Combofix - Scripten

1. Starte das Notepad (Start / Ausführen / notepad[Enter])

2. Jetzt füge mit copy/paste den ganzen Inhalt der untenstehenden Codebox in das Notepad Fenster ein.

http://www.trojaner-board.de/86172-google-ist-langsam-und-leitet-um-auf-dubiose-seiten.html

Collect::
c:\windows\system32\aaae.sys

Driver::
aaae
         

3. Speichere im Notepad als CFScript.txt auf dem Desktop.

4. Deaktivere den Guard Deines Antivirenprogramms und eine eventuell vorhandene Software Firewall.
(Auch Guards von Ad-, Spyware Programmen und den Tea Timer (wenn vorhanden) !)

5. Dann ziehe die CFScript.txt auf die cofi.exe, so wie es im unteren Bild zu sehen ist. Damit wird Combofix neu gestartet.



6. Nach dem Neustart (es wird gefragt ob Du neustarten willst), poste bitte die folgenden Log Dateien:
Combofix.txt

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!

Huhu,


hier der log von Deinem ComboFix Script

ComboFix 10-05-17.03 - Dogan 19.05.2010 9:46.2.1 - x86
Microsoft Windows 7 Ultimate 6.1.7600.0.1252.49.1031.18.1024.424 [GMT 2:00]
ausgeführt von:: c:\users\Dogan\Desktop\confi.exe.exe
Benutzte Befehlsschalter :: c:\users\Dogan\Desktop\CFScript.txt
.

(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\aaae.sys

.
((((((((((((((((((((((((((((((((((((((( Treiber/Dienste )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_AAAE
-------\Service_aaae


((((((((((((((((((((((( Dateien erstellt von 2010-04-19 bis 2010-05-19 ))))))))))))))))))))))))))))))
.

2010-05-19 07:55 . 2010-05-19 07:55 -------- d-----w- C:\Device
2010-05-19 07:55 . 2010-05-19 07:58 -------- d-----w- c:\users\Dogan\AppData\Local\temp
2010-05-19 07:55 . 2010-05-19 07:55 -------- d-----w- c:\users\Public\AppData\Local\temp
2010-05-18 20:04 . 2010-05-18 20:04 -------- d-----w- C:\_OTL
2010-05-18 11:44 . 2010-05-18 11:44 -------- d-----w- c:\program files\DiskInternals
2010-05-17 15:17 . 2010-05-17 15:24 -------- d-----w- c:\users\Dogan\AppData\Roaming\TeamViewer
2010-05-17 15:15 . 2010-05-17 15:18 -------- d-----w- c:\users\Dogan\temp
2010-05-17 13:00 . 2010-05-17 13:00 -------- d-----w- c:\users\Dogan\FileZillaPortable
2010-05-17 09:47 . 2010-05-17 09:47 -------- d-----w- c:\program files\Trend Micro
2010-05-15 16:00 . 2009-11-12 12:48 7168 ----a-w- c:\windows\system32\drivers\StarOpen.sys
2010-05-15 15:40 . 2010-01-16 08:57 -------- d-----w- c:\users\Dogan\JungleFlasher 1.65
2010-05-15 15:36 . 2010-05-15 15:36 -------- d-----w- c:\program files\Lavalys
2010-05-14 13:19 . 2010-05-14 13:19 -------- d-----w- c:\users\Dogan\AppData\Roaming\Need for Speed World
2010-05-14 12:54 . 2010-05-14 12:54 -------- d-----w- c:\users\Dogan\AppData\Local\Electronic_Arts_Inc
2010-05-13 18:33 . 2010-05-13 18:33 -------- d-----w- c:\program files\Common Files\Steam
2010-05-13 18:33 . 2010-05-15 11:28 -------- d-----w- c:\program files\Steam
2010-05-13 09:13 . 2010-05-13 09:13 -------- d-----w- c:\users\Dogan\AppData\Local\MAGIX
2010-05-12 20:33 . 2010-05-12 20:33 -------- d-----w- c:\users\Dogan\AppData\Roaming\MAGIX
2010-05-12 20:28 . 2010-05-13 09:15 -------- d-----w- c:\program files\MAGIX
2010-05-12 20:28 . 2007-04-27 07:43 120200 ----a-w- c:\windows\system32\DLLDEV32i.dll
2010-05-12 20:28 . 2010-05-13 09:14 -------- d-----w- c:\program files\Common Files\MAGIX Services
2010-05-12 20:21 . 2010-05-12 20:21 -------- d-----w- c:\users\Dogan\.gimp-2.6
2010-05-11 15:37 . 2010-05-11 15:37 -------- d-----w- c:\users\Dogan\AppData\Roaming\Malwarebytes
2010-05-11 15:37 . 2010-04-29 13:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-05-11 15:37 . 2010-05-11 15:37 -------- d-----w- c:\programdata\Malwarebytes
2010-05-11 15:37 . 2010-05-11 15:37 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-05-11 15:37 . 2010-04-29 13:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-05-08 12:59 . 2010-05-08 12:59 -------- d-----w- c:\users\Dogan\AppData\Local\GameTuts
2010-05-08 12:59 . 2010-05-08 12:59 -------- d-----w- c:\users\Dogan\AppData\Roaming\GameTuts
2010-05-08 10:51 . 2010-05-08 10:51 -------- d-----w- c:\program files\Microsoft SQL Server Compact Edition
2010-05-08 10:50 . 2010-05-08 10:50 -------- d-----w- c:\program files\Microsoft
2010-05-08 10:49 . 2010-05-08 10:53 -------- d-----w- c:\program files\Windows Live
2010-05-08 10:49 . 2010-05-08 10:49 -------- d-----w- c:\windows\PCHEALTH
2010-05-07 14:05 . 2010-05-07 14:05 -------- d-----w- c:\program files\TMShootBox
2010-04-29 14:55 . 2010-05-03 20:03 -------- d-----w- c:\program files\Microsoft Silverlight
2010-04-27 14:26 . 2010-05-04 14:03 -------- d-----w- c:\users\Dogan\AppData\Roaming\CoSoSys
2010-04-27 14:17 . 2010-04-27 14:17 -------- d-----w- c:\programdata\TrueCrypt
2010-04-27 13:51 . 2010-05-04 14:03 -------- d-----w- c:\program files\Acronis
2010-04-27 13:34 . 2010-05-04 14:03 -------- d-----w- C:\SWSetup
2010-04-27 13:25 . 2010-04-27 13:25 -------- d-----w- c:\programdata\createpart
2010-04-27 13:24 . 2010-04-27 13:24 -------- d-----w- c:\programdata\explauncher
2010-04-27 13:24 . 2010-04-27 13:24 -------- d-----w- c:\programdata\launcher
2010-04-27 13:23 . 2010-05-04 14:03 -------- d-----w- c:\program files\Paragon Software
2010-04-27 13:17 . 2010-02-23 09:51 14848 ----a-w- c:\windows\system32\EuEpmGdi.dll
2010-04-27 13:17 . 2010-04-08 15:16 1711232 ----a-w- c:\windows\system32\BootMan.exe
2010-04-27 13:17 . 2010-02-23 09:51 86408 ----a-w- c:\windows\system32\setupempdrv03.exe
2010-04-27 13:17 . 2010-02-23 09:51 8456 ----a-w- c:\windows\system32\EuGdiDrv.sys
2010-04-27 13:17 . 2010-02-23 09:51 14216 ----a-w- c:\windows\system32\epmntdrv.sys
2010-04-27 13:16 . 2010-05-04 13:10 -------- d-----w- c:\program files\EASEUS
2010-04-22 17:37 . 2010-04-30 22:56 -------- d-----w- c:\users\Dogan\TM SERVER ORNDER
2010-04-22 17:07 . 2010-05-12 15:52 -------- d-----w- c:\users\Dogan\Neuer Ordner (3)
2010-04-20 20:02 . 2010-04-24 10:59 -------- d-----w- c:\users\Dogan\AppData\Local\Adobe
2010-04-20 15:55 . 2010-04-20 15:56 -------- d-----w- c:\users\Dogan\Neuer Ordner (2)
2010-04-20 13:00 . 2010-04-22 17:37 -------- d-----w- c:\users\Dogan\Neuer Ordner

.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-05-19 07:42 . 2009-07-14 08:47 3587532 ----a-w- c:\windows\system32\perfh007.dat
2010-05-19 07:42 . 2009-07-14 08:47 1039540 ----a-w- c:\windows\system32\perfc007.dat
2010-05-18 16:10 . 2009-12-20 12:49 -------- d-----w- c:\users\Dogan\AppData\Roaming\Skype
2010-05-18 14:12 . 2009-11-01 15:44 -------- d-----w- c:\users\Dogan\AppData\Roaming\ICQ
2010-05-18 14:06 . 2009-12-20 12:58 -------- d-----w- c:\users\Dogan\AppData\Roaming\skypePM
2010-05-15 16:14 . 2010-03-31 12:30 -------- d-----w- c:\program files\Common Files\Nero
2010-05-15 16:14 . 2010-03-31 12:30 -------- d-----w- c:\programdata\Nero
2010-05-15 16:00 . 2009-11-01 15:39 -------- d-----w- c:\program files\CDBurnerXP
2010-05-15 08:33 . 2010-04-13 19:47 214808 ----a-w- c:\windows\system32\PnkBstrB.exe
2010-05-15 08:18 . 2010-04-13 19:47 139920 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys
2010-05-13 09:16 . 2010-02-08 19:00 -------- d-----w- c:\program files\Sony Ericsson
2010-05-13 09:16 . 2010-04-15 16:15 -------- d-----w- c:\program files\Unlocker
2010-05-13 09:15 . 2010-05-12 20:31 -------- d-----w- c:\programdata\MAGIX
2010-05-07 20:16 . 2009-11-10 19:46 1 ----a-w- c:\users\Dogan\AppData\Roaming\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
2010-05-06 08:36 . 2009-11-01 15:17 221568 ------w- c:\windows\system32\MpSigStub.exe
2010-05-04 13:11 . 2010-04-17 08:02 -------- d-----w- c:\users\Dogan\AppData\Roaming\vlc
2010-05-04 13:11 . 2010-02-02 17:34 -------- d-----w- c:\users\Dogan\AppData\Roaming\dvdcss
2010-05-04 13:11 . 2009-11-01 15:41 -------- d-----w- c:\program files\XMedia Recode
2010-04-24 11:01 . 2010-04-18 10:18 -------- d-----w- c:\program files\AVS4YOU
2010-04-24 11:01 . 2010-04-18 10:18 -------- d-----w- c:\program files\Common Files\AVSMedia
2010-04-22 17:05 . 2010-02-28 18:36 -------- d-----w- c:\program files\ServerMania
2010-04-21 17:21 . 2009-12-20 10:47 -------- d-----w- c:\program files\TeamSpeak 3 Client
2010-04-21 17:20 . 2009-11-08 12:37 -------- d-----w- c:\program files\Songr
2010-04-19 17:59 . 2009-11-10 16:08 -------- d-----w- c:\users\Dogan\AppData\Roaming\VSO
2010-04-18 10:48 . 2010-04-18 10:48 -------- d-----w- c:\programdata\AVS4YOU
2010-04-18 10:19 . 2009-11-01 15:28 65744 ----a-w- c:\users\Dogan\AppData\Local\GDIPFONTCACHEV1.DAT
2010-04-18 10:19 . 2010-04-18 10:19 -------- d-----w- c:\users\Dogan\AppData\Roaming\AVS4YOU
2010-04-18 10:14 . 2010-01-11 17:25 -------- d-----w- c:\program files\ProgDVB
2010-04-13 19:46 . 2010-04-13 19:46 75064 ----a-w- c:\windows\system32\PnkBstrA.exe
2010-04-13 19:44 . 2010-04-13 19:44 -------- d-----w- c:\users\Dogan\AppData\Roaming\Need for Speed World Online
2010-04-13 19:02 . 2009-11-01 16:16 -------- d-----w- c:\program files\Electronic Arts
2010-04-12 17:15 . 2010-04-12 17:14 -------- d-----w- c:\program files\SweetIM
2010-04-11 16:50 . 2010-04-11 16:49 -------- d-----w- c:\program files\ICQ7.1
2010-04-11 16:49 . 2009-11-01 15:05 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-04-09 15:25 . 2010-04-08 12:45 -------- d-----w- c:\programdata\TrackMania
2010-04-08 12:45 . 2010-04-08 12:27 -------- d-----w- c:\program files\TmUnitedForever
2010-04-08 11:58 . 2009-11-01 16:00 -------- d-----w- c:\program files\TmNationsForever
2010-04-04 16:47 . 2009-11-23 18:32 -------- d-----w- c:\users\Dogan\AppData\Roaming\XnView
2010-04-04 16:25 . 2009-11-23 18:30 -------- d-----w- c:\program files\XnView
2010-04-01 00:14 . 2010-04-01 00:14 -------- d-----w- c:\program files\NaturalSoft
2010-04-01 00:09 . 2009-11-01 15:05 -------- d-----w- c:\program files\Common Files\InstallShield
2010-04-01 00:08 . 2010-04-01 00:08 -------- d-----w- c:\program files\Common Files\L&H
2010-03-31 13:23 . 2010-03-31 12:42 -------- d-----w- c:\users\Dogan\AppData\Roaming\Nero
2010-03-31 11:52 . 2010-03-31 11:52 -------- d-----w- c:\users\Dogan\AppData\Roaming\Canneverbe Limited
2010-03-26 20:27 . 2009-12-16 19:35 -------- d-----w- c:\program files\Google
2010-03-26 16:50 . 2010-03-07 12:53 -------- d-----w- c:\program files\RADVideo
2010-03-26 16:43 . 2010-03-25 21:33 -------- d-----w- c:\programdata\DivX
2010-03-26 16:42 . 2010-03-25 21:24 -------- d-----w- c:\program files\DivX
2010-03-26 16:42 . 2010-03-25 21:35 -------- d-----w- c:\program files\Common Files\PX Storage Engine
2010-03-25 22:19 . 2010-03-25 21:35 -------- d-----w- c:\users\Dogan\AppData\Roaming\DivX
2010-03-25 21:33 . 2010-03-25 21:35 986904 ----a-w- c:\programdata\DivX\Setup\DivXSetup.exe
2010-03-25 18:23 . 2010-01-11 15:42 1170240 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight-2\SpotlightResources.dll
2010-03-25 17:43 . 2010-03-25 17:43 -------- d-----w- c:\users\Dogan\AppData\Roaming\Avira
2010-03-25 17:40 . 2010-03-25 17:25 -------- d-----w- c:\program files\Handbrake
2010-03-25 17:25 . 2010-03-25 17:25 -------- d-----w- c:\users\Dogan\AppData\Roaming\HandBrake
2010-03-21 19:44 . 2010-03-21 19:24 -------- d-----w- c:\programdata\Norton
2010-03-21 19:24 . 2010-03-21 19:24 -------- d-----w- c:\programdata\Symantec
2010-03-21 19:24 . 2010-03-21 19:24 -------- d-----w- c:\programdata\NortonInstaller
2010-03-18 14:35 . 2010-03-18 14:35 1585608 ----a-w- c:\programdata\Skype\Plugins\Plugins\F35E193DC3E84933B83DE961D9AC33BF\SketchPad.exe
2010-03-01 08:05 . 2009-11-01 15:11 124784 ----a-w- c:\windows\system32\drivers\avipbb.sys
2010-02-25 16:28 . 2010-02-25 16:28 9624 ----a-w- c:\users\Dogan\AppData\Roaming\Microsoft\IdentityCRL\production\WLIDClientConfig.dll
2009-06-10 21:26 . 2009-07-14 02:04 9633792 --sha-r- c:\windows\Fonts\StaticCache.dat
2009-07-14 01:14 . 2009-07-13 23:42 396800 --sha-w- c:\windows\winsxs\x86_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7600.16385_none_f12e83abb108c86c\WinMail.exe
.

(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{EEE6C35D-6118-11DC-9C72-001320C79847}"= "c:\program files\SweetIM\Toolbars\Internet Explorer\mgHelper.dll" [2010-03-18 187192]

[HKEY_CLASSES_ROOT\clsid\{eee6c35d-6118-11dc-9c72-001320c79847}]
[HKEY_CLASSES_ROOT\SweetIM_URLSearchHook.ToolbarURLSearchHook.1]
[HKEY_CLASSES_ROOT\TypeLib\{EEE6C35F-6118-11DC-9C72-001320C79847}]
[HKEY_CLASSES_ROOT\SweetIM_URLSearchHook.ToolbarURLSearchHook]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{EEE6C35C-6118-11DC-9C72-001320C79847}]
2010-03-18 14:06 1361208 ----a-r- c:\program files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{EEE6C35B-6118-11DC-9C72-001320C79847}"= "c:\program files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll" [2010-03-18 1361208]

[HKEY_CLASSES_ROOT\clsid\{eee6c35b-6118-11dc-9c72-001320c79847}]
[HKEY_CLASSES_ROOT\SWEETIE.IEToolbar.1]
[HKEY_CLASSES_ROOT\TypeLib\{EEE6C35E-6118-11DC-9C72-001320C79847}]
[HKEY_CLASSES_ROOT\SWEETIE.IEToolbar]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{EEE6C35B-6118-11DC-9C72-001320C79847}"= "c:\program files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll" [2010-03-18 1361208]

[HKEY_CLASSES_ROOT\clsid\{eee6c35b-6118-11dc-9c72-001320c79847}]
[HKEY_CLASSES_ROOT\SWEETIE.IEToolbar.1]
[HKEY_CLASSES_ROOT\TypeLib\{EEE6C35E-6118-11DC-9C72-001320C79847}]
[HKEY_CLASSES_ROOT\SWEETIE.IEToolbar]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"="SOUNDMAN.EXE" [2009-04-14 604704]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2010-03-02 282792]
"PAC7302_Monitor"="c:\windows\PixArt\PAC7302\Monitor.exe" [2006-11-03 319488]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-11-12 149280]
"SweetIM"="c:\program files\SweetIM\Messenger\SweetIM.exe" [2010-03-17 106496]

c:\users\Dogan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
DeskPins.lnk - c:\program files\DeskPins\DeskPins.exe [2004-5-2 62464]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 2 (0x2)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux6"=wdmaud.drv

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"EPSON SX100 Series"=c:\windows\system32\spool\DRIVERS\W32X86\3\E_FATIEDE.EXE /FU "c:\windows\TEMP\E_S2AEA.tmp" /EF "HKCU"
"Google Update"="c:\users\Dogan\AppData\Local\Google\Update\GoogleUpdate.exe" /c

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"SweetIM"=c:\program files\SweetIM\Messenger\SweetIM.exe

R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-02-20 135664]
R3 ASPI;Advanced SCSI Programming Interface Driver;c:\windows\System32\DRIVERS\ASPI32.sys [2002-07-17 84832]
R3 cmudau32;C-Media USB UDA Sound Interface;c:\windows\system32\drivers\cmudaxu.sys [2006-02-10 1391040]
R3 cpuz130;cpuz130;c:\users\Dogan\AppData\Local\Temp\cpuz130\cpuz_x32.sys [x]
R3 EC168BDA;EC168BDA service;c:\windows\system32\DRIVERS\EC168BDA.sys [2007-09-11 87296]
R3 epmntdrv;epmntdrv;c:\windows\system32\epmntdrv.sys [2010-02-23 14216]
R3 EuGdiDrv;EuGdiDrv;c:\windows\system32\EuGdiDrv.sys [2010-02-23 8456]
R3 ggflt;SEMC USB Flash Driver Filter;c:\windows\system32\DRIVERS\ggflt.sys [2010-02-08 13224]
R3 NVIDIAHWAccess;NVIDIAHWAccess;c:\users\Dogan\AppData\Roaming\NVIDIA\HWAccess.sys [x]
R3 PRODIGY;PRODIGY;c:\windows\system32\Drivers\PRODIGY.SYS [2006-08-29 32377]
S2 AntiVirSchedulerService;Avira AntiVir Planer;c:\program files\Avira\AntiVir Desktop\sched.exe [2010-02-24 135336]
S3 seehcri;Sony Ericsson seehcri Device Driver;c:\windows\system32\DRIVERS\seehcri.sys [2010-02-08 27632]

.
Inhalt des "geplante Tasks" Ordners

2010-05-19 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-20 14:06]

2010-05-19 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-20 14:06]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://hemenarabul.net
mStart Page = hxxp://hemenarabul.net
mLocal Page = hxxp://www.searchturk.tk
mSearch Bar = hxxp://www.searchturk.tk
IE: {{71BFC818-0CED-42D6-9C87-5142918957EE} - c:\program files\ICQ7.1\ICQ.exe
TCP: {AAEA8A51-4771-4F59-8AFB-E5E228C02243} = 169.254.1.8
TCP: {E68185B5-D304-448C-9755-34D1071C40F6} = 195.50.140.248 195.50.140.246
FF - ProfilePath - c:\users\Dogan\AppData\Roaming\Mozilla\Firefox\Profiles\7hoqlp6v.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.de/
FF - plugin: c:\program files\Google\Update\1.2.183.23\npGoogleOneClick8.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Win7codecs\rm\browser\plugins\nppl3260.dll
FF - plugin: c:\program files\Win7codecs\rm\browser\plugins\nprpjplug.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll

---- FIREFOX Richtlinien ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\windows\system32\nvvsvc.exe
c:\windows\system32\nvvsvc.exe
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\program files\CDBurnerXP\NMSAccessU.exe
c:\windows\system32\PnkBstrA.exe
c:\windows\system32\taskhost.exe
c:\program files\Avira\AntiVir Desktop\avshadow.exe
c:\windows\system32\conhost.exe
c:\windows\system32\conhost.exe
c:\windows\SOUNDMAN.EXE
.
**************************************************************************
.
Zeit der Fertigstellung: 2010-05-19 10:03:35 - PC wurde neu gestartet
ComboFix-quarantined-files.txt 2010-05-19 08:03
ComboFix2.txt 2010-05-18 20:51

Vor Suchlauf: 18 Verzeichnis(se), 43.335.471.104 Bytes frei
Nach Suchlauf: 20 Verzeichnis(se), 43.153.145.856 Bytes frei

- - End Of File - - EFB254D4047B4E832657DE332606A94E