Trojaner-Board - Laptop startet nicht (Please wait while the connection is beeing established.)

der log-file vom combofix:
Code:
ComboFix 12-04-10.01 - Administrator 10.04.2012  21:06:57.1.2 - x86 MINIMAL

Microsoft Windows 7 Starter   6.1.7600.0.1252.49.1031.18.1014.496 [GMT 2:00]

ausgeführt von:: c:\users\Administrator.taflan-PC\Desktop\ComboFix.exe

AV: AntiVir Desktop *Disabled/Updated* {090F9C29-64CE-6C6F-379C-5901B49A85B7}

SP: AntiVir Desktop *Disabled/Updated* {B26E7DCD-42F4-63E1-0D2C-6273CF1DCF0A}

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

 * Neuer Wiederherstellungspunkt wurde erstellt

.

.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

c:\programdata\Windows

c:\programdata\windows\dumd.dat

c:\programdata\Windows\xdor.dat

.

.

(((((((((((((((((((((((   Dateien erstellt von 2012-03-10 bis 2012-04-10  ))))))))))))))))))))))))))))))

.

.

2012-04-10 19:18 . 2012-04-10 19:18        --------        d-----w-        c:\users\User\AppData\Local\temp

2012-04-10 19:18 . 2012-04-10 19:18        --------        d-----w-        c:\users\taflan\AppData\Local\temp

2012-04-10 19:18 . 2012-04-10 19:18        --------        d-----w-        c:\users\Default\AppData\Local\temp

2012-04-10 19:18 . 2012-04-10 19:18        --------        d-----w-        c:\users\Administrator\AppData\Local\temp

2012-04-10 19:18 . 2012-04-10 19:18        --------        d-----w-        c:\users\Administrator.taflan-PC\AppData\Local\temp

2012-04-10 18:44 . 2012-04-10 19:13        56200        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{85EA9BB2-DC49-493A-8EC0-3B4AF943B4DC}\offreg.dll

2012-04-09 19:09 . 2012-04-09 19:11        --------        d-----w-        c:\programdata\WinZip

2012-04-07 21:32 . 2012-04-07 21:32        593920        ----a-w-        C:\OTL.exe

2012-04-07 01:00 . 2011-11-19 14:25        3957616        ----a-w-        c:\windows\system32\ntkrnlpa.exe

2012-04-07 01:00 . 2011-11-19 14:25        3902320        ----a-w-        c:\windows\system32\ntoskrnl.exe

2012-04-06 23:48 . 2012-04-06 23:48        --------        d-----w-        C:\_OTL

2012-04-06 19:53 . 2012-04-06 19:53        --------        d-----w-        c:\program files\ESET

2012-04-06 19:01 . 2012-04-06 19:01        --------        d-----w-        c:\users\User\AppData\Local\Apple

2012-04-06 18:21 . 2012-03-14 02:15        6582328        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{85EA9BB2-DC49-493A-8EC0-3B4AF943B4DC}\mpengine.dll

2012-04-06 18:20 . 2012-02-03 04:01        2341376        ----a-w-        c:\windows\system32\win32k.sys

2012-04-06 18:20 . 2012-02-10 05:41        1074176        ----a-w-        c:\windows\system32\DWrite.dll

2012-04-06 18:20 . 2012-02-10 05:41        218624        ----a-w-        c:\windows\system32\d3d10_1core.dll

2012-04-06 18:20 . 2012-02-10 05:41        1170944        ----a-w-        c:\windows\system32\d3d10warp.dll

2012-04-06 18:20 . 2012-02-10 05:41        161792        ----a-w-        c:\windows\system32\d3d10_1.dll

2012-04-06 18:20 . 2012-02-10 05:41        739840        ----a-w-        c:\windows\system32\d2d1.dll

2012-04-06 18:19 . 2012-04-06 18:19        --------        d-----w-        c:\users\User\AppData\Roaming\Malwarebytes

2012-04-06 18:19 . 2012-01-25 05:44        57856        ----a-w-        c:\windows\system32\rdpwsx.dll

2012-04-06 18:19 . 2012-01-25 05:44        129536        ----a-w-        c:\windows\system32\rdpcorekmts.dll

2012-04-06 18:19 . 2012-01-25 05:40        8192        ----a-w-        c:\windows\system32\rdrmemptylst.exe

2012-04-06 18:19 . 2012-02-15 05:44        826368        ----a-w-        c:\windows\system32\rdpcore.dll

2012-04-06 18:19 . 2012-02-15 04:22        177152        ----a-w-        c:\windows\system32\drivers\rdpwd.sys

2012-04-06 18:19 . 2012-02-15 04:22        24064        ----a-w-        c:\windows\system32\drivers\tdtcp.sys

2012-04-06 18:19 . 2012-04-06 18:19        --------        d-----w-        c:\programdata\Malwarebytes

2012-04-06 18:19 . 2011-12-10 13:24        20464        ----a-w-        c:\windows\system32\drivers\mbam.sys

2012-04-06 18:19 . 2012-04-06 18:19        --------        d-----w-        c:\program files\Malwarebytes' Anti-Malware

.

.

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2012-04-09 19:12 . 2012-04-09 19:12        46171        ----a-w-        C:\TDSSKiller.2.7.27.0_09.04.2012_19.04.32_log.zip

2012-02-23 08:18 . 2010-11-05 13:30        237072        ------w-        c:\windows\system32\MpSigStub.exe

2012-02-16 14:55 . 2012-02-20 19:57        134104        ----a-w-        c:\program files\mozilla firefox\components\browsercomps.dll

.

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\VeriFace Enc]

@="{771C7324-DA80-49D3-8017-753B0AF60951}"

[HKEY_CLASSES_ROOT\CLSID\{771C7324-DA80-49D3-8017-753B0AF60951}]

2010-02-10 11:01        1410312        ----a-w-        c:\windows\System32\IcnOvrly.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"EnergyUtility"="c:\program files\Lenovo\Energy Management\utility.exe" [2009-07-15 4081480]

"Energy Management"="c:\program files\Lenovo\Energy Management\Energy Management.exe" [2009-06-25 5064520]

"VeriFaceManager"="c:\program files\Lenovo\VeriFace\PManage.exe" [2010-02-10 3122440]

"IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-09-23 141848]

"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-09-23 173592]

"Persistence"="c:\windows\system32\igfxpers.exe" [2009-09-23 150552]

"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2010-08-02 281768]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 10.0\Reader\Reader_sl.exe" [2011-01-30 35736]

"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696]

"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2011-07-05 421888]

"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-01-13 460872]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"aux"=wdmaud.drv

.

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]

Security Packages        REG_MULTI_SZ           kerberos msv1_0 schannel wdigest tspkg pku2u livessp

.

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^McAfee Security Scan Plus.lnk]

path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk

backup=c:\windows\pss\McAfee Security Scan Plus.lnk.CommonStartup

backupExtension=.CommonStartup

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]

2012-01-03 07:37        843712        ----a-w-        c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DriverScanner]

2011-05-16 09:22        338296        ----a-w-        c:\program files\Uniblue\DriverScanner\Launcher.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]

2011-11-08 15:26        136176        ----atw-        c:\users\taflan\AppData\Local\Google\Update\GoogleUpdate.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HTC Sync Loader]

2011-01-27 16:57        585728        ----a-w-        c:\program files\HTC\HTC Sync 3.0\htcUPCTLoader.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]

2011-08-18 23:07        421736        ----a-w-        c:\program files\iTunes\iTunesHelper.exe

.

R1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-13 48128]

R2 AntiVirSchedulerService;Avira AntiVir Planer;c:\program files\Avira\AntiVir Desktop\sched.exe [2011-04-27 136360]

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]

R2 gupdate;Google Update-Dienst (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2011-07-25 136176]

R2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [2012-01-13 652360]

R2 PassThru Service;Internet Pass-Through Service;c:\program files\HTC\Internet Pass-Through\PassThruSvr.exe [2010-09-16 80896]

R2 WMCoreService;Mobile Broadband Core Service;c:\program files\Mobile Broadband Drivers\WMCore\mini_WMCore.exe servicemode [x]

R3 e36gmdfl;F3607gw Mobile Broadband Data Modem Filter (Win7);c:\windows\system32\DRIVERS\e36gmdfl.sys [2009-06-30 14848]

R3 e36gmdm;F3607gw Mobile Broadband Data Modem Driver (Win7);c:\windows\system32\DRIVERS\e36gmdm.sys [2009-06-30 374272]

R3 e36gmgmt;F3607gw Mobile Broadband Device Management Drivers (Win7);c:\windows\system32\DRIVERS\e36gmgmt.sys [2009-06-30 357376]

R3 e36wgps;F3607gw Mobile Broadband GPS Port;c:\windows\system32\DRIVERS\e36wgps.sys [2009-07-10 82984]

R3 gupdatem;Google Update-Dienst (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2011-07-25 136176]

R3 HTCAND32;HTC Device Driver;c:\windows\system32\Drivers\ANDROIDUSB.sys [2009-10-26 25088]

R3 htcnprot;HTC NDIS Protocol Driver;c:\windows\system32\DRIVERS\htcnprot.sys [2010-06-23 23040]

R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2011-12-10 20464]

R3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\McAfee Security Scan\2.0.181\McCHSvc.exe [2010-01-15 227232]

R3 Netaapl;Apple Mobile Device Ethernet Service;c:\windows\system32\DRIVERS\netaapl.sys [2011-05-10 18432]

R3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt86win7.sys [2010-06-23 275048]

R3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [2009-07-13 14336]

R3 wsvd;wsvd;c:\windows\system32\DRIVERS\wsvd.sys [2009-07-21 81704]

R3 WwanUsbServ;Ericsson WWAN Wireless Module Device Driver;c:\windows\system32\DRIVERS\WwanUsbMp.sys [2009-09-22 216616]

R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 51040]

S3 ACPIVPC;Lenovo Virtual Power Controller Driver;c:\windows\system32\DRIVERS\AcpiVpc.sys [2010-01-20 23136]

S3 e36gbus;F3607gw Mobile Broadband Device driver (Win7);c:\windows\system32\DRIVERS\e36gbus.sys [2009-06-30 285056]

S3 ecnssndis;Service for enabling selective suspend to NDIS device;c:\windows\system32\Drivers\wwanuss.sys [2009-09-22 10240]

S3 ecnssndisfltr;SSNDIS filter service;c:\windows\system32\Drivers\wwanussf.sys [2009-09-22 14848]

.

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

LocalServiceAndNoImpersonation        REG_MULTI_SZ           SSDPSRV upnphost SCardSvr TBS FontCache fdrespub AppIDSvc QWAVE wcncsvc

.

Inhalt des "geplante Tasks" Ordners

.

2012-04-10 c:\windows\Tasks\DriverScanner.job

- c:\program files\Uniblue\DriverScanner\dsmonitor.exe [2011-08-06 09:22]

.

2012-04-10 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files\Google\Update\GoogleUpdate.exe [2011-07-25 21:11]

.

2012-04-10 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files\Google\Update\GoogleUpdate.exe [2011-07-25 21:11]

.

2012-04-10 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3307350752-4065957660-339254913-1001Core.job

- c:\users\taflan\AppData\Local\Google\Update\GoogleUpdate.exe [2011-11-08 15:26]

.

2012-04-10 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3307350752-4065957660-339254913-1001UA.job

- c:\users\taflan\AppData\Local\Google\Update\GoogleUpdate.exe [2011-11-08 15:26]

.

.

------- Zusätzlicher Suchlauf -------

.

uStart Page = hxxp://www.lenovo.com

TCP: DhcpNameServer = 192.168.2.1

TCP: Interfaces\{CD2621A6-F693-4486-9B51-31DC61388B91}: NameServer = 139.7.30.126 139.7.30.125

FF - ProfilePath - 

.

- - - - Entfernte verwaiste Registrierungseinträge - - - -

.

SafeBoot-mcmscsvc

SafeBoot-MCODS

.

.

.

--------------------- Gesperrte Registrierungsschluessel ---------------------

.

[HKEY_USERS\S-1-5-21-3307350752-4065957660-339254913-500\Software\Microsoft\Internet Explorer\Approved Extensions]

@Denied: (2) (Administrator)

"{18DF081C-E8AD-4283-A596-FA578C2EBDC3}"=hex:51,66,7a,6c,4c,1d,3b,1b,0c,15,ce,

   01,9d,b8,e9,0f,be,98,ba,17,88,6d,fe,da

"{6EBF7485-159F-4BFF-A14F-B9E3AAC4465B}"=hex:51,66,7a,6c,4c,1d,3b,1b,95,69,ae,

   77,af,45,95,06,ba,41,f9,a3,ae,87,05,42

"{9030D464-4C02-4ABF-8ECC-5164760863C6}"=hex:51,66,7a,6c,4c,1d,3b,1b,74,c9,21,

   89,32,1c,d5,07,95,c2,11,24,72,4b,20,df

"{9FDDE16B-836F-4806-AB1F-1455CBEFF289}"=hex:51,66,7a,6c,4c,1d,3b,1b,7b,fc,cc,

   86,5f,d3,6c,05,b0,11,54,15,cf,ac,b1,90

"{DBC80044-A445-435B-BC74-9C25C1C588A9}"=hex:51,66,7a,6c,4c,1d,3b,1b,54,1d,d9,

   c2,75,f4,31,0e,a7,7a,dc,65,c5,86,cb,b0

.

[HKEY_USERS\S-1-5-21-3307350752-4065957660-339254913-500\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration]

@Denied: (2) (Administrator)

"Timestamp"=hex:a1,c9,cf,1d,56,e2,cc,01

.

[HKEY_USERS\S-1-5-21-3307350752-4065957660-339254913-500\Software\Microsoft\Internet Explorer\User Preferences]

@Denied: (2) (Administrator)

"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,

   d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,63,b0,9c,cc,31,1b,fd,48,84,93,df,\

"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,

   d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,63,b0,9c,cc,31,1b,fd,48,84,93,df,\

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

Zeit der Fertigstellung: 2012-04-10  21:23:59

ComboFix-quarantined-files.txt  2012-04-10 19:23

.

Vor Suchlauf: 7 Verzeichnis(se), 23.799.554.048 Bytes frei

Nach Suchlauf: 10 Verzeichnis(se), 23.945.568.256 Bytes frei

.

- - End Of File - - 43F8A66821D7630AF019A28D28070B94