Trojaner-Board - /Hostprozess/Bootcamp/Explorer.exe funktionieren nicht mehr

So ich hab jetzt Combofix durchlaufen lassen.
Das Ergebnis hier:
Code:
ComboFix 12-12-17.02 - Jan 18.12.2012  15:02:34.1.2 - x86

Microsoft Windows 7 Home Premium   6.1.7600.0.1252.49.1031.18.3037.2176 [GMT 1:00]

ausgeführt von:: c:\users\Jan\Downloads\ComboFix.exe

SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

c:\program files\facemoods.com

c:\program files\facemoods.com\facemoods\1.4.17.11\bh\facemoods.dll

c:\program files\facemoods.com\facemoods\1.4.17.11\facemoods.crx

c:\program files\facemoods.com\facemoods\1.4.17.11\facemoods.png

c:\program files\facemoods.com\facemoods\1.4.17.11\facemoodsApp.dll

c:\program files\facemoods.com\facemoods\1.4.17.11\facemoodsEng.dll

c:\program files\facemoods.com\facemoods\1.4.17.11\facemoodssrv.exe

c:\program files\facemoods.com\facemoods\1.4.17.11\facemoodsTlbr.dll

c:\program files\facemoods.com\facemoods\1.4.17.11\uninstall.exe

c:\users\Jan\AppData\Local\{4a93732b-c99b-44ee-f8e0-5a4d6886817c}\@

c:\users\Jan\AppData\Local\{4a93732b-c99b-44ee-f8e0-5a4d6886817c}\n

c:\users\Jan\AppData\Roaming\AcroIEHelpe.dll

c:\users\Jan\AppData\Roaming\AcroIEHelpe.txt

c:\users\Jan\AppData\Roaming\AcroIEHelpe231.dll

c:\users\Jan\AppData\Roaming\AcroIEHelpe245.dll

c:\users\Jan\AppData\Roaming\BAcroIEHelpe.dll

c:\users\Jan\AppData\Roaming\BAcroIEHelpe203.dll

c:\users\Jan\AppData\Roaming\BAcroIEHelpe205.dll

c:\users\Jan\AppData\Roaming\BAcroIEHelpe228.dll

c:\users\Jan\AppData\Roaming\BAcroIEHelpe245.dll

c:\users\Jan\AppData\Roaming\ko1orb3g.default.tmp

c:\users\Jan\AppData\Roaming\melant.dll

c:\users\Jan\AppData\Roaming\srvblck5.tmp

c:\windows\Installer\{4a93732b-c99b-44ee-f8e0-5a4d6886817c}\@

c:\windows\Installer\{4a93732b-c99b-44ee-f8e0-5a4d6886817c}\L\00000004.@

c:\windows\Installer\{4a93732b-c99b-44ee-f8e0-5a4d6886817c}\L\1afb2d56

c:\windows\Installer\{4a93732b-c99b-44ee-f8e0-5a4d6886817c}\L\201d3dde

c:\windows\Installer\{4a93732b-c99b-44ee-f8e0-5a4d6886817c}\n

c:\windows\Installer\{4a93732b-c99b-44ee-f8e0-5a4d6886817c}\U\00000004.@

c:\windows\Installer\{4a93732b-c99b-44ee-f8e0-5a4d6886817c}\U\00000008.@

c:\windows\Installer\{4a93732b-c99b-44ee-f8e0-5a4d6886817c}\U\000000cb.@

c:\windows\Installer\{4a93732b-c99b-44ee-f8e0-5a4d6886817c}\U\80000000.@

c:\windows\Installer\{4a93732b-c99b-44ee-f8e0-5a4d6886817c}\U\80000032.@

c:\windows\IsUn0407.exe

.

Infizierte Kopie von c:\windows\system32\services.exe wurde gefunden und desinfiziert 

Kopie von - c:\windows\winsxs\x86_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.1.7600.16385_none_cf36168b2e9c967b\services.exe wurde wiederhergestellt 

.

.

(((((((((((((((((((((((   Dateien erstellt von 2012-11-18 bis 2012-12-18  ))))))))))))))))))))))))))))))

.

.

2012-12-18 14:09 . 2012-12-18 14:23        --------        d-----w-        c:\users\Jan\AppData\Local\temp

2012-12-18 14:09 . 2012-12-18 14:09        --------        d-----w-        c:\users\Default\AppData\Local\temp

2012-12-14 14:00 . 2012-12-14 14:00        --------        d-----w-        c:\users\Jan\AppData\Roaming\16001.017

.

.

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2012-12-14 12:57 . 2012-08-29 16:33        697272        ----a-w-        c:\windows\system32\FlashPlayerApp.exe

2012-12-14 12:57 . 2011-08-14 20:12        73656        ----a-w-        c:\windows\system32\FlashPlayerCPLApp.cpl

2012-10-24 17:50 . 2012-11-13 12:09        261600        ----a-w-        c:\program files\mozilla firefox\components\browsercomps.dll

.

.

------- Sigcheck -------

Note: Unsigned files aren't necessarily malware.

.

[-] 2009-10-30 . 5DECCD8F824007CE7ED0ADF917F53FC7 . 2870272 . . [6.1.7600.16385] . . c:\windows\Resources\Themes\Snow Leopard for Windows7\System Files\explorer\64 BIT\explorer.exe

[-] 2009-10-30 . F0D702C51324ACC00E99D35B6A8D724A . 2870272 . . [6.1.7600.16385] . . c:\windows\Resources\Themes\System Files\explorer\64 BIT\explorer.exe

[7] 2009-07-14 . 15BC38A7492BEFE831966ADB477CF76F . 2613248 . . [6.1.7600.16385] . . c:\windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_518afd35db100430\explorer.exe

[-] 2009-04-11 . 8FE72C78CFAA62956285723816679578 . 3116032 . . [6.1.7600.16385] . . c:\windows\explorer.exe

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive1]

@="{F241C880-6982-4CE5-8CF7-7085BA96DA5A}"

[HKEY_CLASSES_ROOT\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}]

2012-09-03 16:05        220608        ----a-w-        c:\users\Jan\AppData\Local\Microsoft\SkyDrive\16.4.6010.0727\SkyDriveShell.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive2]

@="{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}"

[HKEY_CLASSES_ROOT\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}]

2012-09-03 16:05        220608        ----a-w-        c:\users\Jan\AppData\Local\Microsoft\SkyDrive\16.4.6010.0727\SkyDriveShell.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive3]

@="{BBACC218-34EA-4666-9D7A-C78F2274A524}"

[HKEY_CLASSES_ROOT\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}]

2012-09-03 16:05        220608        ----a-w-        c:\users\Jan\AppData\Local\Microsoft\SkyDrive\16.4.6010.0727\SkyDriveShell.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Apple_KbdMgr"="c:\program files\Boot Camp\Bootcamp.exe" [2011-08-15 526208]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 0 (0x0)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableLUA"= 0 (0x0)

"EnableUIADesktopToggle"= 0 (0x0)

"PromptOnSecureDesktop"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]

2012-01-03 07:37        843712        ----a-w-        c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeAAMUpdater-1.0]

2011-03-15 15:42        499608        ------w-        c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\updaterstartuputility.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeCS5.5ServiceManager]

2011-01-12 05:08        1523360        ----a-w-        c:\program files\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Akamai NetSession Interface]

2012-10-09 09:53        4441920        ----a-w-        c:\users\Jan\AppData\Local\Akamai\netsession_win.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\APSDaemon]

2011-09-27 05:22        59240        ----a-w-        c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]

2011-11-10 09:17        3514176        ----a-w-        c:\program files\DAEMON Tools Lite\DTLite.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]

2009-09-23 10:30        173592        ----a-w-        c:\windows\System32\hkcmd.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]

2009-09-23 10:30        141848        ----a-w-        c:\windows\System32\igfxtray.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]

2011-10-09 16:06        421736        ----a-w-        c:\program files\iTunes\iTunesHelper.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Persistence]

2009-09-23 10:30        150552        ----a-w-        c:\windows\System32\igfxpers.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]

2011-07-05 16:36        421888        ----a-w-        c:\program files\QuickTime\QTTask.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RtHDVCpl]

2010-02-01 15:12        7739936        ----a-w-        c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]

2011-07-29 10:31        17361032        ----a-r-        c:\program files\Skype\Phone\Skype.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]

2011-09-30 11:19        252296        ----a-w-        c:\program files\Common Files\Java\Java Update\jusched.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SwitchBoard]

2010-02-19 11:37        517096        ----a-w-        c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe

.

R3 applebt;Apple Built-in Bluetooth;c:\windows\system32\DRIVERS\applebt.sys [x]

R3 BthKicker;Apple Bluetooth Device Driver;c:\windows\system32\DRIVERS\BthKicker.sys [x]

R3 EagleXNt;EagleXNt;c:\windows\system32\drivers\EagleXNt.sys [x]

R3 iSightUpdate;iSight Update Driver;c:\windows\system32\DRIVERS\iSightUP.sys [x]

R3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des [x]

R3 SwitchBoard;SwitchBoard;c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [x]

S0 AppleHFS;AppleHFS; [x]

S0 AppleMNT;AppleMNT; [x]

S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [x]

S2 Akamai;Akamai NetSession Interface;c:\windows\System32\svchost.exe [x]

S2 AppleOSSMgr;Apple OS Switch Manager;c:\windows\system32\AppleOSSMgr.exe [x]

S2 AppleTimeSrv;Apple-Time-Server;c:\windows\system32\AppleTimeSrv.exe [x]

S2 KeyAgent;KeyAgent;c:\windows\system32\drivers\KeyAgent.sys [x]

S2 MacHALDriver;Mac HAL;c:\windows\system32\drivers\MacHALDriver.sys [x]

S3 aapltctp;Apple Trackpad Enabler;c:\windows\system32\DRIVERS\aapltctp.sys [x]

S3 aapltp;Apple Trackpad;c:\windows\system32\DRIVERS\aapltp.sys [x]

S3 IRRemoteFlt;IR Receiver Filter Driver;c:\windows\system32\DRIVERS\IRFilter.sys [x]

S3 KeyMagic;USB Keyboard HID Filter;c:\windows\system32\DRIVERS\KeyMagic.sys [x]

S3 yukonw7;NDIS6.2-Miniporttreiber für Marvell Yukon-Ethernet-Controller;c:\windows\system32\DRIVERS\yk62x86.sys [x]

.

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

Akamai        REG_MULTI_SZ           Akamai

.

Inhalt des "geplante Tasks" Ordners

.

2012-12-18 c:\windows\Tasks\Adobe Flash Player Updater.job

- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-08-29 12:57]

.

.

------- Zusätzlicher Suchlauf -------

.

uStart Page = hxxp://feed.helperbar.com/?publisher=OPENCANDY&dpid=OPENCANDYAPRIL&co=DE&userid=715942a5-7de6-4606-ab64-224de4425cea&affid=111583&searchtype=hp&babsrc=lnkry_nt

uInternet Settings,ProxyOverride = *.local;127.0.0.1:9421;<local>

uSearchAssistant = hxxp://feed.helperbar.com/?publisher=OPENCANDY&dpid=OPENCANDYAPRIL&co=DE&userid=715942a5-7de6-4606-ab64-224de4425cea&affid=111583&searchtype=ds&babsrc=lnkry&q={searchTerms}

TCP: DhcpNameServer = 192.168.2.1

FF - ProfilePath - c:\users\Jan\AppData\Roaming\Mozilla\Firefox\Profiles\ko1orb3g.default\

FF - prefs.js: browser.startup.homepage - hxxp://www.google.de/

FF - prefs.js: keyword.URL - hxxp://feed.helperbar.com/?publisher=OPENCANDY&dpid=OPENCANDYAPRIL&co=DE&userid=715942a5-7de6-4606-ab64-224de4425cea&affid=111583&searchtype=ds&babsrc=lnkry&q=

FF - ExtSQL: !HIDDEN! 2012-11-12 22:41; {33044118-6597-4D2F-ABEA-7974BB185379}; c:\users\Jan\AppData\Roaming\16001.017

.

- - - - Entfernte verwaiste Registrierungseinträge - - - -

.

MSConfigStartUp-facemoods - c:\program files\facemoods.com\facemoods\1.4.17.11\facemoodssrv.exe

MSConfigStartUp-melant - c:\users\Jan\AppData\Roaming\melant.dll

MSConfigStartUp-openvpn-gui - c:\program files\OpenVPN\bin\openvpn-gui.exe

AddRemove-facemoods - c:\program files\facemoods.com\facemoods\1.4.17.11\uninstall.exe

AddRemove-IL Download Manager - c:\program files\Image-Line\Downloader\uninstall.exe

AddRemove-Tomb Raider III - c:\windows\IsUn0407.exe

.

.

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Akamai]

"ServiceDll"="c:\program files\common files\akamai/netsession_win_ce5ba24.dll"

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\npggsvc]

"ImagePath"="c:\windows\system32\GameMon.des -service"

.

--------------------- Gesperrte Registrierungsschluessel ---------------------

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil32_11_5_502_135_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]

@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil32_11_5_502_135_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="IFlashBroker5"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

------------------------ Weitere laufende Prozesse ------------------------

.

c:\windows\system32\WLANExt.exe

c:\windows\system32\conhost.exe

c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe

c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

c:\program files\Bonjour\mDNSResponder.exe

c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe

c:\windows\system32\taskhost.exe

c:\windows\system32\sppsvc.exe

c:\windows\system32\conhost.exe

c:\program files\Windows Media Player\wmpnetwk.exe

.

**************************************************************************

.

Zeit der Fertigstellung: 2012-12-18  15:28:43 - PC wurde neu gestartet

ComboFix-quarantined-files.txt  2012-12-18 14:28

.

Vor Suchlauf: 7.062.835.200 Bytes frei

Nach Suchlauf: 7.121.858.560 Bytes frei

.

- - End Of File - - B63E87DF36B152CA8002319E834F6768