Trojaner-Board - Extrem Langsame Internet Verbindung

ComboFix 09-02-15.01 - ANNA 2009-02-17 23:44:33.1 - NTFSx86
Microsoft® Windows Vista™ Home Premium 6.0.6000.0.1252.1.1031.18.2047.938 [GMT 1:00]
ausgeführt von:: c:\users\ANNA\Desktop\ComboFix.exe
AV: Avira AntiVir PersonalEdition *On-access scanning disabled* (Updated)
AV: Norton Internet Security *On-access scanning disabled* (Updated)
FW: Norton Internet Security *disabled*
* Neuer Wiederherstellungspunkt wurde erstellt
.

((((((((((((((((((((((( Dateien erstellt von 2009-01-17 bis 2009-02-17 ))))))))))))))))))))))))))))))
.

2009-02-17 18:57 . 2009-02-17 18:57 <DIR> d-------- c:\windows\Sun
2009-02-17 00:50 . 2009-02-17 00:50 <DIR> d-------- c:\users\ANNA\AppData\Roaming\Malwarebytes
2009-02-17 00:49 . 2009-02-11 10:19 38,496 --a------ c:\windows\System32\drivers\mbamswissarmy.sys
2009-02-17 00:49 . 2009-02-11 10:19 15,504 --a------ c:\windows\System32\drivers\mbam.sys
2009-02-16 22:04 . 2009-02-16 22:04 <DIR> d-------- c:\users\ANNA\AppData\Roaming\SUPERAntiSpyware.com
2009-02-16 22:04 . 2009-02-16 22:04 <DIR> d-------- c:\users\All Users\SUPERAntiSpyware.com
2009-02-16 22:04 . 2009-02-16 22:04 <DIR> d-------- c:\programdata\SUPERAntiSpyware.com
2009-02-16 22:04 . 2009-02-17 22:44 <DIR> d-------- c:\program files\SUPERAntiSpyware
2009-02-16 22:03 . 2009-02-16 22:03 <DIR> d-------- c:\program files\Common Files\Wise Installation Wizard
2009-02-16 22:02 . 2009-02-17 00:14 <DIR> d-------- c:\program files\Navilog1
2009-02-16 13:11 . 2009-02-16 13:11 <DIR> d-------- c:\program files\Trend Micro
2009-02-16 12:38 . 2009-02-16 12:38 <DIR> d-------- c:\users\All Users\Malwarebytes
2009-02-16 12:38 . 2009-02-16 12:38 <DIR> d-------- c:\programdata\Malwarebytes
2009-02-16 12:38 . 2009-02-17 22:47 <DIR> d-------- c:\program files\Malwarebytes' Anti-Malware
2009-02-13 22:41 . 2009-02-13 22:41 <DIR> d-------- c:\users\Public\Musicload
2009-02-13 11:06 . 2009-02-13 11:06 <DIR> d-------- c:\program files\Avira
2009-02-12 22:23 . 2009-02-13 11:06 <DIR> d-------- c:\users\All Users\Avira
2009-02-12 22:23 . 2009-02-13 11:06 <DIR> d-------- c:\programdata\Avira
2009-02-12 19:50 . 2009-02-12 19:50 15,949 --a------ C:\Test.thk

.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-02-17 22:26 --------- d-----w c:\users\ANNA\AppData\Roaming\Skype
2009-02-17 22:25 --------- d-----w c:\programdata\Symantec
2009-02-17 22:13 --------- d-----w c:\program files\Lx_cats
2009-02-17 18:01 27,448 ----a-w c:\users\ANNA\AppData\Roaming\wklnhst.dat
2009-02-17 15:06 --------- d-----w c:\users\ANNA\AppData\Roaming\skypePM
2009-02-14 09:46 --------- d--h--w c:\program files\InstallShield Installation Information
2009-02-14 09:46 --------- d-----w c:\program files\Google
2009-02-14 00:42 --------- d-----w c:\program files\ICQToolbar
2009-02-13 23:57 --------- d-----w c:\programdata\BVRP Software
2009-02-13 23:45 --------- d-----w c:\program files\Common Files\Marmiko Shared
2009-02-13 17:15 --------- d---a-w c:\programdata\TEMP
2009-02-12 02:01 --------- d-----w c:\programdata\Microsoft Help
2009-02-11 17:13 --------- d-----w c:\users\ANNA\AppData\Roaming\gtk-2.0
2009-02-11 16:56 --------- d-----w c:\users\ANNA\AppData\Roaming\Mein Pferdehof 2
2009-01-23 12:24 --------- d-----w c:\program files\Common Files\Adobe
2009-01-15 04:16 826,368 ----a-w c:\windows\System32\wininet.dll
2009-01-15 04:16 56,320 ----a-w c:\windows\System32\iesetup.dll
2009-01-15 04:16 52,736 ----a-w c:\windows\AppPatch\iebrshim.dll
2009-01-15 04:15 26,624 ----a-w c:\windows\System32\ieUnatt.exe
2008-12-21 21:40 --------- d-----w c:\program files\Java
2008-12-11 02:13 174 --sha-w c:\program files\desktop.ini
2008-02-09 08:15 32 ----a-w c:\users\All Users\ezsid.dat
2008-02-09 08:15 32 ----a-w c:\programdata\ezsid.dat
2008-03-09 20:15 16,384 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
2008-03-09 20:15 32,768 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
2008-03-09 20:15 16,384 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
.

(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-02-07 1232896]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2006-11-02 125440]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2008-02-01 21898024]
"T-Online_Software_6\WLAN-Access Finder"="c:\program files\T-Online\WLAN-Access Finder\ToWLaAcF.exe" [2007-07-25 671796]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2006-11-02 201728]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2009-01-15 1830128]
"WindowsWelcomeCenter"="oobefldr.dll" [2006-11-02 c:\windows\System32\oobefldr.dll]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvSvc"="c:\windows\system32\nvsvc.dll" [2007-06-01 86016]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-06-01 8429568]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-06-01 81920]
"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-02-26 153136]
"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2006-10-24 107112]
"osCheck"="c:\program files\Norton Internet Security\osCheck.exe" [2006-10-27 22696]
"recinfo741"="c:\recinfo\RecInfo.exe" [2007-10-23 2764800]
"LXCFCATS"="c:\windows\system32\spool\DRIVERS\W32X86\3\LXCFtime.dll" [2005-07-20 73728]
"Symantec PIF AlertEng"="c:\program files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2008-01-29 583048]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-11-10 136600]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]
"avgnt"="c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 266497]
"RtHDVCpl"="RtHDVCpl.exe" [2007-10-31 c:\windows\RtHDVCpl.exe]

c:\users\ANNA\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2007-12-07 101440]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
REALTEK USB Wireless LAN Utility.lnk - c:\program files\REALTEK USB Wireless LAN Driver and Utility\RtWLan.exe [2008-08-01 798720]
Wireless Configuration Utility HW.14.lnk - c:\program files\802.11 Wireless LAN\802.11g USB 2.0 WLAN Dongle\WlanCU.exe [2008-02-06 413696]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-12-22 11:05 356352 c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UacDisableNotify"=dword:00000001
"InternetSettingsDisableNotify"=dword:00000001
"AutoUpdateDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{454CE350-F94F-4BE2-9FF2-17CD6D94BFFF}"= UDP:c:\program files\Fujitsu Siemens Computers\FSCLounge\FSCWBaseUpdaterService\2\FSCWBaseUpdaterService.exe:FSCLBaseUpdaterService.exe
"{BA575BA8-95F9-45F0-936E-F2E81B58507D}"= TCP:c:\program files\Fujitsu Siemens Computers\FSCLounge\FSCWBaseUpdaterService\2\FSCWBaseUpdaterService.exe:FSCLBaseUpdaterService.exe
"{E4462112-7C6E-4953-B479-0F8EF1DEFBB1}"= UDP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{299260C9-18F4-438D-BFED-ECC4849C38A0}"= TCP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{D09BFCD5-4439-40D8-A73F-3249BDCAF300}"= TCP:6004|c:\program files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook
"TCP Query User{DDD2B0E9-11DB-41BE-82C8-5A66FFA67D86}c:\\program files\\skype\\phone\\skype.exe"= Disabled:UDP:c:\program files\skype\phone\skype.exe:Skype. Take a deep breath
"UDP Query User{87F39B1D-459E-4C51-B855-6ED727FC9EF8}c:\\program files\\skype\\phone\\skype.exe"= Disabled:TCP:c:\program files\skype\phone\skype.exe:Skype. Take a deep breath

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System]
"DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic|

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
"EnableFirewall"= 0 (0x0)

R1 IDSvix86;Symantec Intrusion Prevention Driver;c:\progra~2\Symantec\DEFINI~1\SymcData\idsdefs\20090129.001\IDSvix86.sys [2009-01-30 270384]
R1 RtlProt;Realtke RtlProt WLAN Utility Protocol Driver;c:\windows\System32\drivers\RtlProt.sys [2008-08-01 25896]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [2009-01-15 8944]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2009-01-15 55024]
R2 Automatisches LiveUpdate - Scheduler;Automatisches LiveUpdate - Scheduler;c:\program files\Symantec\LiveUpdate\AluSchedulerSvc.exe [2007-01-01 554352]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2008-09-04 99376]
R3 RTL8187;Realtek RTL8187 Wireless 802.11g 54Mbps USB 2.0 Network Adapter;c:\windows\System32\drivers\rtl8187.sys [2008-08-01 248320]
R3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [2009-01-15 7408]
R3 SYMNDISV;SYMNDISV;c:\windows\System32\drivers\symndisv.sys [2007-10-30 37936]
S3 RTL8187B;Realtek RTL8187B Wireless 802.11g 54Mbps USB 2.0 Network Adapter;c:\windows\System32\drivers\RTL8187B.sys [2008-02-06 229376]

--- Andere Dienste/Treiber im Speicher ---

*NewlyCreated* - COMHOST

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{63625844-bf8d-11dd-aad2-001bb9fed2b2}]
\shell\AutoRun\command - K:\setupSNK.exe
.
Inhalt des "geplante Tasks" Ordners

2009-02-13 c:\windows\Tasks\Norton Internet Security - Vollständige Systemprüfung ausführen - ANNA.job
- c:\progra~1\NORTON~1\NORTON~1\Navw32.exe [2006-11-07 18:48]

2009-02-16 c:\windows\Tasks\RtlVistaStart.job
- c:\program files\REALTEK USB Wireless LAN Driver and Utility\RtWLan.exe [2007-05-18 18:36]

2009-02-17 c:\windows\Tasks\User_Feed_Synchronization-{280A5689-F345-4D22-A9DA-44050A62E5F6}.job
- c:\windows\system32\msfeedssync.exe [2006-11-02 10:45]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.google.de/
IE: &ieSpell Options - c:\program files\ieSpell\iespell.dll/SPELLOPTION.HTM
IE: Check &Spelling - c:\program files\ieSpell\iespell.dll/SPELLCHECK.HTM
IE: Lookup on Merriam Webster - file://c:\program files\ieSpell\Merriam Webster.HTM
IE: Lookup on Wikipedia - file://c:\program files\ieSpell\wikipedia.HTM
IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
TCP: {C50BBFC1-EAC9-4AD1-8B74-CB6753637AB2} = 192.168.2.1
DPF: {BA162249-F2C5-4851-8ADC-FC58CB424243} - hxxp://static.pe.studivz.net/photouploader/ImageUploader5.cab?nocache=1206384352
DPF: {BA3BAF69-72B1-4BCE-BE96-A4D304EAFBB4} - hxxp://assets.photobox.com/assets/aurigma/ImageUploader4.cab?20080806095533
DPF: {C1FDEE68-98D5-4F42-A4DD-D0BECF5077EB} - hxxp://tools.ebayimg.com/eps/wl/activex/eBay_Enhanced_Picture_Control_v1-0-27-0.cab
FF - ProfilePath - c:\users\ANNA\AppData\Roaming\Mozilla\Firefox\Profiles\z3hu2thn.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF - prefs.js: browser.search.selectedEngine - Google
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-02-17 23:46:17
Windows 6.0.6000 NTFS

Scanne versteckte Prozesse...

Scanne versteckte Autostarteinträge...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
LXCFCATS = rundll32 c:\windows\system32\spool\DRIVERS\W32X86\3\LXCFtime.dll,_RunDLLEntry@16??????????????????????????????????????????????????????????????????????????????? ????????????????????????????????????????????????????????????????????????????????????????????????????

Scanne versteckte Dateien...

Scan erfolgreich abgeschlossen
versteckte Dateien: 0

**************************************************************************
.
--------------------- Gesperrte Registrierungsschluessel ---------------------

[HKEY_USERS\.Default\CMI-CreateHive{274AB9BD-5778-42E7-84B9-863B8D8DF87A}\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="FirefoxHTML"

[HKEY_USERS\.Default\CMI-CreateHive{274AB9BD-5778-42E7-84B9-863B8D8DF87A}\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="FirefoxHTML"

[HKEY_USERS\.Default\CMI-CreateHive{274AB9BD-5778-42E7-84B9-863B8D8DF87A}\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="FirefoxHTML"

[HKEY_USERS\.Default\CMI-CreateHive{274AB9BD-5778-42E7-84B9-863B8D8DF87A}\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="FirefoxHTML"

[HKEY_USERS\.Default\CMI-CreateHive{274AB9BD-5778-42E7-84B9-863B8D8DF87A}\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="FirefoxHTML"
.
Zeit der Fertigstellung: 2009-02-17 23:47:27
ComboFix-quarantined-files.txt 2009-02-17 22:47:24

Vor Suchlauf: 29 Verzeichnis(se), 163.732.406.272 Bytes frei
Nach Suchlauf: 29 Verzeichnis(se), 163,767,373,824 Bytes frei

197 --- E O F --- 2009-02-16 17:03:58