Soooo weiter gehts
Code:
Alles auswählen Aufklappen ATTFilter
ComboFix 11-01-25.05 - Spirit 27.01.2011 0:17.1.1 - x86
Microsoft Windows 7 Ultimate 6.1.7600.0.1252.49.1031.18.2943.2368 [GMT 1:00]
ausgeführt von:: c:\users\Spirit\Desktop\cofi.exe
AV: ESET Smart Security 4.2 *Enabled/Updated* {77DEAFED-8149-104B-25A1-21771CA47CD1}
FW: ESET Personal Firewall *Enabled* {4FE52EC8-CB26-1113-0EFE-8842E2773BAA}
SP: ESET Smart Security 4.2 *Enabled/Updated* {CCBF4E09-A773-1FC5-1F11-1A056723366C}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\users\Spirit\AppData\Roaming\Local
c:\users\Spirit\AppData\Roaming\Local\Temp\DDM\Settings\0.ddi
c:\users\Spirit\AppData\Roaming\Local\Temp\DDM\Settings\1.ddi
c:\users\Spirit\AppData\Roaming\Local\Temp\DDM\Settings\2.ddi
c:\users\Spirit\AppData\Roaming\Local\Temp\DDM\Settings\intro_mfukui.avi.ddr
c:\users\Spirit\AppData\Roaming\Local\Temp\DDM\Settings\settings.ddi
c:\users\Spirit\AppData\Roaming\Local\Temp\DDM\Settings\Temporary Downloaded Files\(2).ddp
c:\users\Spirit\AppData\Roaming\Local\Temp\DDM\Settings\Temporary Downloaded Files\.ddp
c:\users\Spirit\AppData\Roaming\Local\Temp\DDM\Settings\Temporary Downloaded Files\intro_mfukui.avi.ddp
c:\users\Spirit\AppData\Roaming\Local\Temp\DDM\Settings\Temporary Downloaded Files\Post_Install_RB_HiQ_de.divx
c:\users\Spirit\AppData\Roaming\MSA
c:\windows\system32\Device.dll
c:\windows\system32\muzapp.exe
c:\windows\system32\system32
c:\windows\system32\system32\cis-2.4.dll
c:\windows\system32\system32\issacapi_bs-2.3.dll
c:\windows\system32\system32\issacapi_pe-2.3.dll
c:\windows\system32\system32\issacapi_se-2.3.dll
c:\windows\system32\system32\MACXMLProto.dll
c:\windows\system32\system32\MaDRM.dll
c:\windows\system32\system32\MaJGUILib.dll
c:\windows\system32\system32\MaJUtilLib.dll
c:\windows\system32\system32\MAMACExtract.dll
c:\windows\system32\system32\MASetupCaller.dll
c:\windows\system32\system32\MASetupCleaner.exe
c:\windows\system32\system32\MaXMLProto.dll
c:\windows\system32\system32\MetaStore2.dll
c:\windows\system32\system32\Microsoft.Synchronization.dll
c:\windows\system32\system32\MK_Lyric.dll
c:\windows\system32\system32\MSCLib.dll
c:\windows\system32\system32\MSFLib.dll
c:\windows\system32\system32\MSLUR71.dll
c:\windows\system32\system32\msvcp60.dll
c:\windows\system32\system32\MTTELECHIP.dll
c:\windows\system32\system32\MTXSYNCICON.dll
c:\windows\system32\system32\muzaf1.dll
c:\windows\system32\system32\muzapp.dll
c:\windows\system32\system32\muzapp.exe
c:\windows\system32\system32\muzdecode.ax
c:\windows\system32\system32\muzeffect.ax
c:\windows\system32\system32\muzmp4sp.ax
c:\windows\system32\system32\muzmpgsp.ax
c:\windows\system32\system32\muzoggsp.ax
c:\windows\system32\system32\muzwmts.dll
c:\windows\system32\system32\psapi.dll
c:\windows\system32\system32\Synchronization2.dll
.
((((((((((((((((((((((( Dateien erstellt von 2010-12-26 bis 2011-01-26 ))))))))))))))))))))))))))))))
.
2011-01-26 20:53 . 2011-01-26 20:53 -------- d-----w- C:\_OTL
2011-01-26 19:14 . 2011-01-26 19:14 -------- d-----w- c:\users\Spirit\AppData\Roaming\Malwarebytes
2011-01-26 19:14 . 2010-12-20 17:09 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-01-26 19:14 . 2011-01-26 19:14 -------- d-----w- c:\programdata\Malwarebytes
2011-01-26 19:14 . 2010-12-20 17:08 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-01-25 20:18 . 2009-11-25 11:47 99176 ----a-w- c:\windows\system32\PresentationHostProxy.dll
2011-01-25 20:18 . 2009-11-25 11:47 49472 ----a-w- c:\windows\system32\netfxperf.dll
2011-01-25 20:18 . 2009-11-25 11:47 297808 ----a-w- c:\windows\system32\mscoree.dll
2011-01-25 20:18 . 2009-11-25 11:47 295264 ----a-w- c:\windows\system32\PresentationHost.exe
2011-01-25 20:18 . 2009-11-25 11:47 1130824 ----a-w- c:\windows\system32\dfshim.dll
2011-01-25 20:12 . 2010-02-11 07:10 293376 ----a-w- c:\windows\system32\browserchoice.exe
2011-01-25 20:10 . 2009-12-11 07:44 133720 ----a-w- c:\windows\system32\drivers\ksecpkg.sys
2011-01-25 20:09 . 2010-08-27 05:46 168448 ----a-w- c:\windows\system32\srvsvc.dll
2011-01-25 20:07 . 2010-10-20 03:00 2327552 ----a-w- c:\windows\system32\win32k.sys
2011-01-25 16:24 . 2011-01-25 16:26 -------- d-----w- c:\program files\Windows Live Safety Center
2011-01-25 13:48 . 2008-02-05 14:36 798208 ----a-w- c:\windows\system32\NextControls.ocx
2011-01-25 13:48 . 2000-05-22 16:58 608448 ----a-w- c:\windows\system32\comctl32.ocx
2011-01-24 18:37 . 2011-01-24 18:37 -------- d-----w- c:\users\Spirit\AppData\Local\ESET
2011-01-24 14:59 . 2011-01-24 14:59 98392 ----a-w- c:\windows\system32\drivers\SBREDrv.sys
2011-01-24 14:56 . 2011-01-24 14:56 -------- d-----w- c:\users\Spirit\AppData\Local\Sunbelt Software
2011-01-24 14:54 . 2011-01-24 14:54 -------- d-----w- c:\program files\Lavasoft
2011-01-24 13:28 . 2011-01-13 08:41 357968 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2011-01-23 18:45 . 2011-01-24 17:28 -------- d-----w- c:\programdata\Alwil Software
2011-01-23 17:19 . 2011-01-26 21:30 -------- d-----w- c:\programdata\Spybot - Search & Destroy
2011-01-23 15:10 . 2011-01-23 15:10 79360 --sha-r- c:\windows\system32\dwmredirz.dll
2011-01-22 17:49 . 1997-07-19 15:55 1347344 ----a-w- c:\windows\system32\msvbvm50.dll
2011-01-17 17:55 . 2011-01-17 17:55 -------- d-----w- c:\programdata\Messenger Plus!
2011-01-17 17:55 . 2011-01-17 17:55 -------- d-----w- c:\program files\Messenger Plus! Live
2011-01-17 17:53 . 2011-01-17 17:53 -------- d-----w- c:\program files\Microsoft
2011-01-17 17:53 . 2011-01-17 17:53 -------- d-----w- c:\program files\Windows Live SkyDrive
2011-01-17 17:53 . 2011-01-17 17:53 -------- d-----w- c:\program files\Windows Live
2011-01-17 17:53 . 2011-01-17 17:53 -------- d-----w- c:\windows\PCHEALTH
2011-01-11 20:34 . 2011-01-11 20:34 -------- d-----w- c:\program files\TeamViewer
2011-01-11 02:39 . 2011-01-11 02:43 919040 ----a-w- c:\windows\system32\_launch.exe
2011-01-11 02:39 . 2011-01-11 02:39 518656 ----a-w- c:\windows\system32\BomberMan.exe
2011-01-11 02:39 . 2011-01-11 02:39 471552 ----a-w- c:\windows\system32\bmo.dll
2011-01-10 22:04 . 2011-01-11 15:06 -------- d-----w- c:\users\Spirit\AppData\Roaming\skypePM
2011-01-10 22:03 . 2011-01-10 22:03 -------- d-----w- c:\program files\Common Files\Skype
2011-01-10 22:02 . 2011-01-11 20:47 -------- d-----w- c:\users\Spirit\AppData\Roaming\Skype
2011-01-10 22:02 . 2011-01-10 22:02 -------- d-----w- c:\programdata\Skype
2011-01-07 17:32 . 2011-01-10 23:28 270240 ----a-w- c:\windows\system32\PnkBstrB.xtr
2011-01-07 17:30 . 2011-01-07 17:30 -------- d-----w- c:\users\Spirit\AppData\Local\PunkBuster
2011-01-07 17:28 . 2011-01-10 23:28 139080 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys
2011-01-07 17:28 . 2011-01-07 17:28 138056 ----a-w- c:\users\Spirit\AppData\Roaming\PnkBstrK.sys
2011-01-07 17:27 . 2011-01-10 23:28 270240 ----a-w- c:\windows\system32\PnkBstrB.exe
2011-01-07 17:27 . 2011-01-10 23:21 270240 ----a-w- c:\windows\system32\PnkBstrB.ex0
2011-01-07 17:27 . 2011-01-07 17:27 75136 ----a-w- c:\windows\system32\PnkBstrA.exe
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-11-12 00:44 . 2010-11-12 00:44 94208 ----a-w- c:\windows\system32\dpl100.dll
2010-11-08 22:57 . 2010-11-08 22:57 353592 ----a-w- c:\windows\system32\DivXControlPanelApplet.cpl
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"mixer3"=wdmaud.drv
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Malwarebytes' Anti-Malware (reboot)]
2010-12-20 17:08 963976 ----a-w- d:\programme\Malwarebytes' Anti-Malware\mbam.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"ATICustomerCare"="c:\program files\ATI\ATICustomerCare\ATICustomerCare.exe"
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe"
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" -atboottime
"DivX Download Manager"="c:\program files\DivX\DivX Plus Web Player\DDmService.exe" start
"Windows Mobile Device Center"=%windir%\WindowsMobile\wmdc.exe
R1 aswSnx;aswSnx; [x]
R3 epmntdrv;epmntdrv;c:\windows\system32\epmntdrv.sys [2009-02-23 9728]
R3 EuGdiDrv;EuGdiDrv;c:\windows\system32\EuGdiDrv.sys [2009-02-23 3072]
R3 FXDrv32;FXDrv32;E:\FXDrv32.sys [x]
R3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des [2009-12-16 3453712]
R3 sscebus;SAMSUNG USB Composite Device V2 driver (WDM);c:\windows\system32\DRIVERS\sscebus.sys [2010-04-27 98560]
R3 sscemdfl;SAMSUNG Mobile Modem V2 Filter;c:\windows\system32\DRIVERS\sscemdfl.sys [2010-04-27 14848]
R3 sscemdm;SAMSUNG Mobile Modem V2 Drivers;c:\windows\system32\DRIVERS\sscemdm.sys [2010-04-27 123648]
R3 TeamViewer6;TeamViewer 6;c:\program files\TeamViewer\Version6\TeamViewer_Service.exe [2010-12-07 2228008]
R3 XDva289;XDva289;c:\windows\system32\XDva289.sys [x]
R4 Winstep Xtreme Service;Winstep Xtreme Service;d:\programme\Winstep\WsxService [x]
S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2009-12-25 691696]
S2 Akamai;Akamai NetSession Interface;c:\windows\System32\svchost.exe [2009-07-14 20992]
S2 dgdersvc;Device Error Recovery Service;c:\windows\system32\dgdersvc.exe [2010-09-09 95568]
S2 FsUsbExService;FsUsbExService;c:\windows\system32\FsUsbExService.Exe [2010-07-26 217088]
S3 dgderdrv;dgderdrv;c:\windows\system32\drivers\dgderdrv.sys [2010-09-09 18120]
S3 FsUsbExDisk;FsUsbExDisk;c:\windows\system32\FsUsbExDisk.SYS [2010-09-09 36640]
S3 KMWDFILTERx86;HIDServiceDesc;c:\windows\system32\DRIVERS\KMWDFILTER.sys [2009-04-29 25088]
S3 RTL8167;Realtek 8167 NT-Treiber;c:\windows\system32\DRIVERS\Rt86win7.sys [2009-07-13 139776]
--- Andere Dienste/Treiber im Speicher ---
*NewlyCreated* - FSUSBEXDISK
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
Akamai REG_MULTI_SZ Akamai
WindowsMobile REG_MULTI_SZ wcescomm rapimgr
LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr
.
Inhalt des "geplante Tasks" Ordners
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://start.icq.com/
uInternet Settings,ProxyOverride = *.local
FF - ProfilePath - c:\users\Spirit\AppData\Roaming\Mozilla\Firefox\Profiles\6k6sjex9.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2843456&SearchSource=3&q={searchTerms}
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.google.de/
FF - prefs.js: keyword.URL - hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.1.6&q=
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
FF - Ext: Noia 2.0 (eXtreme): {9f08cb5a-76b1-4bcf-aff9-90e1a5d60b1e} - %profile%\extensions\{9f08cb5a-76b1-4bcf-aff9-90e1a5d60b1e}
FF - Ext: Adblock Plus: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} - %profile%\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
FF - Ext: Noia 2.0 eXtreme OPT: noia2_option@kk.noia - %profile%\extensions\noia2_option@kk.noia
FF - Ext: German Dictionary: de-DE@dictionaries.addons.mozilla.org - %profile%\extensions\de-DE@dictionaries.addons.mozilla.org
FF - Ext: Battlefield Heroes Updater: battlefieldheroespatcher@ea.com - %profile%\extensions\battlefieldheroespatcher@ea.com
FF - Ext: Aero Fox Silver XL: {5c876f30-10ce-11dd-bd0b-0800200c9a66} - %profile%\extensions\{5c876f30-10ce-11dd-bd0b-0800200c9a66}
FF - Ext: Bloomind FT Graphite: {8225d6f0-dfca-11df-85ca-0800200c9a66} - %profile%\extensions\{8225d6f0-dfca-11df-85ca-0800200c9a66}
FF - Ext: DivX Plus Web Player HTML5 <video>: {23fcfd51-4958-4f00-80a3-ae97e717ed8b} - c:\program files\DivX\DivX Plus Web Player\firefox\html5video
FF - Ext: DivX HiQ: {6904342A-8307-11DF-A508-4AE2DFD72085} - c:\program files\DivX\DivX Plus Web Player\firefox\wpa
FF - user.js: network.cookie.cookieBehavior - 0
FF - user.js: privacy.clearOnShutdown.cookies - false
FF - user.js: security.warn_viewing_mixed - false
FF - user.js: security.warn_viewing_mixed.show_once - false
FF - user.js: security.warn_submit_insecure - false
FF - user.js: security.warn_submit_insecure.show_once - false
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
ShellIconOverlayIdentifiers-{472083B0-C522-11CF-8763-00608CC02F24} - (no file)
MSConfigStartUp-egui - d:\programme\ESET Smart Security\egui.exe
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\npggsvc]
"ImagePath"="c:\windows\system32\GameMon.des -service"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Winstep Xtreme Service]
"ImagePath"="d:\programme\Winstep\WsxService"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2011-01-27 00:26:58
ComboFix-quarantined-files.txt 2011-01-26 23:26
Vor Suchlauf: 7 Verzeichnis(se), 13.749.870.592 Bytes frei
Nach Suchlauf: 11 Verzeichnis(se), 13.654.642.688 Bytes frei
- - End Of File - - BC436B5B028AA1142E7945EB15DE5AF8
Ich hoffe wir kommen der Sache näher, nun ist nichtmal mehr die weiße Fahne da...
EDIT: Ok, ich muss mich berichtigen. Nun ist die Fahne wieder da. Scheint alles in Ordnung zu sein, das Sicherheitscenter und der Defender Arbeiten wieder. Er meckert nur ein wenig über das noch fehlende Antivirenprogramm
27.01.2011, 00:29
Baum-Darstellung