Ist ja schonmal sehr lobenswert, dass gleich jemand helfen will, danke!
Hier die beiden Berichte:
Combofix Logfile:
Code:
ComboFix 10-06-11.01 - Saturn 12.06.2010 23:01:03.1.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.49.1031.18.3038.1579 [GMT 2:00]
ausgeführt von:: c:\users\Saturn\Downloads\ComboFix.exe
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\programdata\Microsoft\Network\Downloader\qmgr0.dat
c:\programdata\Microsoft\Network\Downloader\qmgr1.dat
c:\users\Saturn\AppData\Roaming\.#
c:\users\Saturn\AppData\Roaming\.#\MBX@1394@1C12738.###
c:\users\Saturn\AppData\Roaming\.#\MBX@1394@1C12768.###
c:\users\Saturn\AppData\Roaming\.#\MBX@147C@B02738.###
c:\users\Saturn\AppData\Roaming\.#\MBX@147C@B02768.###
c:\users\Saturn\AppData\Roaming\MSA
c:\windows\system32\Thumbs.db
c:\windows\Zpazia.exe
----- BITS: Eventuell infizierte Webseiten -----
hxxp://ads1.msads.net
Infizierte Kopie von c:\windows\system32\DRIVERS\DMICall.sys wurde gefunden und desinfiziert
Kopie von - Kitty ate it :p wurde wiederhergestellt
.
((((((((((((((((((((((( Dateien erstellt von 2010-05-12 bis 2010-06-12 ))))))))))))))))))))))))))))))
.
2010-06-12 21:10 . 2010-06-12 21:11 -------- d-----w- c:\users\Saturn\AppData\Local\temp
2010-06-12 21:10 . 2010-06-12 21:10 -------- d-----w- c:\users\Default\AppData\Local\temp
2010-06-12 17:04 . 2010-06-12 17:04 0 ----a-w- c:\windows\nsreg.dat
2010-06-12 13:15 . 2010-06-12 13:15 -------- d-----w- c:\users\Saturn\AppData\Roaming\StreamTorrent
2010-06-12 13:15 . 2010-06-12 13:15 -------- d-----w- c:\program files\StreamTorrent 1.0
2010-06-12 11:12 . 2010-06-12 11:23 -------- d-----w- c:\program files\RegTweaker
2010-06-12 03:32 . 2010-06-12 03:32 -------- d-----w- c:\users\Saturn\AppData\Roaming\Malwarebytes
2010-06-12 03:32 . 2010-04-29 13:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-06-12 03:32 . 2010-06-12 03:32 -------- d-----w- c:\programdata\Malwarebytes
2010-06-12 03:32 . 2010-04-29 13:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-06-12 03:32 . 2010-06-12 03:32 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-06-11 16:08 . 2010-06-12 03:10 -------- d-----w- c:\windows\system32\MpEngineStore
2010-06-11 14:55 . 2010-06-11 14:55 -------- d-----w- c:\program files\Veetle
2010-06-11 14:48 . 2010-06-11 14:48 -------- d-----w- c:\program files\SopCast
2010-06-09 10:44 . 2010-05-01 14:13 2037248 ----a-w- c:\windows\system32\win32k.sys
2010-06-09 09:49 . 2010-04-05 17:01 67072 ----a-w- c:\windows\system32\asycfilt.dll
2010-06-09 09:48 . 2010-05-26 17:06 34304 ----a-w- c:\windows\system32\atmlib.dll
2010-06-09 09:48 . 2010-05-26 14:47 289792 ----a-w- c:\windows\system32\atmfd.dll
2010-06-08 22:20 . 2010-06-10 18:39 -------- d-----w- c:\users\Saturn\AppData\Roaming\Apple Computer
2010-06-08 22:20 . 2010-06-08 22:20 -------- d-----w- c:\users\Saturn\AppData\Local\Apple Computer
2010-06-08 22:19 . 2010-06-12 13:05 -------- dc----w- c:\windows\system32\DRVSTORE
2010-06-08 22:17 . 2010-06-08 22:19 -------- d-----w- c:\programdata\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
2010-06-08 22:13 . 2010-06-08 22:14 -------- d-----w- c:\program files\QuickTime
2010-06-08 22:12 . 2010-06-08 22:17 -------- d-----w- c:\programdata\Apple Computer
2010-06-08 22:12 . 2010-06-08 22:12 -------- d-----w- c:\users\Saturn\AppData\Local\Apple
2010-06-08 22:07 . 2010-06-12 18:11 -------- d-----w- c:\programdata\Apple
2010-06-08 22:07 . 2010-06-12 13:06 -------- d-----w- c:\program files\Common Files\Apple
2010-06-05 01:43 . 2010-06-05 01:49 -------- d-----w- c:\program files\Everest Poker
2010-06-04 04:19 . 2010-06-04 04:19 -------- d-----w- c:\users\Saturn\AppData\Local\ArcSoft
2010-05-26 22:08 . 2010-05-26 22:08 -------- d-sh--we c:\windows\system32\config\systemprofile\Lokale Einstellungen
2010-05-26 22:08 . 2010-05-26 22:08 -------- d-sh--we c:\windows\system32\config\systemprofile\Anwendungsdaten
2010-05-26 21:25 . 2010-05-26 21:29 -------- d-----w- c:\users\Saturn\AppData\Local\Microsoft Games
2010-05-26 11:03 . 2010-04-23 14:13 2048 ----a-w- c:\windows\system32\tzres.dll
2010-05-24 13:42 . 2010-05-24 13:42 -------- d-----w- c:\program files\DotAzilla
2010-05-23 13:27 . 2010-05-26 22:07 -------- d-----w- c:\programdata\ArcSoft
2010-05-23 13:26 . 2010-05-26 22:07 -------- d-----w- c:\users\Saturn\AppData\Roaming\ArcSoft
2010-05-20 12:14 . 2010-05-20 12:14 40 ----a-w- c:\windows\ujf635.bin
2010-05-20 12:14 . 2010-05-20 12:14 -------- d-----w- c:\program files\Betfair
2010-05-20 12:13 . 2010-05-20 12:13 -------- d-----w- c:\users\Saturn\AppData\Local\Downloaded Installations
2010-05-18 09:42 . 2010-05-18 09:42 -------- d-----w- c:\users\Saturn\AppData\Roaming\Command and Conquer 4
2010-05-18 08:44 . 2010-05-18 09:42 -------- d-----w- c:\program files\Command & Conquer 4 Tiberian Twilight
2010-05-17 18:37 . 2010-05-17 18:37 -------- d-----w- c:\program files\SubDownloader2
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-06-12 21:10 . 2009-03-24 09:12 12 ----a-w- c:\windows\bthservsdp.dat
2010-06-12 21:06 . 2008-01-21 07:15 621942 ----a-w- c:\windows\system32\perfh007.dat
2010-06-12 21:06 . 2008-01-21 07:15 123860 ----a-w- c:\windows\system32\perfc007.dat
2010-06-12 20:59 . 2010-04-13 19:06 27934 ----a-w- c:\programdata\nvModes.dat
2010-06-12 17:15 . 2010-04-17 12:24 -------- d-----w- c:\program files\Warcraft III
2010-06-12 11:37 . 2010-04-09 13:00 97104 ----a-w- c:\users\Saturn\AppData\Local\GDIPFONTCACHEV1.DAT
2010-06-12 03:30 . 2010-04-12 19:58 1356 ----a-w- c:\users\Saturn\AppData\Local\d3d9caps.dat
2010-06-11 00:30 . 2010-04-13 10:08 -------- d-----w- c:\users\Saturn\AppData\Roaming\uTorrent
2010-06-10 21:34 . 2010-04-17 18:36 -------- d-----w- c:\program files\JDownloader
2010-06-09 18:23 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail
2010-06-09 15:23 . 2010-04-12 18:36 -------- d-----w- c:\users\Saturn\AppData\Roaming\vlc
2010-06-06 14:59 . 2010-04-18 23:36 -------- d-----w- c:\program files\Microsoft Silverlight
2010-06-05 01:32 . 2010-05-10 19:09 -------- d-----w- c:\program files\CarbonPoker
2010-06-01 01:51 . 2010-04-12 19:26 -------- d-----w- c:\users\Saturn\AppData\Roaming\dvdcss
2010-05-27 01:34 . 2010-03-17 13:19 -------- d-----w- c:\program files\Microsoft
2010-05-26 22:41 . 2010-04-27 23:41 -------- d-----w- c:\program files\Modern Warfare 2
2010-05-26 22:09 . 2009-03-24 10:12 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-05-26 22:06 . 2010-03-17 12:51 -------- d-----w- c:\programdata\McAfee
2010-05-25 12:04 . 2010-04-17 18:37 -------- d-----w- c:\program files\uTorrent
2010-05-24 13:09 . 2010-03-17 12:50 -------- d-----w- c:\program files\Google
2010-05-23 13:33 . 2009-03-24 09:28 -------- d-----w- c:\program files\sony
2010-05-23 13:29 . 2009-03-24 12:36 -------- d-----w- c:\programdata\Sony Corporation
2010-05-23 10:21 . 2010-04-26 23:51 -------- d-----w- c:\users\Saturn\AppData\Roaming\BSW
2010-05-17 13:45 . 2010-04-13 10:04 -------- d-----w- c:\users\Saturn\AppData\Roaming\FileZilla
2010-05-12 09:21 . 2010-04-12 20:28 221568 ------w- c:\windows\system32\MpSigStub.exe
2010-05-07 01:35 . 2010-04-19 23:41 -------- d-----w- c:\program files\PokerStars
2010-05-04 05:59 . 2010-06-09 11:21 916480 ----a-w- c:\windows\system32\wininet.dll
2010-05-04 05:55 . 2010-06-09 11:21 71680 ----a-w- c:\windows\system32\iesetup.dll
2010-05-04 05:55 . 2010-06-09 11:21 109056 ----a-w- c:\windows\system32\iesysprep.dll
2010-05-04 04:31 . 2010-06-09 11:21 133632 ----a-w- c:\windows\system32\ieUnatt.exe
2010-04-28 16:26 . 2010-04-28 16:26 -------- d-----w- c:\program files\Common Files\Java
2010-04-28 16:25 . 2009-03-24 12:37 -------- d-----w- c:\program files\Java
2010-04-27 00:06 . 2010-04-26 23:30 -------- d-----w- c:\users\Saturn\AppData\Roaming\Winamp
2010-04-26 23:51 . 2010-04-26 23:51 -------- d-----w- c:\program files\BSW
2010-04-26 23:32 . 2010-04-26 23:30 -------- d-----w- c:\program files\Winamp
2010-04-26 23:30 . 2010-04-26 23:30 -------- d-----w- c:\program files\Winamp Detect
2010-04-23 14:45 . 2010-04-14 13:09 -------- d-----w- c:\programdata\Roxio
2010-04-20 10:28 . 2010-04-17 18:40 -------- d-----w- c:\program files\FileZilla FTP Client
2010-04-18 19:47 . 2010-04-18 19:47 -------- d-----w- c:\program files\Windows Portable Devices
2010-04-18 19:47 . 2006-11-02 10:25 665600 ----a-w- c:\windows\inf\drvindex.dat
2010-04-18 19:47 . 2010-04-18 19:47 0 ---ha-w- c:\windows\system32\drivers\Msft_User_WpdMtpDr_01_07_00.Wdf
2010-04-18 19:47 . 2010-04-18 19:47 0 ---ha-w- c:\windows\system32\drivers\Msft_User_WpdFs_01_07_00.Wdf
2010-04-18 03:02 . 2009-03-24 10:10 -------- d-----w- c:\programdata\NVIDIA
2010-04-18 02:54 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Calendar
2010-04-18 02:53 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Sidebar
2010-04-18 02:53 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Collaboration
2010-04-18 02:53 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Journal
2010-04-18 02:53 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Photo Gallery
2010-04-18 02:53 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Defender
2010-04-18 02:40 . 2010-03-17 12:58 -------- d-----w- c:\program files\Microsoft Works
2010-04-18 02:19 . 2010-04-18 02:19 -------- d-----w- c:\program files\Microsoft.NET
2010-04-18 00:32 . 2010-04-18 00:19 77216 ----a-w- c:\windows\War3Unin.dat
2010-04-18 00:29 . 2010-04-18 00:27 -------- d-----w- c:\program files\Warkeys
2010-04-18 00:27 . 2010-04-18 00:19 2829 ----a-w- c:\windows\War3Unin.pif
2010-04-18 00:27 . 2010-04-18 00:19 139264 ----a-w- c:\windows\War3Unin.exe
2010-04-17 18:54 . 2010-04-17 18:54 -------- d-----w- c:\users\Saturn\AppData\Roaming\Template
2010-04-17 18:53 . 2010-04-17 18:53 0 ----a-w- c:\users\Saturn\AppData\Roaming\wklnhst.dat
2010-04-17 18:48 . 2010-03-17 12:56 -------- d-----w- c:\programdata\Microsoft Help
2010-04-17 18:38 . 2010-04-16 09:54 -------- d-----w- c:\program files\Rockstar Games
2010-04-17 12:40 . 2010-04-17 12:40 -------- d-----w- c:\program files\Blamestar
2010-04-16 11:01 . 2010-04-16 09:41 -------- d-----w- c:\users\Saturn\AppData\Roaming\DAEMON Tools Lite
2010-04-16 10:55 . 2010-04-16 10:55 -------- d--h--r- c:\users\Saturn\AppData\Roaming\SecuROM
2010-04-16 10:44 . 2010-04-16 10:44 107888 ----a-w- c:\windows\system32\CmdLineExt.dll
2010-04-16 10:43 . 2010-04-16 10:43 -------- d-----w- c:\program files\Microsoft Games for Windows - LIVE
2010-04-16 09:44 . 2010-04-16 09:42 -------- d-----w- c:\program files\DAEMON Tools Lite
2010-04-16 09:43 . 2010-04-16 09:43 691696 ----a-w- c:\windows\system32\drivers\sptd.sys
2010-04-16 09:42 . 2010-04-16 09:41 -------- d-----w- c:\programdata\DAEMON Tools Lite
2010-04-15 20:03 . 2010-04-15 20:03 -------- d-----w- c:\users\Saturn\AppData\Roaming\Avira
2010-04-14 13:09 . 2010-04-14 13:09 -------- d-----w- c:\users\Saturn\AppData\Roaming\Roxio
2010-04-12 15:29 . 2010-04-28 16:25 411368 ----a-w- c:\windows\system32\deployJava1.dll
2010-03-17 12:34 . 2010-03-17 12:34 -------- d-----w- c:\windows\Fonts\Fonts
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NSUFloatingUI"="c:\program files\Sony\Network Utility\LANUtil.exe" [2008-12-21 274432]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\DTLite.exe" [2010-04-01 357696]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-21 1008184]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2009-01-06 6703648]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-03-10 835584]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-12-03 35184]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2008-04-15 178712]
"ISBMgr.exe"="c:\program files\Sony\ISB Utility\ISBMgr.exe" [2008-12-18 317288]
"MarketingTools"="c:\program files\Sony\Marketing Tools\MarketingTools.exe" [2010-03-17 26112]
"AML"="c:\program files\Sony\VAIO Launcher\AML.exe" [2009-03-09 1101824]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2010-03-02 282792]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-03-06 13548064]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-03-06 92704]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-03-17 421888]
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2009-1-24 780840]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"qmbrjsmvcloopryofxrcTaskMgr"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\VESWinlogon]
2009-01-19 11:49 98304 ----a-w- c:\windows\System32\VESWinlogon.dll
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sr.sys]
@="FSFilter System Recovery"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"VistaSp2"=hex(b):49,2e,6d,54,a3,de,ca,01
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-3461945426-2934123827-3769892102-1000]
"EnableNotificationsRef"=dword:00000001
R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-05-21 136176]
R3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys [2009-02-19 29736]
R3 SOHCImp;VAIO Media plus Content Importer;c:\program files\Common Files\Sony Shared\SOHLib\SOHCImp.exe [2009-01-20 120104]
R3 SOHDBSvr;VAIO Media plus Database Manager;c:\program files\Common Files\Sony Shared\SOHLib\SOHDBSvr.exe [2009-01-20 70952]
R3 SOHDms;VAIO Media plus Digital Media Server;c:\program files\Common Files\Sony Shared\SOHLib\SOHDms.exe [2009-01-20 390440]
R3 SOHDs;VAIO Media plus Device Searcher;c:\program files\Common Files\Sony Shared\SOHLib\SOHDs.exe [2009-01-20 75048]
R3 SOHPlMgr;VAIO Media plus Playlist Manager;c:\program files\Common Files\Sony Shared\SOHLib\SOHPlMgr.exe [2009-01-20 91432]
R3 VcmXmlIfHelper;VAIO Content Metadata XML Interface;c:\program files\Common Files\Sony Shared\VcmXml\VcmXmlIfHelper.exe [2009-09-08 83312]
R3 VUAgent;VUAgent;c:\program files\sony\VAIO Update 5\VUAgent.exe [2009-12-08 673136]
R4 sptd;sptd;c:\windows\system32\Drivers\sptd.sys [2010-04-16 691696]
S2 AdobeActiveFileMonitor7.0;Adobe Active File Monitor V7;c:\program files\Adobe\Photoshop Elements 7.0\PhotoshopElementsFileAgent.exe [2008-12-08 169312]
S2 AntiVirSchedulerService;Avira AntiVir Planer;c:\program files\Avira\AntiVir Desktop\sched.exe [2010-02-24 135336]
S2 NSUService;NSUService;c:\program files\sony\Network Utility\NSUService.exe [2008-12-21 303104]
S2 regi;regi;c:\windows\system32\drivers\regi.sys [2007-04-17 11032]
S2 uCamMonitor;CamMonitor;c:\program files\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe [2008-09-18 104960]
S2 VAIO Power Management;VAIO Power Management;c:\program files\Sony\VAIO Power Management\SPMService.exe [2008-12-19 415592]
S2 VCFw;VAIO Content Folder Watcher;c:\program files\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe [2009-03-05 5189992]
S2 VcmIAlzMgr;VAIO Content Metadata Intelligent Analyzing Manager;c:\program files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe [2009-09-16 480624]
S2 yksvc;Marvell Yukon Service;c:\windows\System32\svchost.exe [2008-01-21 21504]
S3 ArcSoftKsUFilter;ArcSoft Magic-I Visual Effect;c:\windows\system32\DRIVERS\ArcSoftKsUFilter.sys [2008-04-24 17920]
S3 JMCR_CFS;JMCR_CFS;c:\windows\system32\DRIVERS\jmcr_cfs.sys [2008-11-06 55696]
S3 NETw5v32;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;c:\windows\system32\DRIVERS\NETw5v32.sys [2009-05-28 4233728]
S3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda32v.sys [2009-03-06 44064]
S3 SFEP;Sony Firmware Extension Parser;c:\windows\system32\DRIVERS\SFEP.sys [2008-11-19 9344]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs REG_MULTI_SZ BthServ
yksvcs REG_MULTI_SZ yksvc
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
.
Inhalt des "geplante Tasks" Ordners
2010-06-12 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-05-21 13:58]
2010-06-12 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-05-21 13:58]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page =
uSearchURL,(Default) = hxxp://www.google.com/search/?q=%s
IE: Bild an &Bluetooth-Gerät senden... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Nach Microsoft &Excel exportieren - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Seite an &Bluetooth-Gerät senden... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
Trusted Zone: corel.com
Trusted Zone: corel.com\www
Trusted Zone: intervideo.com
Trusted Zone: intervideo.com\www
TCP: {9A2B3684-2397-4ECF-9398-7443ADCDA1E4} = 192.168.0.2
DPF: {C345E174-3E87-4F41-A01C-B066A90A49B4} - hxxp://trial.trymicrosoftoffice.com/trialoaa/buymsoffice_assets/framework/microsoft/wrc32.ocx
FF - ProfilePath - c:\users\Saturn\AppData\Roaming\Mozilla\Firefox\Profiles\jq0eno2u.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/ig/redirectdomain?brand=SNYT&bmod=EU01
FF - plugin: c:\program files\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\Google\Update\1.2.183.23\npGoogleOneClick8.dll
FF - plugin: c:\program files\Microsoft\Office Live\npOLW.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npdeployJava1.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npwachk.dll
FF - plugin: c:\program files\Veetle\Player\npvlc.dll
FF - plugin: c:\program files\Veetle\plugins\npVeetle.dll
FF - plugin: c:\program files\Veetle\VLCBroadcast\npvbp.dll
FF - plugin: c:\users\Saturn\AppData\Local\RunRev\revWebPlayer\nprevweb.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
---- FIREFOX Richtlinien ----
FF - user.js: yahoo.homepage.dontask - truec:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
SafeBoot-dmboot.sys
SafeBoot-dmio.sys
SafeBoot-dmload.sys
SafeBoot-dmadmin
SafeBoot-dmserver
SafeBoot-SRService
**************************************************************************
Scanne versteckte Prozesse...
Scanne versteckte Autostarteinträge...
Scanne versteckte Dateien...
Scan erfolgreich abgeschlossen
versteckte Dateien:
**************************************************************************
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
[HKEY_USERS\S-1-5-21-3461945426-2934123827-3769892102-1000\Software\SecuROM\License information*]
"datasecu"=hex:4e,0a,09,13,1c,79,bd,5e,3c,22,d8,04,2d,0d,a3,20,48,0c,36,ae,5a,
f2,ed,33,eb,a9,24,91,ae,97,54,0b,e0,bc,fa,7d,ec,95,b8,5c,e2,52,0a,e7,02,fe,\
"rkeysecu"=hex:5c,bc,52,de,00,3c,d3,9d,3f,4b,82,3a,a8,8c,89,08
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------
- - - - - - - > 'Explorer.exe'(1400)
c:\program files\WIDCOMM\Bluetooth Software\btmmhook.dll
c:\program files\WIDCOMM\Bluetooth Software\btncopy.dll
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\windows\system32\nvvsvc.exe
c:\windows\system32\rundll32.exe
c:\windows\system32\WLANExt.exe
c:\program files\Sony\VAIO Update 5\VAIOUpdt.exe
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\program files\WIDCOMM\Bluetooth Software\btwdins.exe
c:\program files\Intel\WiFi\bin\EvtEng.exe
c:\windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
c:\program files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
c:\program files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\program files\Common Files\Intel\WirelessCommon\RegSrvc.exe
c:\program files\sony\VAIO Event Service\VESMgr.exe
c:\windows\system32\DllHost.exe
c:\program files\sony\VAIO Event Service\VESMgrSub.exe
c:\windows\system32\DllHost.exe
c:\program files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
c:\windows\system32\WUDFHost.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
c:\windows\System32\rundll32.exe
c:\program files\Windows Media Player\wmpnscfg.exe
c:\program files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\program files\Sony\VAIO Power Management\SPMgr.exe
c:\\?\c:\windows\system32\wbem\WMIADAP.EXE
.
**************************************************************************
.
Zeit der Fertigstellung: 2010-06-12 23:19:01 - PC wurde neu gestartet
ComboFix-quarantined-files.txt 2010-06-12 21:18
Vor Suchlauf: 11 Verzeichnis(se), 194.037.124.096 Bytes frei
Nach Suchlauf: 16 Verzeichnis(se), 195.631.257.088 Bytes frei
- - End Of File - - 11FAF3C8C10600B3B490F15E5E2AB7E4
--- --- ---
Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org
Datenbank Version: 4190
Windows 6.0.6002 Service Pack 2 (Safe Mode)
Internet Explorer 8.0.6001.18928
12.06.2010 13:01:57
mbam-log-2010-06-12 (13-01-57).txt
Art des Suchlaufs: Vollständiger Suchlauf (C:\|)
Durchsuchte Objekte: 268743
Laufzeit: 51 Minute(n), 20 Sekunde(n)
Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 4
Infizierte Registrierungswerte: 2
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 7
Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)
Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)
Infizierte Registrierungsschlüssel:
HKEY_CURRENT_USER\SOFTWARE\V71IQL7HI7 (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\M5T8QL3YW3 (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Handle (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\XML (Trojan.FakeAlert) -> Quarantined and deleted successfully.
Infizierte Registrierungswerte:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\halo2 (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\m5t8ql3yw3 (Trojan.FakeAlert) -> Quarantined and deleted successfully.
Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)
Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)
Infizierte Dateien:
C:\Windows\System32\sshnas21.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Program Files\Command & Conquer 4 Tiberian Twilight\CNC4.exe (Hacktool.Gen) -> Quarantined and deleted successfully.
C:\Users\Saturn\AppData\Local\Temp\Zwz.exe (Trojan.Fraudpack) -> Quarantined and deleted successfully.
C:\Users\Saturn\Downloads\Everest Poker.exe (PUP.Casino) -> Quarantined and deleted successfully.
C:\Windows\Tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Windows\Tasks\{8C3FDD81-7AE0-4605-A46A-2488B179F2A3}.job (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Users\Saturn\AppData\Local\Temp\Zw1.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
