Trojaner-Board - MSN Live Messenger verschickt Links von fremden Websites

Combofix Logfile:
Code:
ComboFix 11-02-20.01 - *******20.02.2011  21:25:59.1.2 - x86

Microsoft Windows 7 Home Premium   6.1.7600.0.1252.49.1031.18.1790.887 [GMT 1:00]

ausgeführt von:: c:\users\*******\Downloads\ComboFix.exe

AV: Microsoft Security Essentials *Enabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160}

SP: Microsoft Security Essentials *Enabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.
 

(((((((((((((((((((((((   Dateien erstellt von 2011-01-20 bis 2011-02-20  ))))))))))))))))))))))))))))))

.
 

2011-02-20 20:31 . 2011-02-20 20:31        --------        d-----w-        c:\users\Default\AppData\Local\temp

2011-02-20 14:09 . 2011-02-20 14:09        --------        d-----w-        c:\program files\ERUNT

2011-02-20 12:56 . 2011-02-20 12:56        --------        d-----w-        c:\users\*******\AppData\Local\{6658A698-83F3-40D9-B072-545877998615}

2011-02-20 08:08 . 2011-02-20 08:08        439632        ----a-w-        c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{6E4ACB48-48B2-4D92-891B-689B12F253AA}\gapaengine.dll

2011-02-20 08:08 . 2011-01-13 09:41        5890896        ----a-w-        c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{8B0EE018-024D-41B8-9E0E-7BCDFA44EB3B}\mpengine.dll

2011-02-19 21:36 . 2011-02-19 21:36        --------        d-----w-        c:\users\*******\AppData\Roaming\Malwarebytes

2011-02-19 21:35 . 2010-12-20 17:09        38224        ----a-w-        c:\windows\system32\drivers\mbamswissarmy.sys

2011-02-19 21:35 . 2011-02-19 21:35        --------        d-----w-        c:\programdata\Malwarebytes

2011-02-19 21:35 . 2010-12-20 17:08        20952        ----a-w-        c:\windows\system32\drivers\mbam.sys

2011-02-19 21:35 . 2011-02-19 21:36        --------        d-----w-        c:\program files\Malwarebytes' Anti-Malware

2011-02-19 21:27 . 2011-01-13 09:41        5890896        ----a-w-        c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Updates\mpengine.dll

2011-02-19 21:27 . 2011-02-19 21:28        --------        d-----w-        c:\program files\Microsoft Security Client

2011-02-19 21:26 . 2010-04-09 07:24        240008        ----a-w-        c:\windows\system32\drivers\netio.sys

2011-02-19 21:12 . 2011-02-19 21:12        --------        d-----w-        c:\users\*******\AppData\Local\{71A57A62-6B38-42F2-851F-2AD46E9B5EFA}

2011-02-19 09:11 . 2011-02-19 09:11        --------        d-----w-        c:\users\*******\AppData\Local\{B8B134E1-29F0-4036-8258-08B989BC691F}

2011-02-18 17:07 . 2011-02-18 17:08        --------        d-----w-        c:\users\*******\AppData\Local\{F347EB8E-C79C-42A2-AE1C-D5D4B1E6334F}

2011-02-17 15:06 . 2011-02-17 15:06        --------        d-----w-        c:\users\*******\AppData\Local\{4ECBBD97-C66C-4186-A35D-3F2D9B341A99}

2011-02-16 16:45 . 2011-02-16 16:46        --------        d-----w-        c:\users\*******\AppData\Local\{DE4CAA22-6E4F-447A-9BE5-B33DB925D94E}

2011-02-15 16:22 . 2011-02-15 16:22        --------        d-----w-        c:\users\*******\AppData\Local\{5D27873B-5768-4990-8DC1-ED2A924A88FC}

2011-02-14 14:14 . 2011-02-14 14:15        --------        d-----w-        c:\users\*******\AppData\Local\{54B98E15-D396-4BA3-998D-1ABDF94AF83F}

2011-02-14 13:58 . 2011-02-14 13:58        --------        d-----w-        c:\users\*******\AppData\Local\{4BF74DC7-AFC8-4FD4-95DF-82C10FEA8472}

2011-02-14 13:10 . 2011-02-14 13:10        --------        d-----w-        c:\users\*******\AppData\Local\{B708E319-7BDF-4981-A3B8-EE2DE20C3312}

2011-02-13 15:22 . 2011-02-13 15:22        --------        d-----w-        c:\users\*******\AppData\Local\{4461160A-A332-4D4E-9F4C-D0B963863114}

2011-02-13 11:19 . 2011-02-13 11:19        --------        d-----w-        c:\users\*******\AppData\Local\{E3F31614-BB4D-4EF4-BC2D-2F7DDB79F2B1}

2011-02-12 11:33 . 2011-02-12 11:33        --------        d-----w-        c:\users\*******\AppData\Local\{C4F67CF7-4EF8-4217-9AB2-71B160F013FF}

2011-02-12 11:26 . 2011-02-12 11:26        --------        d-----w-        c:\users\*******\AppData\Local\{C23D4C9E-FF9E-47BE-B11B-BD224BDB0ACA}

2011-02-11 17:14 . 2011-02-11 17:14        --------        d-----w-        c:\users\*******\AppData\Local\{003C6426-1ED8-414C-883E-32AB4F9EEC16}

2011-02-10 11:38 . 2011-02-10 11:39        --------        d-----w-        c:\users\*******\AppData\Local\{93FD4A04-A19B-4A0A-B5AF-D33B808963D6}

2011-02-10 11:35 . 2010-10-27 04:43        3901824        ----a-w-        c:\windows\system32\ntoskrnl.exe

2011-01-30 15:45 . 2011-01-30 15:45        135568        ----a-w-        c:\program files\Mozilla Firefox\plugins\nppdf32.dll

2011-01-30 15:45 . 2011-01-30 15:45        135568        ----a-w-        c:\program files\Internet Explorer\Plugins\nppdf32.dll
 

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2011-01-13 09:41 . 2010-12-12 10:26        5890896        ----a-w-        c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll

2011-01-08 20:36 . 2011-01-08 20:36        472808        ----a-w-        c:\windows\system32\deployJava1.dll

2010-12-02 03:35 . 2010-12-02 03:35        4280320        ----a-w-        c:\windows\system32\GPhotos.scr

.
 

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4
 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]

"LG LinkAir"="c:\program files\LG Electronics\LG PC Suite IV\LinkAir\LinkAir.exe" [2010-09-16 2440552]
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-09-08 421888]

"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-11-10 421160]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 10.0\Reader\Reader_sl.exe" [2011-01-30 35736]

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-11-10 932288]

"VX1000"="c:\windows\vVX1000.exe" [2010-05-20 762736]

"LifeCam"="c:\program files\Microsoft LifeCam\LifeExp.exe" [2010-05-20 119152]

"ATICustomerCare"="c:\program files\ATI\ATICustomerCare\ATICustomerCare.exe" [2010-05-04 311296]

"B2C_AGENT"="c:\programdata\LGMOBILEAX\B2C_Client\B2CNotiAgent.exe" [2010-09-27 391096]

"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]

"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2010-11-30 997408]

"Malwarebytes' Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2010-12-20 963976]
 

c:\users\Corinne\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

ERUNT AutoBackup.lnk - c:\program files\ERUNT\AUTOBACK.EXE [2005-10-20 38912]
 

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [2000-1-21 65588]
 

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 5 (0x5)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableUIADesktopToggle"= 0 (0x0)
 

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]

Security Packages        REG_MULTI_SZ           kerberos msv1_0 schannel wdigest tspkg pku2u livessp
 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]

@="Service"
 

R1 MpKsl7e76bb84;MpKsl7e76bb84;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{F6E631E8-E557-4561-B443-CB9527E570C7}\MpKsl7e76bb84.sys [x]

R1 MpKslb0531ab2;MpKslb0531ab2;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{23EAB0A6-E741-4939-8080-3E77C32185F1}\MpKslb0531ab2.sys [x]

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]

R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-12-22 136176]

R3 Andbus;LGE Android Platform Composite USB Device;c:\windows\system32\DRIVERS\lgandbus.sys [2010-08-02 14336]

R3 AndDiag;LGE Android Platform USB Serial Port;c:\windows\system32\DRIVERS\lganddiag.sys [2010-08-02 20864]

R3 AndGps;LGE Android Platform USB GPS NMEA Port;c:\windows\system32\DRIVERS\lgandgps.sys [2010-08-02 19968]

R3 ANDModem;LGE Android Platform USB Modem;c:\windows\system32\DRIVERS\lgandmodem.sys [2010-08-02 24960]

R3 avmeject;AVM Eject;c:\windows\system32\drivers\avmeject.sys [2010-10-22 4352]

R3 lgbusenum;LG Bluetooth Bus Enumerator;c:\windows\system32\DRIVERS\lgbtbus.sys [x]

R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [2010-10-24 54144]

R3 NisSrv;Microsoft-Netzwerkinspektion;c:\program files\Microsoft Security Client\Antimalware\NisSrv.exe [2010-11-11 206360]

S1 MpKsla10676d4;MpKsla10676d4;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{8B0EE018-024D-41B8-9E0E-7BCDFA44EB3B}\MpKsla10676d4.sys [2011-02-20 28752]

S1 MpKslfdf6c1dd;MpKslfdf6c1dd;c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{8B0EE018-024D-41B8-9E0E-7BCDFA44EB3B}\MpKslfdf6c1dd.sys [2011-02-20 28752]

S3 AtiHDAudioService;ATI Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW73.sys [2010-09-24 102416]

S3 FWLANUSB;AVM FRITZ!WLAN;c:\windows\system32\DRIVERS\fwlanusb.sys [2006-02-23 264704]

S3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\DRIVERS\MpNWMon.sys [2010-10-24 43392]

S3 yukonw7;NDIS6.2-Miniporttreiber für Marvell Yukon-Ethernet-Controller;c:\windows\system32\DRIVERS\yk62x86.sys [2009-07-13 311296]
 
 

--- Andere Dienste/Treiber im Speicher ---
 

*NewlyCreated* - MPKSLA10676D4

.

Inhalt des "geplante Tasks" Ordners
 

2011-02-20 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files\Google\Update\GoogleUpdate.exe [2010-12-22 13:34]
 

2011-02-20 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files\Google\Update\GoogleUpdate.exe [2010-12-22 13:34]

.

.

------- Zusätzlicher Suchlauf -------

.

uInternet Settings,ProxyOverride = *.local

IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200

IE: Free YouTube to MP3 Converter - c:\users\Corinne\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm

IE: LG Air Sync (R-Click) - Save as Mobile Image - c:\program files\LG Electronics\LG PC Suite IV\LinkAir\IEContextMenu.dll/206

IE: LG Air Sync (R-Click) - Save as Mobile Memo - c:\program files\LG Electronics\LG PC Suite IV\LinkAir\IEContextMenu.dll/208

IE: LG Air Sync (R-Click) - Save as Mobile Text file - c:\program files\LG Electronics\LG PC Suite IV\LinkAir\IEContextMenu.dll/210

IE: LG Air Sync (R-Click) - Set as Mobile Wallpaper - c:\program files\LG Electronics\LG PC Suite IV\LinkAir\IEContextMenu.dll/205

IE: LG Air Sync Option - c:\program files\LG Electronics\LG PC Suite IV\LinkAir\IEContextMenu.dll/209

FF - ProfilePath - c:\users\Corinne\AppData\Roaming\Mozilla\Firefox\Profiles\ohmml7v7.default\

FF - prefs.js: browser.startup.homepage - google.de

FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox 4.0 Beta 8\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

FF - Ext: DVDVideoSoft Menu: {ACAA314B-EEBA-48e4-AD47-84E31C44796C} - %profile%\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}

FF - Ext: LG Air Sync: {00ADD29A-66F4-4f22-BCC0-4C1D29DA647B} - c:\program files\LG Electronics\LG PC Suite IV\LinkAir\{00ADD29A-66F4-4f22-BCC0-4C1D29DA647B}

.

- - - - Entfernte verwaiste Registrierungseinträge - - - -
 

HKCU-Run-EA Core - c:\program files\Electronic Arts\EADM\Core.exe
 
 

.

--------------------- Gesperrte Registrierungsschluessel ---------------------
 

[HKEY_USERS\S-1-5-21-552404527-1341641467-2576712595-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eml\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="WindowsLiveMail.Email.1"
 

[HKEY_USERS\S-1-5-21-552404527-1341641467-2576712595-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vcf\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="WindowsLiveMail.VCard.1"
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe,-101"
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]

"Enabled"=dword:00000001
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]

@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe"
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]

@Denied: (A 2) (Everyone)

@="IFlashBroker4"
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"
 

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000
 

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000
 

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

Zeit der Fertigstellung: 2011-02-20  21:34:01

ComboFix-quarantined-files.txt  2011-02-20 20:34
 

Vor Suchlauf: 10 Verzeichnis(se), 80.293.359.616 Bytes frei

Nach Suchlauf: 15 Verzeichnis(se), 79.995.555.840 Bytes frei
 

- - End Of File - - F4962A59526A6D3A9BADFCFEAD1B1A88
--- --- ---