Trojaner-Board - "Achtung! Aus Sicherheitsgründen wurde Ihr Windowssystem blockiert"

Combofix Logfile:
Code:
ComboFix 12-02-08.01 - Richard 08.02.2012  18:23:00.1.4 - x86

Microsoft® Windows Vista™ Home Premium   6.0.6002.2.1252.49.1031.18.2047.1087 [GMT 1:00]

ausgeführt von:: c:\users\Richard\Desktop\ComboFix.exe

AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}

SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

c:\program files\AutocompletePro

c:\program files\AutocompletePro\AutocompletePro.dll

c:\program files\AutocompletePro\chrome\autocompleteprochrome.crx

c:\program files\AutocompletePro\FireFoxExtension.exe

c:\program files\AutocompletePro\InstTracker.exe

c:\program files\AutocompletePro\support@predictad.com\chrome.manifest

c:\program files\AutocompletePro\support@predictad.com\chrome\content\browserOverlay.xul

c:\program files\AutocompletePro\support@predictad.com\chrome\content\options.js

c:\program files\AutocompletePro\support@predictad.com\chrome\content\options.xul

c:\program files\AutocompletePro\support@predictad.com\chrome\content\utils.js

c:\program files\AutocompletePro\support@predictad.com\defaults\preferences\predictad.js

c:\program files\AutocompletePro\support@predictad.com\install.rdf

c:\program files\AutocompletePro\unins000.dat

c:\program files\AutocompletePro\unins000.exe

c:\program files\Mail.Ru\Agent\Mra\dll\newmrasearch.dll

c:\program files\Mozilla Firefox\components\AskHPRFF.js

c:\programdata\Amazon.ico

c:\programdata\Backup.ico

c:\programdata\MercadoLivre.ico

c:\programdata\QuickStores.ico

c:\programdata\Windows

c:\programdata\windows\dsdd.dat

c:\programdata\windows\nudr.dat

c:\users\Richard\AppData\Roaming\Desktopicon

c:\users\Richard\AppData\Roaming\srvblck2.tmp

c:\windows\IsUn0407.exe

c:\windows\system32\drivers\etc\hosts.ics

c:\windows\system32\jucheck.exe

c:\windows\system32\jusched.exe

.

.

(((((((((((((((((((((((   Dateien erstellt von 2012-01-08 bis 2012-02-08  ))))))))))))))))))))))))))))))

.

.

2012-02-08 17:34 . 2012-02-08 17:34        --------        d-----w-        c:\users\IUSR_NMPR\AppData\Local\temp

2012-02-08 17:34 . 2012-02-08 17:34        --------        d-----w-        c:\users\Default\AppData\Local\temp

2012-02-08 11:59 . 2012-01-06 04:19        6557240        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{6623B6D4-EEE5-4D45-BA35-B761D1B17729}\mpengine.dll

2012-02-08 11:45 . 2012-02-08 13:49        --------        d-----w-        C:\_OTL

2012-02-06 19:48 . 2012-02-06 19:48        --------        d-----w-        c:\users\Richard\AppData\Roaming\UAs

2012-01-30 11:42 . 2012-01-30 11:42        --------        d-----w-        c:\program files\DsNET Corp

2012-01-25 18:03 . 2011-11-28 17:51        20568        ----a-w-        c:\windows\system32\drivers\aswFsBlk.sys

2012-01-25 18:03 . 2011-11-28 17:53        314456        ----a-w-        c:\windows\system32\drivers\aswSP.sys

2012-01-25 18:03 . 2011-11-28 17:52        34392        ----a-w-        c:\windows\system32\drivers\aswRdr.sys

2012-01-25 18:03 . 2011-11-28 17:52        52952        ----a-w-        c:\windows\system32\drivers\aswTdi.sys

2012-01-25 18:03 . 2011-11-28 17:53        435032        ----a-w-        c:\windows\system32\drivers\aswSnx.sys

2012-01-25 18:03 . 2011-11-28 17:52        55128        ----a-w-        c:\windows\system32\drivers\aswMonFlt.sys

2012-01-25 18:02 . 2011-11-28 18:01        41184        ----a-w-        c:\windows\avastSS.scr

2012-01-25 18:02 . 2011-11-28 18:01        199816        ----a-w-        c:\windows\system32\aswBoot.exe

2012-01-23 13:45 . 2012-01-23 13:45        2106216        ----a-w-        c:\program files\Mozilla Firefox\D3DCompiler_43.dll

2012-01-23 13:45 . 2012-01-23 13:45        1998168        ----a-w-        c:\program files\Mozilla Firefox\d3dx9_43.dll

2012-01-23 13:45 . 2012-01-23 13:45        121816        ----a-w-        c:\program files\Mozilla Firefox\components\browsercomps.dll

2012-01-23 13:45 . 2012-01-23 13:45        97240        ----a-w-        c:\program files\Mozilla Firefox\libEGL.dll

2012-01-23 13:45 . 2012-01-23 13:45        814040        ----a-w-        c:\program files\Mozilla Firefox\mozsqlite3.dll

2012-01-23 13:45 . 2012-01-23 13:45        548864        ----a-w-        c:\program files\Mozilla Firefox\msvcp80.dll

2012-01-23 13:45 . 2012-01-23 13:45        486360        ----a-w-        c:\program files\Mozilla Firefox\libGLESv2.dll

2012-01-23 13:45 . 2012-01-23 13:45        479232        ----a-w-        c:\program files\Mozilla Firefox\msvcm80.dll

2012-01-23 13:45 . 2012-01-23 13:45        43992        ----a-w-        c:\program files\Mozilla Firefox\mozutils.dll

2012-01-23 13:45 . 2012-01-23 13:45        2124760        ----a-w-        c:\program files\Mozilla Firefox\mozjs.dll

2012-01-23 13:45 . 2012-01-23 13:45        15832        ----a-w-        c:\program files\Mozilla Firefox\mozalloc.dll

2012-01-23 13:45 . 2012-01-23 13:45        626688        ----a-w-        c:\program files\Mozilla Firefox\msvcr80.dll

2012-01-22 12:16 . 2012-01-22 14:39        --------        d-----w-        c:\program files\Doom 3

2012-01-12 10:06 . 2012-01-12 10:06        1207568        ----a-w-        c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll

2012-01-12 08:38 . 2011-11-17 06:48        440192        ----a-w-        c:\windows\system32\drivers\ksecdd.sys

2012-01-12 08:38 . 2011-11-16 16:23        377344        ----a-w-        c:\windows\system32\winhttp.dll

2012-01-12 08:38 . 2011-11-16 16:23        72704        ----a-w-        c:\windows\system32\secur32.dll

2012-01-12 08:38 . 2011-11-16 16:23        278528        ----a-w-        c:\windows\system32\schannel.dll

2012-01-12 08:38 . 2011-11-16 16:21        1259008        ----a-w-        c:\windows\system32\lsasrv.dll

2012-01-12 08:38 . 2011-11-16 14:12        9728        ----a-w-        c:\windows\system32\lsass.exe

2012-01-11 18:15 . 2011-10-14 16:03        189952        ----a-w-        c:\windows\system32\winmm.dll

2012-01-11 18:15 . 2011-10-14 16:00        23552        ----a-w-        c:\windows\system32\mciseq.dll

2012-01-11 18:15 . 2011-11-18 20:23        1205064        ----a-w-        c:\windows\system32\ntdll.dll

2012-01-11 18:15 . 2011-11-18 17:47        66560        ----a-w-        c:\windows\system32\packager.dll

2012-01-11 18:15 . 2011-11-25 15:59        376320        ----a-w-        c:\windows\system32\winsrv.dll

2012-01-11 18:15 . 2011-12-01 15:21        2409784        ----a-w-        c:\program files\Windows Mail\OESpamFilter.dat

2012-01-11 18:15 . 2011-10-25 15:58        1314816        ----a-w-        c:\windows\system32\quartz.dll

2012-01-11 18:15 . 2011-10-25 15:58        497152        ----a-w-        c:\windows\system32\qdvd.dll

2012-01-11 10:07 . 2011-11-03 23:16        141112        ----a-w-        c:\program files\Internet Explorer\sqmapi.dll

2012-01-11 10:07 . 2011-11-03 22:31        2382848        ----a-w-        c:\windows\system32\mshtml.tlb

2012-01-11 10:06 . 2011-11-03 22:39        1127424        ----a-w-        c:\windows\system32\wininet.dll

2012-01-11 10:06 . 2011-11-03 22:37        194048        ----a-w-        c:\program files\Internet Explorer\IEShims.dll

2012-01-11 10:06 . 2011-11-03 22:47        1798144        ----a-w-        c:\windows\system32\jscript9.dll

2012-01-11 10:06 . 2011-11-03 22:42        678912        ----a-w-        c:\program files\Internet Explorer\iedvtool.dll

2012-01-11 10:06 . 2011-11-03 22:40        1427456        ----a-w-        c:\windows\system32\inetcpl.cpl

2012-01-10 10:58 . 2011-10-27 08:01        3602816        ----a-w-        c:\windows\system32\ntkrnlpa.exe

2012-01-10 10:58 . 2011-10-27 08:01        3550080        ----a-w-        c:\windows\system32\ntoskrnl.exe

2012-01-10 10:58 . 2011-10-14 16:02        429056        ----a-w-        c:\windows\system32\EncDec.dll

2012-01-10 10:58 . 2011-11-23 13:37        2043904        ----a-w-        c:\windows\system32\win32k.sys

2012-01-10 10:58 . 2011-10-25 15:56        49152        ----a-w-        c:\windows\system32\csrsrv.dll

2012-01-10 10:57 . 2011-11-08 14:42        2048        ----a-w-        c:\windows\system32\tzres.dll

.

.

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2012-02-02 16:19 . 2011-08-16 23:05        414368        ----a-w-        c:\windows\system32\FlashPlayerCPLApp.cpl

2012-01-26 23:21 . 2009-10-02 17:05        237072        ------w-        c:\windows\system32\MpSigStub.exe

2010-01-26 09:11 . 2010-12-22 19:38        444283        ----a-w-        c:\program files\Common Files\WinPcapNmap.exe

2012-01-23 13:45 . 2012-01-23 13:45        121816        ----a-w-        c:\program files\mozilla firefox\components\browsercomps.dll

2006-05-03 10:06        163328        --sha-w-        c:\windows\System32\flvDX.dll

2007-02-21 11:47        31232        --sha-w-        c:\windows\System32\msfDX.dll

2008-03-16 13:30        216064        --sha-w-        c:\windows\System32\nbDX.dll

2010-01-06 22:00        107520        --sha-w-        c:\windows\System32\TAKDSDecoder.dll

.

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]

@="{472083B0-C522-11CF-8763-00608CC02F24}"

[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]

2011-11-28 18:01        122512        ----a-w-        c:\program files\AVAST Software\Avast\ashShell.dll

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]

"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]

"RegistryMechanic"="c:\program files\Registry Mechanic\RMTray.exe" [2008-07-03 812952]

"Steam"="c:\program files\Steam\Steam.exe" [2012-01-12 1242448]

"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 202240]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"hpsysdrv"="c:\hp\support\hpsysdrv.exe" [2007-04-18 65536]

"OsdMaestro"="c:\program files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe" [2007-02-15 118784]

"RtHDVCpl"="RtHDVCpl.exe" [2008-01-15 4874240]

"MAgent"="c:\program files\Mail.Ru\Agent\MAgent.exe" [2010-01-02 8746680]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-06-26 13789728]

"MobileConnect"="c:\program files\Vodafone\Vodafone Mobile Connect\Bin\MobileConnect.exe" [2009-09-11 2403840]

"DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2010-09-01 1164584]

"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-10-29 249064]

"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2012-01-03 37296]

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-02 843712]

"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2011-11-28 3744552]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]

"Launcher"="c:\windows\SMINST\launcher.exe" [2007-04-03 44168]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"EnableUIADesktopToggle"= 0 (0x0)

.

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\SharedTaskScheduler]

"{1984DD45-52CF-49cd-AB77-18F378FEA264}"= "c:\program files\Stardock\Fences\FencesMenu.dll" [2010-06-22 202088]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"aux"=wdmaud.drv

.

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]

"WindowsWelcomeCenter"=rundll32.exe oobefldr.dll,ShowWelcomeCenter 

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]

"HP Health Check Scheduler"=c:\program files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe

"SunJavaUpdateReg"="c:\windows\system32\jureg.exe"

"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" -atboottime

"HP Software Update"=c:\program files\HP\HP Software Update\HPWuSchd2.exe

"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe"

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe"

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]

"DisableMonitoring"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]

"DisableMonitoring"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]

"DisableMonitoring"=dword:00000001

.

--- Andere Dienste/Treiber im Speicher ---

.

*Deregistered* - BMLoad

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

LocalServiceAndNoImpersonation        REG_MULTI_SZ           FontCache

.

Inhalt des "geplante Tasks" Ordners

.

2012-02-08 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files\Google\Update\GoogleUpdate.exe [2011-05-30 16:11]

.

2012-02-08 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files\Google\Update\GoogleUpdate.exe [2011-05-30 16:11]

.

2012-01-31 c:\windows\Tasks\HPCeeScheduleForRichard.job

- c:\program files\hewlett-packard\sdp\ceement\HPCEE.exe [2007-10-11 14:55]

.

.

------- Zusätzlicher Suchlauf -------

.

uStart Page = hxxp://www.google.de/

mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=DE_DE&c=74&bd=Pavilion&pf=desktop

IE: Free YouTube Download - c:\users\Richard\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm

IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000

IE: {{3B54DEAB-C6D4-48a8-8C32-A70558643400} - c:\program files\FinalVideoDownloader\fvdRunner.html

IE: {{7558B7E5-7B26-4201-BEDB-00D5FF534523} - c:\program files\Mail.Ru\Agent\magent.exe

LSP: bmnet.dll

TCP: DhcpNameServer = 192.168.2.1

FF - ProfilePath - c:\users\Richard\AppData\Roaming\Mozilla\Firefox\Profiles\i7z0g9l0.default\

FF - prefs.js: browser.search.defaulturl - hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.3.1&q=

FF - prefs.js: browser.search.selectedEngine - ICQ Search

FF - prefs.js: browser.startup.homepage - hxxp://de.ask.com/?l=dis&o=14672

FF - prefs.js: keyword.URL - hxxp://go.mail.ru/search?utf8in=1&fr=fftbUFix&q=

FF - user.js: yahoo.homepage.dontask - true

.

- - - - Entfernte verwaiste Registrierungseinträge - - - -

.

URLSearchHooks-{872b5b88-9db5-4310-bdd0-ac189557e5f5} - (no file)

WebBrowser-{EEE6C35B-6118-11DC-9C72-001320C79847} - (no file)

WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)

WebBrowser-{872B5B88-9DB5-4310-BDD0-AC189557E5F5} - (no file)

AddRemove-AutocompletePro3_is1 - c:\program files\AutocompletePro\unins000.exe

.

.

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover

Rootkit scan 2012-02-08 18:34

Windows 6.0.6002 Service Pack 2 NTFS

.

Scanne versteckte Prozesse... 

.

Scanne versteckte Autostarteinträge... 

.

Scanne versteckte Dateien... 

.

Scan erfolgreich abgeschlossen

versteckte Dateien: 0

.

**************************************************************************

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\{22D78859-9CE9-4B77-BF18-AC83E81A9263}]

"ImagePath"="\??\c:\program files\HP\DVDPlay\000.fcl"

.

--------------------- Gesperrte Registrierungsschluessel ---------------------

.

[HKEY_USERS\S-1-5-21-1552494213-100156380-1749047208-1001\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]

"??"=hex:4c,1a,12,91,ca,10,53,98,38,c3,ed,c4,f5,5f,69,4a,19,96,a7,dd,eb,d5,6c,

   6f,e6,c8,37,6a,d1,5f,2a,3a,fd,b7,2b,71,9a,73,ac,11,56,f9,36,e0,83,94,8d,2d,\

"??"=hex:2f,b6,6f,45,ee,e2,ec,0a,29,d5,69,d3,55,fd,2c,18

.

[HKEY_USERS\S-1-5-21-1552494213-100156380-1749047208-1001\Software\SecuROM\License information*]

@Allowed: (Read) (RestrictedCode)

"datasecu"=hex:e0,c1,37,e9,bc,ba,e6,16,8f,a5,e2,19,74,f9,8f,21,f5,b6,6e,b9,9e,

   3f,10,08,a1,3b,a4,46,93,3c,89,a0,66,95,8c,6f,aa,8c,3a,4a,42,5c,3d,fc,19,f9,\

"rkeysecu"=hex:54,5a,d3,79,49,c2,0c,c0,dd,08,73,23,30,dd,c3,fd

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0005\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0006\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

--------------------- Durch laufende Prozesse gestartete DLLs ---------------------

.

- - - - - - - > 'lsass.exe'(676)

c:\windows\system32\bmnet.dll

.

Zeit der Fertigstellung: 2012-02-08  18:40:50

ComboFix-quarantined-files.txt  2012-02-08 17:40

.

Vor Suchlauf: 7 Verzeichnis(se), 105.035.497.472 Bytes frei

Nach Suchlauf: 12 Verzeichnis(se), 108.831.215.616 Bytes frei

.

- - End Of File - - 8A7FC34986505BA70E8F04EA4DD92A64
--- --- ---