Trojaner-Board - Rootkit entfernt weitere Probleme

Guten Tag

Ich habe gestern eine exe Datei gestartet die wohl leider infiziert war.

Nun habe ich bereits mit dem Programm ComboFix einen Rootkit entfernt.

Nun habe ich aber folgendes Problem:
-- Irgend etwas startet immer einen Adobe Acrobat Update, was ich natürlich immer wieder abbreche.. (geschieht bei jedem Rechtsklick auf eine Datei)
-- Malwarebytes' Anti-Malware erkennt C:\Programme\Adobe\acrotray .exe + C:\Programme\Adobe\acrotray.exe als einen Trojaner. Entfernt ihn, ist jedoch sofort wieder da
-- C:\Dokumente und Einstellungen\XX\khalmnpr.exe + khalmnpr .exe + wdbtnmgr .exe + wdbtnmgr.exe kann ich löschen und tauchen sofort wieder auf.
-- Und es gehen immer Fenster im IE auf (Werbung)

Hier den Hijackthis-Log:

Code:

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 15:11:32, on 14.11.2009

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v8.00 (8.00.6001.18702)

Boot mode: Normal
 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\Programme\Lavasoft\Ad-Aware\aawservice.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Programme\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe

C:\Programme\Bonjour\mDNSResponder.exe

C:\Programme\Java\jre6\bin\jqs.exe

C:\Programme\Gemeinsame Dateien\LogiShrd\LVMVFM\LVPrcSrv.exe

C:\Programme\Gemeinsame Dateien\Nero\Nero BackItUp 4\NBService.exe

C:\Programme\Silicon Image\3132-W-R\SATARaid5ConfigService.exe

C:\Programme\Sophos\Sophos Anti-Virus\SAVAdminService.exe

C:\Programme\Sophos\AutoUpdate\ALsvc.exe

C:\WINDOWS\system32\svchost.exe

C:\Programme\VMware\VMware Workstation\vmware-authd.exe

C:\Programme\Gemeinsame Dateien\VMware\VMware Virtual Image Editing\vmount2.exe

C:\WINDOWS\system32\vmnat.exe

C:\Programme\Western Digital\WD Drive Manager\WDBtnMgrSvc.exe

C:\Programme\Canon\CAL\CALMAIN.exe

C:\WINDOWS\system32\vmnetdhcp.exe

C:\WINDOWS\system32\KHALMNPR.EXE

C:\WINDOWS\system32\khalmnpr.exe

C:\Programme\Nero\Nero8\Nero BackItUp\NBKeyScan.exe

C:\WINDOWS\system32\WDBtnMgr.exe

C:\Programme\VMware\VMware Workstation\vmware-tray.exe

C:\Programme\VMware\VMware Workstation\hqtray.exe

C:\Programme\CyberLink\PowerDVD8\PDVD8Serv.exe

C:\Programme\CyberLink\PowerDVD8\Language\Language.exe

C:\Programme\Cyberlink\Shared Files\brs.exe

C:\Programme\Analog Devices\Core\smax4pnp.exe

C:\WINDOWS\system32\wdbtnmgr.exe

C:\Programme\VMware\VMware Workstation\hqtray.exe

C:\Programme\Nero\Nero8\Nero BackItUp\nbkeyscan.exe

C:\Programme\Gemeinsame Dateien\Adobe\CS4ServiceManager\CS4ServiceManager.exe

C:\Programme\CyberLink\PowerDVD8\pdvd8serv.exe

C:\Programme\VMware\VMware Workstation\vmware-tray.exe

C:\Programme\Cyberlink\Shared Files\brs.exe

C:\Programme\VMware\VMware Workstation\hqtray .exe

C:\Programme\Nero\Nero8\Nero BackItUp\nbkeyscan .exe

C:\Programme\CyberLink\PowerDVD8\pdvd8serv .exe

C:\Programme\VMware\VMware Workstation\vmware-tray .exe

C:\Programme\Cyberlink\Shared Files\brs .exe

C:\Programme\Analog Devices\Core\smax4pnp.exe

C:\Programme\Analog Devices\Core\smax4pnp .exe

C:\Programme\Gemeinsame Dateien\Adobe\CS4ServiceManager\cs4servicemanager.exe

C:\Programme\Nero\Nero8\Nero BackItUp\nbkeyscan .exe

C:\Programme\CyberLink\PowerDVD8\Language\language.exe

C:\Programme\Gemeinsame Dateien\Adobe\CS4ServiceManager\cs4servicemanager .exe

C:\WINDOWS\system32\ctfmon.exe

C:\Programme\ASUS WiFi-AP Solo\RtWLan.exe

C:\Programme\Sophos\AutoUpdate\ALMon.exe

C:\Programme\Logitech\SetPoint\SetPoint.exe

C:\Programme\Gemeinsame Dateien\Logitech\KHAL\KHALMNPR.EXE

C:\Programme\Adobe\acrotray.exe

C:\Programme\Adobe\acrotray.exe

C:\Programme\Adobe\acrotray .exe

C:\Programme\Adobe\acrotray .exe

C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe

C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\adobearm.exe

C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\adobearm .exe

C:\Programme\Internet Explorer\IEXPLORE.EXE

C:\Programme\Microsoft Office\Office12\OUTLOOK.EXE

C:\Programme\Mozilla Firefox\firefox.exe

C:\Programme\Java\jre6\bin\java.exe

C:\Programme\Internet Explorer\IEXPLORE.EXE

C:\WINDOWS\system32\NOTEPAD.EXE

C:\Programme\Internet Explorer\IEXPLORE.EXE

C:\Programme\Trend Micro\HijackThis\HijackThis.exe
 

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

O2 - BHO: SnagIt Toolbar Loader - {00C6482D-C502-44C8-8409-FCE54AD9C208} - C:\Programme\TechSmith\Snagit 9\SnagitBHO.dll

O2 - BHO: ContributeBHO Class - {074C1DC5-9320-4A9A-947D-C042949C6216} - C:\Programme\Adobe\/Adobe Contribute CS4/contributeieplugin.dll

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: Sophos Web Content Scanner - {39EA7695-B3F2-4C44-A4BC-297ADA8FD235} - C:\Programme\Sophos\Sophos Anti-Virus\SophosBHO.dll

O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)

O2 - BHO: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Tunebite_WebRipPlugin Class - {AA102584-3B97-47e7-B9BC-75D54C110A7D} - C:\Programme\RapidSolution\Tunebite\plugins\IE\TB_WebRipIePlugin.dll (file missing)

O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll

O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre6\bin\jp2ssv.dll

O2 - BHO: FlashFXP Helper for Internet Explorer - {E5A1691B-D188-4419-AD02-90002030B8EE} - C:\Programme\FlashFXP\IEFlash.dll (file missing)

O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O2 - BHO: SmartSelect - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll

O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll

O3 - Toolbar: Contribute Toolbar - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - C:\Programme\Adobe\/Adobe Contribute CS4/contributeieplugin.dll

O3 - Toolbar: Snagit - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Programme\TechSmith\Snagit 9\SnagitIEAddin.dll

O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE

O4 - HKLM\..\Run: [NBKeyScan] "C:\Programme\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"

O4 - HKLM\..\Run: [WD Button Manager] WDBtnMgr.exe

O4 - HKLM\..\Run: [vmware-tray] C:\Programme\VMware\VMware Workstation\vmware-tray.exe

O4 - HKLM\..\Run: [VMware hqtray] "C:\Programme\VMware\VMware Workstation\hqtray.exe"

O4 - HKLM\..\Run: [RemoteControl8] C:\Programme\CyberLink\PowerDVD8\PDVD8Serv.exe

O4 - HKLM\..\Run: [PDVD8LanguageShortcut] C:\Programme\CyberLink\PowerDVD8\Language\Language.exe

O4 - HKLM\..\Run: [BDRegion] C:\Programme\Cyberlink\Shared Files\brs.exe

O4 - HKLM\..\Run: [SoundMAXPnP] C:\Programme\Analog Devices\Core\smax4pnp.exe

O4 - HKLM\..\Run: [AdobeCS4ServiceManager] "C:\Programme\Gemeinsame Dateien\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin

O4 - HKLM\..\Run: [Adobe Acrobat Speed Launcher] "C:\Programme\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe"

O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Programme\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe"

O4 - HKLM\..\Run: [Adobe_ID0ENQBO] C:\PROGRA~1\GEMEIN~1\Adobe\ADOBEV~2\Server\bin\VERSIO~2.EXE

O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Programme\Logitech\QuickCam\Quickcam.exe" /hide

O4 - HKLM\..\Run: [WD Drive Manager] C:\Programme\Western Digital\WD Drive Manager\WDBtnMgrUI.exe

O4 - HKLM\..\Run: [OSSelectorReinstall] C:\Programme\Gemeinsame Dateien\Acronis\Acronis Disk Director\oss_reinstall.exe

O4 - HKLM\..\Run: [Adobe ARM] "C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe"

O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask      .exe" -atboottime

O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Programme\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript

O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programme\Java\jre6\bin\jusched.exe"

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - Startup: Webshots.lnk.disabled

O4 - Startup: Wuala.lnk.disabled

O4 - Global Startup: ASUS WiFi-AP Solo.lnk = ?

O4 - Global Startup: AutoUpdate Monitor.lnk = C:\Programme\Sophos\AutoUpdate\ALMon.exe

O4 - Global Startup: Logitech SetPoint.lnk = C:\Programme\Logitech\SetPoint\SetPoint.exe

O8 - Extra context menu item: An vorhandene PDF-Datei anfügen - res://C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html

O8 - Extra context menu item: In Adobe PDF konvertieren - res://C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: Linkziel an vorhandene PDF-Datei anhängen - res://C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html

O8 - Extra context menu item: Linkziel in Adobe PDF konvertieren - res://C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html

O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL

O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe

O16 - DPF: {D00E9550-440D-4EF8-BFCE-174300890C05} (DMList Class) - http://www.gomusic.ru/cabs/xdownloader.cab

O17 - HKLM\System\CCS\Services\Tcpip\..\{6DF2F9E4-95AD-41D2-BD48-37821DDFFA15}: NameServer = 195.186.1.111,195.186.4.111

O17 - HKLM\System\CCS\Services\Tcpip\..\{C04CEB92-4160-430A-9936-51A6FF8DFA44}: NameServer = 195.186.1.111,195.186.4.111

O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Programme\Lavasoft\Ad-Aware\aawservice.exe

O23 - Service: Adobe Version Cue CS4 - Adobe Systems Incorporated - C:\Programme\Gemeinsame Dateien\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4.exe

O23 - Service: Adobe Active File Monitor V6 (AdobeActiveFileMonitor6.0) - Unknown owner - C:\Programme\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe

O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe

O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe

O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Programme\Bonjour\mDNSResponder.exe

O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Programme\Canon\CAL\CALMAIN.exe

O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Programme\Gemeinsame Dateien\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Programme\Java\jre6\bin\jqs.exe

O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Programme\Gemeinsame Dateien\LogiShrd\LVMVFM\LVPrcSrv.exe

O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Programme\Gemeinsame Dateien\Macromedia Shared\Service\Macromedia Licensing.exe

O23 - Service: Nero BackItUp Scheduler 4.0 - Nero AG - C:\Programme\Gemeinsame Dateien\Nero\Nero BackItUp 4\NBService.exe

O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Programme\WinPcap\rpcapd.exe

O23 - Service: SATARaid5 Configuration Service (SATARaid5 Config Service) - Unknown owner - C:\Programme\Silicon Image\3132-W-R\SATARaid5ConfigService.exe

O23 - Service: Sophos Anti-Virus Statusreporter (SAVAdminService) - Sophos Plc - C:\Programme\Sophos\Sophos Anti-Virus\SAVAdminService.exe

O23 - Service: Sophos Anti-Virus (SAVService) - Sophos Plc - C:\Programme\Sophos\Sophos Anti-Virus\SavService.exe

O23 - Service: Sophos AutoUpdate Service (sophos autoupdate service) - Sophos Plc - C:\Programme\Sophos\AutoUpdate\ALsvc.exe

O23 - Service: VMware Agent Service (ufad-ws60) - VMware, Inc. - C:\Programme\VMware\VMware Workstation\vmware-ufad.exe

O23 - Service: VMware Authorization Service (VMAuthdService) - VMware, Inc. - C:\Programme\VMware\VMware Workstation\vmware-authd.exe

O23 - Service: VMware DHCP Service (VMnetDHCP) - VMware, Inc. - C:\WINDOWS\system32\vmnetdhcp.exe

O23 - Service: VMware Virtual Mount Manager Extended (vmount2) - VMware, Inc. - C:\Programme\Gemeinsame Dateien\VMware\VMware Virtual Image Editing\vmount2.exe

O23 - Service: VMware NAT Service - VMware, Inc. - C:\WINDOWS\system32\vmnat.exe

O23 - Service: WD Drive Manager Service (WDBtnMgrSvc.exe) - WDC - C:\Programme\Western Digital\WD Drive Manager\WDBtnMgrSvc.exe
 

--

End of file - 13979 bytes

Ich hoffe ihr könnt mir dabei weiterhelfen. Besten Dank schonmal.

Gruss
Simon

Sry für doppel Post, aber mit diesem Eintrag war es vorher zu lang :heilig:

und noch der letzte ComboFix-Log (nach dem zweiten Durchlauf):

Code:

ComboFix 09-11-14.03 - XX 14.11.2009 14:28..2 - FAT32x86

Microsoft Windows XP Professional  5.1.2600.3.1252.41.1031.18.3582.2699 [GMT 1:00]

ausgeführt von:: c:\dokumente und einstellungen\XX\Desktop\ComboFix.exe

AV: Sophos Anti-Virus *On-access scanning disabled* (Updated) {3F13C776-3CBE-4DE9-8BF6-09E5183CA2BD}

.
 

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.
 

c:\dokumente und einstellungen\XX\khalmnpr .exe

c:\dokumente und einstellungen\XX\wdbtnmgr .exe
 

.

(((((((((((((((((((((((   Dateien erstellt von 2009-10-14 bis 2009-11-14  ))))))))))))))))))))))))))))))

.
 

2009-11-14 12:45 . 2007-10-03 21:55        80424        ----a-w-        c:\windows\system32\drivers\SI3132.sys

2009-11-14 12:45 . 2006-08-21 18:24        105344        ----a-w-        c:\windows\system32\drivers\nvatabus.sys

2009-11-14 12:45 . 2008-04-13 18:40        96512        -c--a-w-        c:\windows\system32\dllcache\atapi.sys

2009-11-14 12:45 . 2008-04-13 18:40        96512        ------w-        c:\windows\system32\drivers\atapi.sys

2009-11-14 12:31 . 2009-11-14 12:31        --------        d-----w-        C:\!KillBox

2009-11-14 12:12 . 2009-09-10 13:54        38224        ----a-w-        c:\windows\system32\drivers\mbamswissarmy.sys

2009-11-14 12:12 . 2009-09-10 13:53        19160        ----a-w-        c:\windows\system32\drivers\mbam.sys

2009-11-14 10:24 . 2009-11-14 10:24        --------        d-----w-        c:\dokumente und einstellungen\XX\Lokale Einstellungen\Anwendungsdaten\Sophos

2009-11-14 10:23 . 2009-11-14 09:59        130104        ----a-w-        c:\windows\system32\sdccoinstaller.dll

2009-11-14 10:23 . 2009-11-14 10:23        --------        d-----w-        c:\programme\Gemeinsame Dateien\Cisco Systems

2009-11-14 10:22 . 2009-11-14 13:20        126986        ----a-w-        c:\dokumente und einstellungen\XX\wdbtnmgr.exe

2009-11-14 10:12 . 2009-11-14 09:59        23552        ----a-w-        c:\windows\system32\sophosboottasks.exe

2009-11-14 10:12 . 2009-11-14 10:12        --------        d-----w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\Sophos

2009-11-14 09:59 . 2009-11-14 09:59        14976        ----a-w-        c:\windows\system32\drivers\SophosBootDriver.sys

2009-11-14 09:59 . 2009-11-14 09:59        38528        ----a-w-        c:\windows\system32\drivers\savonaccessfilter.sys

2009-11-14 09:58 . 2009-11-14 09:58        110848        ----a-w-        c:\windows\system32\drivers\savonaccesscontrol.sys

2009-11-14 09:57 . 2009-11-14 10:01        --------        d-----w-        c:\programme\Sophos

2009-11-14 09:56 . 2009-11-14 13:20        155866        ----a-w-        c:\dokumente und einstellungen\XX\khalmnpr.exe

2009-11-14 08:00 . 2009-11-14 08:00        --------        d-sh--w-        c:\dokumente und einstellungen\NetworkService\PrivacIE

2009-11-14 08:00 . 2009-11-14 08:00        --------        d-----r-        c:\dokumente und einstellungen\NetworkService\Favoriten

2009-11-14 08:00 . 2009-11-14 09:53        106918        ----a-w-        c:\windows\system32\wdbtnmgr.exe

2009-11-14 08:00 . 2009-11-14 09:53        112526        ----a-w-        c:\windows\system32\khalmnpr.exe

2009-11-14 07:21 . 2009-11-14 07:21        --------        d-sh--w-        c:\windows\system32\config\systemprofile\IETldCache

2009-11-13 19:12 . 2009-11-13 19:12        --------        d-sh--w-        c:\dokumente und einstellungen\LocalService\IETldCache

2009-11-04 07:12 . 2009-11-04 07:12        152576        ----a-w-        c:\dokumente und einstellungen\XX\Anwendungsdaten\Sun\Java\jre1.6.0_17\lzma.dll

2009-10-22 18:05 . 2009-11-14 13:21        --------        d-----w-        c:\programme\QuickTime

2009-10-22 18:05 . 2009-10-22 18:05        --------        d-----w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\Apple Computer

2009-10-22 18:03 . 2009-10-22 18:03        --------        d-----w-        c:\programme\Gemeinsame Dateien\Apple
 

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-11-14 13:28 . 2008-07-24 20:07        --------        d-----w-        c:\programme\Spybot - Search & Destroy

2009-11-14 13:11 . 2007-10-27 07:09        --------        d-----w-        c:\dokumente und einstellungen\XX\Anwendungsdaten\VMware

2009-11-14 13:10 . 2007-10-26 17:01        --------        d-----w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\VMware

2009-11-14 13:09 . 2007-10-26 17:02        --------        d-----w-        c:\dokumente und einstellungen\LocalService\Anwendungsdaten\VMware

2009-11-14 13:08 . 2007-12-23 13:29        0        ----a-w-        c:\windows\system32\drivers\lvuvc.hs

2009-11-14 13:08 . 2007-12-23 13:29        0        ----a-w-        c:\windows\system32\drivers\logiflt.iad

2009-11-14 12:38 . 2007-10-07 11:11        --------        d-----w-        c:\programme\WinTV

2009-11-14 12:13 . 2008-11-01 17:51        --------        d-----w-        c:\programme\Malwarebytes' Anti-Malware

2009-11-14 08:04 . 2007-10-21 15:48        --------        d-----w-        c:\programme\Webshots

2009-11-12 14:32 . 2009-09-29 11:56        --------        d-----w-        c:\dokumente und einstellungen\XX\Anwendungsdaten\vlc

2009-11-12 07:46 . 2007-09-23 10:53        --------        d-----w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\Microsoft Help

2009-11-05 11:52 . 2009-09-11 16:00        --------        d-----w-        c:\programme\myphotobook

2009-11-04 09:33 . 2007-10-21 13:54        --------        d-----w-        c:\programme\Java

2009-10-25 15:07 . 2008-07-01 16:02        --------        d-----w-        c:\dokumente und einstellungen\XX\Anwendungsdaten\dvdcss

2009-10-25 11:26 . 2007-11-02 17:17        --------        d-----w-        c:\dokumente und einstellungen\XX\Anwendungsdaten\MyPhoneExplorer

2009-10-25 07:38 . 2006-02-28 12:00        454664        ----a-w-        c:\windows\system32\perfh007.dat

2009-10-25 07:38 . 2006-02-28 12:00        82130        ----a-w-        c:\windows\system32\perfc007.dat

2009-10-15 19:32 . 2009-09-11 16:08        25717        ----a-w-        c:\dokumente und einstellungen\XX\Anwendungsdaten\mdbu.bin

2009-10-15 13:57 . 2007-10-21 14:53        --------        d-----w-        c:\programme\Gemeinsame Dateien\Adobe

2009-10-14 20:11 . 2008-04-17 06:12        18400        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\Microsoft\VSA\9.0\1031\ResourceCache.dll

2009-10-14 20:11 . 2008-04-17 06:12        749696        ----a-w-        c:\dokumente und einstellungen\All Users\Anwendungsdaten\Microsoft\VisualStudio\9.0\1031\ResourceCache.dll

2009-10-11 03:17 . 2008-12-11 13:49        411368        ----a-w-        c:\windows\system32\deploytk.dll

2009-10-08 17:04 . 2009-01-08 16:34        --------        d-----w-        c:\programme\Microsoft

2009-10-04 15:47 . 2009-10-04 15:47        --------        d-----w-        c:\programme\Electronic Arts

2009-10-04 15:38 . 2009-10-04 15:38        --------        d-----w-        c:\programme\AGEIA Technologies

2009-09-27 18:16 . 2009-09-27 17:35        --------        d-----w-        c:\dokumente und einstellungen\XX\Anwendungsdaten\Download Manager

2009-09-11 16:08 . 2007-09-23 08:17        62288        ----a-w-        c:\dokumente und einstellungen\XX\Lokale Einstellungen\Anwendungsdaten\GDIPFONTCACHEV1.DAT

2009-09-11 14:17 . 2006-02-28 12:00        136192        ----a-w-        c:\windows\system32\msv1_0.dll

2009-09-04 21:03 . 2006-02-28 12:00        58880        ----a-w-        c:\windows\system32\msasn1.dll

2009-08-29 07:54 . 2006-02-28 12:00        916480        ------w-        c:\windows\system32\wininet.dll

2009-08-26 08:00 . 2006-02-28 12:00        247326        ----a-w-        c:\windows\system32\strmdll.dll

2009-08-19 21:50 . 2008-11-29 20:08        22872        ----a-r-        c:\windows\system32\AdobePDFUI.dll

2009-08-19 21:50 . 2008-11-29 20:08        46928        ----a-r-        c:\windows\system32\AdobePDF.dll

2009-08-17 21:33 . 2009-08-17 21:33        1193832        ----a-w-        c:\windows\system32\FM20.DLL

2006-05-03 09:06 . 2009-01-23 19:01        163328        --sh--r-        c:\windows\system32\flvDX.dll

2007-02-21 10:47 . 2009-07-26 11:04        31232        --sh--r-        c:\windows\system32\msfDX.dll

2008-03-16 12:30 . 2009-07-26 11:04        216064        --sh--r-        c:\windows\system32\nbDX.dll

.
 

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"QuickTime Task"="c:\programme\QuickTime\qttask  .exe -atboottime" [X]

"NBKeyScan"="c:\programme\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2009-11-14 151754]

"vmware-tray"="c:\programme\VMware\VMware Workstation\vmware-tray.exe" [2009-11-14 158718]

"VMware hqtray"="c:\programme\VMware\VMware Workstation\hqtray.exe" [2009-11-14 127446]

"RemoteControl8"="c:\programme\CyberLink\PowerDVD8\PDVD8Serv.exe" [2009-11-14 150638]

"PDVD8LanguageShortcut"="c:\programme\CyberLink\PowerDVD8\Language\Language.exe" [2009-11-14 132906]

"BDRegion"="c:\programme\Cyberlink\Shared Files\brs.exe" [2009-11-14 122282]

"SoundMAXPnP"="c:\programme\Analog Devices\Core\smax4pnp.exe" [2009-11-14 122726]

"AdobeCS4ServiceManager"="c:\programme\Gemeinsame Dateien\Adobe\CS4ServiceManager\CS4ServiceManager.exe" [2009-11-14 149670]

"Adobe Acrobat Speed Launcher"="c:\programme\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe" [2009-11-14 131458]

"Acrobat Assistant 8.0"="c:\programme\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe" [2009-11-14 124806]

"LogitechQuickCamRibbon"="c:\programme\Logitech\QuickCam\Quickcam.exe" [2009-11-14 142050]

"WD Drive Manager"="c:\programme\Western Digital\WD Drive Manager\WDBtnMgrUI.exe" [2009-11-14 132726]

"OSSelectorReinstall"="c:\programme\Gemeinsame Dateien\Acronis\Acronis Disk Director\oss_reinstall.exe" [2009-11-14 161178]

"Adobe ARM"="c:\programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe" [2009-11-14 134470]

"Malwarebytes Anti-Malware (reboot)"="c:\programme\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080]

"SunJavaUpdateSched"="c:\programme\Java\jre6\bin\jusched.exe" [2009-11-14 158406]

"Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" - c:\windows\system32\khalmnpr.exe [2009-11-14 112526]

"WD Button Manager"="WDBtnMgr.exe" - c:\windows\system32\wdbtnmgr.exe [2009-11-14 106918]
 

c:\dokumente und einstellungen\XX\Startmen\Programme\Autostart\

Webshots.lnk.disabled [2008-1-19 662]

Wuala.lnk.disabled [2008-8-31 1052]
 

c:\dokumente und einstellungen\All Users\Startmen\Programme\Autostart\

ASUS WiFi-AP Solo.lnk - c:\programme\ASUS WiFi-AP Solo\RtWLan.exe [2007-9-23 995328]

AutoUpdate Monitor.lnk - c:\programme\Sophos\AutoUpdate\ALMon.exe [2009-11-14 245760]

Logitech SetPoint.lnk - c:\programme\Logitech\SetPoint\SetPoint.exe [2007-9-23 528384]
 

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]

BootExecute        REG_MULTI_SZ           autocheck autochk /K:G*\0lsdelete
 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]

@="Service"
 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SAVService]

@="service"
 

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]

"DLD.EXE"=c:\programme\Download Direct\DLD.exe
 

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]

"Adobe Photo Downloader"="c:\programme\Adobe\Photoshop Elements 6.0\apdproxy.exe"
 

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\sophosantivirus]

"DisableMonitoring"=dword:00000001
 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Programme\\Microsoft Office\\Office12\\OUTLOOK.EXE"=

"c:\\Programme\\FlashFXP\\FlashFXP.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Programme\\Bonjour\\mDNSResponder.exe"=

"c:\\WINDOWS\\system32\\java.exe"=

"c:\\Programme\\Java\\jre1.6.0_07\\launch4j-tmp\\JD-WinLauncher.exe"=

"c:\\Programme\\Gemeinsame Dateien\\Adobe\\CS4ServiceManager\\CS4ServiceManager.exe"=

"c:\\Programme\\Gemeinsame Dateien\\Adobe\\Adobe Version Cue CS4\\Server\\bin\\VersionCueCS4.exe"=

"c:\\Programme\\Java\\jre6\\launch4j-tmp\\JD-WinLauncher.exe"=

"c:\\Programme\\Zattoo\\zattood.exe"=

"c:\\Programme\\Zattoo\\Zattoo2.exe"=

"c:\\Programme\\Cain\\Cain.exe"=

"c:\\Programme\\mIRC\\mirc.exe"=

"c:\\Programme\\xampp\\apache\\bin\\apache.exe"=

"c:\\Programme\\xampp\\mysql\\bin\\mysqld.exe"=

"c:\\Programme\\Windows Live\\Messenger\\wlcsdk.exe"=

"c:\\Programme\\Microsoft Visual Studio 9.0\\Common7\\IDE\\devenv.exe"=

"c:\\Programme\\Java\\jre6\\bin\\javaw.exe"=

"c:\\Programme\\Java\\jre6\\bin\\java.exe"=

"c:\\Programme\\Windows Live\\Messenger\\msnmsgr.exe"=

"c:\\Programme\\Gemeinsame Dateien\\Adobe\\CS4ServiceManager\\cs4servicemanager .exe"=
 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"1342:TCP"= 1342:TCP:*:Disabled:PowerFolder

"1337:TCP"= 1337:TCP:*:Disabled:PowerFolder

"3389:TCP"= 3389:TCP:*:Disabled:@xpsp2res.dll,-22009

"5353:TCP"= 5353:TCP:Adobe CSI CS4

"3703:TCP"= 3703:TCP:Adobe Version Cue CS4 Server

"3704:TCP"= 3704:TCP:Adobe Version Cue CS4 Server

"51000:TCP"= 51000:TCP:Adobe Version Cue CS4 Server

"51001:TCP"= 51001:TCP:Adobe Version Cue CS4 Server

"1700:TCP"= 1700:TCP:MioNet Remote Drive Access 0

"1701:TCP"= 1701:TCP:MioNet Remote Drive Access 1

"1702:TCP"= 1702:TCP:MioNet Remote Drive Access 2

"1703:TCP"= 1703:TCP:MioNet Remote Drive Access 3

"1704:TCP"= 1704:TCP:MioNet Remote Drive Access 4

"1705:TCP"= 1705:TCP:MioNet Remote Drive Access 5

"1706:TCP"= 1706:TCP:MioNet Remote Drive Access 6

"1707:TCP"= 1707:TCP:MioNet Remote Drive Access 7

"1708:TCP"= 1708:TCP:MioNet Remote Drive Access 8

"1709:TCP"= 1709:TCP:MioNet Remote Drive Access 9

"1641:TCP"= 1641:TCP:MioNet Remote Drive Verification

"1647:TCP"= 1647:TCP:MioNet Storage Device Configuration

"5432:UDP"= 5432:UDP:MioNet Storage Device Discovery
 

R?2 SAVService;Sophos Anti-Virus;c:\programme\Sophos\Sophos Anti-Virus\SavService.exe [14.11.2009 10:58 98304]

R1 HCW88AUD;Hauppauge WinTV 88x Audio Capture;c:\windows\system32\drivers\hcw88aud.sys [07.10.2007 12:07 11904]

R1 savonaccesscontrol;SAVOnAccessControl;c:\windows\system32\drivers\savonaccesscontrol.sys [14.11.2009 10:58 110848]

R1 savonaccessfilter;SAVOnAccessFilter;c:\windows\system32\drivers\savonaccessfilter.sys [14.11.2009 10:59 38528]

R2 {FE4C91E7-22C2-4D0C-9F6B-82F1B7742054};{FE4C91E7-22C2-4D0C-9F6B-82F1B7742054};c:\programme\CyberLink\PowerDVD8\000.fcl [27.06.2008 15:50 61424]

R2 AdobeActiveFileMonitor6.0;Adobe Active File Monitor V6;c:\programme\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe [10.09.2007 23:45 124832]

R2 WDBtnMgrSvc.exe;WD Drive Manager Service;c:\programme\Western Digital\WD Drive Manager\WDBtnMgrSvc.exe [24.10.2008 11:09 102400]

R3 HCW88BDA;Hauppauge WinTV 88x DVB Tuner/Demod;c:\windows\system32\drivers\hcw88bda.sys [07.10.2007 12:09 207872]

R3 hcw88rc5;Hauppauge WinTV 88x IR Decoder;c:\windows\system32\drivers\hcw88rc5.sys [07.10.2007 12:09 11776]

R3 HCW88TSE;Hauppauge WinTV 88x MPEG/TS Capture;c:\windows\system32\drivers\hcw88tse.sys [07.10.2007 12:08 299776]

R3 HCW88TUNE;Hauppauge WinTV 88x Tuner;c:\windows\system32\drivers\hcw88tun.sys [07.10.2007 12:09 149504]

R3 hcw88vid;Hauppauge WinTV 88x Video;c:\windows\system32\drivers\hcw88vid.sys [07.10.2007 12:09 498176]

R3 HCW88XBAR;Hauppauge WinTV 88x Crossbar;c:\windows\system32\drivers\hcw88bar.sys [07.10.2007 12:09 23552]

S1 7fdab3ea;7fdab3ea;c:\windows\system32\drivers\7fdab3ea.sys --> c:\windows\system32\drivers\7fdab3ea.sys [?]

S1 NGS;Norman General Security Driver;\??\c:\programme\norman\nvc\bin\ngs.sys --> c:\programme\norman\nvc\bin\ngs.sys [?]

S2 SATARaid5 Config Service;SATARaid5 Configuration Service;c:\programme\Silicon Image\3132-W-R\SATARaid5ConfigService.exe [05.10.2005 17:19 131072]

S2 SAVAdminService;Sophos Anti-Virus Statusreporter;c:\programme\Sophos\Sophos Anti-Virus\SAVAdminService.exe [14.11.2009 10:58 80936]

S3 Adobe Version Cue CS4;Adobe Version Cue CS4;c:\programme\Gemeinsame Dateien\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4.exe [15.08.2008 05:46 288112]

S3 ggflt;SEMC USB Flash Driver Filter;c:\windows\system32\drivers\ggflt.sys [03.01.2008 13:20 13352]

S3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [06.11.2007 21:22 34064]

S3 RTLWUSB;Realtek RTL8187 Wireless 802.11g 54Mbps USB 2.0 Network Adapter;c:\windows\system32\drivers\RTL8187.sys [23.09.2007 11:13 176128]

S3 SjyPkt;SjyPkt;c:\windows\system32\drivers\SjyPkt.sys [23.09.2007 11:13 13532]

S3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\drivers\wdcsam.sys [07.09.2006 21:16 11520]

S4 SophosBootDriver;SophosBootDriver;c:\windows\system32\drivers\SophosBootDriver.sys [14.11.2009 10:59 14976]
 

--- Andere Dienste/Treiber im Speicher ---
 

*NewlyCreated* - MBR

*Deregistered* - mbr

*Deregistered* - PROCEXP113
 

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{61E3FE32-07B9-4563-A3E0-2DE2D620FE10}]

c:\programme\PixiePack Codec Pack\InstallerHelper.exe

.

Inhalt des "geplante Tasks" Ordners
 

2009-11-14 c:\windows\Tasks\At1.job

- c:\programme\Adobe\acrotray.exe [2009-11-14 13:21]
 

2009-11-14 c:\windows\Tasks\At10.job

- c:\programme\Adobe\acrotray.exe [2009-11-14 13:21]
 

2009-11-14 c:\windows\Tasks\At11.job

- c:\programme\Adobe\acrotray.exe [2009-11-14 13:21]
 

2009-11-14 c:\windows\Tasks\At12.job

- c:\programme\Adobe\acrotray.exe [2009-11-14 13:21]
 

2009-11-14 c:\windows\Tasks\At13.job

- c:\programme\Adobe\acrotray.exe [2009-11-14 13:21]
 

2009-11-14 c:\windows\Tasks\At14.job

- c:\programme\Adobe\acrotray.exe [2009-11-14 13:21]
 

2009-11-14 c:\windows\Tasks\At15.job

- c:\programme\Adobe\acrotray.exe [2009-11-14 13:21]
 

2009-11-14 c:\windows\Tasks\At16.job

- c:\programme\Adobe\acrotray.exe [2009-11-14 13:21]
 

2009-11-14 c:\windows\Tasks\At17.job

- c:\programme\Adobe\acrotray.exe [2009-11-14 13:21]
 

2009-11-14 c:\windows\Tasks\At18.job

- c:\programme\Adobe\acrotray.exe [2009-11-14 13:21]
 

2009-11-14 c:\windows\Tasks\At19.job

- c:\programme\Adobe\acrotray.exe [2009-11-14 13:21]
 

2009-11-14 c:\windows\Tasks\At2.job

- c:\programme\Adobe\acrotray.exe [2009-11-14 13:21]
 

2009-11-14 c:\windows\Tasks\At20.job

- c:\programme\Adobe\acrotray.exe [2009-11-14 13:21]
 

2009-11-14 c:\windows\Tasks\At21.job

- c:\programme\Adobe\acrotray.exe [2009-11-14 13:21]
 

2009-11-14 c:\windows\Tasks\At22.job

- c:\programme\Adobe\acrotray.exe [2009-11-14 13:21]
 

2009-11-14 c:\windows\Tasks\At23.job

- c:\programme\Adobe\acrotray.exe [2009-11-14 13:21]
 

2009-11-14 c:\windows\Tasks\At24.job

- c:\programme\Adobe\acrotray.exe [2009-11-14 13:21]
 

2009-11-14 c:\windows\Tasks\At3.job

- c:\programme\Adobe\acrotray.exe [2009-11-14 13:21]
 

2009-11-14 c:\windows\Tasks\At4.job

- c:\programme\Adobe\acrotray.exe [2009-11-14 13:21]
 

2009-11-14 c:\windows\Tasks\At5.job

- c:\programme\Adobe\acrotray.exe [2009-11-14 13:21]
 

2009-11-14 c:\windows\Tasks\At6.job

- c:\programme\Adobe\acrotray.exe [2009-11-14 13:21]
 

2009-11-14 c:\windows\Tasks\At7.job

- c:\programme\Adobe\acrotray.exe [2009-11-14 13:21]
 

2009-11-14 c:\windows\Tasks\At8.job

- c:\programme\Adobe\acrotray.exe [2009-11-14 13:21]
 

2009-11-14 c:\windows\Tasks\At9.job

- c:\programme\Adobe\acrotray.exe [2009-11-14 13:21]
 

2009-04-16 c:\windows\Tasks\NeroLiveEpgUpdate-PCBUR02_XX.job

- c:\programme\Nero\Nero 9\Nero Live\NeroLive.exe [2008-09-18 11:51]
 

2009-11-14 c:\windows\Tasks\OGALogon.job

- c:\windows\system32\OGAEXEC.exe [2009-08-03 13:07]

.

.

------- Zusätzlicher Suchlauf -------

.

uStart Page = about:blank

uInternet Settings,ProxyOverride = *.local

IE: An vorhandene PDF-Datei anfügen - c:\programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html

IE: In Adobe PDF konvertieren - c:\programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html

IE: Linkziel an vorhandene PDF-Datei anhängen - c:\programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html

IE: Linkziel in Adobe PDF konvertieren - c:\programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html

IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000

TCP: {6DF2F9E4-95AD-41D2-BD48-37821DDFFA15} = 195.186.1.111,195.186.4.111

TCP: {C04CEB92-4160-430A-9936-51A6FF8DFA44} = 195.186.1.111,195.186.4.111

DPF: {D00E9550-440D-4EF8-BFCE-174300890C05} - hxxp://www.gomusic.ru/cabs/xdownloader.cab

FF - ProfilePath - c:\dokumente und einstellungen\XX\Anwendungsdaten\Mozilla\Firefox\Profiles\y7xowi4g.default\

FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
 

---- FIREFOX Richtlinien ----

c:\programme\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);

.

- - - - Entfernte verwaiste Registrierungseinträge - - - -
 

HKCU-Run-SpybotSD TeaTimer - c:\programme\Spybot - Search & Destroy\TeaTimer.exe
 
 
 

**************************************************************************
 

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-11-14 14:31

Windows 5.1.2600 Service Pack 3 NTFS
 

Scanne versteckte Prozesse... 
 

Scanne versteckte Autostarteinträge... 
 

Scanne versteckte Dateien... 
 

Scan erfolgreich abgeschlossen

versteckte Dateien: 0
 

**************************************************************************
 

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net
 

device: opened successfully

user: MBR read successfully

called modules: ntkrnlpa.exe catchme.sys CLASSPNP.SYS disk.sys ACPI.sys hal.dll >>UNKNOWN [0x8AFCE1F8]<< 

kernel: MBR read successfully

user & kernel MBR OK 
 

**************************************************************************
 

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\{FE4C91E7-22C2-4D0C-9F6B-82F1B7742054}]

"ImagePath"="\??\c:\programme\CyberLink\PowerDVD8\000.fcl"

.

--------------------- Gesperrte Registrierungsschluessel ---------------------
 

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{BEB3C0C7-B648-4257-96D9-B5D024816E27}\Version*Version]

"Version"=hex:b5,7a,a1,0e,a9,4b,7d,66,9a,26,5a,4a,c0,5f,b3,f5,d2,95,59,6a,89,

   39,11,d1,f1,b4,7a,b5,bf,0e,75,20,7d,ab,14,d7,97,0d,27,b3,00,71,69,80,f4,0a,\
 

[HKEY_LOCAL_MACHINE\software\Minnetonka Audio Software\SurCode Dolby Digital Premiere\Version*Version]

"Version"=hex:b5,7a,a1,0e,a9,4b,7d,66,9a,26,5a,4a,c0,5f,b3,f5,d2,95,59,6a,89,

   39,11,d1,f1,b4,7a,b5,bf,0e,75,20,7d,ab,14,d7,97,0d,27,b3,00,71,69,80,f4,0a,\

.

--------------------- Durch laufende Prozesse gestartete DLLs ---------------------
 

- - - - - - - > 'winlogon.exe'(1144)

c:\windows\system32\Ati2evxx.dll

c:\programme\Gemeinsame Dateien\Adobe\Adobe Drive CS4\AdobeDriveCS4_NP.dll

.

Zeit der Fertigstellung: 2009-11-14 14:34

ComboFix-quarantined-files.txt  2009-11-14 13:34

ComboFix2.txt  2009-11-14 13:22
 

Vor Suchlauf: 14 Verzeichnis(se), 46'972'383'232 Bytes frei

Nach Suchlauf: 16 Verzeichnis(se), 46'958'891'008 Bytes frei
 

WindowsXP-KB310994-SP2-Pro-BootDisk-DEU.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS

[operating systems]

c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect /usepmtimer
 

- - End Of File - - 6E0968B6B2DDF28AEF342E8F8580B631