Trojaner-Board - windows aus sicherheitsgründen blockiert... soll 50€ paysafe für pin zahlen

sorry aber da stand nichts von skip. da stand nur reboot oder later... hab jedenfalls auf reboot geklickt und jetzt gerade nochmals combofix gemacht. hoffe das war nicht schlimm. hier ist der log von combofix:

Combofix Logfile:
Code:
ComboFix 12-03-04.02 - diana 07.03.2012  21:11:44.4.2 - x86

Microsoft® Windows Vista™ Home Basic   6.0.6002.2.1252.49.1031.18.2039.1076 [GMT 1:00]

ausgeführt von:: c:\users\diana\downloads\ComboFix.exe

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

c:\users\diana\AppData\Local\Temp\9b93aee4-5d0f-43c6-98ae-ec0b1e7534ab\CliSecureRT.dll

.

---- Vorheriger Suchlauf -------

.

c:\users\diana\AppData\Local\Temp\9b93aee4-5d0f-43c6-98ae-ec0b1e7534ab\CliSecureRT.dll

.

.

(((((((((((((((((((((((   Dateien erstellt von 2012-02-07 bis 2012-03-07  ))))))))))))))))))))))))))))))

.

.

2012-03-07 20:17 . 2012-03-07 20:19        --------        d-----w-        c:\users\diana\AppData\Local\temp

2012-03-07 20:17 . 2012-03-07 20:17        --------        d-----w-        c:\users\Default\AppData\Local\temp

2012-03-07 19:58 . 2012-03-01 12:34        6552120        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{B8A4B940-C81D-4B5B-BEB3-9A0A7BFBC5EF}\mpengine.dll

2012-03-06 12:16 . 2011-11-25 15:59        376320        ----a-w-        c:\windows\system32\winsrv.dll

2012-03-06 11:51 . 2011-10-14 16:03        189952        ----a-w-        c:\windows\system32\winmm.dll

2012-03-06 11:51 . 2011-10-14 16:00        23552        ----a-w-        c:\windows\system32\mciseq.dll

2012-03-06 11:50 . 2011-12-01 15:21        2409784        ----a-w-        c:\program files\Windows Mail\OESpamFilter.dat

2012-03-06 11:49 . 2011-10-25 15:58        1314816        ----a-w-        c:\windows\system32\quartz.dll

2012-03-06 11:49 . 2011-10-25 15:58        497152        ----a-w-        c:\windows\system32\qdvd.dll

2012-03-06 11:49 . 2011-11-18 20:23        1205064        ----a-w-        c:\windows\system32\ntdll.dll

2012-03-06 11:39 . 2012-03-06 12:18        --------        d-----w-        C:\_OTL

2012-02-26 20:51 . 2011-11-17 06:48        440192        ----a-w-        c:\windows\system32\drivers\ksecdd.sys

2012-02-26 20:51 . 2011-11-16 16:23        377344        ----a-w-        c:\windows\system32\winhttp.dll

2012-02-26 20:51 . 2011-11-16 16:23        72704        ----a-w-        c:\windows\system32\secur32.dll

2012-02-26 20:51 . 2011-11-16 16:23        278528        ----a-w-        c:\windows\system32\schannel.dll

2012-02-26 20:51 . 2011-11-16 16:21        1259008        ----a-w-        c:\windows\system32\lsasrv.dll

2012-02-26 20:51 . 2011-11-16 14:12        9728        ----a-w-        c:\windows\system32\lsass.exe

.

.

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2012-02-23 08:18 . 2010-12-21 09:02        237072        ------w-        c:\windows\system32\MpSigStub.exe

.
 

        Code:


        
<pre>

c:\program files\Adobe\Reader 10.0\Reader\Reader_sl .exe

c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM .exe

c:\program files\Common Files\Java\Java Update\jusched .exe

c:\program files\DivX\DivX Plus Web Player\DDmService .exe

c:\program files\DivX\DivX Update\DivXUpdate .exe

c:\program files\ICQ7.2\ICQ .exe

</pre>

 
.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4

.

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]

"{a51a36e6-31e7-4838-9ff7-76298b527ec0}"= "c:\program files\softonic-Germany\prxtbsof0.dll" [2011-01-17 175912]

.

[HKEY_CLASSES_ROOT\clsid\{a51a36e6-31e7-4838-9ff7-76298b527ec0}]

.

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1AD61D5B-58A3-4592-9B34-DC84688FF805}]

2010-10-13 17:27        107328        ----a-w-        c:\program files\PDF Suite 2011\PDFIEHelper.dll

.

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}]

2011-01-17 14:54        175912        ----a-w-        c:\program files\ConduitEngine\prxConduitEngine.dll

.

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{a51a36e6-31e7-4838-9ff7-76298b527ec0}]

2011-01-17 14:54        175912        ----a-w-        c:\program files\softonic-Germany\prxtbsof0.dll

.

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]

2010-09-28 20:44        1400712        ----a-w-        c:\program files\Ask.com\GenericAskToolbar.dll

.

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{FE163F11-1919-4257-A280-FF5AF8DAEECB}]

2011-08-25 06:15        50240        ----a-w-        c:\program files\icq\Internet Explorer\icq.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]

"{a51a36e6-31e7-4838-9ff7-76298b527ec0}"= "c:\program files\softonic-Germany\prxtbsof0.dll" [2011-01-17 175912]

"{30F9B915-B755-4826-820B-08FBA6BD249D}"= "c:\program files\ConduitEngine\prxConduitEngine.dll" [2011-01-17 175912]

"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-09-28 1400712]

.

[HKEY_CLASSES_ROOT\clsid\{a51a36e6-31e7-4838-9ff7-76298b527ec0}]

.

[HKEY_CLASSES_ROOT\clsid\{30f9b915-b755-4826-820b-08fba6bd249d}]

.

[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]

[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]

[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]

[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

.

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]

"{A51A36E6-31E7-4838-9FF7-76298B527EC0}"= "c:\program files\softonic-Germany\prxtbsof0.dll" [2011-01-17 175912]

"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-09-28 1400712]

.

[HKEY_CLASSES_ROOT\clsid\{a51a36e6-31e7-4838-9ff7-76298b527ec0}]

.

[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]

[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]

[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]

[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]

"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2011-01-04 39408]

"KiesHelper"="c:\program files\Samsung\Kies\KiesHelper.exe" [2011-04-28 934800]

"KiesTrayAgent"="c:\program files\Samsung\Kies\KiesTrayAgent.exe" [2011-04-28 3373968]

"KiesPDLR"="c:\program files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe" [2011-04-28 19856]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-02-11 141848]

"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-02-11 166424]

"Persistence"="c:\windows\system32\igfxpers.exe" [2008-02-11 133656]

"MRT"="c:\windows\system32\MRT.exe" [2012-03-07 52128560]

.

c:\users\diana\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

OpenOffice.org 3.2.lnk - c:\windows.old\Program Files\OpenOffice.org 3\program\quickstart.exe [2010-5-20 1195008]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"aux"=wdmaud.drv

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

LocalServiceNoNetwork        REG_MULTI_SZ           PLA DPS BFE mpssvc

bthsvcs        REG_MULTI_SZ           BthServ

LocalServiceAndNoImpersonation        REG_MULTI_SZ           FontCache

.

Inhalt des "geplante Tasks" Ordners

.

2012-03-07 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files\Google\Update\GoogleUpdate.exe [2010-12-25 03:22]

.

2012-03-07 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files\Google\Update\GoogleUpdate.exe [2010-12-25 03:22]

.

2011-12-20 c:\windows\Tasks\Norton Security Scan for diana.job

- c:\progra~1\NORTON~2\Engine\351~1.8\Nss.exe [2011-10-29 23:02]

.

2012-01-08 c:\windows\Tasks\{B60FF6AD-5DED-4CED-8C6B-D3307023359A}.job

- c:\program files\opera\opera.exe [2011-06-20 13:34]

.

.

------- Zusätzlicher Suchlauf -------

.

uStart Page = hxxp://start.icq.com/sm

IE: Free YouTube Download - c:\users\diana\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm

IE: Free YouTube to MP3 Converter - c:\users\diana\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm

IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000

TCP: DhcpNameServer = 192.168.0.1

.

- - - - Entfernte verwaiste Registrierungseinträge - - - -

.

ShellIconOverlayIdentifiers-{96AFBE69-C3B0-4b00-8578-D933D2896EE2} - (no file)

.

.

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net

Rootkit scan 2012-03-07 21:19

Windows 6.0.6002 Service Pack 2 NTFS

.

Scanne versteckte Prozesse... 

.

Scanne versteckte Autostarteinträge... 

.

Scanne versteckte Dateien... 

.

Scan erfolgreich abgeschlossen

versteckte Dateien: 0

.

**************************************************************************

.

--------------------- Gesperrte Registrierungsschluessel ---------------------

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

"MSCurrentCountry"=dword:000000b5

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

------------------------ Weitere laufende Prozesse ------------------------

.

c:\windows\System32\lpksetup.exe

c:\program files\LSI SoftModem\agrsmsvc.exe

c:\windows\system32\FsUsbExService.Exe

c:\windows\system32\HPSIsvc.exe

c:\program files\PDF Suite 2011\ConversionService.exe

c:\program files\Common Files\Intel\WirelessCommon\RegSrvc.exe

c:\program files\Intel\WiFi\bin\EvtEng.exe

c:\windows\servicing\TrustedInstaller.exe

c:\windows\system32\wbem\unsecapp.exe

c:\windows\system32\conime.exe

c:\windows\system32\igfxsrvc.exe

c:\windows.old\Program Files\OpenOffice.org 3\program\soffice.exe

c:\windows.old\Program Files\OpenOffice.org 3\program\soffice.bin

c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe

c:\program files\PC Connectivity Solution\ServiceLayer.exe

c:\program files\PC Connectivity Solution\Transports\NclUSBSrv.exe

c:\program files\PC Connectivity Solution\Transports\NclRSSrv.exe

c:\program files\PC Connectivity Solution\Transports\NclMSBTSrv.exe

c:\windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe

.

**************************************************************************

.

Zeit der Fertigstellung: 2012-03-07  21:25:16 - PC wurde neu gestartet

ComboFix-quarantined-files.txt  2012-03-07 20:25

.

Vor Suchlauf: 15 Verzeichnis(se), 227.319.930.880 Bytes frei

Nach Suchlauf: 16 Verzeichnis(se), 227.646.590.976 Bytes frei

.

- - End Of File - - BBD272F9A54144219FF7A4CA646556BA
--- --- ---