Verdacht auf Trojaner

roflkartofel

Hier das Logfile:

ComboFix 10-02-09.04 - User 10.02.2010 14:29:09.1.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.49.1031.18.2047.1543 [GMT 1:00]
ausgeführt von:: c:\dokumente und einstellungen\User\Desktop\cofi.exe
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}

.

(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\programme\ICQ6.5\ICQLRun.exe
c:\windows\system32\826700.dll
c:\windows\system32\twain_32.dll

.
((((((((((((((((((((((((((((((((((((((( Treiber/Dienste )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_SSHNAS


((((((((((((((((((((((( Dateien erstellt von 2010-01-10 bis 2010-02-10 ))))))))))))))))))))))))))))))
.

2010-02-03 16:40 . 2010-02-03 16:40 -------- d-----w- c:\programme\iPod
2010-02-03 16:29 . 2010-02-03 16:29 72488 ----a-w- c:\dokumente und einstellungen\All Users\Anwendungsdaten\Apple Computer\Installer Cache\iTunes 9.0.3.15\SetupAdmin.exe
2010-02-02 16:38 . 2010-02-02 16:38 -------- d-----w- C:\rsit
2010-01-28 17:13 . 2010-01-28 17:13 -------- d-----w- c:\dokumente und einstellungen\User\Anwendungsdaten\Malwarebytes
2010-01-28 17:13 . 2010-01-07 15:07 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-01-28 17:13 . 2010-01-28 17:13 -------- d-----w- c:\programme\Malwarebytes' Anti-Malware
2010-01-28 17:13 . 2010-01-28 17:13 -------- d-----w- c:\dokumente und einstellungen\All Users\Anwendungsdaten\Malwarebytes
2010-01-28 17:13 . 2010-01-07 15:07 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-01-21 15:01 . 2009-04-09 13:55 3768 ----a-w- c:\windows\system32\drivers\DrmRVideo.sys
2010-01-18 09:53 . 2010-01-18 09:53 37920 ----a-w- c:\windows\system32\drivers\tbhsd.sys
2010-01-18 09:52 . 2010-01-18 09:52 27168 ----a-w- c:\windows\system32\drivers\rrnetcap.sys
2010-01-17 11:35 . 2010-01-17 11:35 -------- d-----w- c:\programme\Gemeinsame Dateien\Digidesign
2010-01-16 12:17 . 2009-04-09 13:55 23096 ----a-w- c:\windows\system32\drivers\DrmRAudio.sys
2010-01-14 15:12 . 2010-01-14 15:12 -------- d-----w- c:\dokumente und einstellungen\User\Anwendungsdaten\Audio Recorder for Free

.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-02-10 13:32 . 2009-03-10 14:19 -------- d-----w- c:\programme\ICQ6.5
2010-02-10 12:43 . 2008-05-01 17:11 -------- d-----w- c:\dokumente und einstellungen\User\Anwendungsdaten\ICQ
2010-02-09 15:49 . 2008-05-31 11:53 -------- d-----w- c:\dokumente und einstellungen\All Users\Anwendungsdaten\Google Updater
2010-02-08 15:51 . 2007-08-29 18:18 -------- d-----w- c:\dokumente und einstellungen\User\Anwendungsdaten\Skype
2010-02-07 18:47 . 2007-09-05 15:03 -------- d-----w- c:\dokumente und einstellungen\User\Anwendungsdaten\Xfire
2010-02-05 14:10 . 2008-01-23 15:00 -------- d-----w- c:\programme\Steam
2010-02-05 13:27 . 2007-09-05 15:03 -------- d-----w- c:\programme\Xfire
2010-02-03 16:41 . 2009-12-07 17:23 -------- d-----w- c:\programme\iTunes
2010-02-03 16:40 . 2007-09-27 16:30 -------- d-----w- c:\programme\Gemeinsame Dateien\Apple
2010-01-29 15:57 . 2007-08-23 13:43 221196 ----a-w- c:\windows\War3Unin.dat
2010-01-29 10:18 . 2009-10-20 09:50 -------- d-----w- c:\programme\Heroes of Newerth
2010-01-17 11:35 . 2009-05-21 14:37 -------- d-----w- c:\programme\Vstplugins
2010-01-14 17:11 . 2007-08-22 11:43 -------- d--h--w- c:\programme\InstallShield Installation Information
2010-01-05 09:52 . 2006-02-28 12:00 832512 ----a-w- c:\windows\system32\wininet.dll
2010-01-05 09:52 . 2006-02-28 12:00 78336 ----a-w- c:\windows\system32\ieencode.dll
2010-01-05 09:52 . 2006-02-28 12:00 17408 ----a-w- c:\windows\system32\corpol.dll
2009-12-22 20:59 . 2008-05-31 11:53 -------- d-----w- c:\programme\Google
2009-12-08 13:02 . 2009-06-30 15:03 56816 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2009-11-29 19:32 . 2009-11-07 13:28 50388 ---ha-w- c:\windows\system32\mlfcache.dat
2009-11-24 14:19 . 2007-08-22 13:08 72648 ----a-w- c:\dokumente und einstellungen\User\Lokale Einstellungen\Anwendungsdaten\GDIPFONTCACHEV1.DAT
2009-11-21 16:37 . 2006-02-28 12:00 470528 ----a-w- c:\windows\AppPatch\aclayers.dll
2009-11-19 10:48 . 2009-11-26 18:01 872960 ----a-w- c:\dokumente und einstellungen\User\Anwendungsdaten\Mozilla\Firefox\Profiles\20ho4eh2.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\frozen.dll
2009-11-19 10:48 . 2009-11-26 18:01 43008 ----a-w- c:\dokumente und einstellungen\User\Anwendungsdaten\Mozilla\Firefox\Profiles\20ho4eh2.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\googletoolbarloader.dll
2009-11-19 10:48 . 2009-11-26 18:01 340480 ----a-w- c:\dokumente und einstellungen\User\Anwendungsdaten\Mozilla\Firefox\Profiles\20ho4eh2.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\libraries\googletoolbar-ff2.dll
2009-11-19 10:48 . 2009-11-26 18:01 346624 ----a-w- c:\dokumente und einstellungen\User\Anwendungsdaten\Mozilla\Firefox\Profiles\20ho4eh2.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\libraries\googletoolbar-ff3.dll
2006-05-03 10:06 . 2008-03-20 19:24 163328 --sh--r- c:\windows\system32\flvDX.dll
2007-02-21 11:47 . 2008-03-20 19:24 31232 --sh--r- c:\windows\system32\msfDX.dll
2007-12-17 13:43 . 2008-03-20 19:24 27648 --sh--w- c:\windows\system32\Smab0.dll
2008-02-04 19:26 . 2008-03-20 19:24 151040 --sh--w- c:\windows\system32\VistaUltm.dll
.

------- Sigcheck -------

[-] 2007-06-13 . 01A48FAEF0FFC2E6A0763DE98F5BA4A6 . 978944 . . [6.00.2900.3156] . . c:\windows\explorer.exe
[-] 2007-06-13 . 01A48FAEF0FFC2E6A0763DE98F5BA4A6 . 978944 . . [6.00.2900.3156] . . c:\windows\system32\dllcache\explorer.exe
[7] 2007-06-13 . 331ED93570BAF3CFE30340298762CD56 . 1036288 . . [6.00.2900.3156] . . c:\windows\$hf_mig$\KB938828\SP2QFE\explorer.exe
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{201f27d4-3704-41d6-89c1-aa35e39143ed}]
2008-08-26 09:32 279944 ----a-w- c:\programme\AskBarDis\bar\bin\askBar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{3041d03e-fd4b-44e0-b742-2d9b88305f98}"= "c:\programme\AskBarDis\bar\bin\askBar.dll" [2008-08-26 279944]

[HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]
[HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{3041D03E-FD4B-44E0-B742-2D9B88305F98}"= "c:\programme\AskBarDis\bar\bin\askBar.dll" [2008-08-26 279944]

[HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]
[HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TomTomHOME.exe"="c:\programme\TomTom HOME 2\HOMERunner.exe" [2008-12-09 234856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SkyTel"="SkyTel.EXE" [2006-05-16 2879488]
"amd_dc_opt"="c:\programme\AMD\Dual-Core Optimizer\amd_dc_opt.exe" [2006-11-17 77824]
"Launch LGDCore"="c:\programme\Logitech\G-series Software\LGDCore.exe" [2006-03-06 1122304]
"Launch LCDMon"="c:\programme\Logitech\G-series Software\LCDMon.exe" [2006-03-06 497152]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2008-02-29 76304]
"RTHDCPL"="RTHDCPL.EXE" [2007-01-30 16116224]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-05-16 13529088]
"nwiz"="nwiz.exe" [2008-05-16 1630208]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-05-16 86016]
"Adobe Photo Downloader"="c:\programme\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" [2005-06-23 57344]
"Adobe Reader Speed Launcher"="c:\programme\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]
"avgnt"="c:\programme\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"QuickTime Task"="c:\programme\QuickTime\QTTask.exe" [2009-11-10 417792]
"AppleSyncNotifier"="c:\programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2009-08-13 177440]
"iTunesHelper"="c:\programme\iTunes\iTunesHelper.exe" [2010-01-22 141608]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2006-02-28 15360]

c:\dokumente und einstellungen\User\Startmen�\Programme\Autostart\
RocketDock.lnk - c:\windows\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe [2007-3-18 630784]
Y'z Shadow.lnk - c:\windows\BricoPacks\Vista Inspirat 2\YzShadow\YzShadow.exe [2006-5-21 155648]

c:\dokumente und einstellungen\All Users\Startmen�\Programme\Autostart\
GammaTray.lnk - c:\programme\MagicTune Premium\GammaTray.exe [2008-12-20 36864]
hp psc 1000 series.lnk - c:\programme\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe [2003-4-6 147456]
hpoddt01.exe.lnk - c:\programme\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe [2003-4-6 28672]
Logitech SetPoint.lnk - c:\programme\Logitech\SetPoint\SetPoint.exe [2008-7-30 805392]
Microsoft Office.lnk - c:\programme\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"UIHost"="c:\dokumente und einstellungen\All Users\Anwendungsdaten\TuneUp Software\TuneUp Utilities\WinStyler\tu_logonui.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
2008-05-02 00:42 72208 ----a-w- c:\programme\Gemeinsame Dateien\Logitech\Bluetooth\LBTWLgn.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"CTFMON.EXE"=c:\windows\system32\ctfmon.exe
"Steam"="c:\programme\Steam\Steam.exe" -silent
"Skype"="c:\programme\Skype\Phone\Skype.exe" /nosplash /minimized
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\programme\Gemeinsame Dateien\Ahead\Lib\NMBgMonitor.exe"
"Vidalia"="c:\programme\Vidalia Bundle\Vidalia\vidalia.exe"
"Comrade.exe"=c:\programme\GameSpy\Comrade\Comrade.exe
"Free Download Manager"="c:\programme\Free Download Manager\fdm.exe" -autorun
"MSMSGS"="c:\programme\Messenger\msmsgs.exe" /background
"BLASC"="c:\programme\buffed\BLASC.exe" silent
"Octoshape Streaming Services"="c:\programme\Octoshape Streaming Services\User\OctoshapeClient.exe" -inv:bootrun
"ICQ"="c:\programme\ICQ6.5\ICQ.exe" silent

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"QuickTime Task"="c:\programme\QuickTime\QTTask.exe" -atboottime
"iTunesHelper"="c:\programme\iTunes\iTunesHelper.exe"
"NeroFilterCheck"=c:\programme\Gemeinsame Dateien\Ahead\Lib\NeroCheck.exe
"Adobe Reader Speed Launcher"="c:\programme\Adobe\Reader 8.0\Reader\Reader_sl.exe"
"Xfire Music"=c:\programme\Xfire\xfiremusic.exe
"Adobe Photo Downloader"="c:\programme\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
"SunJavaUpdateSched"="c:\programme\Java\jre6\bin\jusched.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Programme\\Xfire\\xfire.exe"=
"c:\\Warcraft III\\Frozen Throne.exe"=
"c:\\Warcraft III\\Warcraft III.exe"=
"c:\\Programme\\Sierra Entertainment\\WORLD IN CONFLICT\\wic.exe"=
"c:\\Programme\\Sierra Entertainment\\WORLD IN CONFLICT\\wic_online.exe"=
"c:\\Programme\\Sierra Entertainment\\WORLD IN CONFLICT\\wic_ds.exe"=
"c:\\Programme\\TrackMania Nations ESWC\\TmNationsESWC.exe"=
"c:\\Programme\\Octoshape Streaming Services\\User\\OctoshapeClient.exe"=
"c:\\Programme\\Skype\\Phone\\Skype.exe"=
"c:\\Programme\\Unreal Tournament 3 (LG)\\Binaries\\UT3.exe"=
"c:\\Programme\\Steam\\Steam.exe"=
"c:\\Programme\\Anno 1701\\Anno1701.exe"=
"c:\\Programme\\Ascoron Entertaiment\\Sacred.exe"=
"c:\\Programme\\Ascaron Entertainment\\Sacred 2 - Fallen Angel\\system\\s2gs.exe"=
"c:\\Programme\\Ascaron Entertainment\\Sacred 2 - Fallen Angel\\system\\sacred2.exe"=
"c:\\Programme\\MagicTune Premium\\MagicTune.exe"=
"c:\\Programme\\Steam\\steamapps\\common\\trackmania nations forever\\TmForever.exe"=
"c:\\Programme\\Steam\\steamapps\\common\\trackmania nations forever\\TmForeverLauncher.exe"=
"c:\\Programme\\Bonjour\\mDNSResponder.exe"=
"c:\\Programme\\ICQ6.5\\ICQ.exe"=
"c:\\Programme\\Java\\jre6\\bin\\javaw.exe"=
"c:\\Programme\\Java\\jre6\\bin\\java.exe"=
"c:\\Programme\\iTunes\\iTunes.exe"=
"c:\\Dokumente und Einstellungen\\User\\Desktop\\Skype.exe"=

R1 Klmc;Klmc;c:\windows\system32\drivers\klmc.sys [20.03.2006 18:22 10899]
R2 AntiVirSchedulerService;Avira AntiVir Planer;c:\programme\Avira\AntiVir Desktop\sched.exe [30.06.2009 16:03 108289]
R3 L6UX2;Service - Line 6 UX2;c:\windows\system32\drivers\L6UX2.sys [09.04.2009 10:22 532992]
S2 gupdate1ca0e9d65f7d2f8;Google Update Service (gupdate1ca0e9d65f7d2f8);c:\programme\Google\Update\GoogleUpdate.exe [27.07.2009 10:34 133104]
S3 ASPI;Advanced SCSI Programming Interface Driver;c:\windows\system32\drivers\ASPI32.SYS [16.03.2008 20:29 16512]
S3 DrmRAudio;DrmRAudio;c:\windows\system32\drivers\DrmRAudio.sys [16.01.2010 13:17 23096]
S3 DrmRVideo;DrmRVideo;c:\windows\system32\drivers\DrmRVideo.sys [21.01.2010 16:01 3768]
S3 hamachi_oem;PlayLinc Adapter;c:\windows\system32\drivers\gan_adapter.sys [28.08.2006 23:54 10664]
S3 SCREAMINGBDRIVER;Screaming Bee Audio;c:\windows\system32\drivers\ScreamingBAudio.sys --> c:\windows\system32\drivers\ScreamingBAudio.sys [?]
S3 sea1bus;Sony Ericsson Device 0A1 driver (WDM);c:\windows\system32\drivers\sea1bus.sys [16.03.2008 17:33 61536]
S3 sea1mdfl;Sony Ericsson Device 0A1 USB WMC Modem Filter;c:\windows\system32\drivers\sea1mdfl.sys [16.03.2008 20:24 9360]
S3 sea1mdm;Sony Ericsson Device 0A1 USB WMC Modem Driver;c:\windows\system32\drivers\sea1mdm.sys [16.03.2008 20:24 97088]
S3 sea1mgmt;Sony Ericsson Device 0A1 USB WMC Device Management Drivers (WDM);c:\windows\system32\drivers\sea1mgmt.sys [16.03.2008 20:46 88624]
S3 sea1nd5;Sony Ericsson Device 0A1 USB Ethernet Emulation SEMCA1 (NDIS);c:\windows\system32\drivers\sea1nd5.sys [16.03.2008 20:46 18704]
S3 sea1obex;Sony Ericsson Device 0A1 USB WMC OBEX Interface;c:\windows\system32\drivers\sea1obex.sys [16.03.2008 20:24 86432]
S3 sea1unic;Sony Ericsson Device 0A1 USB Ethernet Emulation SEMCA1 (WDM);c:\windows\system32\drivers\sea1unic.sys [16.03.2008 20:46 90800]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
Inhalt des "geplante Tasks" Ordners


2010-02-09 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\programme\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]

2010-02-09 c:\windows\Tasks\FRU Task 2003-04-06 08:52ewlett-Packard2003-04-06 08:52p psc 1100 series5E771253C1676EBED677BF361FDFC537825E15B8201450655.job
- c:\programme\Hewlett-Packard\Digital Imaging\Bin\hpqfrucl.exe [2003-04-05 23:52]

2010-02-10 c:\windows\Tasks\Google Software Updater.job
- c:\programme\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-05-31 14:17]

2010-02-10 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\programme\Google\Update\GoogleUpdate.exe [2009-07-27 09:33]

2010-02-10 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\programme\Google\Update\GoogleUpdate.exe [2009-07-27 09:33]

2010-01-10 c:\windows\Tasks\Uniblue SpeedUpMyPC Nag.job
- c:\programme\Uniblue\SpeedUpMyPC 3\SpeedUpMyPC.exe [2008-05-30 07:50]

2008-05-30 c:\windows\Tasks\Uniblue SpeedUpMyPC.job
- c:\programme\Uniblue\SpeedUpMyPC 3\SpeedUpMyPC.exe [2008-05-30 07:50]

2010-02-10 c:\windows\Tasks\XoftSpySE 2.job
- c:\programme\XoftSpySE\XoftSpy.exe [2007-10-24 18:59]

2008-01-01 c:\windows\Tasks\XoftSpySE.job
- c:\programme\XoftSpySE\XoftSpy.exe [2007-10-24 18:59]
.
.
------- Zusätzlicher Suchlauf -------
.
uInternet Settings,ProxyOverride = *.local
IE: &Search
Trusted Zone: line6.net
FF - ProfilePath - c:\dokumente und einstellungen\User\Anwendungsdaten\Mozilla\Firefox\Profiles\20ho4eh2.default\
FF - prefs.js: browser.search.selectedEngine - Wikipedia (de)
FF - prefs.js: keyword.URL - hxxp://*ww.crawler.com/search/dispatcher.aspx?tp=aus&tbid=66006&qkw=
FF - prefs.js: network.proxy.http - localhost
FF - prefs.js: network.proxy.http_port - 8118
FF - prefs.js: network.proxy.socks - localhost
FF - prefs.js: network.proxy.socks_port - 9050
FF - prefs.js: network.proxy.ssl - localhost
FF - prefs.js: network.proxy.ssl_port - 8118
FF - prefs.js: network.proxy.type - 4
FF - component: c:\dokumente und einstellungen\User\Anwendungsdaten\Mozilla\Firefox\Profiles\20ho4eh2.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}\components\frozen.dll
FF - component: c:\programme\Gemeinsame Dateien\DVDVideoSoft\Dll\FFContextMenuY\components\FFContextMenu.dll
FF - plugin: c:\dokumente und einstellungen\User\Anwendungsdaten\Mozilla\Firefox\Profiles\20ho4eh2.default\extensions\moveplayer@movenetworks.com\platform\WINNT_x86-msvc\plugins\npmnqmp071303000004.dll
FF - plugin: c:\dokumente und einstellungen\User\Anwendungsdaten\Mozilla\plugins\npoctoshape.dll
FF - plugin: c:\programme\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: c:\programme\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll
FF - plugin: c:\programme\Google\Update\1.2.183.13\npGoogleOneClick8.dll
FF - plugin: c:\programme\Mozilla Firefox\plugins\npstrlnk.dll
FF - plugin: c:\programme\Octoshape Streaming Services\User\octoprogram-L03-NMS0810164_SUA_000\npoctoshape.dll
FF - plugin: c:\programme\VistaCodecPack\rm\browser\plugins\nppl3260.dll
FF - plugin: c:\programme\VistaCodecPack\rm\browser\plugins\nprpjplug.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX Richtlinien ----
FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: content.max.tokenizing.time - 1800000
FF - user.js: content.notify.interval - 600000
FF - user.js: content.switch.threshold - 1000000
FF - user.js: nglayout.initialpaint.delay - 600
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -

BHO-{FC8CD9DD-AA12-4AE6-8674-B00B33F7EDA0} - (no file)
ActiveSetup-{9C450606-ED24-4958-92BA-B8940C99D441} - c:\programme\PixiePack Codec Pack\InstallerHelper.exe
AddRemove-{0886900B-B2F3-452C-B580-60F1253F7F80} - c:\dokumente und einstellungen\All Users\Anwendungsdaten\{0CC51CB2-911C-40BB-BC1B-BD3CAC590222}\Controller Editor Setup.exe
AddRemove-{0B8565BA-BAD5-4732-B122-5FD78EFC50A9} - c:\dokumente und einstellungen\All Users\Anwendungsdaten\{D7CFB71A-972A-44FF-AE44-8780EB53ABB2}\Service Center Setup.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-02-10 14:41
Windows 5.1.2600 Service Pack 2 NTFS

Scanne versteckte Prozesse...

Scanne versteckte Autostarteinträge...

Scanne versteckte Dateien...

Scan erfolgreich abgeschlossen
versteckte Dateien: 0

**************************************************************************
.
--------------------- Gesperrte Registrierungsschluessel ---------------------

[HKEY_USERS\S-1-5-21-1343024091-57989841-839522115-1004\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{40FC7F1E-2624-C1F7-71B6-A14A1AFC64DF}*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
"laickcngfniohccjneehplpo"=hex:64,62,61,69,64,70,63,69,6c,6d,61,63,69,63,6b,6c,
6d,68,69,6d,66,62,66,6f,6d,6f,70,6d,6e,6b,68,6e,69,6c,6f,62,6a,62,69,6d,00,\
"lacdbpoglgjehbbnmalnkfgn"=hex:64,62,61,69,64,70,63,69,6c,6d,61,63,69,63,6b,6c,
6d,68,69,6d,66,62,66,6f,6d,6f,70,6d,6e,6b,68,6e,69,6c,6f,62,6a,62,69,6d,00,\

[HKEY_USERS\S-1-5-21-1343024091-57989841-839522115-1004\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:c4,52,d8,a7,4d,eb,e3,c6,1b,e5,49,34,e6,fb,23,fa,f0,8f,44,40,e4,3f,2f,
81,14,01,46,46,70,03,48,66,cc,2f,a3,a2,be,38,ae,1e,7a,9b,f7,78,b1,0c,12,3e,\
"??"=hex:b6,a3,c1,25,70,20,89,50,aa,7e,8b,33,83,af,03,ee

[HKEY_USERS\S-1-5-21-1343024091-57989841-839522115-1004\Software\SecuROM\License information*]
"datasecu"=hex:cf,a7,24,78,17,02,8e,f5,94,e5,ed,e6,34,41,41,ef,d8,bb,08,6b,7b,
4c,e2,da,29,83,9a,ca,82,52,3b,05,61,b7,3d,e9,a6,23,d1,e4,26,a2,68,dd,19,f0,\
"rkeysecu"=hex:ef,ee,b7,7b,87,4d,69,38,12,a4,c1,60,53,f6,c2,b3
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------

- - - - - - - > 'winlogon.exe'(728)
c:\programme\gemeinsame dateien\logitech\bluetooth\LBTWlgn.dll
c:\programme\gemeinsame dateien\logitech\bluetooth\LBTServ.dll

- - - - - - - > 'explorer.exe'(3400)
c:\windows\system32\SHDOCVW.dll
c:\windows\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.dll
c:\windows\BricoPacks\Vista Inspirat 2\YzShadow\YzShadow.dll
c:\programme\Logitech\SetPoint\GameHook.dll
c:\programme\Logitech\SetPoint\lgscroll.dll
c:\windows\system32\NETSHELL.dll
c:\windows\system32\credui.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\programme\Avira\AntiVir Desktop\avguard.exe
c:\programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\programme\Bonjour\mDNSResponder.exe
c:\programme\Java\jre6\bin\jqs.exe
c:\programme\Gemeinsame Dateien\LightScribe\LSSrvc.exe
c:\programme\MagicTune Premium\MagicTuneEngine.exe
c:\windows\system32\nvsvc32.exe
c:\programme\CyberLink\Shared Files\RichVideo.exe
c:\windows\system32\wbem\wmiapsrv.exe
c:\windows\RTHDCPL.EXE
c:\windows\system32\RUNDLL32.EXE
c:\programme\MagicTune Premium\MagicTune.exe
c:\programme\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
c:\programme\Logitech\G-series Software\Applets\LCDClock.exe
c:\programme\Logitech\G-series Software\Applets\LCDMedia.exe
c:\programme\Gemeinsame Dateien\Logishrd\KHAL2\KHALMNPR.EXE
c:\programme\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
c:\programme\iPod\bin\iPodService.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2010-02-10 14:42:02 - PC wurde neu gestartet
ComboFix-quarantined-files.txt 2010-02-10 13:41

Vor Suchlauf: 4.439.838.720 Bytes frei
Nach Suchlauf: 4.625.252.352 Bytes frei

WindowsXP-KB310994-SP2-Home-BootDisk-DEU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect /usepmtimer /TUTag=I8E4BP /Kernel=TUKernel.exe
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition (TuneUp Backup)" /noexecute=optin /fastdetect /usepmtimer /TUTag=I8E4BP-BAK

- - End Of File - - EE60F45315C6CFC9F48C60F337F025F7

CCleaner hab ich auch laufen lassen.