| Benja123 | 17.12.2010 21:08 |
Ja endlich !!!!!!!!!!!!!!!!!!!! Log ist fertig. Hier der Log :Combofix Logfile: Code:
ComboFix 10-12-16.05 - Benjamin_2 17.12.2010 20:55:28.5.1 - FAT32x86
Microsoft Windows XP Professional 5.1.2600.3.1252.49.1031.18.512.101 [GMT 1:00]
ausgeführt von:: c:\dokumente und einstellungen\Benjamin_2\Desktop\cofi.exe
.
((((((((((((((((((((((( Dateien erstellt von 2010-11-17 bis 2010-12-17 ))))))))))))))))))))))))))))))
.
2010-12-17 19:35 . 2010-12-17 19:35 -------- d-----w- C:\FOUND.050
2010-12-16 13:41 . 2010-12-16 13:41 -------- d-----w- c:\programme\iPod
2010-12-16 13:41 . 2010-12-16 13:41 -------- d-----w- c:\programme\iTunes
2010-12-16 13:38 . 2010-12-16 13:38 159744 ----a-w- c:\programme\Internet Explorer\PLUGINS\npqtplugin7.dll
2010-12-16 13:38 . 2010-12-16 13:38 159744 ----a-w- c:\programme\Internet Explorer\PLUGINS\npqtplugin6.dll
2010-12-16 13:38 . 2010-12-16 13:38 159744 ----a-w- c:\programme\Internet Explorer\PLUGINS\npqtplugin5.dll
2010-12-16 13:38 . 2010-12-16 13:38 159744 ----a-w- c:\programme\Internet Explorer\PLUGINS\npqtplugin4.dll
2010-12-16 13:38 . 2010-12-16 13:38 159744 ----a-w- c:\programme\Internet Explorer\PLUGINS\npqtplugin3.dll
2010-12-16 13:38 . 2010-12-16 13:38 159744 ----a-w- c:\programme\Internet Explorer\PLUGINS\npqtplugin2.dll
2010-12-16 13:38 . 2010-12-16 13:38 159744 ----a-w- c:\programme\Internet Explorer\PLUGINS\npqtplugin.dll
2010-12-16 13:34 . 2010-12-16 13:35 -------- d-----w- c:\programme\Bonjour
2010-12-15 16:07 . 2010-12-15 16:07 -------- d-----w- C:\FOUND.049
2010-12-15 13:57 . 2010-12-15 13:57 -------- d-----w- C:\FOUND.048
2010-12-14 19:38 . 2010-12-14 19:38 -------- d-----w- C:\_OTL
2010-12-12 11:02 . 2010-12-12 11:02 -------- d-----w- c:\programme\CCleaner
2010-12-09 17:29 . 2010-12-09 17:29 -------- d-----w- c:\dokumente und einstellungen\LocalService\Anwendungsdaten\McAfee
2010-12-07 16:46 . 2010-12-07 16:46 -------- d-----w- c:\dokumente und einstellungen\Benjamin_2\Anwendungsdaten\Meine Die Schlacht um Mittelerde™ II-Dateien
2010-12-07 13:15 . 2010-12-07 13:15 -------- d-----w- c:\dokumente und einstellungen\Benjamin_2\Anwendungsdaten\Malwarebytes
2010-12-07 13:15 . 2010-11-29 16:42 38224 ----a-w- c:\winnt\system32\drivers\mbamswissarmy.sys
2010-12-07 13:15 . 2010-12-07 13:15 -------- d-----w- c:\dokumente und einstellungen\All Users\Anwendungsdaten\Malwarebytes
2010-12-07 13:15 . 2010-11-29 16:42 20952 ----a-w- c:\winnt\system32\drivers\mbam.sys
2010-12-06 19:56 . 2010-12-06 19:56 -------- d-----w- c:\dokumente und einstellungen\All Users\Anwendungsdaten\PC Suite
2010-12-06 19:56 . 2010-12-06 19:56 -------- d-----w- c:\dokumente und einstellungen\Benjamin_2\Anwendungsdaten\PC Suite
2010-12-06 19:56 . 2008-04-13 18:45 26112 ----a-w- c:\winnt\system32\drivers\usbser.sys
2010-12-06 19:56 . 2008-04-13 18:45 26112 ----a-w- c:\winnt\system32\dllcache\usbser.sys
2010-12-06 19:56 . 2008-11-07 17:55 16928 ------w- c:\winnt\system32\spmsgXP_2k3.dll
2010-12-06 19:46 . 2010-12-06 19:46 -------- d-----w- c:\dokumente und einstellungen\All Users\Anwendungsdaten\Nokia
2010-12-06 19:40 . 2010-12-06 19:40 -------- d-----w- c:\programme\DIFX
2010-12-06 19:40 . 2008-08-26 09:26 18816 ----a-w- c:\winnt\system32\drivers\pccsmcfd.sys
2010-12-06 19:39 . 2010-12-06 19:39 -------- d-----w- c:\programme\PC Connectivity Solution
2010-12-06 19:39 . 2010-02-26 13:21 137344 ----a-w- c:\winnt\system32\drivers\nmwcdnsu.sys
2010-12-06 19:39 . 2010-02-26 13:32 8192 ----a-w- c:\winnt\system32\drivers\usbser_lowerfltj.sys
2010-12-06 19:39 . 2010-02-26 13:32 8192 ----a-w- c:\winnt\system32\drivers\usbser_lowerflt.sys
2010-12-06 19:39 . 2010-02-26 13:32 22528 ----a-w- c:\winnt\system32\drivers\ccdcmbo.sys
2010-12-06 19:38 . 2010-02-26 13:32 662016 ----a-w- c:\winnt\system32\nmwcdcocls.dll
2010-12-06 19:38 . 2010-02-26 13:32 18176 ----a-w- c:\winnt\system32\drivers\ccdcmb.sys
2010-12-06 19:38 . 2010-02-26 13:19 1461992 ----a-w- c:\winnt\system32\wdfcoinstaller01009.dll
2010-12-06 19:38 . 2010-02-26 13:32 92672 ----a-w- c:\winnt\system32\nmwcdcls.dll
2010-12-06 19:37 . 2010-12-06 19:37 -------- d-----w- c:\programme\Gemeinsame Dateien\Nokia
2010-12-06 19:37 . 2010-12-06 19:37 -------- d-----w- c:\programme\Nokia
2010-12-06 19:33 . 2010-12-06 19:33 -------- d-----w- c:\dokumente und einstellungen\All Users\Anwendungsdaten\Installations
2010-12-06 13:15 . 2010-12-06 13:15 -------- d-----w- c:\dokumente und einstellungen\All Users\Anwendungsdaten\McAfee
2010-12-06 13:15 . 2010-12-06 13:15 -------- d-----w- c:\dokumente und einstellungen\All Users\Anwendungsdaten\McAfee Security Scan
2010-12-06 13:14 . 2010-12-06 13:14 -------- d-----w- c:\programme\McAfee Security Scan
2010-12-04 12:26 . 2010-12-04 12:26 -------- d-----w- c:\dokumente und einstellungen\Benjamin_2\Anwendungsdaten\NCH Software
2010-12-03 13:25 . 2010-12-03 13:25 -------- d-----w- c:\dokumente und einstellungen\Benjamin_2\Lokale Einstellungen\Anwendungsdaten\Mozilla
2010-11-29 16:38 . 2010-11-29 16:38 94208 ----a-w- c:\winnt\system32\QuickTimeVR.qtx
2010-11-29 16:38 . 2010-11-29 16:38 69632 ----a-w- c:\winnt\system32\QuickTime.qts
2010-11-29 13:07 . 2010-11-29 13:07 -------- d-----w- c:\dokumente und einstellungen\Benjamin_2\Lokale Einstellungen\Anwendungsdaten\IncrediMail_MediaBar_2
2010-11-29 13:07 . 2010-11-29 13:07 -------- d-----w- c:\dokumente und einstellungen\Benjamin_2\Lokale Einstellungen\Anwendungsdaten\ConduitEngine
2010-11-29 13:07 . 2010-11-29 13:07 -------- d-----w- c:\programme\ConduitEngine
2010-11-29 13:07 . 2010-11-29 13:07 -------- d-----w- c:\programme\IncrediMail_MediaBar_2
2010-11-27 09:35 . 2010-11-27 09:35 -------- d-----w- c:\dokumente und einstellungen\Benjamin_2\Anwendungsdaten\DVDVideoSoftIEHelpers
2010-11-27 09:35 . 2010-11-27 09:35 -------- d-----w- c:\programme\DVDVideoSoft
2010-11-27 09:34 . 2010-11-27 09:34 -------- d-----w- c:\programme\Gemeinsame Dateien\DVDVideoSoft
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-10-07 11:23 . 2010-10-07 11:23 91424 ----a-w- c:\winnt\system32\dnssd.dll
2010-10-07 11:23 . 2010-10-07 11:23 75040 ----a-w- c:\winnt\system32\jdns_sd.dll
2010-10-07 11:23 . 2010-10-07 11:23 197920 ----a-w- c:\winnt\system32\dnssdX.dll
2010-10-07 11:23 . 2010-10-07 11:23 107808 ----a-w- c:\winnt\system32\dns-sd.exe
2010-09-26 13:18 . 2010-09-26 13:18 17212818 ----a-w- C:\RTL8187B_Auto_Install_Program.zip
2010-09-26 13:10 . 2010-09-26 13:10 23619775 ----a-w- C:\vista3264-v6_1118_0220_2008.zip
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{EEE6C35D-6118-11DC-9C72-001320C79847}"= "c:\programme\SweetIM\Toolbars\Internet Explorer\mgHelper.dll" [2008-10-08 173368]
"{00bf7b9c-acd2-4080-bea8-b1c41987070f}"= "c:\programme\TranslatorBar_1\tbTran.dll" [2010-06-03 2736736]
"{d40b90b4-d3b1-4d6b-a5d7-dc041c1b76c0}"= "c:\programme\IncrediMail_MediaBar_2\tbIncr.dll" [2010-09-12 3863136]
[HKEY_CLASSES_ROOT\clsid\{eee6c35d-6118-11dc-9c72-001320c79847}]
[HKEY_CLASSES_ROOT\SweetIM_URLSearchHook.ToolbarURLSearchHook.1]
[HKEY_CLASSES_ROOT\TypeLib\{EEE6C35F-6118-11DC-9C72-001320C79847}]
[HKEY_CLASSES_ROOT\SweetIM_URLSearchHook.ToolbarURLSearchHook]
[HKEY_CLASSES_ROOT\clsid\{00bf7b9c-acd2-4080-bea8-b1c41987070f}]
[HKEY_CLASSES_ROOT\clsid\{d40b90b4-d3b1-4d6b-a5d7-dc041c1b76c0}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{00bf7b9c-acd2-4080-bea8-b1c41987070f}]
2010-06-03 17:24 2736736 ----a-w- c:\programme\TranslatorBar_1\tbTran.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}]
2010-09-12 14:02 3863136 ----a-w- c:\programme\ConduitEngine\ConduitEngine.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{d40b90b4-d3b1-4d6b-a5d7-dc041c1b76c0}]
2010-09-12 14:02 3863136 ----a-w- c:\programme\IncrediMail_MediaBar_2\tbIncr.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{EEE6C35C-6118-11DC-9C72-001320C79847}]
2008-10-08 11:22 1172792 ----a-w- c:\programme\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{EEE6C35B-6118-11DC-9C72-001320C79847}"= "c:\programme\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll" [2008-10-08 1172792]
"{00bf7b9c-acd2-4080-bea8-b1c41987070f}"= "c:\programme\TranslatorBar_1\tbTran.dll" [2010-06-03 2736736]
"{d40b90b4-d3b1-4d6b-a5d7-dc041c1b76c0}"= "c:\programme\IncrediMail_MediaBar_2\tbIncr.dll" [2010-09-12 3863136]
"{30F9B915-B755-4826-820B-08FBA6BD249D}"= "c:\programme\ConduitEngine\ConduitEngine.dll" [2010-09-12 3863136]
[HKEY_CLASSES_ROOT\clsid\{eee6c35b-6118-11dc-9c72-001320c79847}]
[HKEY_CLASSES_ROOT\SWEETIE.SWEETIE.3]
[HKEY_CLASSES_ROOT\TypeLib\{EEE6C35E-6118-11DC-9C72-001320C79847}]
[HKEY_CLASSES_ROOT\SWEETIE.SWEETIE]
[HKEY_CLASSES_ROOT\clsid\{00bf7b9c-acd2-4080-bea8-b1c41987070f}]
[HKEY_CLASSES_ROOT\clsid\{d40b90b4-d3b1-4d6b-a5d7-dc041c1b76c0}]
[HKEY_CLASSES_ROOT\clsid\{30f9b915-b755-4826-820b-08fba6bd249d}]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{EEE6C35B-6118-11DC-9C72-001320C79847}"= "c:\programme\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll" [2008-10-08 1172792]
"{00BF7B9C-ACD2-4080-BEA8-B1C41987070F}"= "c:\programme\TranslatorBar_1\tbTran.dll" [2010-06-03 2736736]
"{D40B90B4-D3B1-4D6B-A5D7-DC041C1B76C0}"= "c:\programme\IncrediMail_MediaBar_2\tbIncr.dll" [2010-09-12 3863136]
"{30F9B915-B755-4826-820B-08FBA6BD249D}"= "c:\programme\ConduitEngine\ConduitEngine.dll" [2010-09-12 3863136]
[HKEY_CLASSES_ROOT\clsid\{eee6c35b-6118-11dc-9c72-001320c79847}]
[HKEY_CLASSES_ROOT\SWEETIE.SWEETIE.3]
[HKEY_CLASSES_ROOT\TypeLib\{EEE6C35E-6118-11DC-9C72-001320C79847}]
[HKEY_CLASSES_ROOT\SWEETIE.SWEETIE]
[HKEY_CLASSES_ROOT\clsid\{00bf7b9c-acd2-4080-bea8-b1c41987070f}]
[HKEY_CLASSES_ROOT\clsid\{d40b90b4-d3b1-4d6b-a5d7-dc041c1b76c0}]
[HKEY_CLASSES_ROOT\clsid\{30f9b915-b755-4826-820b-08fba6bd249d}]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-04-19 68856]
"IncrediMail"="c:\programme\IncrediMail\bin\IncMail.exe" [2010-11-29 353736]
"BitTorrent DNA"="c:\programme\DNA\btdna.exe" [2010-03-20 323392]
"Pando Media Booster"="c:\programme\Pando Networks\Media Booster\PMB.exe" [2010-04-11 2937528]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Smapp"="c:\programme\Analog Devices\SoundMAX\SMTray.exe" [2003-05-05 143360]
"NvCplDaemon"="c:\winnt\system32\NvCpl.dll" [2006-10-22 7700480]
"nwiz"="nwiz.exe" [2006-10-22 1622016]
"NvMediaCenter"="c:\winnt\system32\NvMcTray.dll" [2006-10-22 86016]
"SweetIM"="c:\programme\SweetIM\Messenger\SweetIM.exe" [2008-12-02 111928]
"Adobe Reader Speed Launcher"="c:\programme\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]
"REGSHAVE"="c:\programme\REGSHAVE\REGSHAVE.EXE" [2002-02-04 53248]
"SunJavaUpdateSched"="c:\programme\Gemeinsame Dateien\Java\Java Update\jusched.exe" [2010-05-14 248552]
"QuickTime Task"="c:\programme\QuickTime\QTTask.exe" [2010-11-29 421888]
"iTunesHelper"="c:\programme\iTunes\iTunesHelper.exe" [2010-12-13 421160]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\winnt\System32\CTFMON.EXE" [2008-04-14 15360]
c:\dokumente und einstellungen\All Users\Startmen\Programme\Autostart\
VIA RAID TOOL.lnk - c:\programme\VIA\RAID\raid_tool.exe [2005-12-9 565248]
McAfee Security Scan Plus.lnk - c:\programme\McAfee Security Scan\2.0.181\SSScheduler.exe [2010-1-15 255536]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Programme\\Electronic Arts\\Need for Speed Carbon\\NFSC.EXE"=
"c:\\WINNT\\System32\\java.exe"=
"c:\\Dokumente und Einstellungen\\Benjamin\\Anwendungsdaten\\PowerChallenge\\PowerSoccer\\PowerSoccer.exe"=
"c:\\Programme\\Don't Get Angry 2\\DA2.exe"=
"c:\\Programme\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Programme\\Windows Live\\Messenger\\livecall.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Programme\\Java\\JRE6\\BIN\\java.exe"=
"c:\\Programme\\IncrediMail\\Bin\\IncMail.exe"=
"c:\\Programme\\IncrediMail\\Bin\\ImApp.exe"=
"c:\\Programme\\IncrediMail\\Bin\\ImpCnt.exe"=
"c:\\Programme\\Steam\\SteamApps\\terminator1997857\\race\\Race_Steam.exe"=
"c:\\Programme\\Steam\\SteamApps\\terminator1997857\\race\\SteamProxy.exe"=
"c:\\Programme\\Steam\\SteamApps\\terminator1997857\\race\\RaceConfig_Steam.exe"=
"c:\\Programme\\DNA\\btdna.exe"=
"c:\\Programme\\LucasArts\\Star Wars Battlefront II\\GameData\\BattlefrontII.exe"=
"c:\\Programme\\GameSpy Arcade\\Aphex.exe"=
"c:\\Programme\\Pando Networks\\Media Booster\\PMB.exe"=
"c:\\Programme\\TmNationsForever\\TmForever.exe"=
"c:\\Programme\\ijji\\ijji REACTOR\\REACTOR.exe"=
"c:\\Programme\\ijji\\ijji REACTOR\\ijjiOptimizer.exe"=
"c:\\ijji\\ENGLISH\\Gunz\\Gunz.exe"=
"c:\dokumente und einstellungen\Benjamin_2\Desktop\Launcher.atm"= c:\dokumente und einstellungen\Benjamin_2\Desktop\Launcher.atm:Enabled:GameExe2
"c:\\Programme\\Atari\\Crashday\\Crashday.exe"=
"c:\\Programme\\Empire Interactive\\FlatOut2\\FlatOut2.exe"=
"c:\\Programme\\Google\\Google Earth\\client\\googleearth.exe"=
"c:\\Dokumente und Einstellungen\\Benjamin_2\\Anwendungsdaten\\IMVUClient\\1VivoxVoice.exe"=
"c:\\Programme\\Skype\\Phone\\Skype.exe"=
"c:\\Programme\\ICQ7.2\\ICQ.exe"=
"c:\\Programme\\ICQ7.2\\aolload.exe"=
"c:\\Programme\\Gemeinsame Dateien\\Nokia\\Service Layer\\A\\nsl_host_process.exe"=
"c:\\Programme\\Nokia\\Nokia Software Updater\\nsu_ui_client.exe"=
"c:\\Programme\\Electronic Arts\\Die Schlacht um Mittelerde II\\game.dat"=
"c:\\Programme\\Bonjour\\mDNSResponder.exe"=
"c:\\Programme\\iTunes\\iTunes.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009
"1879:UDP"= 1879:UDP:Windows Media Format SDK (IEXPLORE.EXE)
"1878:UDP"= 1878:UDP:Windows Media Format SDK (IEXPLORE.EXE)
"1880:UDP"= 1880:UDP:Windows Media Format SDK (IEXPLORE.EXE)
"57576:TCP"= 57576:TCP:Pando Media Booster
"57576:UDP"= 57576:UDP:Pando Media Booster
R0 viasraid;viasraid;c:\winnt\system32\drivers\viasraid.sys [05.08.2009 15:06 77312]
R1 bckd;bckd;c:\winnt\system32\drivers\bckd.sys [14.01.2009 00:39 72992]
R2 ACEDRV08;ACEDRV08;c:\winnt\system32\drivers\ACEDRV08.sys [13.02.2007 16:45 108768]
R2 bckwfs;Blue Coat K9 Web Protection;c:\programme\Blue Coat K9 Web Protection\k9filter.exe [30.04.2007 22:15 1078560]
R2 ICQ Service;ICQ Service;c:\programme\ICQ6Toolbar\ICQ Service.exe [10.03.2009 14:14 247096]
R2 litsgt;litsgt;c:\winnt\system32\drivers\litsgt.sys [30.04.2008 19:33 137344]
R2 tansgt;tansgt;c:\winnt\system32\drivers\tansgt.sys [30.04.2008 19:33 12032]
R3 RTL8187B;Realtek RTL8187B Wireless 802.11b/g 54Mbps USB 2.0 Network Adapter;c:\winnt\system32\drivers\rtl8187B.sys [26.09.2010 14:19 275712]
S2 gupdate1c9e07aa2321856;Google Update Service (gupdate1c9e07aa2321856);c:\programme\Google\Update\GoogleUpdate.exe [29.05.2009 18:29 133104]
S3 dump_wmimmc;dump_wmimmc;\??\c:\ijji\ENGLISH\Gunz\GameGuard\dump_wmimmc.sys --> c:\ijji\ENGLISH\Gunz\GameGuard\dump_wmimmc.sys [?]
S3 McComponentHostService;McAfee Security Scan Component Host Service;c:\programme\McAfee Security Scan\2.0.181\McCHSvc.exe [15.01.2010 13:49 227232]
S3 npggsvc;nProtect GameGuard Service;c:\winnt\system32\GameMon.des -service --> c:\winnt\system32\GameMon.des -service [?]
S3 PAC207;SoC PC-Camera;c:\winnt\system32\drivers\pfc027.sys [08.04.2005 10:46 162176]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
Inhalt des "geplante Tasks" Ordners
2010-12-03 c:\winnt\Tasks\1-Klick-Wartung.job
- c:\programme\TuneUp Utilities 2007\SystemOptimizer.exe [2006-11-23 15:46]
2010-12-17 c:\winnt\Tasks\Google Software Updater.job
- c:\programme\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-04-19 14:20]
2010-12-17 c:\winnt\Tasks\GoogleUpdateTaskMachineCore.job
- c:\programme\Google\Update\GoogleUpdate.exe [2009-05-29 17:29]
2010-12-17 c:\winnt\Tasks\GoogleUpdateTaskMachineUA.job
- c:\programme\Google\Update\GoogleUpdate.exe [2009-05-29 17:29]
2010-12-17 c:\winnt\Tasks\User_Feed_Synchronization-{78B46E83-124C-40C4-BF4C-7AE63DE263C3}.job
- c:\winnt\system32\msfeedssync.exe [2007-08-13 03:31]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = about:blank
uInternet Settings,ProxyOverride = *.local
IE: Free YouTube to Mp3 Converter - c:\dokumente und einstellungen\Benjamin_2\Anwendungsdaten\DVDVideoSoftIEHelpers\youtubetomp3.htm
IE: Google Sidewiki... - c:\programme\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_E11712C84EA7E12B.dll/cmsidewiki.html
IE: {{d9288080-1baa-4bc4-9cf8-a92d743db949} - c:\dokumente und einstellungen\Benjamin_2\Startmenü\Programme\IMVU\Run IMVU.lnk
DPF: Microsoft XML Parser for Java - file://c:\winnt\Java\classes\xmldso.cab
DPF: {4BFD075D-C36E-4F28-BB0A-5D472795197A} - hxxp://powersoccer.spielen.com/applet/PowerLoader.cab
FF - ProfilePath - c:\dokumente und einstellungen\Benjamin_2\Anwendungsdaten\Mozilla\Firefox\Profiles\wj7ota7w.default\
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2010-12-17 21:03
Windows 5.1.2600 Service Pack 3 FAT NTAPI
Scanne versteckte Prozesse...
Scanne versteckte Autostarteinträge...
Scanne versteckte Dateien...
Scan erfolgreich abgeschlossen
versteckte Dateien: 0
**************************************************************************
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\npggsvc]
"ImagePath"="c:\winnt\system32\GameMon.des -service"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
[HKEY_USERS\S-1-5-21-1993962763-73586283-839522115-1005\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:58,46,41,7f,11,64,22,10,3f,83,ec,5d,49,66,b2,8a,37,cb,02,1c,77,ec,24,
bb,07,91,41,38,19,e7,18,51,88,91,d5,44,f8,6f,08,cc,22,c0,3c,fa,52,bf,ed,8c,\
"??"=hex:13,4e,5f,d5,a3,13,e5,fe,39,63,00,c7,c9,2d,74,38
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINNT\\system32\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe,-101"
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\WINNT\\system32\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe"
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{C09C5BC9-8988-1d5f-24a9-28dcfa1ea25f}\InprocServer32*]
"Class"=hex:ac,73,28,3a,d0,b0,e5,39,49,74,d0,35,d9,e1,d2,5d,4a,73,e4,1b,2f,ed,
94,19,a3,b3,c5,bf,5e,56,b8,e5,99,d6,20,8b,c6,5a,96,5a,ee,8b,7d,68,43,fc,ed,\
"ThreadingModel"="Apartment"
@="c:\\WINNT\\system32\\OLE32.DLL"
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{C09C5BC9-8988-2918-0026-28b2fa1ea25f}\InprocServer32*]
"Class"=hex:e5,98,3e,88,4c,e0,a7,2a,d8,0d,1d,a9,a1,8b,6d,ae,03,e0,63,71,65,9d,
6a,2f,81,97,3a,9f,f4,23,92,94,79,e4,5d,1a,c9,9a,41,d8,99,8f,89,a4,9b,1e,79,\
"ThreadingModel"="Apartment"
@="c:\\WINNT\\system32\\OLE32.DLL"
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{C09C5BC9-8988-7abc-1a32-17cefa1ea25f}\InprocServer32*]
"Class"=hex:62,1f,30,f9,1e,90,b7,9b,c2,c1,cd,60,e6,36,67,3b,ce,a6,7b,64,92,a9,
c1,3e,0c,da,46,8d,53,f3,32,df,c2,6d,bf,ca,c7,71,af,cf,fb,20,ab,b1,12,69,4f,\
"ThreadingModel"="Apartment"
@="c:\\WINNT\\system32\\OLE32.DLL"
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{C09C5BC9-8988-8949-c0db-b1adfa1ea25f}\InprocServer32*]
"Class"=hex:22,83,22,3b,32,67,14,ab,59,d0,2a,62,14,a1,68,7d,b2,c5,7d,a3,5d,61,
c0,28,ff,3a,17,7a,4f,60,6b,4c,41,3e,8f,e1,a3,3d,3f,da,b7,6c,6c,dc,4f,52,31,\
"ThreadingModel"="Apartment"
@="c:\\WINNT\\system32\\OLE32.DLL"
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{C09C5BC9-8988-8d5e-e452-867efa1ea25f}\InprocServer32*]
"Class"=hex:52,50,74,39,9e,e7,f9,4d,fe,f9,e9,0f,75,33,5f,0c,f6,4e,26,49,31,39,
7a,e7,a2,71,ce,43,0f,34,64,45,c2,82,07,8b,cc,ec,f6,69,01,07,6f,dd,04,67,21,\
"ThreadingModel"="Apartment"
@="c:\\WINNT\\system32\\OLE32.DLL"
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{C09C5BC9-8988-9a20-9d55-e86efa1ea25f}\InprocServer32*]
"Class"=hex:84,43,78,6d,4b,d8,74,da,c6,d8,d9,86,60,8f,8f,87,a1,fd,3b,d5,dc,89,
ae,2a,2e,37,30,ca,15,16,93,34,0b,fe,fd,e4,24,0a,cf,2f,bb,7d,aa,f1,b1,ff,41,\
"ThreadingModel"="Apartment"
@="c:\\WINNT\\system32\\OLE32.DLL"
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{C09C5BC9-8988-d230-d1f2-73cffa1ea25f}\InprocServer32*]
"Class"=hex:7a,90,17,a5,65,6c,02,6a,00,e4,ef,c0,1d,1a,8f,2c,1f,14,f0,2d,a0,bf,
06,47,6b,81,85,34,24,5b,42,dc,61,67,c0,fd,2f,ae,16,a9,f6,3e,6b,7c,5d,d0,0b,\
"ThreadingModel"="Apartment"
@="c:\\WINNT\\system32\\OLE32.DLL"
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------
- - - - - - - > 'explorer.exe'(3644)
c:\winnt\system32\webcheck.dll
c:\winnt\system32\WPDShServiceObj.dll
c:\winnt\system32\PortableDeviceTypes.dll
c:\winnt\system32\PortableDeviceApi.dll
.
Zeit der Fertigstellung: 2010-12-17 21:06:11
ComboFix-quarantined-files.txt 2010-12-17 20:06
Vor Suchlauf: 87 Verzeichnis(se), 409.975.488.512 Bytes frei
Nach Suchlauf: 89 Verzeichnis(se), 409.930.366.976 Bytes frei
- - End Of File - - 9A438D44FF7DCDA91919621C44659957
--- --- --- |
