Trojaner-Board - TR/Rootkir.Gen und TR/Dldr.FraudLo.sxm

So hab Combofix nochmal drüberlaufen lassen. Hier der Bericht:

ComboFix 09-08-10.06 - Kotzi 17.08.2009 16:39.3.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.49.1031.18.2046.1483 [GMT 2:00]
ausgeführt von:: c:\dokumente und einstellungen\Kotzi\Desktop\Combofix.exe
AV: Avira AntiVir PersonalEdition *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
FW: Norton Internet Worm Protection *disabled* {990F9400-4CEE-43EA-A83A-D013ADD8EA6E}
.

((((((((((((((((((((((( Dateien erstellt von 2009-07-17 bis 2009-08-17 ))))))))))))))))))))))))))))))
.

2009-08-17 13:04 . 2009-08-17 13:14 -------- d-s---w- C:\Test.exe
2009-08-16 18:55 . 2009-08-16 19:04 -------- d-----w- c:\programme\Navilog1
2009-08-16 18:42 . 2009-08-16 18:42 -------- d-----w- c:\programme\Trend Micro
2009-08-16 16:45 . 2009-08-16 16:45 -------- d-----w- c:\dokumente und einstellungen\Kotzi\Anwendungsdaten\Malwarebytes
2009-08-16 16:45 . 2009-08-03 11:36 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-08-16 16:45 . 2009-08-16 16:45 -------- d-----w- c:\programme\Malwarebytes' Anti-Malware
2009-08-16 16:45 . 2009-08-16 16:45 -------- d-----w- c:\dokumente und einstellungen\All Users\Anwendungsdaten\Malwarebytes
2009-08-16 16:45 . 2009-08-03 11:36 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-08-14 22:38 . 2009-08-14 22:38 -------- d-----w- c:\windows\system32\XPSViewer
2009-08-14 22:38 . 2009-08-14 22:38 -------- d-----w- c:\programme\MSBuild
2009-08-14 22:38 . 2009-08-14 22:38 -------- d-----w- c:\programme\Reference Assemblies
2009-08-14 22:38 . 2008-07-06 12:06 89088 -c----w- c:\windows\system32\dllcache\filterpipelineprintproc.dll
2009-08-14 22:38 . 2008-07-06 12:06 575488 -c----w- c:\windows\system32\dllcache\xpsshhdr.dll
2009-08-14 22:38 . 2008-07-06 12:06 575488 ------w- c:\windows\system32\xpsshhdr.dll
2009-08-14 22:38 . 2008-07-06 12:06 1676288 -c----w- c:\windows\system32\dllcache\xpssvcs.dll
2009-08-14 22:38 . 2008-07-06 12:06 1676288 ------w- c:\windows\system32\xpssvcs.dll
2009-08-14 22:38 . 2008-07-06 12:06 117760 ------w- c:\windows\system32\prntvpt.dll
2009-08-14 22:38 . 2008-07-06 10:50 597504 -c----w- c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2009-08-14 08:51 . 2009-08-14 08:51 -------- d-----w- c:\windows\system32\wbem\Repository
2009-08-14 08:46 . 2008-04-13 19:15 574976 -c--a-w- c:\windows\system32\dllcache\ntfs.sys
2009-08-13 05:36 . 2009-07-10 13:26 1315328 -c----w- c:\windows\system32\dllcache\msoe.dll
2009-08-05 08:59 . 2009-08-05 08:59 206336 -c----w- c:\windows\system32\dllcache\mswebdvd.dll

.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-08-16 19:36 . 2007-03-03 18:23 -------- d-----w- c:\programme\Winamp
2009-08-15 22:28 . 2007-01-07 12:27 -------- d-----w- c:\dokumente und einstellungen\All Users\Anwendungsdaten\AntiVir PersonalEdition Classic
2009-08-15 22:28 . 2006-09-30 07:37 50600 ----a-w- c:\dokumente und einstellungen\Administrator\Lokale Einstellungen\Anwendungsdaten\GDIPFONTCACHEV1.DAT
2009-08-14 22:40 . 2006-09-30 08:23 85350 ----a-w- c:\windows\system32\perfc007.dat
2009-08-14 22:40 . 2006-09-30 08:23 460608 ----a-w- c:\windows\system32\perfh007.dat
2009-08-11 13:31 . 2009-01-29 09:20 777 -c--a-w- c:\windows\eReg.dat
2009-08-10 17:21 . 2007-01-11 12:08 -------- d-----w- c:\dokumente und einstellungen\Kotzi\Anwendungsdaten\teamspeak2
2009-08-10 14:41 . 2007-02-10 16:23 -------- d-----w- c:\dokumente und einstellungen\Kotzi\Anwendungsdaten\Skype
2009-08-10 14:29 . 2009-05-19 15:40 -------- d-----w- c:\dokumente und einstellungen\Kotzi\Anwendungsdaten\skypePM
2009-08-05 08:59 . 2006-09-30 08:23 206336 ----a-w- c:\windows\system32\mswebdvd.dll
2009-07-26 09:17 . 2006-11-04 23:24 440 ----a-w- c:\dokumente und einstellungen\Gregor\Anwendungsdaten\wklnhst.dat
2009-07-18 14:05 . 2009-07-18 14:05 -------- d-----w- c:\programme\SkinBuilder
2009-07-18 12:02 . 2009-07-18 11:48 -------- d-----w- c:\programme\ICQ6.5
2009-07-18 11:50 . 2009-07-18 11:50 -------- d-----w- c:\programme\ICQ6Toolbar
2009-07-18 11:50 . 2009-07-18 11:50 -------- d-----w- c:\dokumente und einstellungen\All Users\Anwendungsdaten\ICQ
2009-07-18 11:49 . 2008-05-06 15:26 -------- d-----w- c:\programme\ICQ6
2009-07-17 19:01 . 2009-07-17 19:01 58880 ----a-w- c:\windows\system32\SET21.tmp
2009-07-17 19:01 . 2006-09-30 08:23 58880 ----a-w- c:\windows\system32\atl.dll
2009-07-17 19:01 . 2006-09-30 08:23 58880 ----a-w- c:\windows\system32\atl(2).dll
2009-07-13 21:43 . 2006-09-30 08:23 286208 ----a-w- c:\windows\system32\wmpdxm.dll
2009-07-10 13:13 . 2008-01-31 22:51 -------- d-----w- c:\programme\ScanWizard 5
2009-07-07 21:09 . 2006-11-29 22:05 -------- d-----w- c:\programme\EPSON
2009-07-07 21:08 . 2006-09-30 07:33 -------- d--h--w- c:\programme\InstallShield Installation Information
2009-06-26 16:49 . 2006-09-30 08:23 672256 ----a-w- c:\windows\system32\wininet.dll
2009-06-26 16:49 . 2006-09-30 08:23 81920 ----a-w- c:\windows\system32\ieencode.dll
2009-06-16 14:36 . 2006-09-30 08:23 119808 ----a-w- c:\windows\system32\t2embed.dll
2009-06-16 14:36 . 2006-09-30 08:23 81920 ----a-w- c:\windows\system32\fontsub.dll
2009-06-15 10:43 . 2006-09-30 08:23 78848 ----a-w- c:\windows\system32\telnet.exe
2009-06-15 10:43 . 2006-09-30 08:23 82944 ----a-w- c:\windows\system32\tlntsess.exe
2009-06-10 14:13 . 2006-09-30 08:23 85504 ----a-w- c:\windows\system32\avifil32.dll
2009-06-10 07:19 . 2006-09-30 06:33 2066432 ----a-w- c:\windows\system32\mstscax.dll
2009-06-10 06:14 . 2006-09-30 08:23 132096 ----a-w- c:\windows\system32\wkssvc.dll
2009-06-03 19:09 . 2006-09-30 08:23 1296896 ------w- c:\windows\system32\quartz.dll
2009-05-27 18:22 . 2007-04-22 11:51 75096 ----a-w- c:\windows\system32\drivers\avipbb.sys
2009-05-25 14:05 . 2008-02-12 17:15 138168 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys
2009-05-25 14:05 . 2008-02-12 17:15 189472 ----a-w- c:\windows\system32\PnkBstrB.exe
2009-05-19 15:40 . 2009-05-19 15:40 56 ---ha-w- c:\windows\system32\ezsidmv.dat
.

((((((((((((((((((((((((((((( SnapShot@2009-08-17_09.21.13 )))))))))))))))))))))))))))))))))))))))))
.
+ 2006-09-30 08:23 . 2008-04-13 19:15 574976 c:\windows\system32\drivers\ntfs.sys
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"La_View Mouse"="c:\progra~1\Kotzi\HAMAS1~1\S1_2k.exe" [2005-07-26 2871296]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray"="c:\windows\ehome\ehtray.exe" [2005-08-05 64512]
"AVMWlanClient"="c:\programme\avmwlanstick\FRITZWLANMini.exe" [2006-06-23 343552]
"avgnt"="c:\programme\AntiVir PersonalEdition Classic\avgnt.exe" [2008-07-18 266497]
"MULTIMEDIA KEYBOARD"="c:\programme\Netropa\Multimedia Keyboard\MMKeybd.exe" [2003-09-30 425984]
"StartCCC"="c:\programme\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-07-16 61440]
"QuickTime Task"="c:\programme\QuickTime\QTTask.exe" [2007-10-19 286720]
"SkyTel"="SkyTel.EXE" - c:\windows\SkyTel.exe [2006-05-16 2879488]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" - c:\windows\KHALMNPR.Exe [2007-04-11 56080]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
"Picasa Media Detector"="m:\picasa2\PicasaMediaDetector.exe" [2007-10-23 443968]

c:\dokumente und einstellungen\Gregor\Startmen\Programme\Autostart\
Picture Motion Browser Medien-Prfung.lnk - m:\pmbcore\SPUVolumeWatcher.exe [2009-1-25 385024]

c:\dokumente und einstellungen\All Users\Startmen\Programme\Autostart\
Adobe Gamma.lnk - c:\programme\Gemeinsame Dateien\Adobe\Calibration\Adobe Gamma Loader.exe [2005-3-16 113664]
AOL 9.0 Tray-Symbol.lnk - c:\programme\AOL 9.0\aoltray.exe [2006-10-9 156784]
Logitech SetPoint.lnk - c:\programme\Logitech\SetPoint\SetPoint.exe [2007-12-30 692224]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Programme\\AOL 9.0\\waol.exe"=
"c:\\Programme\\Messenger\\msmsgs.exe"=
"c:\\Programme\\EA GAMES\\Battlefield 2\\BF2.exe"=
"n:\\Company of Heroes\\RelicCOH.exe"=
"n:\\Company of Heroes\\BugReport\\BugReport.exe"=
"c:\\Programme\\Mozilla Firefox\\firefox.exe"=
"c:\\Programme\\BearShare\\BearShare.exe"=
"c:\\Programme\\Xfire\\xfire.exe"=
"c:\\Programme\\Foolish Entertainment\\ATC for Battlefield 2\\atcbf2.exe"=
"c:\\Programme\\Electronic Arts\\Command & Conquer 3\\RetailExe\\1.0\\cnc3game.dat"=
"c:\\Programme\\Electronic Arts\\Command & Conquer 3\\RetailExe\\1.4\\cnc3game.dat"=
"n:\\Steam\\SteamApps\\don_kroki\\counter-strike source\\hl2.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Programme\\Electronic Arts\\Command & Conquer 3\\RetailExe\\1.6\\cnc3game.dat"=
"n:\\Stalker\\S.T.A.L.K.E.R. - Shadow of Chernobyl\\bin\\XR_3DA.exe"=
"n:\\Stalker\\S.T.A.L.K.E.R. - Shadow of Chernobyl\\bin\\dedicated\\XR_3DA.exe"=
"c:\\Programme\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Programme\\Windows Live\\Messenger\\livecall.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Programme\\Sony Ericsson\\Sony Ericsson Media Manager\\MediaManager.exe"=
"c:\\Programme\\TVUPlayer\\TVUPlayer.exe"=
"c:\\Programme\\ICQ6.5\\ICQ.exe"=
"c:\\Programme\\Skype\\Phone\\Skype.exe"=

R1 msikbd2k;Multimedia Keyboard Filter Driver;c:\windows\system32\drivers\Msikbd2k.sys [08.04.2007 17:47 6656]
R2 ICQ Service;ICQ Service;c:\programme\ICQ6Toolbar\ICQ Service.exe [18.07.2009 13:50 222968]
R2 nhksrv;Netropa NHK Server;c:\programme\Netropa\Multimedia Keyboard\nhksrv.exe [08.04.2007 17:47 28672]
R3 3xHybrid;Pinnacle PCTV 100i-110i-300i-310i;c:\windows\system32\drivers\3xHybrid.sys [30.09.2006 10:27 882688]
R3 FWLANUSB;AVM FRITZ!WLAN;c:\windows\system32\drivers\fwlanusb.sys [29.11.2006 21:14 264704]
R3 X10Hid;X10 Hid Device;c:\windows\system32\drivers\x10hid.sys [30.09.2006 09:25 7040]
S3 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance;c:\magix\Common\Database\bin\fbserver.exe [30.09.2006 09:28 1527900]
S3 imhidusb;Immersion's HID USB Driver;c:\windows\system32\drivers\imhidusb.sys [30.10.2006 12:43 26804]
S3 sea1bus;Sony Ericsson Device 0A1 driver (WDM);c:\windows\system32\drivers\sea1bus.sys [29.11.2007 19:09 61536]
S3 sea1mdfl;Sony Ericsson Device 0A1 USB WMC Modem Filter;c:\windows\system32\drivers\sea1mdfl.sys [29.11.2007 19:17 9360]
S3 sea1mdm;Sony Ericsson Device 0A1 USB WMC Modem Driver;c:\windows\system32\drivers\sea1mdm.sys [29.11.2007 19:17 97088]
S3 sea1mgmt;Sony Ericsson Device 0A1 USB WMC Device Management Drivers (WDM);c:\windows\system32\drivers\sea1mgmt.sys [29.11.2007 19:40 88624]
S3 sea1nd5;Sony Ericsson Device 0A1 USB Ethernet Emulation SEMCA1 (NDIS);c:\windows\system32\drivers\sea1nd5.sys [29.11.2007 19:48 18704]
S3 sea1obex;Sony Ericsson Device 0A1 USB WMC OBEX Interface;c:\windows\system32\drivers\sea1obex.sys [29.11.2007 19:40 86432]
S3 sea1unic;Sony Ericsson Device 0A1 USB Ethernet Emulation SEMCA1 (WDM);c:\windows\system32\drivers\sea1unic.sys [29.11.2007 19:40 90800]
.
Inhalt des "geplante Tasks" Ordners

2009-07-25 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\programme\Apple Software Update\SoftwareUpdate.exe [2007-08-29 13:57]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.google.com
mStart Page = hxxp://www.google.com
uSearchURL,(Default) = hxxp://red.clientapps.yahoo.com/customize/fuji/defaults/su/*http://www.yahoo.com
IE: Add to AMV Converter... - c:\programme\MP3 Player Utilities 4.09\AMVConverter\grab.html
IE: Easy-WebPrint - Drucken - c:\programme\Canon\Easy-WebPrint\Toolband.dll/RC_Print.html
IE: Easy-WebPrint - Schnelldruck - c:\programme\Canon\Easy-WebPrint\Toolband.dll/RC_HSPrint.html
IE: Easy-WebPrint - Vorschau - c:\programme\Canon\Easy-WebPrint\Toolband.dll/RC_Preview.html
IE: Easy-WebPrint - Zu Druckliste hinzufügen - c:\programme\Canon\Easy-WebPrint\Toolband.dll/RC_AddToList.html
IE: MediaManager tool grab multimedia file - c:\programme\MP3 Player Utilities 4.09\MediaManager\grab.html
FF - ProfilePath - c:\dokumente und einstellungen\Kotzi\Anwendungsdaten\Mozilla\Firefox\Profiles\dti3e8w2.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.yodl.de/href.php?hrefname=FF-splug_google&q=
FF - prefs.js: browser.search.selectedEngine - ICQ Search
FF - prefs.js: browser.startup.homepage - hxxp://www.lokalisten.de/web/showHome.do
FF - prefs.js: keyword.URL - hxxp://search.icq.com/search/afe_results.php?ch_id=afex&q=
FF - plugin: c:\programme\Java\jre1.5.0_10\bin\NPJava11.dll
FF - plugin: c:\programme\Java\jre1.5.0_10\bin\NPJava12.dll
FF - plugin: c:\programme\Java\jre1.5.0_10\bin\NPJava13.dll
FF - plugin: c:\programme\Java\jre1.5.0_10\bin\NPJava14.dll
FF - plugin: c:\programme\Java\jre1.5.0_10\bin\NPJava32.dll
FF - plugin: c:\programme\Java\jre1.5.0_10\bin\NPJPI150_10.dll
FF - plugin: c:\programme\Java\jre1.5.0_10\bin\NPOJI610.dll
FF - plugin: c:\programme\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-08-17 16:45
Windows 5.1.2600 Service Pack 3 NTFS

Scanne versteckte Prozesse...

Scanne versteckte Autostarteinträge...

Scanne versteckte Dateien...

Scan erfolgreich abgeschlossen
versteckte Dateien: 0

**************************************************************************
.
--------------------- Gesperrte Registrierungsschluessel ---------------------

[HKEY_USERS\S-1-5-21-67824176-1372446298-3875667211-1005\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu2\Programs\Electronic Arts\C*o*m*m*a*n*d* *&* *C*o*n*q*u*e*r* *3* *T*i*b*e*r*i*u*m* *W*a*r*s*"!\Kundendienst]
"Order"=hex:08,00,00,00,02,00,00,00,b8,02,00,00,01,00,00,00,04,00,00,00,de,00,
00,00,00,00,00,00,d0,00,00,00,41,75,67,4d,02,00,00,00,01,00,00,00,be,00,32,\

[HKEY_USERS\S-1-5-21-67824176-1372446298-3875667211-1005\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:e5,84,94,b0,74,b9,0a,86,1f,cd,5a,10,f1,5d,5c,35,64,31,6d,53,95,7b,54,
19,7f,a5,1d,4f,fc,f4,a5,f8,99,e1,60,ba,47,31,6e,c4,9d,6a,f7,d7,6c,bd,18,74,\
"??"=hex:51,26,68,11,bc,f8,f9,83,2f,7f,08,b5,c7,73,36,4c

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"cd042efbbd7f7af1647644e76e06692b"=hex:e2,63,26,f1,3f,c8,ff,68,94,9e,97,7d,f1,
83,b8,42,e2,63,26,f1,3f,c8,ff,68,41,78,54,6b,cb,25,73,5e,e2,63,26,f1,3f,c8,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"bca643cdc5c2726b20d2ecedcc62c59b"=hex:71,3b,04,66,8b,46,0d,96,01,21,d9,f5,83,
d3,c9,b7,6a,9c,d6,61,af,45,84,18,38,bb,d5,45,c2,68,70,5c,6a,9c,d6,61,af,45,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"2c81e34222e8052573023a60d06dd016"=hex:ff,7c,85,e0,43,d4,0e,fe,6a,8f,ee,6c,90,
39,34,ef,ff,7c,85,e0,43,d4,0e,fe,e7,38,ef,42,95,63,97,c3,ff,7c,85,e0,43,d4,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"2582ae41fb52324423be06337561aa48"=hex:86,8c,21,01,be,91,eb,e7,49,68,bf,0f,24,
6d,72,41,86,8c,21,01,be,91,eb,e7,ba,33,a5,03,1a,41,48,16,86,8c,21,01,be,91,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"caaeda5fd7a9ed7697d9686d4b818472"=hex:e9,02,6c,fa,fb,1d,47,57,1d,9c,e7,7f,67,
bb,32,a7,f5,1d,4d,73,a8,13,5c,05,1d,83,69,e8,ac,fb,66,38,f5,1d,4d,73,a8,13,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"a4a1bcf2cc2b8bc3716b74b2b4522f5d"=hex:50,93,e5,ab,ec,6a,4e,ab,94,be,2e,02,34,
d8,79,45,df,20,58,62,78,6b,cf,c8,4e,9e,52,48,ec,c0,a7,1c,df,20,58,62,78,6b,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"4d370831d2c43cd13623e232fed27b7b"=hex:fb,a7,78,e6,12,2f,9a,ea,3d,05,72,76,72,
3d,96,50,fb,a7,78,e6,12,2f,9a,ea,e2,c6,0d,83,3a,45,f8,77,fb,a7,78,e6,12,2f,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"1d68fe701cdea33e477eb204b76f993d"=hex:01,3a,48,fc,e8,04,4a,f1,92,65,20,e0,37,
15,19,2c,01,3a,48,fc,e8,04,4a,f1,82,29,83,2f,7d,40,7b,d2,01,3a,48,fc,e8,04,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"1fac81b91d8e3c5aa4b0a51804d844a3"=hex:51,fa,6e,91,28,9e,14,cc,a7,a1,68,5f,4c,
f9,8f,fe,f6,0f,4e,58,98,5b,89,c9,25,df,65,00,2e,63,32,b1,f6,0f,4e,58,98,5b,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"f5f62a6129303efb32fbe080bb27835b"=hex:b1,cd,45,5a,a8,c4,f8,b9,91,17,04,e4,56,
7d,ff,cc,3d,ce,ea,26,2d,45,aa,78,37,32,9f,41,5c,1f,78,77,3d,ce,ea,26,2d,45,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"fd4e2e1a3940b94dceb5a6a021f2e3c6"=hex:2a,b7,cc,b5,b9,7f,41,e7,68,d3,57,35,15,
4f,66,c8,2a,b7,cc,b5,b9,7f,41,e7,8b,2c,6d,d9,31,77,a6,50,2a,b7,cc,b5,b9,7f,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"8a8aec57dd6508a385616fbc86791ec2"=hex:fa,ea,66,7f,d4,3b,6b,70,5f,a3,4a,3d,49,
72,6e,6e,6c,43,2d,1e,aa,22,2f,9c,92,e1,1e,0f,d6,06,73,36,6c,43,2d,1e,aa,22,\
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------

- - - - - - - > 'winlogon.exe'(708)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(212)
c:\programme\Logitech\SetPoint\GameHook.dll
c:\programme\Logitech\SetPoint\lgscroll.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Zeit der Fertigstellung: 2009-08-17 16:47
ComboFix-quarantined-files.txt 2009-08-17 14:47
ComboFix2.txt 2009-08-17 13:14
ComboFix3.txt 2009-08-17 09:23

Vor Suchlauf: 1.943.560.192 Bytes frei
Nach Suchlauf: 1.888.849.920 Bytes frei

273 --- E O F --- 2009-08-15 22:48

Im Augenblick kommt mir wieder alles recht normal vor:aplaus:
EIne frage hätt ich da noch: Ich kenn mich ja nicht so wirklich mit Pcs aus...was soll ich von wem kopieren und was könnte passieren wenn ich des ned herbekomm?
Danke bis jetzt und schonmal im Vorraus