| kingwilli | 13.10.2010 20:55 |
Combofix Logfile: Code:
ComboFix 10-10-11.05 - Florian 13.10.2010 17:15:00.1.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.49.1031.18.1982.1087 [GMT 2:00]
ausgeführt von:: c:\users\Florian\Desktop\ComboFix.exe
FW: ZoneAlarm Firewall *enabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B}
SP: Avira AntiVir PersonalEdition *enabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
SP: Spybot - Search and Destroy *disabled* (Outdated) {ED588FAF-1B8F-43B4-ACA8-8E3C85DADBE9}
SP: Windows-Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.
ADS - Windows: deleted 48 bytes in 1 streams.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\fheydbueyj.exe
c:\fheydbueyj.exe\config.bin
c:\fheydbueyj.exe\fheydbueyj.exe
c:\users\Florian\AppData\Local\dizicd.dll
c:\users\Florian\Desktop\nudetube.com.lnk
c:\users\Florian\Desktop\pornotube.com.lnk
c:\users\Florian\Desktop\spam001.exe
c:\users\Florian\Desktop\spam003.exe
c:\users\Florian\Desktop\troj000.exe
c:\users\Florian\Desktop\youporn.com.lnk
c:\users\Florian\Media
c:\users\Florian\Media\index.html
c:\users\Florian\Media\system\css\calendar-jos.css
c:\users\Florian\Media\system\css\index.html
c:\users\Florian\Media\system\css\modal.css
c:\users\Florian\Media\system\css\mootree.css
c:\users\Florian\Media\system\images\closebox.png
c:\users\Florian\Media\system\images\index.html
c:\users\Florian\Media\system\images\mootree.gif
c:\users\Florian\Media\system\images\mootree_loader.gif
c:\users\Florian\Media\system\index.html
c:\users\Florian\Media\system\js\calendar-setup.js
c:\users\Florian\Media\system\js\calendar.js
c:\users\Florian\Media\system\js\caption.js
c:\users\Florian\Media\system\js\combobox.js
c:\users\Florian\Media\system\js\index.html
c:\users\Florian\Media\system\js\modal.js
c:\users\Florian\Media\system\js\mootools-uncompressed.js
c:\users\Florian\Media\system\js\mootools.js
c:\users\Florian\Media\system\js\mootree.js
c:\users\Florian\Media\system\js\mootree_packed.js
c:\users\Florian\Media\system\js\openid.js
c:\users\Florian\Media\system\js\swf.js
c:\users\Florian\Media\system\js\switcher.js
c:\users\Florian\Media\system\js\tabs.js
c:\users\Florian\Media\system\js\uploader.js
c:\users\Florian\Media\system\js\validate.js
c:\users\Florian\Media\system\swf\uploader.swf
.
((((((((((((((((((((((( Dateien erstellt von 2010-09-13 bis 2010-10-13 ))))))))))))))))))))))))))))))
.
2010-10-13 16:04 . 2010-10-13 16:04 -------- d-----w- c:\users\Default\AppData\Local\temp
2010-10-12 13:52 . 2010-10-12 13:52 -------- d-----w- C:\_OTL
2010-10-12 07:16 . 2010-10-12 07:16 -------- d-----w- c:\users\Florian\AppData\Roaming\Malwarebytes
2010-10-12 07:15 . 2010-04-29 10:19 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-10-12 07:15 . 2010-10-12 07:15 -------- d-----w- c:\programdata\Malwarebytes
2010-10-12 07:15 . 2010-10-12 07:16 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-10-12 07:15 . 2010-04-29 10:19 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-10-12 06:54 . 2010-10-12 06:54 -------- d-----w- c:\users\Florian\AppData\Roaming\AnVi
2010-10-11 23:51 . 2010-10-11 23:51 -------- d-----w- C:\DBControl
2010-10-11 21:35 . 2010-10-11 21:35 -------- d-----w- c:\users\Florian\AppData\Local\DBControl
2010-10-11 20:33 . 2010-09-09 22:52 6084944 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{844D97A2-68E9-4B3C-B548-7E9E1380A057}\mpengine.dll
2010-09-29 20:50 . 2009-11-08 08:55 99176 ----a-w- c:\windows\system32\PresentationHostProxy.dll
2010-09-29 20:50 . 2009-11-08 08:55 49472 ----a-w- c:\windows\system32\netfxperf.dll
2010-09-29 20:50 . 2009-11-08 08:55 297808 ----a-w- c:\windows\system32\mscoree.dll
2010-09-29 20:50 . 2009-11-08 08:55 295264 ----a-w- c:\windows\system32\PresentationHost.exe
2010-09-29 20:50 . 2009-11-08 08:55 1130824 ----a-w- c:\windows\system32\dfshim.dll
2010-09-15 14:48 . 2010-09-15 14:48 -------- d-----w- c:\users\Florian\AppData\Roaming\Nvu
2010-09-15 14:48 . 2010-09-15 14:48 -------- d-----w- c:\program files\Nvu
2010-09-15 14:46 . 2010-08-17 10:52 2409784 ----a-w- c:\program files\Windows Mail\OESpamFilter.dat
2010-09-15 14:44 . 2010-05-27 19:16 738816 ----a-w- c:\windows\system32\inetcomm.dll
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-13 21:55 . 2009-05-13 21:55 1044480 ----a-w- c:\program files\mozilla firefox\plugins\libdivx.dll
2009-05-13 21:55 . 2009-05-13 21:55 200704 ----a-w- c:\program files\mozilla firefox\plugins\ssldivx.dll
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 202240]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-19 1008184]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-01-13 827392]
"QPService"="c:\program files\HP\QuickPlay\QPService.exe" [2007-04-24 176128]
"QlbCtrl"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2007-02-13 159744]
"HP Health Check Scheduler"="c:\program files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe" [2008-06-16 75008]
"hpWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2007-03-01 472776]
"WAWifiMessage"="c:\program files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe" [2007-01-10 317128]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 144784]
"ZoneAlarm Client"="c:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [2008-01-23 959976]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-12-04 13556256]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-12-04 92704]
"avgnt"="c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 266497]
"HP Software Update"="c:\program files\Hp\HP Software Update\HPWuSchd2.exe" [2008-12-08 54576]
"UIExec"="c:\program files\Join Air\UIExec.exe" [2009-08-31 132608]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-03-18 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-07-21 141608]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"Launcher"="c:\windows\SMINST\launcher.exe" [2006-11-08 44128]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001
R2 gupdate1ca09e3cb19e5af;Google Update Service (gupdate1ca09e3cb19e5af);c:\program files\Google\Update\GoogleUpdate.exe [2009-07-21 133104]
R2 UI Assistant Service;UI Assistant Service;c:\program files\Join Air\AssistantServices.exe [2009-08-31 241664]
R3 ColdFusion MX ODBC Agent;ColdFusion MX ODBC Agent;c:\cfusionmx\db\slserver52\bin\swagent.exe ColdFusion MX ODBC Agent [x]
R3 ggflt;SEMC USB Flash Driver Filter;c:\windows\system32\DRIVERS\ggflt.sys [2010-02-10 13224]
R3 hcw95bda;Hauppauge MOD7700 Tuner Driver;c:\windows\system32\Drivers\hcw95bda.sys [2009-01-31 562176]
R3 hcw95rc;Hauppauge MOD7700 IR Driver;c:\windows\system32\DRIVERS\hcw95rc.sys [2009-01-31 15616]
R3 massfilter;ZTE Mass Storage Filter Driver;c:\windows\system32\drivers\massfilter.sys [2009-04-22 9728]
R3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [2010-04-29 38224]
S2 SBSDWSCService;SBSD Security Center Service;c:\program files\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368]
S3 seehcri;Sony Ericsson seehcri Device Driver;c:\windows\system32\DRIVERS\seehcri.sys [2010-02-10 27632]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2007-04-19 20:23 452136 ----a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe
.
Inhalt des "geplante Tasks" Ordners
2010-10-13 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-07-21 09:15]
2010-10-13 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-07-21 09:15]
2010-10-13 c:\windows\Tasks\User_Feed_Synchronization-{CA26E69E-EA0D-4B6D-94D2-2BCE8EF98532}.job
- c:\windows\system32\msfeedssync.exe [2008-09-11 07:33]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=DE_DE&c=73&bd=Pavilion&pf=laptop
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=DE_DE&c=73&bd=Pavilion&pf=laptop
uInternet Settings,ProxyOverride = *.local
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: Nach Microsoft &Excel exportieren - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\users\Florian\AppData\Roaming\Mozilla\Firefox\Profiles\omgrzihv.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.tagesschau.de/
FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll
FF - plugin: c:\program files\Google\Update\1.2.183.29\npGoogleOneClick8.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
HKCU-Run-fheydbueyj.exe - c:\fheydbueyj.exe\fheydbueyj.exe
HKCU-Run-Pbucidequb - c:\users\Florian\AppData\Local\dizicd.dll
HKLM-Run-NapsterShell - c:\program files\Napster\napster.exe
HKLM-Run-EfreeSoft Boss Key - c:\program files\Mgboss\mgboss.exe
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\Tcpip6\Parameters\Interfaces\{2555450f-18d2-4d43-a7f1-6c0b38aaa86d}]
@DACL=(02 0000)
"Dhcpv6Iaid"=dword:0a001b24
"Dhcpv6State"=dword:00000000
"NameServer"=""
"Domain"=""
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\Tcpip6\Parameters\Interfaces\{47ee5fb4-2bda-4b2f-a404-e0f3f6856f60}]
@DACL=(02 0000)
"Dhcpv6Iaid"=dword:0b001a73
"Dhcpv6State"=dword:00000000
"NameServer"=""
"Domain"=""
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\Tcpip6\Parameters\Interfaces\{58c545ab-f83c-45b8-9474-fcf0c1448451}]
@DACL=(02 0000)
"Dhcpv6Iaid"=dword:12020054
"Dhcpv6State"=dword:00000000
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\Tcpip6\Parameters\Interfaces\{5dc361d0-c465-4c53-a229-844f1ca09b2d}]
@DACL=(02 0000)
"Dhcpv6Iaid"=dword:0f000000
"Dhcpv6State"=dword:00000000
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\Tcpip6\Parameters\Interfaces\{649eecd5-7424-4fc2-ad40-30686b0f92bb}]
@DACL=(02 0000)
"Dhcpv6Iaid"=dword:0d001a73
"Dhcpv6State"=dword:00000000
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\Tcpip6\Parameters\Interfaces\{8559c0a9-fd22-4323-82a9-54330168cc8f}]
@DACL=(02 0000)
"Dhcpv6Iaid"=dword:0e0016d3
"Dhcpv6State"=dword:00000000
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\Tcpip6\Parameters\Interfaces\{9c642153-bfe0-4511-a0b6-e778ddd5ea9e}]
@DACL=(02 0000)
"Dhcpv6Iaid"=dword:07001422
"Dhcpv6State"=dword:00000000
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\Tcpip6\Parameters\Interfaces\{acb3eeaf-70c2-46c8-9d21-30c4f4885bd7}]
@DACL=(02 0000)
"Dhcpv6Iaid"=dword:10001a73
"Dhcpv6State"=dword:00000000
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\Tcpip6\Parameters\Interfaces\{f50c0996-5b4a-4c6a-a322-6e991d4caa0e}]
@DACL=(02 0000)
"Dhcpv6Iaid"=dword:06001422
"Dhcpv6State"=dword:00000000
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\windows\system32\nvvsvc.exe
c:\windows\system32\rundll32.exe
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\HP\QuickPlay\Kernel\TV\CLCapSvc.exe
c:\windows\system32\DRIVERS\xaudio.exe
c:\windows\system32\WUDFHost.exe
c:\program files\HP\QuickPlay\Kernel\TV\CLSched.exe
c:\windows\ehome\ehsched.exe
c:\windows\ehome\ehRecvr.exe
c:\windows\System32\rundll32.exe
c:\program files\Hewlett-Packard\Shared\hpqwmiex.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\windows\system32\wbem\unsecapp.exe
c:\program files\Hewlett-Packard\Shared\HpqToaster.exe
c:\windows\ehome\ehmsas.exe
c:\program files\iPod\bin\iPodService.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2010-10-13 21:01:05 - PC wurde neu gestartet
ComboFix-quarantined-files.txt 2010-10-13 18:55
Vor Suchlauf: 8.071.266.304 Bytes frei
Nach Suchlauf: 7.221.067.776 Bytes frei
Current=1 Default=1 Failed=0 LastKnownGood=119 Sets=1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117,118,119
- - End Of File - - 222E6398D8F7BFC74EBD16DC054BB193
--- --- --- |
