Trojaner-Board - Computer funktioniert nur mehr im abgesicherten Modus

JAAAAAAAAAAAAA! ich hab eine Combafix Logdatei .. :applaus:

Ist jetzt übrigens so gegangen als ob nie was gewesen wäre.

---

Combofix Logfile:
Code:
ComboFix 10-08-24.0A - Stefan 25.08.2010  12:26:19.1.2 - x86

Microsoft® Windows Vista™ Home Premium   6.0.6002.2.1252.43.1031.18.1791.1132 [GMT 2:00]

ausgeführt von:: c:\users\Stefan\Desktop\ComboFix.exe

SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}

.
 

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

---- Vorheriger Suchlauf -------

.

c:\windows\system32\driVERs\jcpuaxx.sys . . . . Nicht in der Lage zu löschen
 

-- Vorheriger Suchlauf --
 

c:\windows\system32\wininit.exe . . . ist infiziert!!
 

-- Vorheriger Suchlauf --
 

c:\windows\system32\wininit.exe . . . ist infiziert!!
 

--------
 

c:\windows\system32\wininit.exe . . . ist infiziert!!
 

--------
 

c:\windows\system32\wininit.exe . . . ist infiziert!!
 

.

(((((((((((((((((((((((((((((((((((((((   Treiber/Dienste   )))))))))))))))))))))))))))))))))))))))))))))))))

.
 

-------\Legacy_jcpuaxx

-------\Service_jcpuaxx

-------\Legacy_jcpuaxx

-------\Service_jcpuaxx

-------\Legacy_jcpuaxx

-------\Service_jcpuaxx

-------\Legacy_jcpuaxx

-------\Service_jcpuaxx

-------\Legacy_jcpuaxx

-------\Service_jcpuaxx

-------\Legacy_JCPUAXX

-------\Service_jcpuaxx

-------\Legacy_JCPUAXX

-------\Service_jcpuaxx

-------\Legacy_JCPUAXX

-------\Service_jcpuaxx

-------\Legacy_JCPUAXX
 
 

(((((((((((((((((((((((   Dateien erstellt von 2010-07-25 bis 2010-08-25  ))))))))))))))))))))))))))))))

.
 

2010-08-25 10:33 . 2010-08-25 10:33        --------        d-----w-        c:\users\Default\AppData\Local\temp

2010-08-25 08:47 . 2010-04-29 10:19        38224        ----a-w-        c:\windows\system32\drivers\mbamswissarmy.sys

2010-08-25 08:47 . 2010-08-25 08:47        --------        d-----w-        c:\program files\Malwarebytes' Anti-Malware

2010-08-25 08:47 . 2010-04-29 10:19        20952        ----a-w-        c:\windows\system32\drivers\mbam.sys

2010-08-25 06:12 . 2010-08-25 10:40        --------        d-----w-        c:\users\Stefan\AppData\Local\temp

2010-08-24 14:53 . 2010-08-24 14:53        --------        d-----w-        c:\programdata\WindowsSearch

2010-08-24 05:45 . 2010-08-24 05:45        --------        d-----w-        c:\windows\Sun

2010-08-11 08:06 . 2010-06-16 16:04        905088        ----a-w-        c:\windows\system32\drivers\tcpip.sys
 

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2010-08-25 10:40 . 2010-02-13 19:10        52878        ----a-w-        c:\programdata\nvModes.dat

2010-08-25 08:53 . 2010-02-13 17:39        1356        ----a-w-        c:\users\Stefan\AppData\Local\d3d9caps.dat

2010-08-24 16:14 . 2008-01-21 07:15        688380        ----a-w-        c:\windows\system32\perfh007.dat

2010-08-24 16:14 . 2008-01-21 07:15        144782        ----a-w-        c:\windows\system32\perfc007.dat

2010-08-24 14:13 . 2010-08-24 14:13        976832        ----a-w-        c:\programdata\Adobe\Reader\9.3\ARM\22954\AdobeARM.exe

2010-08-24 14:13 . 2010-08-24 14:13        331176        ----a-w-        c:\programdata\Adobe\Reader\9.3\ARM\22954\AcrobatUpdater.exe

2010-08-24 06:45 . 2010-03-03 16:05        --------        d-----w-        c:\program files\Common Files\Real

2010-08-24 06:43 . 2010-03-28 10:18        --------        d-----w-        c:\program files\BIPA

2010-08-12 06:29 . 2006-11-02 11:18        --------        d-----w-        c:\program files\Windows Mail

2010-07-29 09:04 . 2010-04-24 06:25        --------        d-----w-        c:\users\Stefan\AppData\Roaming\vlc

2010-07-17 06:48 . 2010-02-13 18:38        243024        ----a-w-        c:\windows\system32\drivers\avgtdix.sys

2010-07-17 06:48 . 2010-07-17 06:48        12536        ----a-w-        c:\windows\system32\avgrsstx.dll

2010-07-17 06:48 . 2010-02-13 18:38        216400        ----a-w-        c:\windows\system32\drivers\avgldx86.sys

2010-07-15 06:00 . 2010-02-13 18:38        --------        d-----w-        c:\programdata\avg9

2010-06-26 06:05 . 2010-08-11 08:07        916480        ----a-w-        c:\windows\system32\wininet.dll

2010-06-26 06:02 . 2010-08-11 08:07        109056        ----a-w-        c:\windows\system32\iesysprep.dll

2010-06-26 06:02 . 2010-08-11 08:07        71680        ----a-w-        c:\windows\system32\iesetup.dll

2010-06-26 04:25 . 2010-08-11 08:07        133632        ----a-w-        c:\windows\system32\ieUnatt.exe

2010-06-21 13:37 . 2010-08-11 08:07        2037760        ----a-w-        c:\windows\system32\win32k.sys

2010-06-18 17:31 . 2010-08-11 08:07        36864        ----a-w-        c:\windows\system32\rtutils.dll

2010-06-18 15:04 . 2010-08-11 08:07        302080        ----a-w-        c:\windows\system32\drivers\srv.sys

2010-06-18 15:04 . 2010-08-11 08:07        144896        ----a-w-        c:\windows\system32\drivers\srv2.sys

2010-06-11 16:16 . 2010-08-11 08:07        274944        ----a-w-        c:\windows\system32\schannel.dll

2010-06-11 16:15 . 2010-08-11 08:07        1248768        ----a-w-        c:\windows\system32\msxml3.dll

2010-06-08 17:35 . 2010-08-11 08:07        3548040        ----a-w-        c:\windows\system32\ntoskrnl.exe

2010-06-08 17:35 . 2010-08-11 08:07        3600768        ----a-w-        c:\windows\system32\ntkrnlpa.exe

2010-06-03 07:46 . 2010-02-13 18:38        29584        ----a-w-        c:\windows\system32\drivers\avgmfx86.sys

2010-05-27 20:08 . 2010-08-11 08:07        81920        ----a-w-        c:\windows\system32\iccvid.dll

.
 

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-21 1008184]

"AVG9_TRAY"="c:\progra~1\AVG\AVG9\avgtray.exe" [2010-07-17 2065760]

"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-02-15 417792]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-12-22 35760]

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-12-11 948672]

"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]

"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2010-04-29 1090952]
 

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]
 

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"EnableUIADesktopToggle"= 0 (0x0)
 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]

"AppInit_DLLs"=c:\windows\System32\avgrsstx.dll
 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]

@="Service"
 

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]

"VistaSp2"=hex(b):53,6c,2c,e4,1f,c0,ca,01
 

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]

R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]

S1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\System32\Drivers\avgldx86.sys [2010-07-17 216400]

S1 AvgTdiX;AVG Free Network Redirector;c:\windows\System32\Drivers\avgtdix.sys [2010-07-17 243024]

S2 avg9emc;AVG Free E-mail Scanner;c:\program files\AVG\AVG9\avgemc.exe [2010-07-21 921952]

S2 avg9wd;AVG Free WatchDog;c:\program files\AVG\AVG9\avgwdsvc.exe [2010-07-17 308136]
 
 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

LocalServiceAndNoImpersonation        REG_MULTI_SZ           FontCache

.

Inhalt des "geplante Tasks" Ordners
 

2010-08-24 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-796722432-745633425-1174557795-1000.job

- c:\program files\Real\RealUpgrade\realupgrade.exe [2010-02-24 20:09]

.

.

------- Zusätzlicher Suchlauf -------

.

IE: Nach Microsoft &Excel exportieren - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000

FF - ProfilePath - c:\users\Stefan\AppData\Roaming\Mozilla\Firefox\Profiles\letz8p2x.default\

FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll

FF - plugin: c:\program files\Mozilla Firefox\plugins\npdeployJava1.dll

FF - plugin: c:\program files\Mozilla Firefox\plugins\npOGAPlugin.dll

FF - plugin: c:\programdata\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll

FF - plugin: c:\windows\system32\TVUAx\npTVUAx.dll

FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
 

---- FIREFOX Richtlinien ----

c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);

c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);

c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");

c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);

c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation",  false);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);

.
 

**************************************************************************
 

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net

Rootkit scan 2010-08-25 12:39

Windows 6.0.6002 Service Pack 2 NTFS
 

Scanne versteckte Prozesse... 
 

Scanne versteckte Autostarteinträge... 
 

Scanne versteckte Dateien... 
 
 

c:\users\Stefan\AppData\Local\Temp\catchme.dll 53248 bytes executable
 

Scan erfolgreich abgeschlossen

versteckte Dateien: 1
 

**************************************************************************

.

------------------------ Weitere laufende Prozesse ------------------------

.

c:\windows\system32\nvvsvc.exe

c:\windows\system32\nvvsvc.exe

c:\program files\AVG\AVG9\avgnsx.exe

c:\program files\AVG\AVG9\avgcsrvx.exe

c:\windows\system32\conime.exe

c:\program files\AVG\AVG9\avgchsvx.exe

c:\program files\AVG\AVG9\avgrsx.exe

c:\program files\AVG\AVG9\avgcsrvx.exe

c:\program files\AVG\AVG9\avgtray.exe

.

**************************************************************************

.

Zeit der Fertigstellung: 2010-08-25  12:46:31 - PC wurde neu gestartet

ComboFix-quarantined-files.txt  2010-08-25 10:46
 

Vor Suchlauf: 11 Verzeichnis(se), 143.051.063.296 Bytes frei

Nach Suchlauf: 13 Verzeichnis(se), 142.953.713.664 Bytes frei
 

- - End Of File - - F70F3194A6B9A76A05AC019B36166C3D
--- --- ---