TR/Dropper.Gen2

ComboFix 10-09-14.01 - expert 14.09.2010  19:23:25.1.4 - x86
Microsoft Windows 7 Home Premium   6.1.7600.0.1252.49.1031.18.3566.2543 [GMT 2:00]
ausgeführt von:: c:\users\expert\Downloads\ComboFix.exe
.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\programdata\FullRemove.exe
c:\users\expert\AppData\Local\_xx_server.exe
c:\users\expert\AppData\Local\keylog.dat
c:\users\expert\AppData\Roaming\.#
c:\windows\SEC
c:\windows\SEC\172100logo.bmp
c:\windows\SEC\banner.png
c:\windows\SEC\Computer.png
c:\windows\SEC\Media _S_ Logo.png
c:\windows\SEC\Samsung.png
c:\windows\SEC\Samsung2.png
c:\windows\SEC\SamsungLogo.png
c:\windows\SEC\Thumbs.db
c:\windows\SEC\Wallpapers\Thumbs.db
c:\windows\SEC\Wallpapers\wallpaper.jpg
c:\windows\SEC\Wallpapers\wallpaper1.jpg
c:\windows\SEC\Wallpapers\Wallpaper2.jpg

.
(((((((((((((((((((((((   Dateien erstellt von 2010-08-14 bis 2010-09-14  ))))))))))))))))))))))))))))))
.

2010-09-14 17:27 . 2010-09-14 17:27	--------	d-----w-	c:\users\Gast\AppData\Local\temp
2010-09-14 17:27 . 2010-09-14 17:27	--------	d-----w-	c:\users\Default\AppData\Local\temp
2010-09-12 23:00 . 2010-09-12 23:00	--------	d-----w-	c:\windows\system32\Adobe
2010-09-10 00:19 . 2010-09-10 00:19	--------	d-----w-	c:\users\expert\AppData\Roaming\vlc
2010-09-09 23:09 . 2010-09-12 21:35	--------	d-----w-	c:\users\Maximilian\AppData\Local\Microsoft
2010-09-09 23:09 . 2010-09-12 21:35	--------	d-----w-	c:\users\Maximilian
2010-09-08 13:49 . 2010-09-08 13:49	--------	d-----w-	c:\users\Gast\AppData\Roaming\Apple Computer
2010-09-08 13:49 . 2010-09-08 13:49	--------	d-----w-	c:\users\Gast\AppData\Local\Power2Go
2010-08-25 07:16 . 2010-04-07 07:10	571904	----a-w-	c:\windows\system32\oleaut32.dll
2010-08-22 18:13 . 2010-08-22 18:13	--------	d-----w-	c:\users\expert\AppData\Roaming\EPSON
2010-08-17 19:08 . 2010-08-17 19:20	--------	d-----w-	c:\programdata\NOS

.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-09-12 21:08 . 2010-05-07 12:01	--------	d-----w-	c:\program files\Common Files\DVDVideoSoft
2010-09-12 21:05 . 2010-04-15 12:03	--------	d-----w-	c:\users\expert\AppData\Roaming\Skype
2010-09-12 20:45 . 2010-04-15 12:04	--------	d-----w-	c:\users\expert\AppData\Roaming\skypePM
2010-08-17 19:29 . 2010-05-06 14:35	--------	d-----w-	c:\programdata\DivX
2010-07-29 06:30 . 2010-08-11 12:14	197632	----a-w-	c:\windows\system32\ir32_32.dll
2010-07-29 06:30 . 2010-08-11 12:14	82944	----a-w-	c:\windows\system32\iccvid.dll
2010-07-19 14:26 . 2010-07-19 14:26	--------	d-----w-	c:\programdata\Blizzard Entertainment
2010-07-19 12:55 . 2010-07-19 11:56	--------	d-----w-	c:\program files\Common Files\Blizzard Entertainment
2010-07-19 11:55 . 2010-07-19 11:55	--------	d-----w-	c:\programdata\Blizzard
2010-07-18 18:11 . 2010-05-06 14:36	57344	----a-w-	c:\programdata\DivX\RunAsUser\RUNASUSERPROCESS.dll
2010-07-18 18:06 . 2010-07-18 18:06	56765	----a-w-	c:\programdata\DivX\DivXPlusShortcuts\Uninstaller.exe
2010-07-18 18:06 . 2010-05-06 14:35	--------	d-----w-	c:\program files\DivX
2010-07-18 18:06 . 2010-07-18 18:06	56997	----a-w-	c:\programdata\DivX\WebPlayer\Uninstaller.exe
2010-07-18 18:06 . 2010-07-18 18:06	53600	----a-w-	c:\programdata\DivX\Update\Uninstaller.exe
2010-07-18 18:06 . 2010-07-18 18:06	57715	----a-w-	c:\programdata\DivX\Player\Uninstaller.exe
2010-07-18 18:05 . 2010-07-18 18:05	54153	----a-w-	c:\programdata\DivX\DFXPlugin\Uninstaller.exe
2010-07-18 18:05 . 2010-07-18 18:05	54128	----a-w-	c:\programdata\DivX\Converter\Uninstaller.exe
2010-07-18 18:05 . 2010-07-18 18:05	54644	----a-w-	c:\programdata\DivX\TranscodeEngine\Uninstaller.exe
2010-07-18 18:05 . 2010-07-18 18:05	54101	----a-w-	c:\programdata\DivX\MPEG2Plugin\Uninstaller.exe
2010-07-18 18:04 . 2010-05-06 14:36	895256	----a-w-	c:\programdata\DivX\Setup\DivXSetup.exe
2010-07-18 18:04 . 2010-05-06 14:36	1062184	----a-w-	c:\programdata\DivX\Setup\Resource.dll
2010-07-12 18:15 . 2009-12-05 22:15	654166	----a-w-	c:\windows\system32\perfh007.dat
2010-07-12 18:15 . 2009-12-05 22:15	130006	----a-w-	c:\windows\system32\perfc007.dat
2010-06-30 06:25 . 2010-08-11 12:14	978432	----a-w-	c:\windows\system32\wininet.dll
2010-06-22 02:47 . 2010-08-11 12:14	310784	----a-w-	c:\windows\system32\drivers\srv.sys
2010-06-22 02:47 . 2010-08-11 12:14	307200	----a-w-	c:\windows\system32\drivers\srv2.sys
2010-06-22 02:47 . 2010-08-11 12:14	113664	----a-w-	c:\windows\system32\drivers\srvnet.sys
2010-06-19 06:33 . 2010-08-11 12:14	3955080	----a-w-	c:\windows\system32\ntkrnlpa.exe
2010-06-19 06:33 . 2010-08-11 12:14	3899784	----a-w-	c:\windows\system32\ntoskrnl.exe
2010-06-19 06:23 . 2010-08-11 12:14	37376	----a-w-	c:\windows\system32\rtutils.dll
2010-06-19 04:07 . 2010-08-11 12:14	2326016	----a-w-	c:\windows\system32\win32k.sys
2009-06-10 21:26 . 2009-07-14 02:04	9633792	--sha-r-	c:\windows\Fonts\StaticCache.dat
2009-07-14 01:14 . 2009-07-13 23:42	396800	--sha-w-	c:\windows\winsxs\x86_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7600.16385_none_f12e83abb108c86c\WinMail.exe
.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-12-05 39408]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-07-14 1173504]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2009-10-29 7862816]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2009-10-10 1578280]
"UpdateLBPShortCut"="c:\program files\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe" [2009-05-19 222504]
"CLMLServer"="c:\program files\CyberLink\Power2Go\CLMLSvc.exe" [2009-06-03 103720]
"UpdateP2GoShortCut"="c:\program files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" [2009-05-19 222504]
"UpdatePDRShortCut"="c:\program files\CyberLink\PowerDirector\MUITransfer\MUIStartMenu.exe" [2008-01-04 222504]
"RemoteControl8"="c:\program files\CyberLink\PowerDVD8\PDVD8Serv.exe" [2009-04-15 91432]
"PDVD8LanguageShortcut"="c:\program files\CyberLink\PowerDVD8\Language\Language.exe" [2009-04-15 50472]
"UpdatePPShortCut"="c:\program files\CyberLink\PowerProducer\MUITransfer\MUIStartMenu.exe" [2008-12-03 218408]
"UpdatePSTShortCut"="c:\program files\CyberLink\DVD Suite\MUITransfer\MUIStartMenu.exe" [2009-07-21 210216]
"APLangApp"="c:\program files\AnyPC Client\APLangApp.exe" [2009-10-20 13312]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-11-04 13830760]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"UCam_Menu"="c:\program files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" [2009-05-19 222504]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2010-03-02 282792]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-03-17 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-04-28 142120]
"DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2010-06-03 1144104]

c:\users\expert\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2008-10-25 98696]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"mixer8"=wdmaud.drv

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-04-15 135664]
R3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt86win7.sys [2009-07-13 139776]
S1 SABI;SAMSUNG Kernel Driver For Windows 7;c:\windows\system32\Drivers\SABI.sys [2009-05-28 10752]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-13 48128]
S2 AntiVirSchedulerService;Avira AntiVir Planer;c:\program files\Avira\AntiVir Desktop\sched.exe [2010-02-24 135336]
S2 OberonGameConsoleService;Oberon Media Game Console service;c:\program files\Samsung Casual Games\GameConsole\OberonGameConsoleService.exe [2009-08-13 44312]
S2 Rezip;Rezip;c:\windows\SYSTEM32\Rezip.exe [2009-03-05 311296]
S3 Impcd;Impcd;c:\windows\system32\DRIVERS\Impcd.sys [2009-10-26 125696]
S3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda32v.sys [2009-06-27 66080]
S3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x86.sys [2009-09-28 315392]

.
Inhalt des "geplante Tasks" Ordners

2010-09-14 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-04-15 11:37]

2010-09-14 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-04-15 11:37]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.google.de/
uInternet Settings,ProxyOverride = *.local
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html
IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\users\expert\AppData\Roaming\Mozilla\Firefox\Profiles\df8o1tcy.default\
FF - prefs.js: browser.startup.homepage - google.de
FF - plugin: c:\program files\DivX\DivX Plus Web Player\npdivx32.dll
FF - plugin: c:\program files\Google\Update\1.2.183.29\npGoogleOneClick8.dll
FF - plugin: c:\program files\Microsoft\Office Live\npOLW.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll

---- FIREFOX Richtlinien ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true); 
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true); 
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -

Toolbar-Locked - (no file)
HKCU-Run-Server - c:\users\expert\AppData\Local\_xx_server.exe
SafeBoot-mcmscsvc
SafeBoot-MCODS


.
--------------------- Gesperrte Registrierungsschluessel ---------------------

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2010-09-14  19:29:52
ComboFix-quarantined-files.txt  2010-09-14 17:29

Vor Suchlauf: 8 Verzeichnis(se), 186.014.904.320 Bytes frei
Nach Suchlauf: 12 Verzeichnis(se), 186.644.955.136 Bytes frei

- - End Of File - - 3CAADC73E866BD0948AB56105B2591F6