Trojaner-Board - Virus bei msn und skype!

okay, also hier ist der log von combofix:

Combofix Logfile:
Code:
ComboFix 10-09-08.03 - Alissa 09.09.2010  18:35:23.1.2 - x86

Microsoft® Windows Vista™ Home Premium   6.0.6001.1.1252.49.1031.18.3000.1904 [GMT 2:00]

ausgeführt von:: c:\users\Alissa\Downloads\ComboFix.exe

SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}

.
 

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.
 

c:\users\Alissa\AppData\Local\Microsoft\Windows\Temporary Internet Files\26Id6Z25L

c:\users\Alissa\AppData\Local\Microsoft\Windows\Temporary Internet Files\Wb_S--

c:\users\Alissa\AppData\Roaming\Microsoft\CD Burning\AUTORUN.inF

c:\users\Alissa\AppData\Roaming\Oscam\xuhy.exe

c:\users\Public\Favorites\ID.Conf

c:\windows\8324.exe

c:\windows\system32\Install.cmd

c:\windows\Tasks\MSNMessengerAPI.dll

c:\windows\Tasks\SharpPcap.dll
 

.

(((((((((((((((((((((((   Dateien erstellt von 2010-08-09 bis 2010-09-09  ))))))))))))))))))))))))))))))

.
 

2010-09-09 16:41 . 2010-09-09 16:41        --------        d-----w-        c:\users\Default\AppData\Local\temp

2010-09-08 16:38 . 2010-09-08 16:38        --------        d-----w-        c:\users\Alissa\AppData\Roaming\Malwarebytes

2010-09-08 16:38 . 2010-04-29 13:39        38224        ----a-w-        c:\windows\system32\drivers\mbamswissarmy.sys

2010-09-08 16:38 . 2010-09-08 16:38        --------        d-----w-        C:\Malwarebytes' Anti-Malware

2010-09-08 16:38 . 2010-09-08 16:38        --------        d-----w-        c:\programdata\Malwarebytes

2010-09-08 16:38 . 2010-04-29 13:39        20952        ----a-w-        c:\windows\system32\drivers\mbam.sys

2010-09-07 18:13 . 2008-05-02 07:26        1414440        ----a-w-        c:\windows\system32\ShellManager310E2D762.dll

2010-09-07 17:30 . 2010-09-07 17:30        --------        d-----w-        c:\program files\Common Files\Skype

2010-09-07 17:30 . 2010-09-07 17:30        --------        d-----r-        c:\program files\Skype

2010-09-07 17:27 . 2010-09-07 17:27        --------        d-----w-        c:\users\Alissa\AppData\Local\Windows Live Writer

2010-09-07 17:27 . 2010-09-07 17:27        --------        d-----w-        c:\users\Alissa\AppData\Roaming\Windows Live Writer

2010-09-07 17:09 . 2010-09-07 17:09        2560        ----a-w-        c:\windows\_MSRSTRT.EXE

2010-08-20 18:55 . 2010-06-18 16:43        36352        ----a-w-        c:\windows\system32\rtutils.dll

2010-08-20 18:55 . 2010-06-11 15:30        1257472        ----a-w-        c:\windows\system32\msxml3.dll

2010-08-20 18:55 . 2010-06-18 14:43        302080        ----a-w-        c:\windows\system32\drivers\srv.sys

2010-08-20 18:55 . 2010-06-18 14:43        144896        ----a-w-        c:\windows\system32\drivers\srv2.sys

2010-08-20 18:55 . 2010-06-16 15:59        898952        ----a-w-        c:\windows\system32\drivers\tcpip.sys
 

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2010-09-09 16:29 . 2010-05-15 17:28        --------        d-----w-        c:\users\Alissa\AppData\Roaming\Skype

2010-09-08 17:44 . 2010-03-15 01:37        --------        d-----w-        c:\users\Alissa\AppData\Roaming\Oscam

2010-09-08 16:12 . 2010-05-15 17:34        --------        d-----w-        c:\users\Alissa\AppData\Roaming\skypePM

2010-09-08 13:33 . 2009-01-08 16:41        --------        d-----w-        c:\program files\Google

2010-09-07 19:13 . 2008-01-21 07:15        637852        ----a-w-        c:\windows\system32\perfh007.dat

2010-09-07 19:13 . 2008-01-21 07:15        129160        ----a-w-        c:\windows\system32\perfc007.dat

2010-09-07 19:04 . 2009-09-13 11:11        76384        ----a-w-        c:\users\Alissa\AppData\Local\GDIPFONTCACHEV1.DAT

2010-09-07 18:14 . 2009-03-14 13:00        --------        d-----w-        c:\program files\Common Files\Nero

2010-09-07 18:14 . 2009-03-14 13:00        --------        d-----w-        c:\programdata\Nero

2010-09-07 17:59 . 2009-01-09 00:07        --------        d-----w-        c:\program files\PACKARD BELL

2010-09-07 17:59 . 2009-01-08 16:29        --------        d--h--w-        c:\program files\InstallShield Installation Information

2010-09-07 17:58 . 2009-01-08 16:36        --------        d-----w-        c:\program files\Microsoft Works

2010-09-07 17:49 . 2009-01-08 16:34        --------        d-----w-        c:\programdata\Microsoft Help

2010-09-07 17:49 . 2009-01-08 16:36        --------        d-----w-        c:\program files\Microsoft.NET

2010-09-07 17:44 . 2009-11-11 18:39        --------        d-----w-        c:\program files\DVDVideoSoft

2010-09-07 17:44 . 2009-11-11 18:39        --------        d-----w-        c:\program files\Common Files\DVDVideoSoft

2010-09-07 17:43 . 2010-05-18 12:10        --------        d-----w-        c:\program files\OpenOffice.org 3

2010-09-07 17:33 . 2009-10-05 11:34        --------        d-----w-        c:\users\Alissa\AppData\Roaming\uTorrent

2010-09-07 17:30 . 2010-05-02 16:31        --------        d-----w-        c:\users\Alissa\AppData\Roaming\Oduv

2010-09-07 17:30 . 2010-05-15 17:27        --------        d-----w-        c:\programdata\Skype

2010-09-07 17:23 . 2009-01-08 16:51        --------        d-----w-        c:\program files\Windows Live

2010-08-21 08:22 . 2006-11-02 11:18        --------        d-----w-        c:\program files\Windows Mail

2010-07-31 16:14 . 2009-01-08 16:55        --------        d-----w-        c:\programdata\Norton

2010-07-31 16:14 . 2009-01-08 16:55        --------        d-----w-        c:\programdata\NortonInstaller

2010-06-29 18:03 . 2010-06-23 12:27        1408        ----a-w-        c:\windows\system32\ealregsnapshot1.reg

2010-06-29 18:02 . 2010-06-29 18:02        310        ----a-w-        c:\windows\system32\UnifiedToolbarCleanup.bat

2010-06-29 18:01 . 2010-06-29 18:01        349        ----a-w-        c:\windows\system32\KiweeChatbarCleanup.bat

2010-06-28 16:17 . 2010-08-20 18:56        833024        ----a-w-        c:\windows\system32\wininet.dll

2010-06-28 16:13 . 2010-08-20 18:56        78336        ----a-w-        c:\windows\system32\ieencode.dll

2010-06-21 13:18 . 2010-08-20 18:56        2036736        ----a-w-        c:\windows\system32\win32k.sys

2010-06-18 10:35 . 2010-05-18 12:14        1        ----a-w-        c:\users\Alissa\AppData\Roaming\OpenOffice.org\3\user\uno_packages\cache\stamp.sys

2010-08-20 19:40 . 2009-11-30 20:28        119808        ----a-w-        c:\program files\mozilla firefox\components\GoogleDesktopMozilla.dll

.
 

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4
 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"SmpcSys"="c:\program files\PACKARD BELL\SetUpMyPC\SmpSys.exe" [2008-07-07 1038136]

"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2010-04-16 3872080]

"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-09-13 68856]

"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-21 1233920]

"Skype"="c:\program files\Skype\Phone\Skype.exe" [2010-09-02 13351304]

"Google Update"="c:\users\Alissa\AppData\Local\Google\Update\GoogleUpdate.exe" [2010-05-15 136176]
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-21 1008184]

"Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2010-08-20 30192]

"SmpcSys"="c:\program files\Packard Bell\SetupMyPC\SmpSys.exe" [2008-07-07 1038136]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]

"RtHDVCpl"="RtHDVCpl.exe" [2008-08-04 6265376]

"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-08-12 150040]

"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-08-12 170520]

"Persistence"="c:\windows\system32\igfxpers.exe" [2008-08-12 145944]

"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-11-10 417792]

"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-11-12 141600]

"Malwarebytes Anti-Malware (reboot)"="c:\malwarebytes' anti-malware\mbam.exe" [2010-04-29 1090952]
 

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"EnableUIADesktopToggle"= 0 (0x0)

"HideFastUserSwitching"= 0 (0x0)
 

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]

"AppInit_DLLs"=c:\progra~1\Google\GOOGLE~1\GoogleDesktopNetwork3.dll
 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"aux"=wdmaud.drv
 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]

@="Service"
 

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]

R3 GoogleDesktopManager-051210-111108;Google Desktop Manager 5.9.1005.12335;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [2010-08-20 30192]

R3 netr73;RT73 USB Wireless LAN Card Driver for Vista;c:\windows\system32\DRIVERS\netr73.sys [2008-02-26 493568]

R3 NETw5v32;Intel(R) Wireless WiFi Link Adaptertreiber für Windows Vista 32-Bit;c:\windows\system32\DRIVERS\NETw5v32.sys [2008-04-27 3658752]

R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]

R4 sptd;sptd;c:\windows\system32\Drivers\sptd.sys [2009-10-05 722416]

S2 ETService;Empowering Technology Service;c:\program files\Packard Bell\Packard Bell Recovery Management\Service\ETService.exe [2008-07-16 24576]

S2 ezSharedSvc;Easybits Shared Services for Windows;c:\windows\system32\svchost.exe [2008-01-21 21504]

S3 netr28;Ralink 802.11n Wireless Driver for Windows Vista;c:\windows\system32\DRIVERS\netr28.sys [2008-07-29 418816]
 
 

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost  - NetSvcs

ezSharedSvc

.

Inhalt des "geplante Tasks" Ordners
 

2010-09-08 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1314263970-507656192-2917605825-1000Core.job

- c:\users\Alissa\AppData\Local\Google\Update\GoogleUpdate.exe [2010-09-07 17:28]
 

2010-09-09 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1314263970-507656192-2917605825-1000UA.job

- c:\users\Alissa\AppData\Local\Google\Update\GoogleUpdate.exe [2010-09-07 17:28]
 

2010-09-09 c:\windows\Tasks\User_Feed_Synchronization-{E7BC8163-5E80-479E-A769-A4C908941CCC}.job

- c:\windows\system32\msfeedssync.exe [2008-01-21 02:24]

.

.

------- Zusätzlicher Suchlauf -------

.

uStart Page = hxxp://fullarticles.net

mStart Page = hxxp://homepage.packardbell.com/rdr.aspx?b=ACPW&l=0407&s=2&o=vp32&d=0309&m=easynote_mh45

IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html

IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000

TCP: {A415EFD2-976F-4023-B71C-3D489D99FD5C} = 62.109.123.197 213.191.74.19

DPF: CabBuilder - hxxp://kiw.imgag.com/imgag/kiw/toolbar/download/InstallerControl.cab

.

- - - - Entfernte verwaiste Registrierungseinträge - - - -
 

WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)

HKCU-Run-DAEMON Tools Lite - c:\users\Alissa\Desktop\DAEMON Tools Lite\daemon.exe

HKCU-Run-{CC833917-CFE4-D8BF-A168-E1C97E7ECD30} - c:\users\Alissa\AppData\Roaming\Oscam\xuhy.exe

HKLM-Run-eRecoveryService - (no file)

HKLM-Run-NBKeyScan - c:\program files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe
 
 
 

**************************************************************************
 

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover

Rootkit scan 2010-09-09 18:41

Windows 6.0.6001 Service Pack 1 NTFS
 

Scanne versteckte Prozesse... 
 

Scanne versteckte Autostarteinträge... 
 

Scanne versteckte Dateien... 
 

Scan erfolgreich abgeschlossen

versteckte Dateien: 0
 

**************************************************************************

.

Zeit der Fertigstellung: 2010-09-09  18:43:43

ComboFix-quarantined-files.txt  2010-09-09 16:43
 

Vor Suchlauf: 8 Verzeichnis(se), 213.430.050.816 Bytes frei

Nach Suchlauf: 13 Verzeichnis(se), 214.121.209.856 Bytes frei
 

- - End Of File - - 2E6ABA799B50EC77226AFC72A710AF9A
--- --- ---

& was jetzt?