Trojaner-Board - Windows Vista reagiert verzögert

hallo arne,
combofix ist nun auch erledigt...

gruß
tom

hier die log...

Combofix Logfile:
Code:
ComboFix 11-01-31.02 - Buchholz 04.02.2011   9:14.1.2 - x86

Microsoft® Windows Vista™ Home Premium   6.0.6001.1.1252.49.1031.18.2046.1292 [GMT 1:00]

ausgeführt von:: c:\users\Buchholz\Downloads\ComboFix.exe

AV: AntiVir Desktop *Disabled/Outdated* {090F9C29-64CE-6C6F-379C-5901B49A85B7}

AV: avast! Antivirus *Disabled/Updated* {C37D8F93-0602-E43C-40AA-47DAD597F308}

SP: AntiVir Desktop *Disabled/Outdated* {B26E7DCD-42F4-63E1-0D2C-6273CF1DCF0A}

SP: avast! Antivirus *Disabled/Updated* {781C6E77-2038-EBB2-7A1A-7CA8AE10B9B5}

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.
 

(((((((((((((((((((((((   Dateien erstellt von 2011-01-04 bis 2011-02-04  ))))))))))))))))))))))))))))))

.
 

2011-02-04 08:23 . 2011-02-04 08:24        --------        d-----w-        c:\users\Buchholz\AppData\Local\temp

2011-02-04 08:23 . 2011-02-04 08:23        --------        d-----w-        c:\users\Default\AppData\Local\temp

2011-02-03 18:42 . 2011-02-03 18:42        --------        d-----w-        C:\_OTL

2011-02-02 10:41 . 2011-02-02 10:41        --------        d-----w-        c:\programdata\WindowsSearch

2011-02-02 09:46 . 2011-01-29 20:19        295632        ----a-w-        c:\windows\system32\drivers\aswSP.sys

2011-02-02 09:46 . 2011-01-29 20:14        17744        ----a-w-        c:\windows\system32\drivers\aswFsBlk.sys

2011-02-02 09:46 . 2011-01-29 20:17        47440        ----a-w-        c:\windows\system32\drivers\aswTdi.sys

2011-02-02 09:46 . 2011-01-29 20:14        23632        ----a-w-        c:\windows\system32\drivers\aswRdr.sys

2011-02-02 09:46 . 2011-01-29 20:19        360528        ----a-w-        c:\windows\system32\drivers\aswSnx.sys

2011-02-02 09:46 . 2011-01-29 20:14        51280        ----a-w-        c:\windows\system32\drivers\aswMonFlt.sys

2011-02-02 09:45 . 2011-01-29 20:26        38848        ----a-w-        c:\windows\avastSS.scr

2011-02-02 09:45 . 2011-01-29 20:26        188216        ----a-w-        c:\windows\system32\aswBoot.exe

2011-02-02 09:45 . 2011-02-02 09:45        --------        d-----w-        c:\programdata\AVAST Software

2011-02-02 09:45 . 2011-02-02 09:45        --------        d-----w-        c:\program files\AVAST Software

2011-02-02 07:16 . 2011-01-13 09:41        5890896        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{89E82FCE-9588-4A75-9F20-3F482EA02400}\mpengine.dll

2011-01-28 15:12 . 2011-02-03 07:17        --------        d-----w-        c:\users\Buchholz\AppData\Roaming\QuickScan

2011-01-28 09:23 . 2011-01-28 09:23        --------        d-----w-        c:\program files\iPod

2011-01-27 08:40 . 2011-01-27 08:40        85465960        ----a-w-        c:\program files\Common Files\Windows Live\.cache\wlc7E65.tmp

2011-01-25 09:26 . 2011-01-26 07:52        --------        d-----w-        c:\users\Buchholz\AppData\Local\Eraser

2011-01-22 16:56 . 2011-01-28 09:24        --------        d-----w-        c:\program files\iTunes

2011-01-20 07:26 . 2010-10-12 15:48        33280        ----a-w-        c:\program files\Windows Mail\wabfind.dll

2011-01-20 07:25 . 2010-12-14 15:49        1169408        ----a-w-        c:\windows\system32\sdclt.exe

2011-01-20 07:25 . 2010-10-18 13:56        2037248        ----a-w-        c:\windows\system32\win32k.sys

2011-01-20 07:25 . 2010-11-06 11:09        603648        ----a-w-        c:\windows\system32\schedsvc.dll

2011-01-20 07:25 . 2010-11-06 11:10        345088        ----a-w-        c:\windows\system32\wmicmiplugin.dll

2011-01-20 07:25 . 2010-11-06 11:10        357376        ----a-w-        c:\windows\system32\taskschd.dll

2011-01-20 07:25 . 2010-11-06 11:10        270336        ----a-w-        c:\windows\system32\taskcomp.dll

2011-01-20 07:25 . 2010-11-05 00:53        171520        ----a-w-        c:\windows\system32\taskeng.exe

2011-01-20 07:25 . 2010-10-18 14:01        81920        ----a-w-        c:\windows\system32\consent.exe

2011-01-20 07:25 . 2010-11-03 10:51        2409784        ----a-w-        c:\program files\Windows Mail\OESpamFilter.dat
 

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2010-12-23 11:22 . 2010-12-23 11:22        1222408        ----a-w-        c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll

2010-12-22 07:08 . 2009-07-31 14:08        135096        ----a-w-        c:\windows\system32\drivers\avipbb.sys

2010-12-20 17:09 . 2010-01-27 08:27        38224        ----a-w-        c:\windows\system32\drivers\mbamswissarmy.sys

2010-12-20 17:08 . 2010-01-27 08:27        20952        ----a-w-        c:\windows\system32\drivers\mbam.sys

2010-11-29 16:38 . 2010-11-29 16:38        94208        ----a-w-        c:\windows\system32\QuickTimeVR.qtx

2010-11-29 16:38 . 2010-11-29 16:38        69632        ----a-w-        c:\windows\system32\QuickTime.qts

2010-11-24 10:56 . 2009-07-31 14:08        61960        ----a-w-        c:\windows\system32\drivers\avgntflt.sys

.
 

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4
 

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{8E5E2654-AD2D-48bf-AC2D-D17F00898D06}]

2011-01-29 20:26        743392        ----a-w-        c:\program files\AVAST Software\Avast\aswWebRepIE.dll
 

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{E601996F-E400-41CA-804B-CD6373A7EEE2}]

2010-11-23 19:51        919408        ----a-w-        c:\program files\kikin\ie_kikin.dll
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]

"{8E5E2654-AD2D-48bf-AC2D-D17F00898D06}"= "c:\program files\AVAST Software\Avast\aswWebRepIE.dll" [2011-01-29 743392]
 

[HKEY_CLASSES_ROOT\clsid\{8e5e2654-ad2d-48bf-ac2d-d17f00898d06}]

[HKEY_CLASSES_ROOT\Avast.WrcBar.1]

[HKEY_CLASSES_ROOT\TypeLib\{CD3AF781-AF1F-4400-9A30-15470BE43AD9}]

[HKEY_CLASSES_ROOT\Avast.WrcBar]
 

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]

@="{472083B0-C522-11CF-8763-00608CC02F24}"

[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]

2011-01-29 20:26        120712        ----a-w-        c:\program files\AVAST Software\Avast\ashShell.dll
 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]

"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 202240]
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"hpWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2007-10-03 480560]

"HP Health Check Scheduler"="c:\program files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe" [2008-12-04 75016]

"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2008-03-25 49152]

"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2010-11-15 281768]

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-20 932288]

"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-11-29 421888]
 

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"EnableUIADesktopToggle"= 0 (0x0)
 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

@="Driver"
 

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^GammaTray.lnk]

path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\GammaTray.lnk

backup=c:\windows\pss\GammaTray.lnk.CommonStartup

backupExtension=.CommonStartup
 

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]

path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk

backup=c:\windows\pss\HP Digital Imaging Monitor.lnk.CommonStartup

backupExtension=.CommonStartup
 

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Microsoft Office.lnk]

path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Office.lnk

backup=c:\windows\pss\Microsoft Office.lnk.CommonStartup

backupExtension=.CommonStartup
 

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^NCProTray.lnk]

path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\NCProTray.lnk

backup=c:\windows\pss\NCProTray.lnk.CommonStartup

backupExtension=.CommonStartup
 

[HKLM\~\startupfolder\C:^Users^Buchholz^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OpenOffice.org 3.1.lnk]

path=c:\users\Buchholz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.1.lnk

backup=c:\windows\pss\OpenOffice.org 3.1.lnk.Startup

backupExtension=.Startup
 

[HKLM\~\startupfolder\CCleaner.exe]

path=CCleaner.exe

backup=c:\windows\pss\CCleaner.exe.Startup

backupExtension=.Startup
 

[HKLM\~\startupfolder\uninst.exe]

path=uninst.exe

backup=c:\windows\pss\uninst.exe.Startup

backupExtension=.Startup
 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]

2010-09-23 02:47        35760        ----a-w-        c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe
 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\avast]

2011-01-29 20:26        3427024        ----a-w-        c:\program files\AVAST Software\Avast\AvastUI.exe
 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Eraser]

2009-06-10 13:22        334224        ----a-w-        c:\program files\Eraser\Eraser.exe
 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\hpqSRMon]

2008-03-13 07:34        81920        ----a-w-        c:\program files\HP\Digital Imaging\bin\HpqSRmon.exe
 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]

2011-01-25 14:08        421160        ----a-w-        c:\program files\iTunes\iTunesHelper.exe
 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]

2010-04-16 21:12        3872080        ----a-w-        c:\program files\Windows Live\Messenger\msnmsgr.exe
 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OnScreenDisplay]

2007-11-01 16:42        554288        ----a-w-        c:\program files\Hewlett-Packard\HP QuickTouch\HPKBDAPP.exe
 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QlbCtrl.exe]

2008-08-01 14:14        202032        ----a-w-        c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]

2010-11-29 16:38        421888        ----a-w-        c:\program files\QuickTime\QTTask.exe
 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sidebar]

2008-01-19 07:33        1233920        ----a-w-        c:\program files\Windows Sidebar\sidebar.exe
 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]

2009-07-31 13:29        148888        ----a-w-        c:\program files\Java\jre6\bin\jusched.exe
 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPEnh]

2008-06-20 14:37        1316136        ----a-w-        c:\program files\Synaptics\SynTP\SynTPEnh.exe
 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TomTomHOME.exe]

2009-11-13 11:31        247144        ----a-w-        c:\program files\TomTom HOME 2\TomTomHOMERunner.exe
 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UCam_Menu]

2008-12-03 20:15        218408        ------w-        c:\program files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe
 

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]

R3 Com4QLBEx;Com4QLBEx;c:\program files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe [2008-04-03 193840]

R3 NDISKIO;NDISKIO;c:\users\Buchholz\AppData\Local\Temp\000013a5.nmc\nse\bin\ndiskio.sys [x]

R3 Netaapl;Apple Mobile Device Ethernet Service;c:\windows\system32\DRIVERS\netaapl.sys [2010-04-19 18432]

R3 NETw5v32;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;c:\windows\system32\DRIVERS\NETw5v32.sys [2008-08-28 3664384]

R3 nsak;nsak;c:\users\Buchholz\AppData\Local\Temp\000013a5.nmc\nse\bin\nsak.sys [x]

R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]

S1 aswSnx;aswSnx; [x]

S1 aswSP;aswSP; [x]

S2 AntiVirSchedulerService;Avira AntiVir Planer;c:\program files\Avira\AntiVir Desktop\sched.exe [2010-11-15 135336]

S2 aswFsBlk;aswFsBlk; [x]

S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2011-01-29 51280]

S2 DBService;DATA BECKER Update Service;c:\program files\Common Files\DATA BECKER Shared\DBService.exe [2010-08-17 187456]

S2 SBSDWSCService;SBSD Security Center Service;c:\program files\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368]

S2 TomTomHOMEService;TomTomHOMEService;c:\program files\TomTom HOME 2\TomTomHOMEService.exe [2009-11-13 92008]
 
 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

HPZ12        REG_MULTI_SZ           Pml Driver HPZ12 Net Driver HPZ12

hpdevmgmt        REG_MULTI_SZ           hpqcxs08 hpqddsvc

.

.

------- Zusätzlicher Suchlauf -------

.

uStart Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT2319825

uInternet Settings,ProxyOverride = *.local

IE: {{0F7195C2-6713-4d93-A1BC-DA5FA33F0A65} - {E601996F-E400-41CA-804B-CD6373A7EEE2} - c:\program files\kikin\ie_kikin.dll

FF - ProfilePath - c:\users\Buchholz\AppData\Roaming\Mozilla\Firefox\Profiles\zz6kvqwg.default\

FF - prefs.js: browser.search.defaulturl - hxxp://search.sweetim.com/search.asp?src=2&q=

FF - prefs.js: browser.search.selectedEngine - SweetIM Search

FF - prefs.js: browser.startup.homepage - hxxp://www.google.de/

FF - prefs.js: keyword.URL - hxxp://search.sweetim.com/search.asp?src=2&q=

FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}

FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension

FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}

FF - Ext: Adblock Plus: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} - %profile%\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}

FF - Ext: ImTranslator: {9AA46F4F-4DC7-4c06-97AF-5035170634FE} - %profile%\extensions\{9AA46F4F-4DC7-4c06-97AF-5035170634FE}

FF - Ext: FoxTab: {ef4e370e-d9f0-4e00-b93e-a4f274cfdd5a} - %profile%\extensions\{ef4e370e-d9f0-4e00-b93e-a4f274cfdd5a}

FF - Ext: FireShot: {0b457cAA-602d-484a-8fe7-c1d894a011ba} - %profile%\extensions\{0b457cAA-602d-484a-8fe7-c1d894a011ba}

FF - Ext: BetterPrivacy: {d40f5e7b-d2cf-4856-b441-cc613eeffbe3} - %profile%\extensions\{d40f5e7b-d2cf-4856-b441-cc613eeffbe3}

FF - Ext: GoogleTube: googletube@googletube.com - %profile%\extensions\googletube@googletube.com

FF - Ext: 1-Click YouTube Video Downloader: YoutubeDownloader@PeterOlayev.com - %profile%\extensions\YoutubeDownloader@PeterOlayev.com

FF - Ext: YouTube mp3: info@youtube-mp3.org - %profile%\extensions\info@youtube-mp3.org

FF - Ext: BitDefender QuickScan: {e001c731-5e37-4538-a5cb-8168736a2360} - %profile%\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}

.

- - - - Entfernte verwaiste Registrierungseinträge - - - -
 

MSConfigStartUp-Babylon Client - c:\program files\Babylon\Babylon-Pro\Babylon.exe

MSConfigStartUp-QPService - c:\program files\HP\QuickPlay\QPService.exe

MSConfigStartUp-SpywareTerminator - c:\program files\Spyware Terminator\SpywareTerminatorShield.exe
 
 
 

**************************************************************************
 

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net

Rootkit scan 2011-02-04 09:24

Windows 6.0.6001 Service Pack 1 NTFS
 

Scanne versteckte Prozesse... 
 

Scanne versteckte Autostarteinträge... 
 

Scanne versteckte Dateien... 
 

Scan erfolgreich abgeschlossen

versteckte Dateien: 0
 

**************************************************************************

.

--------------------- Gesperrte Registrierungsschluessel ---------------------
 

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

Zeit der Fertigstellung: 2011-02-04  09:26:53

ComboFix-quarantined-files.txt  2011-02-04 08:26
 

Vor Suchlauf: 12 Verzeichnis(se), 156.250.714.112 Bytes frei

Nach Suchlauf: 20 Verzeichnis(se), 156.183.183.360 Bytes frei
 

- - End Of File - - 1E5568606914823B532516C9CD8ADB6D
--- --- ---