Agent.rouge/Gen-nullo(exe)

Fipse

ok, hier der combofix log:

ComboFix 10-01-04.01 - Ich 06.01.2010 13:14:33.1.1 - FAT32x86
ausgeführt von:: c:\dokumente und einstellungen\Ich\Desktop\Cofi.exe
.

(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\LOG.TXT
c:\programme\INSTALL.LOG
c:\windows.0\AUTOLNCH.REG
c:\windows.0\system32\i

.
((((((((((((((((((((((( Dateien erstellt von 2009-12-06 bis 2010-01-06 ))))))))))))))))))))))))))))))
.

2010-01-06 11:55 . 2003-01-17 21:33 17408 ----a-w- c:\windows.0\system32\LIST.EXE
2010-01-06 11:46 . 2003-01-17 21:33 17408 ----a-w- c:\windows.0\system32\LIST.EXE.vir
2010-01-05 22:18 . 2009-08-14 15:10 1850752 ------w- c:\windows.0\system32\dllcache\win32k.sys
2010-01-05 22:17 . 2009-09-11 14:17 136192 ------w- c:\windows.0\system32\dllcache\msv1_0.dll
2010-01-05 22:14 . 2009-07-17 16:15 1441792 ------w- c:\windows.0\system32\dllcache\query.dll
2010-01-05 22:14 . 2009-09-04 21:03 58880 ------w- c:\windows.0\system32\dllcache\msasn1.dll
2010-01-05 22:13 . 2009-09-06 07:09 126976 ------w- c:\windows.0\system32\dllcache\ftpsvc2.dll
2010-01-05 22:12 . 2009-06-21 21:45 153088 ------w- c:\windows.0\system32\dllcache\triedit.dll
2010-01-05 22:11 . 2009-08-13 15:15 512000 ------w- c:\windows.0\system32\dllcache\jscript.dll
2010-01-05 22:10 . 2009-06-15 11:08 82944 ------w- c:\windows.0\system32\dllcache\tlntsess.exe
2010-01-05 22:10 . 2009-06-15 10:44 78848 ------w- c:\windows.0\system32\dllcache\telnet.exe
2010-01-05 22:09 . 2009-06-10 06:14 132096 ------w- c:\windows.0\system32\dllcache\wkssvc.dll
2010-01-05 22:08 . 2009-06-10 14:13 85504 ------w- c:\windows.0\system32\dllcache\avifil32.dll
2010-01-05 22:07 . 2009-08-05 08:59 206336 ------w- c:\windows.0\system32\dllcache\mswebdvd.dll
2010-01-05 22:06 . 2009-07-17 19:01 58880 ------w- c:\windows.0\system32\dllcache\atl.dll
2010-01-05 22:06 . 2009-07-29 04:34 81920 ------w- c:\windows.0\system32\dllcache\fontsub.dll
2010-01-05 22:06 . 2009-07-29 04:34 119808 ------w- c:\windows.0\system32\dllcache\t2embed.dll
2010-01-05 22:05 . 2009-06-03 19:09 1296896 ------w- c:\windows.0\system32\dllcache\quartz.dll
2010-01-05 22:04 . 2009-04-15 14:51 585216 ------w- c:\windows.0\system32\dllcache\rpcrt4.dll
2010-01-05 22:04 . 2009-05-07 15:32 348160 ------w- c:\windows.0\system32\dllcache\localspl.dll
2010-01-05 22:03 . 2009-05-21 18:47 268288 ------w- c:\windows.0\system32\dllcache\httpext.dll
2010-01-05 22:02 . 2009-02-03 19:57 56832 ------w- c:\windows.0\system32\dllcache\secur32.dll
2010-01-05 22:02 . 2009-03-21 14:06 1063424 ------w- c:\windows.0\system32\dllcache\kernel32.dll
2010-01-05 22:01 . 2008-12-16 12:30 354304 ------w- c:\windows.0\system32\dllcache\winhttp.dll
2010-01-05 21:59 . 2008-06-12 14:20 956928 ------w- c:\windows.0\system32\dllcache\msdtctm.dll
2010-01-05 21:59 . 2008-06-12 14:20 66560 ------w- c:\windows.0\system32\dllcache\mtxclu.dll
2010-01-05 21:59 . 2008-06-12 14:20 161792 ------w- c:\windows.0\system32\dllcache\msdtcuiu.dll
2010-01-05 21:59 . 2008-06-12 14:20 91648 ------w- c:\windows.0\system32\dllcache\mtxoci.dll
2010-01-05 21:59 . 2008-06-12 14:20 58880 ------w- c:\windows.0\system32\dllcache\msdtclog.dll
2010-01-05 21:58 . 2008-04-21 21:13 217600 ------w- c:\windows.0\system32\dllcache\wordpad.exe
2010-01-05 21:58 . 2008-12-05 06:55 144896 ------w- c:\windows.0\system32\dllcache\schannel.dll
2010-01-05 21:57 . 2008-12-11 10:57 333952 ------w- c:\windows.0\system32\dllcache\srv.sys
2010-01-05 21:56 . 2008-10-23 12:36 286720 ------w- c:\windows.0\system32\dllcache\gdi32.dll
2010-01-05 21:55 . 2008-09-04 17:15 1106944 ------w- c:\windows.0\system32\dllcache\msxml3.dll
2010-01-05 21:54 . 2008-10-24 11:21 455296 ------w- c:\windows.0\system32\dllcache\mrxsmb.sys
2010-01-05 21:54 . 2008-10-15 16:35 337408 ------w- c:\windows.0\system32\dllcache\netapi32.dll
2010-01-05 21:53 . 2008-08-28 07:46 74752 ------w- c:\windows.0\system32\dllcache\msw3prt.dll
2010-01-05 21:53 . 2008-08-28 07:46 104960 ------w- c:\windows.0\system32\dllcache\win32spl.dll
2010-01-05 21:51 . 2008-07-07 20:26 253952 ------w- c:\windows.0\system32\dllcache\es.dll
2010-01-05 21:51 . 2008-06-24 16:42 74240 ------w- c:\windows.0\system32\dllcache\mscms.dll
2010-01-05 21:50 . 2008-08-14 10:04 138496 ------w- c:\windows.0\system32\dllcache\afd.sys
2010-01-05 21:50 . 2008-06-20 11:51 361600 ------w- c:\windows.0\system32\dllcache\tcpip.sys
2010-01-05 21:50 . 2008-06-20 17:46 247296 ------w- c:\windows.0\system32\dllcache\mswsock.dll
2010-01-05 21:50 . 2008-06-20 17:46 147968 ------w- c:\windows.0\system32\dllcache\dnsapi.dll
2010-01-05 21:50 . 2008-06-20 11:08 225856 ------w- c:\windows.0\system32\dllcache\tcpip6.sys
2010-01-05 21:49 . 2008-05-08 14:02 203136 ------w- c:\windows.0\system32\dllcache\rmcast.sys
2010-01-05 21:48 . 2008-06-14 17:32 273024 ------w- c:\windows.0\system32\dllcache\bthport.sys
2010-01-05 21:44 . 2009-08-26 08:00 247326 ------w- c:\windows.0\system32\dllcache\strmdll.dll
2010-01-05 21:42 . 2009-07-10 13:26 1315328 ------w- c:\windows.0\system32\dllcache\msoe.dll
2010-01-05 21:41 . 2008-04-11 19:04 691712 ------w- c:\windows.0\system32\dllcache\inetcomm.dll
2010-01-05 21:39 . 2009-09-25 05:35 672768 ------w- c:\windows.0\system32\dllcache\wininet.dll
2010-01-05 21:39 . 2009-09-25 05:35 628736 ------w- c:\windows.0\system32\dllcache\urlmon.dll
2010-01-05 21:39 . 2009-09-25 05:35 81920 ------w- c:\windows.0\system32\dllcache\ieencode.dll
2010-01-05 21:39 . 2009-09-25 05:35 1509888 ------w- c:\windows.0\system32\dllcache\shdocvw.dll
2010-01-05 21:39 . 2009-10-19 23:51 3091968 ------w- c:\windows.0\system32\dllcache\mshtml.dll
2010-01-05 21:37 . 2010-01-05 21:37 -------- d-----w- C:\XPpostSP3update
2010-01-05 20:47 . 2008-04-14 06:52 155136 ------w- c:\windows.0\system32\mssha.dll
2010-01-05 20:28 . 2008-04-13 21:06 144384 ------w- c:\windows.0\system32\drivers\hdaudbus.sys
2010-01-05 20:28 . 2008-04-13 23:10 10240 ------w- c:\windows.0\system32\drivers\sffp_mmc.sys
2010-01-02 18:54 . 2010-01-02 18:54 -------- d-----w- C:\rsit
2010-01-02 18:53 . 2010-01-02 18:53 -------- d-----w- c:\dokumente und einstellungen\Ich\Anwendungsdaten\Malwarebytes
2010-01-02 18:52 . 2009-12-30 13:55 38224 ----a-w- c:\windows.0\system32\drivers\mbamswissarmy.sys
2010-01-02 18:52 . 2010-01-02 18:52 -------- d-----w- c:\dokumente und einstellungen\All Users\Anwendungsdaten\Malwarebytes
2010-01-02 18:52 . 2009-12-30 13:54 19160 ----a-w- c:\windows.0\system32\drivers\mbam.sys
2010-01-02 18:52 . 2010-01-02 18:52 -------- d-----w- c:\programme\Malwarebytes' Anti-Malware
2010-01-02 18:51 . 2010-01-02 18:51 -------- d-----w- c:\programme\CCleaner
2010-01-01 16:16 . 2010-01-05 19:45 52224 ----a-w- c:\dokumente und einstellungen\Ich\Anwendungsdaten\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10005.dll
2009-12-30 22:57 . 2009-12-30 22:57 -------- d-----w- c:\programme\tento.XT
2009-12-30 22:39 . 2009-12-30 22:39 -------- d-----w- c:\dokumente und einstellungen\Ich\Lokale Einstellungen\Anwendungsdaten\MarkAble
2009-12-30 22:39 . 2009-12-30 22:39 -------- d-----w- c:\dokumente und einstellungen\Ich\Lokale Einstellungen\Anwendungsdaten\{49CAE968-747F-460e-8581-5135D9AC7963}
2009-12-30 22:37 . 2009-12-30 22:37 -------- d-----w- C:\universa

.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-06 12:03 . 2009-04-15 19:37 32 --sha-w- c:\windows.0\system32\drivers\fidbox.idx
2010-01-06 12:03 . 2009-04-15 19:37 32 --sha-w- c:\windows.0\system32\drivers\fidbox.dat
2010-01-05 21:35 . 2006-02-03 16:57 32216 ----a-w- c:\dokumente und einstellungen\Ich\Lokale Einstellungen\Anwendungsdaten\GDIPFONTCACHEV1.DAT
2010-01-05 19:45 . 2009-07-04 12:06 117760 ----a-w- c:\dokumente und einstellungen\Ich\Anwendungsdaten\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2010-01-04 18:09 . 2009-06-08 21:45 1 ----a-w- c:\dokumente und einstellungen\Ich\Anwendungsdaten\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
2009-12-07 21:15 . 2009-05-16 15:05 56816 ----a-w- c:\windows.0\system32\drivers\avgntflt.sys
2009-12-03 19:57 . 2009-12-03 19:57 -------- d-----w- c:\dokumente und einstellungen\Ich\Anwendungsdaten\Canneverbe_Limited
2009-12-03 19:57 . 2009-12-03 19:57 -------- d-----w- c:\dokumente und einstellungen\All Users\Anwendungsdaten\Canneverbe Limited
2009-12-03 19:47 . 2002-08-29 12:00 84524 ----a-w- c:\windows.0\system32\perfc007.dat
2009-12-03 19:47 . 2002-08-29 12:00 459152 ----a-w- c:\windows.0\system32\perfh007.dat
2009-12-03 19:46 . 2009-12-03 19:46 2288 ----a-w- c:\dokumente und einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\FontCache3.0.0.0.dat
2009-12-03 19:45 . 2009-12-03 19:45 -------- d-----w- c:\programme\MSBuild
2009-12-03 19:45 . 2009-12-03 19:44 -------- d-----w- c:\programme\Reference Assemblies
2009-12-03 19:36 . 2009-12-03 19:36 -------- d-----w- c:\programme\MSXML 6.0
2009-12-01 18:26 . 2009-12-01 18:26 9459778 ------w- c:\windows.0\Internet Logs\vsmon_on_demand_2009_12_01_16_08_07_full.dmp.zip
2009-11-30 21:19 . 2009-11-30 21:19 -------- d-----w- c:\programme\DDR - Pen Drive Recovery (DEMO)
2009-11-30 21:07 . 2009-11-30 21:07 -------- d-----w- c:\programme\Convar
2009-11-30 16:46 . 2009-11-30 16:46 -------- d-----w- c:\programme\PC Inspector File Recovery
2009-11-26 14:55 . 2009-11-26 15:14 3279360 ------w- c:\windows.0\Internet Logs\xDBC.tmp
2009-11-25 15:26 . 2009-11-25 15:34 3538944 ------w- c:\windows.0\Internet Logs\xDBB.tmp
2009-11-23 22:24 . 2009-11-23 22:24 152576 ----a-w- c:\dokumente und einstellungen\Ich\Anwendungsdaten\Sun\Java\jre1.6.0_17\lzma.dll
2009-11-23 22:23 . 2009-11-23 22:23 79488 ----a-w- c:\dokumente und einstellungen\Ich\Anwendungsdaten\Sun\Java\jre1.6.0_17\gtapi.dll
2009-11-16 21:25 . 2009-11-16 21:25 -------- d-----w- c:\programme\Gemeinsame Dateien\DivX Shared
2009-11-11 11:53 . 2009-11-11 12:03 3225088 ------w- c:\windows.0\Internet Logs\xDBA.tmp
2009-11-09 16:07 . 2009-11-09 16:15 3224064 ------w- c:\windows.0\Internet Logs\xDB9.tmp
2009-10-23 23:49 . 2009-10-24 10:36 143872 ------w- c:\windows.0\Internet Logs\xDB8.tmp
2009-10-17 21:36 . 2009-10-17 21:36 152576 ----a-w- c:\dokumente und einstellungen\Ich\Anwendungsdaten\Sun\Java\jre1.6.0_16\lzma.dll
2009-10-14 12:54 . 2009-10-14 12:54 8570848 ------w- c:\windows.0\Internet Logs\vsmon_on_demand_2009_10_14_13_43_48_full.dmp.zip
2009-10-14 12:44 . 2009-10-14 12:48 297472 ------w- c:\windows.0\Internet Logs\xDB7.tmp
2009-10-13 17:50 . 2007-11-06 15:36 177024 ----a-w- c:\dokumente und einstellungen\Ich\Anwendungsdaten\Mozilla\Firefox\Profiles\8og5lqml.default\FlashGot.exe
2009-10-11 03:17 . 2009-06-01 22:00 411368 ----a-w- c:\windows.0\system32\deploytk.dll
2002-12-17 13:18 . 2002-12-17 13:15 900591 ----a-w- c:\programme\usbf_110.zip
2002-12-17 11:05 . 2002-12-17 10:54 3474331 ----a-w- c:\programme\treiber_ml_adsl_fun_usb.zip
2002-12-16 08:05 . 2002-05-24 23:22 11253 ---h--w- c:\programme\folder.htt
2009-09-25 16:41 . 2009-09-25 16:41 1044480 ----a-w- c:\programme\mozilla firefox\plugins\libdivx.dll
2009-09-25 16:41 . 2009-09-25 16:41 200704 ----a-w- c:\programme\mozilla firefox\plugins\ssldivx.dll
.

(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BySoft FreeRAM"="c:\programme\BySoft FreeRAM\FreeRAM.exe" [2007-09-28 318976]
"SUPERAntiSpyware"="c:\programme\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2009-12-18 2002160]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Logitech Utility"="Logi_MwX.Exe" [2003-12-17 19968]
"NvCplDaemon"="c:\windows.0\system32\NvCpl.dll" [2006-10-22 7700480]
"nwiz"="nwiz.exe" [2006-10-22 1622016]
"SoundMan"="SOUNDMAN.EXE" [2002-02-05 46592]
"QuickTime Task"="c:\programme\QuickTime\qttask.exe" [2006-10-25 282624]
"iTunesHelper"="c:\programme\iTunes\iTunesHelper.exe" [2006-10-30 256576]
"NvMediaCenter"="c:\windows.0\system32\NvMcTray.dll" [2006-10-22 86016]
"ZoneAlarm Client"="c:\programme\Zone Labs\ZoneAlarm\zlclient.exe" [2008-07-09 919016]
"avgnt"="c:\programme\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"Adobe Reader Speed Launcher"="c:\programme\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-10-03 35696]
"Adobe ARM"="c:\programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe" [2009-09-04 935288]
"SunJavaUpdateSched"="c:\programme\Java\jre6\bin\jusched.exe" [2009-10-11 149280]

c:\dokumente und einstellungen\Ich\Startmen�\Programme\Autostart\
Secunia PSI.lnk - c:\programme\Secunia\PSI\psi.exe [2009-6-24 803176]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\programme\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-06 10:44 548352 ----a-w- c:\programme\SUPERAntiSpyware\SASWINLO.DLL

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Programme\\Opera\\opera.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

R0 fasttrak;fasttrak;c:\windows.0\system32\drivers\Fasttrak.sys [1.2.2006 18:24 70528]
R1 SASDIFSV;SASDIFSV;c:\programme\SUPERAntiSpyware\sasdifsv.sys [23.6.2009 11:01 9968]
R1 SASKUTIL;SASKUTIL;c:\programme\SUPERAntiSpyware\SASKUTIL.SYS [23.6.2009 11:01 74480]
R2 AntiVirSchedulerService;Avira AntiVir Planer;c:\programme\Avira\AntiVir Desktop\sched.exe [16.5.2009 16:05 108289]
R3 RMSPPPOE;WAN Miniport (PPP over Ethernet Protocol);c:\windows.0\system32\drivers\RMSPPPOE.SYS [10.6.2002 00:09 31232]
S0 sptd;sptd;c:\windows.0\system32\drivers\sptd.sys [20.9.2009 18:26 721904]
S2 AUL;MicroLink ADSL Fun USB Loader;c:\windows.0\system32\drivers\MLDSLUSB.SYS [1.2.2006 19:34 162764]
S3 gtstusbser;Option210 USB Device for Legacy Serial Communication;c:\windows.0\system32\drivers\gtstusbser.sys [7.4.2009 20:54 103552]
S3 MIINPazX;MIINPazX NDIS Protocol Driver;c:\progra~1\GEMEIN~1\MARMIK~1\MInfraIS\MIINPazX.SYS [23.8.2006 18:26 17152]
S3 MlAdslUsb;MicroLink ADSL Fun USB;c:\windows.0\system32\drivers\MLDSLUSB.SYS [1.2.2006 19:34 162764]
S3 PSI;PSI;c:\windows.0\system32\drivers\psi_mf.sys [17.6.2009 14:20 12648]
S3 SASENUM;SASENUM;c:\programme\SUPERAntiSpyware\SASENUM.SYS [23.6.2009 11:01 7408]
S3 SetupNTGLM7X;SetupNTGLM7X;\??\e:\ntglm7x.sys --> e:\NTGLM7X.sys [?]
S3 Slnt7554;USB Soft Modem Driver;c:\windows.0\system32\drivers\slnt7554.sys [5.2.2006 16:55 224888]
.
Inhalt des "geplante Tasks" Ordners

2006-11-14 c:\windows.0\Tasks\AppleSoftwareUpdate.job
- c:\programme\Apple Software Update\SoftwareUpdate.exe [2006-10-10 16:13]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.google.de/
uInternet Connection Wizard,ShellNext = hxxp://www.google.de/
DPF: {7F8C8173-AD80-4807-AA75-5672F22B4582} - hxxp://download.zonelabs.com/bin/promotions/spywaredetector/ICSScanner37710.cab
FF - ProfilePath - c:\dokumente und einstellungen\Ich\Anwendungsdaten\Mozilla\Firefox\Profiles\8og5lqml.default\
FF - prefs.js: browser.search.selectedEngine - ICQ Search
FF - prefs.js: keyword.URL - hxxp://search.icq.com/search/afe_results.php?ch_id=afex&q=
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -

HKLM-Run-H-Tray - (no file)



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-01-06 13:22
Windows 5.1.2600 Service Pack 3 FAT NTAPI

Scanne versteckte Prozesse...

Scanne versteckte Autostarteinträge...

Scanne versteckte Dateien...

Scan erfolgreich abgeschlossen
versteckte Dateien: 0

**************************************************************************
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------

- - - - - - - > 'winlogon.exe'(644)
c:\programme\SUPERAntiSpyware\SASWINLO.DLL
.
Zeit der Fertigstellung: 2010-01-06 13:26:20
ComboFix-quarantined-files.txt 2010-01-06 12:26

Vor Suchlauf: 757.252.096 Bytes frei
Nach Suchlauf: 729.169.920 Bytes frei

WindowsXP-KB310994-SP2-Pro-BootDisk-DEU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS.0
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS.0="Microsoft Windows XP Professional" /fastdetect /NoExecute=OptIn

Current=1 Default=1 Failed=0 LastKnownGood=4 Sets=1,2,3,4
- - End Of File - - 73D7EAD30E5446A8BC9E33842E94AEE6