Trojaner-Board - AVAST meldet Mal-Infektion bei svchost.exe

so, bin fertig , hier ist der Log

Code:

All processes killed

========== OTL ==========

Prefs.js: "Ask.com" removed from browser.search.defaultengine

Prefs.js: "Web Search..." removed from browser.search.defaultenginename

Prefs.js: "Search" removed from browser.search.defaultthis.engineName

Prefs.js: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2269050&SearchSource=3&q={searchTerms}" removed from browser.search.defaulturl

Prefs.js: "Ask.com" removed from browser.search.order.1

HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\\Default_Page_URL| /E : value set successfully!

HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\\Local Page| /E : value set successfully!

HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page| /E : value set successfully!

Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\\{e9911ec6-1bcc-40b0-9993-e0eea7f6953f} deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e9911ec6-1bcc-40b0-9993-e0eea7f6953f}\ deleted successfully.

C:\Programme\DVDVideoSoft\tbDVDV.dll moved successfully.

Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\\{e9911ec6-1bcc-40b0-9993-e0eea7f6953f} deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e9911ec6-1bcc-40b0-9993-e0eea7f6953f}\ not found.

File C:\Programme\DVDVideoSoft\tbDVDV.dll not found.

Folder C:\Users\******\AppData\Roaming\mozilla\Firefox\Profiles\yj2llo6v.default\extensions\engine@conduit.com\ not found.

Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{e9911ec6-1bcc-40b0-9993-e0eea7f6953f}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e9911ec6-1bcc-40b0-9993-e0eea7f6953f}\ not found.

File C:\Programme\DVDVideoSoft\tbDVDV.dll not found.

Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{32099AAC-C132-4136-9E9A-4E364A424E17} deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{32099AAC-C132-4136-9E9A-4E364A424E17}\ deleted successfully.

C:\Programme\DAEMON Tools Toolbar\DTToolbar.dll moved successfully.

Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{E9911EC6-1BCC-40B0-9993-E0EEA7F6953F} deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E9911EC6-1BCC-40B0-9993-E0EEA7F6953F}\ not found.

File C:\Programme\DVDVideoSoft\tbDVDV.dll not found.

Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ deleted successfully.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!

C:\autoexec.bat moved successfully.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{627510c7-b8d7-11de-b7a5-001e8c8b6501}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{627510c7-b8d7-11de-b7a5-001e8c8b6501}\ not found.

File K:\Menu.exe not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{84ac6857-b216-11df-8153-001e8c8b6501}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{84ac6857-b216-11df-8153-001e8c8b6501}\ not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{84ac6857-b216-11df-8153-001e8c8b6501}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{84ac6857-b216-11df-8153-001e8c8b6501}\ not found.

File K:\SETUP.EXE not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{84ac6857-b216-11df-8153-001e8c8b6501}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{84ac6857-b216-11df-8153-001e8c8b6501}\ not found.

File K:\TEST\CHECKER.exe not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{84ac6857-b216-11df-8153-001e8c8b6501}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{84ac6857-b216-11df-8153-001e8c8b6501}\ not found.

File K:\TEST\DSTEST.exe not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{84ac6857-b216-11df-8153-001e8c8b6501}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{84ac6857-b216-11df-8153-001e8c8b6501}\ not found.

File K:\DIRECTX\DXSETUP.exe not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{fdfe7eb4-7f34-11dd-a3c2-806e6f6e6963}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{fdfe7eb4-7f34-11dd-a3c2-806e6f6e6963}\ not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{fdfe7eb4-7f34-11dd-a3c2-806e6f6e6963}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{fdfe7eb4-7f34-11dd-a3c2-806e6f6e6963}\ not found.

File E:\EPSETUP.EXE not found.

========== COMMANDS ==========

HOSTS file reset successfully

 

[EMPTYTEMP]

 

User: All Users

 

User: Default

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 33170 bytes

 

User: Default User

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

 

User: ********

->Temp folder emptied: 1078492 bytes

->Temporary Internet Files folder emptied: 7464746 bytes

->Java cache emptied: 76103331 bytes

->FireFox cache emptied: 101368503 bytes

->Flash cache emptied: 2812893 bytes

 

User: Public

 

%systemdrive% .tmp files removed: 0 bytes

%systemroot% .tmp files removed: 0 bytes

%systemroot%\System32 .tmp files removed: 0 bytes

%systemroot%\System32\drivers .tmp files removed: 279440 bytes

Windows Temp folder emptied: 6792528 bytes

%systemroot%\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 75418289 bytes

RecycleBin emptied: 0 bytes

 

Total Files Cleaned = 259,00 mb

 

 

OTL by OldTimer - Version 3.2.22.3 log created on 04152011_191805
 

Files\Folders moved on Reboot...

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TGOOXXWB\display[1].htm moved successfully.

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TGOOXXWB\display[2].htm moved successfully.

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TGOOXXWB\ok[1].htm moved successfully.

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TGOOXXWB\redirect[2].htm moved successfully.

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TGOOXXWB\searchCAQHNVAR.htm moved successfully.

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TGOOXXWB\search[4].htm moved successfully.

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TGOOXXWB\search[7].htm moved successfully.

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TGOOXXWB\search[8].htm moved successfully.

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JPBWLZNI\display[4].htm moved successfully.

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JPBWLZNI\display[5].htm moved successfully.

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JPBWLZNI\display[8].htm moved successfully.

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JPBWLZNI\search[4].htm moved successfully.

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JPBWLZNI\search[5].htm moved successfully.

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9TH8F4E4\display[1].htm moved successfully.

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9TH8F4E4\redirect[1].htm moved successfully.

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9TH8F4E4\search[4].htm moved successfully.

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4MWIGWZB\display[1].htm moved successfully.

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4MWIGWZB\display[3].htm moved successfully.

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4MWIGWZB\redirect[1].htm moved successfully.

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4MWIGWZB\search[3].htm moved successfully.

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4MWIGWZB\search[4].htm moved successfully.
 

Registry entries deleted on Reboot...

so ,fertig, hier ist es:

Combofix Logfile:

Code:

ComboFix 11-04-14.03 - ******** 15.04.2011  22:25:53.1.2 - x86

Microsoft® Windows Vista™ Home Premium   6.0.6002.2.1252.49.1031.18.3071.1542 [GMT 2:00]

ausgeführt von:: c:\users\********\Desktop\cofi.exe

AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}

SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

c:\users\********\Documents\Übergabeprotokoll für eine Mietwohnung bei Einzug.doc

c:\users\********\Documents\Anschreiben.pdf

c:\users\********\Documents\cc_20110326_145821.reg

c:\users\********\Documents\cc_20110326_192950.reg

c:\users\********\Documents\cc_20110326_210238.reg

c:\users\********\Documents\cc_20110411_220950.reg

c:\users\********\Documents\Extras.Txt

c:\users\********\Documents\Falls Sie keinen Lastschriftauftrag erteilen möchten.doc

c:\users\********\Documents\Flur.doc

c:\users\********\Documents\Hallo liebe Hausbewohner.doc

c:\users\********\Documents\Kündigung.doc

c:\users\********\Documents\Meine Geschätsidee besteht darin einfache Tools zu entwickeln die das alltägliche Leben erleichtern sollen ohne Elektronik nur mit den einfachsten Mechanismen.doc

c:\users\********\Documents\Rheinenergie.doc

c:\users\********\Documents\Thesenblatt.doc

c:\users\********\Documents\vlc-1.0.3-win32.exe

c:\users\********\Documents\vlc-1.1.0-win32.exe

c:\users\********\Documents\Ziel des versuches war es Umfangreiche Messungen bezüglich Form und Lage Funktionskritischer Merkmale eines Übungswerkstück und eines Zylinderkopf zu ermitteln.doc

c:\windows\system32\jusched.exe

c:\windows\system32\rnaph.dll

.

.

(((((((((((((((((((((((   Dateien erstellt von 2011-03-15 bis 2011-04-15  ))))))))))))))))))))))))))))))

.

.

2011-04-15 20:32 . 2011-04-15 20:32        --------        d-----w-        c:\users\Default\AppData\Local\temp

2011-04-15 18:56 . 2011-03-15 04:05        6792528        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{979EDA4E-E5C8-4282-91E1-8214CA13AC81}\mpengine.dll

2011-04-15 17:18 . 2011-04-15 17:18        --------        d-----w-        C:\_OTL

2011-04-13 19:41 . 2011-04-13 19:41        --------        d-----w-        c:\users\********\AppData\Roaming\Malwarebytes

2011-04-13 19:41 . 2010-12-20 16:09        38224        ----a-w-        c:\windows\system32\drivers\mbamswissarmy.sys

2011-04-13 19:41 . 2011-04-13 19:41        --------        d-----w-        c:\programdata\Malwarebytes

2011-04-13 19:41 . 2011-04-13 19:41        --------        d-----w-        c:\program files\Malwarebytes' Anti-Malware

2011-04-13 19:41 . 2010-12-20 16:08        20952        ----a-w-        c:\windows\system32\drivers\mbam.sys

2011-04-12 17:25 . 2011-02-23 13:56        301528        ----a-w-        c:\windows\system32\drivers\aswSP.sys

2011-04-12 17:25 . 2011-02-23 13:54        19544        ----a-w-        c:\windows\system32\drivers\aswFsBlk.sys

2011-04-12 17:25 . 2011-02-23 13:56        371544        ----a-w-        c:\windows\system32\drivers\aswSnx.sys

2011-04-12 17:25 . 2011-02-23 13:55        49240        ----a-w-        c:\windows\system32\drivers\aswTdi.sys

2011-04-12 17:25 . 2011-02-23 13:55        25432        ----a-w-        c:\windows\system32\drivers\aswRdr.sys

2011-04-12 17:25 . 2011-02-23 13:55        53592        ----a-w-        c:\windows\system32\drivers\aswMonFlt.sys

2011-04-12 17:25 . 2011-02-23 14:04        40648        ----a-w-        c:\windows\avastSS.scr

2011-04-12 17:25 . 2011-02-23 14:04        190016        ----a-w-        c:\windows\system32\aswBoot.exe

2011-04-12 17:25 . 2011-04-12 17:25        --------        d-----w-        c:\programdata\AVAST Software

2011-04-12 17:25 . 2011-04-12 17:25        --------        d-----w-        c:\program files\AVAST Software

2011-03-29 10:53 . 2011-03-29 10:53        --------        d-----w-        c:\programdata\WindowsSearch

2011-03-27 02:03 . 2011-03-27 02:03        --------        d-----w-        c:\users\Default\AppData\Local\Microsoft Help

2011-03-26 19:38 . 2011-03-26 19:38        --------        d-----w-        c:\program files\Windows Resource Kits

2011-03-26 18:26 . 2011-03-26 18:26        --------        d-----w-        c:\users\********\AppData\Local\PackageAware

2011-03-26 17:54 . 2011-03-26 17:54        3584        ----a-r-        c:\users\********\AppData\Roaming\Microsoft\Installer\{121634B0-2F4B-11D3-ADA3-00C04F52DD52}\Icon386ED4E3.exe

2011-03-26 17:54 . 2011-03-26 17:54        --------        d-----w-        c:\program files\Windows Installer Clean Up

2011-03-26 17:53 . 2011-03-26 17:54        --------        d-----w-        c:\program files\MSECACHE

2011-03-26 16:00 . 2011-03-26 16:00        --------        d-----w-        c:\programdata\Martau

2011-03-26 16:00 . 2011-03-26 16:00        --------        d-----w-        c:\program files\Total Uninstall 5

2011-03-26 13:53 . 2011-03-26 13:53        --------        d-----w-        c:\program files\CCleaner

2011-03-25 16:19 . 2011-03-25 16:19        --------        d-----w-        c:\program files\Microsoft Visual Studio 8

2011-03-23 10:05 . 2011-02-22 13:33        1068544        ----a-w-        c:\windows\system32\DWrite.dll

2011-03-23 10:05 . 2011-02-22 14:13        288768        ----a-w-        c:\windows\system32\XpsGdiConverter.dll

2011-03-23 10:05 . 2011-02-22 13:33        797696        ----a-w-        c:\windows\system32\FntCache.dll

.

.

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2011-02-02 17:11 . 2009-11-05 10:06        222080        ------w-        c:\windows\system32\MpSigStub.exe

2011-01-20 16:37 . 2011-02-09 08:50        638336        ----a-w-        c:\windows\system32\drivers\dxgkrnl.sys

2011-01-20 16:08 . 2011-02-09 08:50        478720        ----a-w-        c:\windows\system32\dxgi.dll

2011-01-20 16:08 . 2011-02-09 08:50        219648        ----a-w-        c:\windows\system32\d3d10_1core.dll

2011-01-20 16:08 . 2011-02-09 08:50        160768        ----a-w-        c:\windows\system32\d3d10_1.dll

2011-01-20 16:08 . 2011-02-09 08:50        1029120        ----a-w-        c:\windows\system32\d3d10.dll

2011-01-20 16:08 . 2011-02-09 08:50        189952        ----a-w-        c:\windows\system32\d3d10core.dll

2011-01-20 16:07 . 2011-02-09 08:50        37376        ----a-w-        c:\windows\system32\cdd.dll

2011-01-20 16:07 . 2011-02-09 08:50        258048        ----a-w-        c:\windows\system32\winspool.drv

2011-01-20 16:07 . 2011-02-09 08:50        586240        ----a-w-        c:\windows\system32\stobject.dll

2011-01-20 16:06 . 2011-02-09 08:50        2873344        ----a-w-        c:\windows\system32\mf.dll

2011-01-20 16:06 . 2011-02-09 08:50        26112        ----a-w-        c:\windows\system32\printfilterpipelineprxy.dll

2011-01-20 16:04 . 2011-02-09 08:50        209920        ----a-w-        c:\windows\system32\mfplat.dll

2011-01-20 16:04 . 2011-02-09 08:50        98816        ----a-w-        c:\windows\system32\mfps.dll

2011-01-20 14:28 . 2011-02-09 08:50        1554432        ----a-w-        c:\windows\system32\xpsservices.dll

2011-01-20 14:27 . 2011-02-09 08:50        876032        ----a-w-        c:\windows\system32\XpsPrint.dll

2011-01-20 14:26 . 2011-02-09 08:50        667648        ----a-w-        c:\windows\system32\printfilterpipelinesvc.exe

2011-01-20 14:25 . 2011-02-09 08:50        847360        ----a-w-        c:\windows\system32\OpcServices.dll

2011-01-20 14:24 . 2011-02-09 08:50        135680        ----a-w-        c:\windows\system32\XpsRasterService.dll

2011-01-20 14:15 . 2011-02-09 08:50        979456        ----a-w-        c:\windows\system32\MFH264Dec.dll

2011-01-20 14:14 . 2011-02-09 08:50        357376        ----a-w-        c:\windows\system32\MFHEAACdec.dll

2011-01-20 14:14 . 2011-02-09 08:50        302592        ----a-w-        c:\windows\system32\mfmp4src.dll

2011-01-20 14:14 . 2011-02-09 08:50        261632        ----a-w-        c:\windows\system32\mfreadwrite.dll

2011-01-20 14:12 . 2011-02-09 08:50        1172480        ----a-w-        c:\windows\system32\d3d10warp.dll

2011-01-20 14:11 . 2011-02-09 08:50        486400        ----a-w-        c:\windows\system32\d3d10level9.dll

2011-01-20 13:47 . 2011-02-09 08:50        683008        ----a-w-        c:\windows\system32\d2d1.dll

.

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]

@="{472083B0-C522-11CF-8763-00608CC02F24}"

[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]

2011-02-23 14:04        122512        ----a-w-        c:\program files\AVAST Software\Avast\ashShell.dll

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]

"WindowsWelcomeCenter"="oobefldr.dll" [2009-04-11 2153472]

"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2010-04-16 3872080]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"hpsysdrv"="c:\hp\support\hpsysdrv.exe" [2007-04-18 65536]

"KBD"="c:\hp\KBD\KbdStub.EXE" [2006-12-08 65536]

"OsdMaestro"="c:\program files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe" [2007-02-15 118784]

"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2007-07-12 178712]

"RtHDVCpl"="RtHDVCpl.exe" [2008-01-15 4874240]

"NvSvc"="c:\windows\system32\nvsvc.dll" [2008-01-10 92704]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-01-10 8530464]

"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-01-10 88608]

"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-09-23 35760]

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-20 932288]

"FUFAXSTM"="c:\program files\Epson Software\FAX Utility\FUFAXSTM.exe" [2009-12-02 847872]

"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]

"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2011-02-23 3451496]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"aux"=wdmaud.drv

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]

2010-04-16 21:12        3872080        ----a-w-        c:\program files\Windows Live\Messenger\msnmsgr.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]

2009-03-05 14:07        2260480        --sha-r-        c:\program files\Spybot - Search & Destroy\TeaTimer.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VeohPlugin]

2010-07-06 14:01        2634048        ----a-w-        c:\program files\Veoh Networks\VeohWebPlayer\veohwebplayer.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]

"DisableMonitoring"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]

"DisableMonitoring"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]

"DisableMonitoring"=dword:00000001

.

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]

R2 ENI Server;ENI Server;c:\program files\3S Software\CoDeSys ENI Server\ENI.exe [2007-05-08 565248]

R3 ASPI;Advanced SCSI Programming Interface Driver;c:\windows\System32\DRIVERS\ASPI32.sys [2002-07-17 84832]

R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]

R3 XDva326;XDva326;c:\windows\system32\XDva326.sys [x]

R3 XDva328;XDva328;c:\windows\system32\XDva328.sys [x]

R3 XDva332;XDva332;c:\windows\system32\XDva332.sys [x]

R3 XDva337;XDva337;c:\windows\system32\XDva337.sys [x]

R3 XDva341;XDva341;c:\windows\system32\XDva341.sys [x]

R3 XDva343;XDva343;c:\windows\system32\XDva343.sys [x]

R3 XDva346;XDva346;c:\windows\system32\XDva346.sys [x]

R3 XDva347;XDva347;c:\windows\system32\XDva347.sys [x]

R3 XDva349;XDva349;c:\windows\system32\XDva349.sys [x]

R3 XDva351;XDva351;c:\windows\system32\XDva351.sys [x]

R3 XDva352;XDva352;c:\windows\system32\XDva352.sys [x]

R3 XDva354;XDva354;c:\windows\system32\XDva354.sys [x]

R3 XDva358;XDva358;c:\windows\system32\XDva358.sys [x]

R3 XDva359;XDva359;c:\windows\system32\XDva359.sys [x]

R3 XDva362;XDva362;c:\windows\system32\XDva362.sys [x]

R3 XDva370;XDva370;c:\windows\system32\XDva370.sys [x]

R3 XDva375;XDva375;c:\windows\system32\XDva375.sys [x]

R3 XDva380;XDva380;c:\windows\system32\XDva380.sys [x]

R3 XDva383;XDva383;c:\windows\system32\XDva383.sys [x]

S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2010-08-27 691696]

S1 aswSnx;aswSnx; [x]

S1 aswSP;aswSP; [x]

S2 aswFsBlk;aswFsBlk; [x]

S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2011-02-23 53592]

S2 SBSDWSCService;SBSD Security Center Service;c:\program files\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368]

S3 XDva385;XDva385;c:\windows\system32\XDva385.sys [x]

.

.

--- Andere Dienste/Treiber im Speicher ---

.

*NewlyCreated* - XDVA385

*Deregistered* - klmd25

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

getPlusHelper        REG_MULTI_SZ           getPlusHelper

LocalServiceAndNoImpersonation        REG_MULTI_SZ           FontCache

.

.

------- Zusätzlicher Suchlauf -------

.

uStart Page = hxxp://www.google.de/

mStart Page = 

mLocal Page = 

IE: Free YouTube to Mp3 Converter - c:\users\********\AppData\Roaming\DVDVideoSoftIEHelpers\youtubetomp3.htm

IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000

IE: Save YouTube Video as MP3 - c:\program files\Common Files\DVDVideoSoft\Dll\IEContextMenuY.dll/scriptY2MP3.htm

FF - ProfilePath - c:\users\********\AppData\Roaming\Mozilla\Firefox\Profiles\yj2llo6v.default\

FF - prefs.js: browser.search.defaulturl - 

FF - prefs.js: browser.search.selectedEngine - Google

FF - prefs.js: browser.startup.homepage - www.google.de

FF - Ext: Screengrab: {02450954-cdd9-410f-b1da-db804e18c671} - %profile%\extensions\{02450954-cdd9-410f-b1da-db804e18c671}

FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}

FF - Ext: avast! WebRep: wrc@avast.com - c:\program files\AVAST Software\Avast\WebRep\FF

FF - user.js: network.http.max-persistent-connections-per-server - 4

FF - user.js: content.max.tokenizing.time - 200000

FF - user.js: content.notify.interval - 100000

FF - user.js: content.switch.threshold - 650000

FF - user.js: nglayout.initialpaint.delay - 300

.

- - - - Entfernte verwaiste Registrierungseinträge - - - -

.

Toolbar-{e9911ec6-1bcc-40b0-9993-e0eea7f6953f} - (no file)

WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)

MSConfigStartUp-HP Software Update - c:\program files\HP\HP Software Update\HPWuSchd2.exe

.

.

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net

Rootkit scan 2011-04-15 22:32

Windows 6.0.6002 Service Pack 2 NTFS

.

Scanne versteckte Prozesse... 

.

Scanne versteckte Autostarteinträge... 

.

Scanne versteckte Dateien... 

.

Scan erfolgreich abgeschlossen

versteckte Dateien: 0

.

**************************************************************************

.

--------------------- Gesperrte Registrierungsschluessel ---------------------

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\Tcpip6\Parameters\Interfaces\{59f9a6ed-7952-44ff-84b0-733d6f26699e}]

@DACL=(02 0000)

"Dhcpv6Iaid"=dword:3a020054

"Dhcpv6State"=dword:00000000

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\Tcpip6\Parameters\Interfaces\{86cd1880-ff72-46f6-9569-e5ad99eef5f5}]

@DACL=(02 0000)

"Dhcpv6Iaid"=dword:0c001e8c

"Dhcpv6State"=dword:00000000

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\Tcpip6\Parameters\Interfaces\{9c642153-bfe0-4511-a0b6-e778ddd5ea9e}]

@DACL=(02 0000)

"Dhcpv6Iaid"=dword:07001422

"Dhcpv6State"=dword:00000000

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\Tcpip6\Parameters\Interfaces\{f50c0996-5b4a-4c6a-a322-6e991d4caa0e}]

@DACL=(02 0000)

"Dhcpv6Iaid"=dword:06001422

"Dhcpv6State"=dword:00000000

.

Zeit der Fertigstellung: 2011-04-15  22:34:19

ComboFix-quarantined-files.txt  2011-04-15 20:34

.

Vor Suchlauf: 22 Verzeichnis(se), 70.753.882.112 Bytes frei

Nach Suchlauf: 25 Verzeichnis(se), 70.164.422.656 Bytes frei

.

- - End Of File - - FAAC3F6B4FE8851ED831A5FE8F928821

--- --- ---