C:\Windows\System32\SearchFilterHost.exe
- 2008-01-19 07:33:28 302,080 ----a-w C:\Windows\System32\SearchIndexer.exe
+ 2008-05-27 05:18:43 439,808 ----a-w C:\Windows\System32\SearchIndexer.exe
- 2008-01-19 07:33:28 179,200 ----a-w C:\Windows\System32\SearchProtocolHost.exe
+ 2008-05-27 05:18:16 184,832 ----a-w C:\Windows\System32\SearchProtocolHost.exe
- 2008-08-21 18:19:11 6,291,456 ----a-w C:\Windows\System32\SMI\Store\Machine\SCHEMA.DAT
+ 2008-08-23 08:15:50 6,291,456 ----a-w C:\Windows\System32\SMI\Store\Machine\SCHEMA.DAT
- 2008-01-19 07:36:35 258,048 ----a-w C:\Windows\System32\srchadmin.dll
+ 2008-05-27 05:17:28 301,568 ----a-w C:\Windows\System32\srchadmin.dll
- 2008-01-19 03:17:42 100,043 ----a-w C:\Windows\System32\StructuredQuerySchema.bin
+ 2008-05-27 04:59:39 106,605 ----a-w C:\Windows\System32\StructuredQuerySchema.bin
- 2006-11-02 06:29:53 18,271 ----a-w C:\Windows\System32\StructuredQuerySchemaTrivial.bin
+ 2008-05-27 04:59:40 18,904 ----a-w C:\Windows\System32\StructuredQuerySchemaTrivial.bin
- 2006-11-02 09:46:13 313,344 ----a-w C:\Windows\System32\thawbrkr.dll
+ 2008-05-27 05:17:16 313,344 ----a-w C:\Windows\System32\thawbrkr.dll
- 2008-01-19 07:36:42 1,505,792 ----a-w C:\Windows\System32\tquery.dll
+ 2008-05-27 05:21:07 1,582,592 ----a-w C:\Windows\System32\tquery.dll
- 2008-08-22 10:28:14 5,590 ----a-w C:\Windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-173415343-4217618928-1528127927-1000_UserData.bin
+ 2008-08-23 08:17:21 6,140 ----a-w C:\Windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-173415343-4217618928-1528127927-1000_UserData.bin
- 2008-08-22 10:28:14 53,376 ----a-w C:\Windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
+ 2008-08-23 08:17:21 53,526 ----a-w C:\Windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
- 2008-08-22 10:28:11 29,564 ----a-w C:\Windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2008-08-23 08:17:17 30,426 ----a-w C:\Windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin
- 2008-08-21 20:28:46 255,032 ----a-w C:\Windows\System32\WDI\SuspendPerformanceDiagnostics_SystemData_FastS4.bin
+ 2008-08-22 14:09:14 255,480 ----a-w C:\Windows\System32\WDI\SuspendPerformanceDiagnostics_SystemData_FastS4.bin
- 2008-01-19 07:37:11 27,136 ----a-w C:\Windows\System32\wsepno.dll
+ 2008-05-27 05:18:35 29,184 ----a-w C:\Windows\System32\wsepno.dll
- 2008-01-19 07:37:12 110,592 ----a-w C:\Windows\System32\xmlfilter.dll
+ 2008-05-27 05:18:32 56,320 ----a-w C:\Windows\System32\xmlfilter.dll
- 2008-08-21 06:54:30 114,084,656 ----a-w C:\Windows\winsxs\ManifestCache\6.0.6001.18000_001c50b5_blobs.bin
+ 2008-08-22 18:04:59 114,898,006 ----a-w C:\Windows\winsxs\ManifestCache\6.0.6001.18000_001c50b5_blobs.bin
+ 2008-05-27 05:17:28 301,568 ----a-w C:\Windows\winsxs\x86_desktop_shell-search-srchadmin_31bf3856ad364e35_7.0.6001.16503_none_13fcab3737a334c2\srchadmin.dll
+ 2008-05-27 05:18:30 136,704 ----a-w C:\Windows\winsxs\x86_microsoft-windows-content-filter-html_31bf3856ad364e35_7.0.6001.16503_none_13ff1de93d266b97\nlhtml.dll
+ 2008-05-27 05:18:32 56,320 ----a-w C:\Windows\winsxs\x86_microsoft-windows-content-filter-html_31bf3856ad364e35_7.0.6001.16503_none_13ff1de93d266b97\xmlfilter.dll
+ 2008-05-27 05:18:32 40,448 ----a-w C:\Windows\winsxs\x86_microsoft-windows-content-filter-mime_31bf3856ad364e35_7.0.6001.16503_none_10a358dd3f57c0de\mimefilt.dll
+ 2008-05-27 05:17:23 194,560 ----a-w C:\Windows\winsxs\x86_microsoft-windows-content-filter-office_31bf3856ad364e35_7.0.6001.16503_none_fab3f42bbfadf408\offfilt.dll
+ 2008-05-27 05:18:30 38,400 ----a-w C:\Windows\winsxs\x86_microsoft-windows-content-filter-rtf_31bf3856ad364e35_7.0.6001.16503_none_485964bf76e0570a\rtffilt.dll
+ 2008-05-27 05:17:46 754,176 ----a-w C:\Windows\winsxs\x86_microsoft-windows-propsys_31bf3856ad364e35_7.0.6001.16503_none_f3d11aeeb9526bbb\propsys.dll
+ 2008-05-27 05:18:35 29,184 ----a-w C:\Windows\winsxs\x86_microsoft-windows-search-profilenotify_31bf3856ad364e35_7.0.6001.16503_none_d86cd72c8d3c237e\wsepno.dll
+ 2008-05-27 05:17:16 6,103,040 ----a-w C:\Windows\winsxs\x86_microsoft-windows-w..-chinesetraditional_31bf3856ad364e35_7.0.6001.16503_none_df2000cce0d8c017\chtbrkr.dll
+ 2008-05-27 05:17:16 313,344 ----a-w C:\Windows\winsxs\x86_microsoft-windows-w..breakerstemmer-thai_31bf3856ad364e35_7.0.6001.16503_none_d40428cfc6b6fdf9\thawbrkr.dll
+ 2008-05-27 05:17:16 143,872 ----a-w C:\Windows\winsxs\x86_microsoft-windows-w..eakerstemmer-korean_31bf3856ad364e35_7.0.6001.16503_none_14072d09797cf93d\korwbrkr.dll
+ 2008-05-27 05:17:13 1,671,680 ----a-w C:\Windows\winsxs\x86_microsoft-windows-w..r-chinesesimplified_31bf3856ad364e35_7.0.6001.16503_none_4cbdb704b61543d2\chsbrkr.dll
+ 2008-05-27 05:18:43 13,824 ----a-w C:\Windows\winsxs\x86_windowssearch-wtrservicingsupport_31bf3856ad364e35_7.0.6001.16503_none_163fe74a2171e12e\WSWTRSvc.exe
+ 2008-05-27 05:18:32 231,936 ----a-w C:\Windows\winsxs\x86_windowssearchengine-structuredquery_31bf3856ad364e35_7.0.6001.16503_none_98586419f9103903\msshsq.dll
+ 2008-05-27 04:59:39 106,605 ----a-w C:\Windows\winsxs\x86_windowssearchengine..uredqueryschema.bin_31bf3856ad364e35_7.0.6001.16503_none_88f88929e3c77aa3\StructuredQuerySchema.bin
+ 2008-05-27 04:59:40 18,904 ----a-w C:\Windows\winsxs\x86_windowssearchengine..uredqueryschema.bin_31bf3856ad364e35_7.0.6001.16503_none_88f88929e3c77aa3\StructuredQuerySchemaTrivial.bin
+ 2008-05-27 05:17:42 34,816 ----a-w C:\Windows\winsxs\x86_windowssearchengine_31bf3856ad364e35_7.0.6001.16503_none_3b8c27e8ba3dd3dd\msscb.dll
+ 2008-05-27 05:17:25 60,416 ----a-w C:\Windows\winsxs\x86_windowssearchengine_31bf3856ad364e35_7.0.6001.16503_none_3b8c27e8ba3dd3dd\msscntrs.dll
+ 2008-05-27 05:17:36 11,776 ----a-w C:\Windows\winsxs\x86_windowssearchengine_31bf3856ad364e35_7.0.6001.16503_none_3b8c27e8ba3dd3dd\msshooks.dll
+ 2008-05-27 05:17:25 87,552 ----a-w C:\Windows\winsxs\x86_windowssearchengine_31bf3856ad364e35_7.0.6001.16503_none_3b8c27e8ba3dd3dd\mssitlb.dll
+ 2008-05-27 05:18:25 350,208 ----a-w C:\Windows\winsxs\x86_windowssearchengine_31bf3856ad364e35_7.0.6001.16503_none_3b8c27e8ba3dd3dd\mssph.dll
+ 2008-05-27 05:18:55 203,776 ----a-w C:\Windows\winsxs\x86_windowssearchengine_31bf3856ad364e35_7.0.6001.16503_none_3b8c27e8ba3dd3dd\mssphtb.dll
+ 2008-05-27 05:17:26 32,768 ----a-w C:\Windows\winsxs\x86_windowssearchengine_31bf3856ad364e35_7.0.6001.16503_none_3b8c27e8ba3dd3dd\mssprxy.dll
+ 2008-05-27 05:21:24 1,418,240 ----a-w C:\Windows\winsxs\x86_windowssearchengine_31bf3856ad364e35_7.0.6001.16503_none_3b8c27e8ba3dd3dd\mssrch.dll
+ 2008-05-27 05:18:40 44,032 ----a-w C:\Windows\winsxs\x86_windowssearchengine_31bf3856ad364e35_7.0.6001.16503_none_3b8c27e8ba3dd3dd\msstrc.dll
+ 2008-05-27 05:18:56 670,208 ----a-w C:\Windows\winsxs\x86_windowssearchengine_31bf3856ad364e35_7.0.6001.16503_none_3b8c27e8ba3dd3dd\mssvp.dll
+ 2008-05-27 05:18:06 71,680 ----a-w C:\Windows\winsxs\x86_windowssearchengine_31bf3856ad364e35_7.0.6001.16503_none_3b8c27e8ba3dd3dd\propdefs.dll
+ 2008-05-27 05:17:55 87,552 ----a-w C:\Windows\winsxs\x86_windowssearchengine_31bf3856ad364e35_7.0.6001.16503_none_3b8c27e8ba3dd3dd\SearchFilterHost.exe
+ 2008-05-27 05:18:43 439,808 ----a-w C:\Windows\winsxs\x86_windowssearchengine_31bf3856ad364e35_7.0.6001.16503_none_3b8c27e8ba3dd3dd\SearchIndexer.exe
+ 2008-05-27 05:18:16 184,832 ----a-w C:\Windows\winsxs\x86_windowssearchengine_31bf3856ad364e35_7.0.6001.16503_none_3b8c27e8ba3dd3dd\SearchProtocolHost.exe
+ 2008-05-27 05:21:07 1,582,592 ----a-w C:\Windows\winsxs\x86_windowssearchengine_31bf3856ad364e35_7.0.6001.16503_none_3b8c27e8ba3dd3dd\tquery.dll
.
-- Snapshot reset to current date --
.
(((((((((((((((((((((((((((( Autostart Punkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Eintrage & legitime Standardeintrage werden nicht angezeigt.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray.exe"="C:\Windows\ehome\ehTray.exe" [2008-01-19 09:33 125952]
"Picasa Media Detector"="C:\Program Files\Picasa2\PicasaMediaDetector.exe" [2008-02-26 03:23 443968]
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 09:33 202240]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"JMB36X IDE Setup"="C:\Windows\RaidTool\xInsIDE.exe" [2007-03-20 16:36 36864]
"avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 14:28 266497]
"PivotSoftware"="C:\Program Files\Portrait Displays\Pivot Software\wpctrl.exe" [2007-02-09 12:17 694008]
"DT HPW"="C:\Program Files\Common Files\Portrait Displays\Shared\DT_startup.exe" [2008-07-14 13:42 81920]
"Google Desktop Search"="C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" [2008-08-08 22:59 29744]
"AppleSyncNotifier"="C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-07-22 20:42 116040]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-05-27 10:50 413696]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-07-30 10:47 289064]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 04:27 144784]
"P3000x_S2P"="C:\PROGRAM FILES\DELL\DELL LASER MFP 1600N\PSU\ScanToPc.exe" [2004-04-02 12:11 57344]
"PaperPort PTD"="C:\Program Files\DELL\Dell Laser MFP 1600n\PaperPort\pptd40nt.exe" [2004-03-17 15:23 57393]
"IndexSearch"="C:\Program Files\DELL\Dell Laser MFP 1600n\PaperPort\IndexSearch.exe" [2004-03-17 15:44 40960]
"NvSvc"="C:\Windows\system32\nvsvc.dll" [2007-12-11 17:06 86016]
"NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [2007-12-11 17:06 8530464]
"NvMediaCenter"="C:\Windows\system32\NvMcTray.dll" [2007-12-11 17:06 81920]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 02:38 34672]
"RtHDVCpl"="RtHDVCpl.exe" [2007-03-23 21:04 4423680 C:\Windows\RtHDVCpl.exe]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2008-02-29 03:12 76304 C:\Windows\KHALMNPR.Exe]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\
Logitech SetPoint.lnk - C:\Program Files\Logitech\SetPoint\SetPoint.exe [2008-08-14 18:45:08 805392]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{ED3117F9-8286-444E-AF6C-1D82578BDF72}"= UDP:C:\Program Files\Bonjour\mDNSResponder.exe:Bonjour
"{64A6C2B7-B822-4F34-9654-BB217D9F1A52}"= TCP:C:\Program Files\Bonjour\mDNSResponder.exe:Bonjour
"{5EA0E270-C60B-4B32-B8E7-E9A19162D72E}"= UDP:C:\Program Files\iTunes\iTunes.exe:iTunes
"{19F752A6-827F-48AE-867A-D3A9DC3329FA}"= TCP:C:\Program Files\iTunes\iTunes.exe:iTunes
"TCP Query User{B11B8E49-D74D-4B70-8DDF-464E6F501ADD}C:\\program files\\itunes\\itunes.exe"= UDP:C:\program files\itunes\itunes.exe:iTunes
"UDP Query User{A14D6088-A02F-46D3-8243-AD1D6B0BBDDB}C:\\program files\\itunes\\itunes.exe"= TCP:C:\program files\itunes\itunes.exe:iTunes
"TCP Query User{25103F96-8045-4E44-8A3E-F622B004EF59}C:\\program files\\internet explorer\\iexplore.exe"= UDP:C:\program files\internet explorer\iexplore.exe:Internet Explorer
"UDP Query User{53C42108-9BED-42E2-834B-0689B6F1432C}C:\\program files\\internet explorer\\iexplore.exe"= TCP:C:\program files\internet explorer\iexplore.exe:Internet Explorer
"TCP Query User{B2DFE3ED-7987-4D88-8434-6A01A2BBEDF6}C:\\program files\\mozilla firefox\\firefox.exe"= UDP:C:\program files\mozilla firefox\firefox.exe:Firefox
"UDP Query User{CD4B00E7-258C-427F-8DBE-7CF6418754B5}C:\\program files\\mozilla firefox\\firefox.exe"= TCP:C:\program files\mozilla firefox\firefox.exe:Firefox
"{12F35088-D41F-4D2B-9791-B97DA2E5BF75}"= Disabled:UDP

:\fsetup.exe:AVM FSetup Application
"{D826921B-061C-4263-B8F1-C97563130B20}"= Disabled:TCP

:\fsetup.exe:AVM FSetup Application
"{31A5CDB6-C9C0-4EB7-B31A-12B637DF3DE0}"= Disabled:UDP

:\fsetup.exe:AVM FSetup Application
"{92964E93-034C-41C0-B130-EEC498FE90C0}"= Disabled:TCP

:\fsetup.exe:AVM FSetup Application
"{2BD6088A-CAC1-48FF-B21E-59BAF861CAA7}"= Disabled:UDP:E:\fsetup.exe:AVM FSetup Application
"{3CBD371E-1A43-478E-BDA6-D9C663D194CA}"= Disabled:TCP:E:\fsetup.exe:AVM FSetup Application

R3 AtcL001;NDIS Miniport Driver for Attansic L1 Gigabit Ethernet Controller;C:\Windows\system32\DRIVERS\atl01v32.sys [2007-03-15 16:41]
S3 GoogleDesktopManager-061008-081103;Google Desktop Manager 5.7.806.10245;C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe [2008-08-08 22:59]
S3 HauppaugeTVServer;HauppaugeTVServer;C:\PROGRA~1\WinTV\HCWTVS~1.EXE [2008-06-02 15:55]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4bbb1909-6478-11dd-accc-806e6f6e6963}]
\shell\AutoRun\command - E:\FSetup.exe
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-23 10:33:01
Windows 6.0.6001 Service Pack 1 NTFS

Scanne versteckte Prozesse...

Scanne versteckte Autostart Einträge...

Scanne versteckte Dateien...

Scan erfolgreich abgeschlossen
versteckte Dateien: 0

**************************************************************************
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------

Prozess: C:\Windows\Explorer.exe
-> C:\Program Files\Portrait Displays\Pivot Software\winphook.dll
.
Zeit der Fertigstellung: 2008-08-23 10:34:11
ComboFix-quarantined-files.txt 2008-08-23 08:34:08
ComboFix2.txt 2008-08-22 14:27:57
ComboFix3.txt 2008-08-22 12:50:49

Pre-Run: Das System hat keinen Meldungstext für die Meldungsnummer 0x2379 in der Meldungsdatei Application gefunden.
Post-Run: 20 Verzeichnis(se), 315,196,059,648 Bytes frei

330 --- E O F --- 2008-08-22 18:05:26

Windows Firewall Pop-up Meldung alle 5 Min.

Plagegeister aller Art und deren Bekämpfung: Windows Firewall Pop-up Meldung alle 5 Min.