|
Hallo Arne, hier die Ergebnisse von Combofix: omboFix 10-07-14.01 - Isis2 14.07.2010 20:36:15.2.2 - x86 Microsoft® Windows Vista™ Ultimate 6.0.6002.2.1252.49.1031.18.3069.1291 [GMT 2:00] ausgeführt von:: c:\users\Isis2\Desktop\cofi.exe SP: Spybot - Search and Destroy *disabled* (Updated) {ED588FAF-1B8F-43B4-ACA8-8E3C85DADBE9} SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46} . ((((((((((((((((((((((( Dateien erstellt von 2010-06-14 bis 2010-07-14 )))))))))))))))))))))))))))))) . 2010-07-14 18:46 . 2010-07-14 18:46 -------- d-----w- c:\users\Public\AppData\Local\temp 2010-07-14 18:46 . 2010-07-14 18:46 -------- d-----w- c:\users\Default\AppData\Local\temp 2010-07-14 18:46 . 2010-07-14 18:46 -------- d-----w- c:\users\Administrator\AppData\Local\temp 2010-07-14 12:07 . 2010-07-14 12:22 -------- d-----w- C:\cofi 2010-07-12 09:03 . 2010-07-12 09:04 -------- d-----w- C:\rsit 2010-07-12 05:46 . 2010-07-12 05:46 -------- d-----w- c:\users\Isis2\AppData\Roaming\Malwarebytes 2010-07-12 05:46 . 2010-04-29 10:19 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2010-07-12 05:46 . 2010-07-12 05:46 -------- d-----w- c:\programdata\Malwarebytes 2010-07-12 05:46 . 2010-04-29 10:19 20952 ----a-w- c:\windows\system32\drivers\mbam.sys 2010-07-12 05:46 . 2010-07-12 05:46 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware 2010-07-11 13:36 . 2010-07-11 13:36 -------- d-----w- c:\program files\Common Files\Java 2010-07-11 13:36 . 2010-04-12 15:29 411368 ----a-w- c:\windows\system32\deployJava1.dll 2010-06-23 13:20 . 2009-11-08 08:55 99176 ----a-w- c:\windows\system32\PresentationHostProxy.dll 2010-06-23 13:20 . 2009-11-08 08:55 49472 ----a-w- c:\windows\system32\netfxperf.dll 2010-06-23 13:20 . 2009-11-08 08:55 297808 ----a-w- c:\windows\system32\mscoree.dll 2010-06-23 13:20 . 2009-11-08 08:55 295264 ----a-w- c:\windows\system32\PresentationHost.exe 2010-06-23 13:20 . 2009-11-08 08:55 1130824 ----a-w- c:\windows\system32\dfshim.dll 2010-06-23 13:11 . 2010-06-23 13:11 -------- d-----w- c:\programdata\McAfee Security Scan 2010-06-23 13:11 . 2010-06-23 15:22 -------- d-----w- c:\program files\McAfee Security Scan 2010-06-23 13:11 . 2010-06-23 14:42 -------- d-----w- c:\programdata\NOS 2010-06-23 10:18 . 2010-04-16 16:43 28672 ----a-w- c:\windows\system32\Apphlpdm.dll 2010-06-23 10:18 . 2010-04-16 14:39 4240384 ----a-w- c:\windows\system32\GameUXLegacyGDFs.dll 2010-06-18 10:15 . 2010-06-18 10:15 -------- d-----w- c:\program files\iPod 2010-06-18 10:15 . 2010-06-18 10:16 -------- d-----w- c:\program files\iTunes 2010-06-18 10:08 . 2010-06-18 10:08 -------- d-----w- c:\program files\Bonjour 2010-06-18 10:02 . 2010-06-18 10:02 72504 ----a-w- c:\programdata\Apple Computer\Installer Cache\iTunes 9.2.0.61\SetupAdmin.exe 2010-06-17 10:39 . 2010-06-17 10:39 143712 ----a-w- c:\programdata\RapidSolution\Radiotracker_2009\RadioRip\PlgYoutube.dll 2010-06-17 10:39 . 2010-06-17 10:39 158560 ----a-w- c:\programdata\RapidSolution\Radiotracker_2009\RadioRip\PlgSoundclick.dll 2010-06-17 10:39 . 2010-06-17 10:39 101216 ----a-w- c:\programdata\RapidSolution\Radiotracker_2009\RadioRip\PlgPandora.dll 2010-06-17 10:39 . 2010-06-17 10:39 119648 ----a-w- c:\programdata\RapidSolution\Radiotracker_2009\RadioRip\PlgMyspace.dll 2010-06-17 10:39 . 2010-06-17 10:39 103264 ----a-w- c:\programdata\RapidSolution\Radiotracker_2009\RadioRip\PlgLastfm.dll 2010-06-17 10:38 . 2010-06-17 10:38 127328 ----a-w- c:\programdata\RapidSolution\Radiotracker_2009\RadioRip\PlgImeem.dll 2010-06-17 10:38 . 2010-06-17 10:38 86880 ----a-w- c:\programdata\RapidSolution\Radiotracker_2009\RadioRip\PlgIJigg.dll 2010-06-17 10:38 . 2010-06-17 10:38 221024 ----a-w- c:\programdata\RapidSolution\Radiotracker_2009\RadioRip\PlgHypemachine.dll 2010-06-17 10:38 . 2010-06-17 10:38 142176 ----a-w- c:\programdata\RapidSolution\Radiotracker_2009\RadioRip\PlgGeneral.dll 2010-06-17 10:38 . 2010-06-17 10:38 75104 ----a-w- c:\programdata\RapidSolution\Radiotracker_2009\RadioRip\PlgDefault.dll 2010-06-17 10:38 . 2010-06-17 10:38 135520 ----a-w- c:\programdata\RapidSolution\Radiotracker_2009\RadioRip\PlgDeezer.dll 2010-06-17 10:38 . 2010-06-17 10:38 580448 ----a-w- c:\programdata\RapidSolution\Radiotracker_2009\RadioRip\RadioRip.dll 2010-06-16 09:06 . 2010-06-16 09:06 -------- d-----w- C:\Advanced Wheel Mouse 2010-06-16 09:05 . 2010-06-16 09:05 -------- d-----w- C:\download 2010-06-16 09:05 . 2007-01-25 21:45 6784 ----a-w- c:\windows\system32\drivers\whfltr2k.sys . (((((((((((((((((((((((((((((((((((( Find3M Bericht )))))))))))))))))))))))))))))))))))))))))))))))))))))) . 2010-07-14 18:47 . 2009-02-03 20:51 -------- d-----w- c:\users\Isis2\AppData\Roaming\Skype 2010-07-14 14:09 . 2009-02-03 20:53 -------- d-----w- c:\users\Isis2\AppData\Roaming\skypePM 2010-07-14 12:36 . 2010-06-10 09:57 -------- d-----w- c:\programdata\Spybot - Search & Destroy 2010-07-12 11:55 . 2010-02-28 19:05 -------- d-----w- c:\program files\Mozilla Thunderbird 2010-07-12 09:04 . 2010-06-11 09:29 -------- d-----w- c:\program files\Trend Micro 2010-07-12 06:49 . 2009-02-03 20:08 1356 ----a-w- c:\users\Isis2\AppData\Local\d3d9caps.dat 2010-07-12 06:48 . 2009-02-03 20:08 117296 ----a-w- c:\users\Isis2\AppData\Local\GDIPFONTCACHEV1.DAT 2010-07-12 06:45 . 2008-06-03 08:40 12 ----a-w- c:\windows\bthservsdp.dat 2010-07-11 13:35 . 2008-06-03 13:06 -------- d-----w- c:\program files\Java 2010-07-08 20:24 . 2010-06-10 09:57 -------- d-----w- c:\program files\Spybot - Search & Destroy 2010-07-06 06:13 . 2008-01-21 08:24 678092 ----a-w- c:\windows\system32\perfh007.dat 2010-07-06 06:13 . 2008-01-21 08:24 147244 ----a-w- c:\windows\system32\perfc007.dat 2010-07-01 06:47 . 2008-06-23 09:04 -------- d-----w- c:\programdata\Microsoft Help 2010-06-27 01:02 . 2008-06-23 09:05 -------- d-----w- c:\program files\Microsoft.NET 2010-06-18 10:15 . 2009-02-03 21:05 -------- d-----w- c:\program files\Common Files\Apple 2010-06-16 09:09 . 2008-06-23 09:31 -------- d-----w- c:\program files\McAfee 2010-06-15 12:32 . 2009-02-03 21:08 -------- d-----w- c:\users\Isis2\AppData\Roaming\Apple Computer 2010-06-11 18:41 . 2010-06-11 18:41 -------- d-----w- c:\program files\CCleaner 2010-06-11 09:29 . 2010-06-11 09:29 388096 ----a-r- c:\users\Isis2\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe 2010-06-09 20:22 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail 2010-06-07 09:16 . 2010-04-03 18:39 -------- d-----w- c:\program files\Microsoft Silverlight 2010-06-01 05:23 . 2008-06-03 08:53 -------- d-----w- c:\program files\Google 2010-05-31 19:37 . 2010-05-31 19:37 -------- d-----w- c:\program files\SoftByte Labs 2010-05-31 19:29 . 2010-05-31 19:29 -------- d-----w- c:\program files\HDCleaner 2010-05-27 09:59 . 2010-01-30 21:59 -------- d-----w- c:\program files\RapidSolution 2010-05-26 17:06 . 2010-06-09 12:07 34304 ----a-w- c:\windows\system32\atmlib.dll 2010-05-26 14:47 . 2010-06-09 12:07 289792 ----a-w- c:\windows\system32\atmfd.dll 2010-05-21 11:01 . 2010-05-21 11:01 -------- d-----w- c:\program files\DVDVideoSoftTB 2010-05-21 11:01 . 2010-05-21 11:01 -------- d-----w- c:\program files\Conduit 2010-05-21 11:01 . 2010-05-21 11:01 52224 ----a-w- c:\users\Isis2\AppData\Roaming\Mozilla\Firefox\Profiles\fsdn7669.default\extensions\{e9911ec6-1bcc-40b0-9993-e0eea7f6953f}\components\FFExternalAlert.dll 2010-05-21 11:01 . 2010-05-21 11:01 101376 ----a-w- c:\users\Isis2\AppData\Roaming\Mozilla\Firefox\Profiles\fsdn7669.default\extensions\{e9911ec6-1bcc-40b0-9993-e0eea7f6953f}\components\RadioWMPCore.dll 2010-05-21 11:01 . 2010-05-21 11:01 -------- d-----w- c:\users\Isis2\AppData\Roaming\DVDVideoSoftIEHelpers 2010-05-21 11:01 . 2010-05-21 11:00 -------- d-----w- c:\program files\Common Files\DVDVideoSoft 2010-05-21 11:01 . 2010-05-21 11:00 -------- d-----w- c:\program files\DVDVideoSoft 2010-05-18 14:35 . 2010-05-18 14:35 91424 ----a-w- c:\windows\system32\dnssd.dll 2010-05-18 14:35 . 2010-05-18 14:35 107808 ----a-w- c:\windows\system32\dns-sd.exe 2010-05-07 08:03 . 2010-05-07 08:03 54600 ----a-w- c:\programdata\WebEx\WebEx\924\atauthor.exe 2010-05-07 08:03 . 2010-05-07 08:03 49152 ----a-w- c:\programdata\WebEx\WebEx\924\wbxtrace.dll 2010-05-07 08:03 . 2010-05-07 08:03 46408 ----a-w- c:\programdata\WebEx\WebEx\924\atrcp.dll 2010-05-07 08:03 . 2010-05-07 08:03 387992 ----a-w- c:\programdata\WebEx\WebEx\924\atasctrl.dll 2010-05-04 05:59 . 2010-06-09 12:07 916480 ----a-w- c:\windows\system32\wininet.dll 2010-05-04 05:55 . 2010-06-09 12:07 71680 ----a-w- c:\windows\system32\iesetup.dll 2010-05-04 05:55 . 2010-06-09 12:07 109056 ----a-w- c:\windows\system32\iesysprep.dll 2010-05-04 04:31 . 2010-06-09 12:07 133632 ----a-w- c:\windows\system32\ieUnatt.exe 2010-05-01 14:13 . 2010-06-09 12:06 2037248 ----a-w- c:\windows\system32\win32k.sys 2010-04-23 14:13 . 2010-05-26 06:21 2048 ----a-w- c:\windows\system32\tzres.dll 2010-04-16 16:43 . 2010-06-23 10:18 173056 ----a-w- c:\windows\AppPatch\AcXtrnal.dll 2010-04-16 16:43 . 2010-06-23 10:18 458752 ----a-w- c:\windows\AppPatch\AcSpecfc.dll 2010-04-16 16:43 . 2010-06-23 10:18 542720 ----a-w- c:\windows\AppPatch\AcLayers.dll 2010-04-16 16:43 . 2010-06-23 10:18 2159616 ----a-w- c:\windows\AppPatch\AcGenral.dll . ((((((((((((((((((((((((((((( SnapShot@2010-07-14_12.19.48 ))))))))))))))))))))))))))))))))))))))))) . - 2009-02-03 20:05 . 2010-07-14 12:11 32768 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat + 2009-02-03 20:05 . 2010-07-14 18:18 32768 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat + 2009-02-03 20:05 . 2010-07-14 18:18 49152 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat - 2009-02-03 20:05 . 2010-07-14 12:11 49152 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat + 2009-02-03 20:05 . 2010-07-14 18:18 16384 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat - 2009-02-03 20:05 . 2010-07-14 12:11 16384 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat + 2008-06-03 11:00 . 2010-07-14 16:26 561270 c:\windows\System32\WDI\SuspendPerformanceDiagnostics_SystemData_S3.bin - 2009-05-18 15:06 . 2010-07-14 11:18 245760 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat + 2009-05-18 15:06 . 2010-07-14 15:29 245760 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat + 2010-07-14 12:08 . 2010-07-14 18:34 6508544 c:\windows\ERDNT\Hiv-backup\SCHEMA.DAT - 2010-07-14 12:08 . 2010-07-14 12:08 6508544 c:\windows\ERDNT\Hiv-backup\SCHEMA.DAT . (((((((((((((((((((((((((((( Autostartpunkte der Registrierung )))))))))))))))))))))))))))))))))))))))) . . *Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. REGEDIT4 [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks] "{872b5b88-9db5-4310-bdd0-ac189557e5f5}"= "c:\program files\DVDVideoSoftTB\tbDVDV.dll" [2010-04-15 2515552] [HKEY_CLASSES_ROOT\clsid\{872b5b88-9db5-4310-bdd0-ac189557e5f5}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{872b5b88-9db5-4310-bdd0-ac189557e5f5}] 2010-04-15 10:33 2515552 ----a-w- c:\program files\DVDVideoSoftTB\tbDVDV.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{872b5b88-9db5-4310-bdd0-ac189557e5f5}"= "c:\program files\DVDVideoSoftTB\tbDVDV.dll" [2010-04-15 2515552] [HKEY_CLASSES_ROOT\clsid\{872b5b88-9db5-4310-bdd0-ac189557e5f5}] [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser] "{872B5B88-9DB5-4310-BDD0-AC189557E5F5}"= "c:\program files\DVDVideoSoftTB\tbDVDV.dll" [2010-04-15 2515552] [HKEY_CLASSES_ROOT\clsid\{872b5b88-9db5-4310-bdd0-ac189557e5f5}] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NSUFloatingUI"="c:\program files\Sony\Network Utility\LANUtil.exe" [2008-05-29 262144] "T-Online_Software_6\WLAN-Access Finder"="c:\program files\T-Online\WLAN-Access Finder\ToWLaAcF.exe" [2008-04-08 671796] "TomTomHOME.exe"="c:\program files\TomTom HOME 2\TomTomHOMERunner.exe" [2009-03-18 251240] "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-02-12 39408] "ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952] "Sony Ericsson PC Suite"="c:\program files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe" [2009-09-24 434176] "WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240] "SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480] "AdobeUpdater"="c:\program files\Common Files\Adobe\Updater5\AdobeUpdater.exe" [2009-02-05 2356088] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-21 1008184] "RtHDVCpl"="RtHDVCpl.exe" [2008-04-29 6111232] "Apoint"="c:\program files\Apoint\Apoint.exe" [2008-02-23 122880] "Acrobat Assistant 8.0"="c:\program files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe" [2008-10-14 623992] "ISBMgr.exe"="c:\program files\Sony\ISB Utility\ISBMgr.exe" [2008-04-03 317280] "StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-01-21 61440] "mcagent_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2009-10-29 1218008] "McENUI"="c:\progra~1\McAfee\MHN\McENUI.exe" [2009-07-07 1176808] "MarketingTools"="c:\program files\Sony\Marketing Tools\MarketingTools.exe" [2008-06-23 36864] "AML"="c:\program files\Sony\VAIO Launcher\AML.exe" [2008-03-26 1093632] "CanonSolutionMenu"="c:\program files\Canon\SolutionMenu\CNSLMAIN.exe" [2007-05-14 644696] "CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2007-04-03 1603152] "SSBkgdUpdate"="c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2006-10-25 210472] "OpwareSE4"="c:\program files\ScanSoft\OmniPageSE4\OpwareSE4.exe" [2007-02-04 79400] "WrtMon.exe"="c:\windows\system32\spool\drivers\w32x86\3\WrtMon.exe" [2006-09-20 20480] "zinit32"="c:\windows\ZInit32.exe" [2009-02-09 6091776] "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040] "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-03-17 421888] "WheelMouse"="c:\advanc~1\wh_exec.exe" [2007-11-10 98304] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-06-15 141624] "Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2010-04-29 1090952] c:\users\Isis2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2009-2-26 97680] c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ BTTray.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2007-10-30 748072] McAfee Security Scan Plus.lnk - c:\program files\McAfee Security Scan\2.0.181\SSScheduler.exe [2010-1-15 255536] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "EnableUIADesktopToggle"= 0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\VESWinlogon] 2008-05-15 15:20 98304 ----a-w- c:\windows\System32\VESWinlogon.dll [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc] @="" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS] @="" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend] @="Service" [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc] "VistaSp2"=hex(b):f2,11,8f,ee,a7,53,ca,01 R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384] R2 gupdate1ca8242b57226d0;Google Update Service (gupdate1ca8242b57226d0);c:\program files\Google\Update\GoogleUpdate.exe [2009-12-21 133104] R2 OMSI download service;Sony Ericsson OMSI download service;c:\program files\Sony Ericsson\Sony Ericsson PC Suite\SupServ.exe [2009-04-30 90112] R3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys [2007-12-12 28464] R3 ggflt;SEMC USB Flash Driver Filter;c:\windows\system32\DRIVERS\ggflt.sys [2009-04-06 13224] R3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\McAfee Security Scan\2.0.181\McCHSvc.exe [2010-01-15 227232] R3 RRNetCap;RRNetCap Service;c:\windows\system32\DRIVERS\rrnetcap.sys [2010-03-04 31848] R3 s0017bus;Sony Ericsson Device 0017 driver (WDM);c:\windows\system32\DRIVERS\s0017bus.sys [2008-10-21 86824] R3 s0017mdfl;Sony Ericsson Device 0017 USB WMC Modem Filter;c:\windows\system32\DRIVERS\s0017mdfl.sys [2008-10-21 15016] R3 s0017mdm;Sony Ericsson Device 0017 USB WMC Modem Driver;c:\windows\system32\DRIVERS\s0017mdm.sys [2008-10-21 114600] R3 s0017mgmt;Sony Ericsson Device 0017 USB WMC Device Management Drivers (WDM);c:\windows\system32\DRIVERS\s0017mgmt.sys [2008-10-21 108328] R3 s0017nd5;Sony Ericsson Device 0017 USB Ethernet Emulation SEMC0017 (NDIS);c:\windows\system32\DRIVERS\s0017nd5.sys [2008-10-21 26024] R3 s0017obex;Sony Ericsson Device 0017 USB WMC OBEX Interface;c:\windows\system32\DRIVERS\s0017obex.sys [2008-10-21 104616] R3 s0017unic;Sony Ericsson Device 0017 USB Ethernet Emulation SEMC0017 (WDM);c:\windows\system32\DRIVERS\s0017unic.sys [2008-10-21 109736] R3 SOHCImp;VAIO Media plus Content Importer;c:\program files\Sony\VAIO Media plus\SOHCImp.exe [2008-03-04 104288] R3 SOHDms;VAIO Media plus Digital Media Server;c:\program files\Sony\VAIO Media plus\SOHDms.exe [2008-03-04 350048] R3 SOHDs;VAIO Media plus Device Searcher;c:\program files\Sony\VAIO Media plus\SOHDs.exe [2008-03-04 63328] R3 stusb2ir;USB 2.0 IrDA-Brücke;c:\windows\system32\DRIVERS\stusb2ir.sys [2006-11-02 41728] R3 VcmIAlzMgr;VAIO Content Metadata Intelligent Analyzing Manager;c:\program files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe [2008-03-03 333088] R3 VcmXmlIfHelper;VAIO Content Metadata XML Interface;c:\program files\Common Files\Sony Shared\VcmXml\VcmXmlIfHelper.exe [2008-03-03 87328] R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504] S1 vflt;Shrew Soft Lightweight Filter;c:\windows\system32\DRIVERS\vfilter.sys [2009-11-19 17408] S2 ABBYY.Licensing.FineReader.Professional.9.0;ABBYY FineReader 9.0-Lizenzierungsdienst;c:\program files\ABBYY FineReader 9.0\NetworkLicenseServer.exe [2007-09-24 566560] S2 EmmaDevMgmtSvc;Emma Device Management;c:\program files\Common Files\Sony Ericsson\Emma Core\Services\EmmaDeviceMgmt.exe [2009-10-12 306296] S2 EmmaUpdMgmtSvc;Emma Update Management;c:\program files\Common Files\Sony Ericsson\Emma Core\Services\EmmaUpdateMgmt.exe [2009-10-29 162936] S2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\McAfee\SiteAdvisor\McSACore.exe [2009-12-08 93320] S2 NSUService;NSUService;c:\program files\Sony\Network Utility\NSUService.exe [2008-05-29 229376] S2 regi;regi;c:\windows\system32\drivers\regi.sys [2007-04-17 11032] S2 RtkHDMIService;RtkHDMIService;c:\windows\RtkAudioService.exe [2008-04-29 98304] S2 SBSDWSCService;SBSD Security Center Service;c:\program files\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368] S2 uCamMonitor;CamMonitor;c:\program files\ArcSoft\Magic-i Visual Effects\uCamMonitor.exe [2007-11-09 104960] S2 VAIO Power Management;VAIO Power Management;c:\program files\Sony\VAIO Power Management\SPMService.exe [2008-05-27 411488] S3 ArcSoftKsUFilter;ArcSoft Magic-I Visual Effect;c:\windows\system32\DRIVERS\ArcSoftKsUFilter.sys [2008-01-30 17408] S3 NETw5v32;Intel(R) Wireless WiFi Link Adaptertreiber für Windows Vista 32-Bit;c:\windows\system32\DRIVERS\NETw5v32.sys [2008-04-28 3658752] S3 RRNetCapMP;RRNetCapMP;c:\windows\system32\DRIVERS\rrnetcap.sys [2010-03-04 31848] S3 seehcri;Sony Ericsson seehcri Device Driver;c:\windows\system32\DRIVERS\seehcri.sys [2008-01-09 27632] S3 SFEP;Sony Firmware Extension Parser;c:\windows\system32\DRIVERS\SFEP.sys [2007-12-17 9344] S3 whfltr2k;WheelMouse USB Lower Filter Driver;c:\windows\system32\DRIVERS\whfltr2k.sys [2007-01-25 6784] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] bthsvcs REG_MULTI_SZ BthServ LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{A8D647C8-65AC-409F-B7B2-3C0FEE1A32F2}] 2010-02-16 18:02 114688 ----a-w- c:\program files\PixiePack Codec Pack\InstallerHelper.exe . Inhalt des "geplante Tasks" Ordners 2010-07-14 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files\Google\Update\GoogleUpdate.exe [2009-12-21 13:37] 2010-07-14 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files\Google\Update\GoogleUpdate.exe [2009-12-21 13:37] 2010-05-15 c:\windows\Tasks\McDefragTask.job - c:\progra~1\mcafee\mqc\QcConsol.exe [2009-10-21 10:22] 2010-06-30 c:\windows\Tasks\McQcTask.job - c:\progra~1\mcafee\mqc\QcConsol.exe [2009-10-21 10:22] 2010-07-14 c:\windows\Tasks\User_Feed_Synchronization-{0EA200C2-F63D-4E3F-9FB8-D2193747A7E4}.job - c:\windows\system32\msfeedssync.exe [2010-06-09 04:30] . . ------- Zusätzlicher Suchlauf ------- . uInternet Settings,ProxyOverride = *.local IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200 IE: An vorhandenes PDF anfügen - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html IE: Ausgewählte Verknüpfungen in Adobe PDF konvertieren - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html IE: Ausgewählte Verknüpfungen in vorhandene PDF-Datei konvertieren - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html IE: Auswahl in Adobe PDF konvertieren - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html IE: Auswahl in vorhandene PDF-Datei konvertieren - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html IE: Bild an &Bluetooth-Gerät senden... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm IE: Free YouTube to Mp3 Converter - c:\users\Isis2\AppData\Roaming\DVDVideoSoftIEHelpers\youtubetomp3.htm IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html IE: In Adobe PDF konvertieren - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000 IE: Seite an &Bluetooth-Gerät senden... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm IE: Verknüpfungsziel in Adobe PDF konvertieren - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html IE: Verknüpfungsziel in vorhandene PDF-Datei konvertieren - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html Trusted Zone: microsoft.com Trusted Zone: microsoft.com\*.update Trusted Zone: microsoft.com\*.windowsupdate Trusted Zone: windowsupdate.com Handler: fluxhttp - {8E2D00A0-82C6-4821-90BC-07F290841BB6} - c:\program files\Common Files\fluxDVD\Lib\XEB\xebnavigation.ax Handler: fluxhttp\0x00000007 - {8E2D00A0-82C6-4821-90BC-07F290841BB6} - c:\program files\Common Files\fluxDVD\Lib\XEB\xebnavigation.ax DPF: {4ECE056F-E50F-4F9D-B069-EB342D21F26A} - hxxp://www3.snapfish.de/SnapfishActivia3.cab FF - ProfilePath - c:\users\Isis2\AppData\Roaming\Mozilla\Firefox\Profiles\fsdn7669.default\ FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2269050&SearchSource=3&q={searchTerms} FF - prefs.js: browser.search.selectedEngine - Google FF - prefs.js: browser.startup.homepage - hxxp://www.google.de/ FF - component: c:\program files\McAfee\SiteAdvisor\components\McFFPlg.dll FF - component: c:\users\Isis2\AppData\Roaming\Mozilla\Firefox\Profiles\fsdn7669.default\extensions\{e9911ec6-1bcc-40b0-9993-e0eea7f6953f}\components\FFExternalAlert.dll FF - component: c:\users\Isis2\AppData\Roaming\Mozilla\Firefox\Profiles\fsdn7669.default\extensions\{e9911ec6-1bcc-40b0-9993-e0eea7f6953f}\components\RadioWMPCore.dll FF - plugin: c:\program files\Common Files\mpDRM\NPMPDRM.dll FF - plugin: c:\program files\Google\Google Earth\plugin\npgeplugin.dll FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll FF - plugin: c:\program files\Google\Update\1.2.183.29\npGoogleOneClick8.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\npatgpc.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\npdeployJava1.dll FF - plugin: c:\program files\Videoload Manager\NPWMDRMWrapper.dll FF - plugin: c:\users\Isis2\AppData\Roaming\Mozilla\Firefox\Profiles\fsdn7669.default\extensions\{E78313ED-E64C-451B-9B5F-8A66A8D08A64}\plugins\npietab2.dll FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ ---- FIREFOX Richtlinien ---- c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.lu", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nu", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.nz", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--p1ai", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbayh7gpa", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.tel", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false); c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.proxy.type", 5); c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.ipc.plugins.timeoutSecs", 45); c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false); c:\program files\Mozilla Firefox\greprefs\all.js - pref("accelerometer.enabled", true); c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true); c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", ""); c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false); c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties"); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties"); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.nptest.dll", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npswf32.dll", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npctrl.dll", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npqtplugin.dll", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false); . ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover Rootkit scan 2010-07-14 20:46 Windows 6.0.6002 Service Pack 2 NTFS Scanne versteckte Prozesse... Scanne versteckte Autostarteinträge... Scanne versteckte Dateien... Scan erfolgreich abgeschlossen versteckte Dateien: 0 ************************************************************************** . --------------------- Gesperrte Registrierungsschluessel --------------------- [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0005\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . --------------------- Durch laufende Prozesse gestartete DLLs --------------------- - - - - - - - > 'Explorer.exe'(1560) c:\advanced wheel mouse\wh_hook.dll c:\windows\system32\btmmhook.dll . Zeit der Fertigstellung: 2010-07-14 20:55:59 ComboFix-quarantined-files.txt 2010-07-14 18:55 ComboFix2.txt 2010-07-14 12:22 Vor Suchlauf: 23 Verzeichnis(se), 165.414.248.448 Bytes frei Nach Suchlauf: 24 Verzeichnis(se), 165.390.262.272 Bytes frei - - End Of File - - E4E08055A75F101B02769F7B9C7822DF |
Ok. Bitte nun Logs mit GMER und OSAM erstellen und posten. GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus Anschließend den bootkit_remover herunterladen. Entpacke das Tool in einen eigenen Ordner auf dem Desktop und führe in diesem Ordner die Datei remove.exe aus. Wenn Du Windows Vista oder Windows 7 verwendest, musst Du die remover.exe über ein Rechtsklick => als Administrator ausführen Ein schwarzes Fenster wird sich öffnen und automatisch nach bösartigen Veränderungen im MBR suchen. Poste dann bitte, ob es Veränderungen gibt und wenn ja in welchem device. Am besten alles posten was die remover.exe ausgibt. |
Hallo Arne, wie von Dir befürchtet funktioniert GMER nicht - hier das logfile von OSAM: OSAM Logfile: Code: Report of OSAM: Autorun Manager v5.0.11926.0If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru |
Hier das Ergebnis des bootkit removers: OK (DOS/Win32 Boot code found) - MBR boot code is clean. |
| Alle Zeitangaben in WEZ +1. Es ist jetzt 05:49 Uhr. |
Copyright ©2000-2025, Trojaner-Board