Trojaner-Board - Computer startet nicht nach Entfernung von Windows Recovery Virus

hi,

hab Ccleaner und cofi entsprechend der anleitung durchgeführt.

Inzwischen ist auch nichts mehr unsichtbar, obwohl ich ja unhide noch nicht ausgeführt hatte.

grüße
Code:
ComboFix 11-04-17.03 - xxxxxxx 18.04.2011  22:30:00.1.2 - x86

Microsoft Windows XP Professional  5.1.2600.3.1252.49.1033.18.3327.2920 [GMT 2:00]

ausgeführt von:: c:\documents and settings\xxxxxxx\Desktop\cofi.exe

.

.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

c:\documents and settings\All Users\Application Data\hpe7E.dll

c:\documents and settings\All Users\Application Data\hpeDA.dll

c:\documents and settings\xxxxxxx\Application Data\Adobe\plugs

c:\documents and settings\xxxxxxx\Application Data\Adobe\shed

.

.

(((((((((((((((((((((((   Dateien erstellt von 2011-03-18 bis 2011-04-18  ))))))))))))))))))))))))))))))

.

.

2011-04-18 19:24 . 2011-04-18 19:24        --------        d-----w-        C:\_OTL

2011-04-18 16:44 . 2011-04-17 22:38        53760        ----a-w-        c:\windows\system32\drivers\volsnap.sys

2011-04-15 23:30 . 2011-04-15 23:30        --------        d-----w-        c:\documents and settings\xxxxxxx\Application Data\Malwarebytes

2011-04-15 23:29 . 2010-12-20 16:09        38224        ----a-w-        c:\windows\system32\drivers\mbamswissarmy.sys

2011-04-15 23:29 . 2011-04-15 23:29        --------        d-----w-        c:\documents and settings\All Users\Application Data\Malwarebytes

2011-04-15 23:29 . 2011-04-15 23:29        --------        d-----w-        c:\program files\Malwarebytes' Anti-Malware

2011-04-15 23:29 . 2010-12-20 16:08        20952        ----a-w-        c:\windows\system32\drivers\mbam.sys

2011-04-10 13:27 . 2011-04-10 13:29        --------        d-----w-        c:\program files\Inkscape

2011-04-08 11:10 . 2011-04-10 13:30        --------        d--h--w-        c:\documents and settings\xxxxxxx\Application Data\inkscape

2011-03-27 12:38 . 2011-03-27 12:38        781272        ----a-w-        c:\program files\Mozilla Firefox\mozsqlite3.dll

2011-03-27 12:38 . 2011-03-27 12:38        1874904        ----a-w-        c:\program files\Mozilla Firefox\mozjs.dll

2011-03-27 12:38 . 2011-03-27 12:38        728024        ----a-w-        c:\program files\Mozilla Firefox\libGLESv2.dll

2011-03-27 12:38 . 2011-03-27 12:38        1893336        ----a-w-        c:\program files\Mozilla Firefox\d3dx9_42.dll

2011-03-27 12:38 . 2011-03-27 12:38        15832        ----a-w-        c:\program files\Mozilla Firefox\mozalloc.dll

2011-03-27 12:38 . 2011-03-27 12:38        142296        ----a-w-        c:\program files\Mozilla Firefox\libEGL.dll

2011-03-27 12:38 . 2011-03-27 12:38        142296        ----a-w-        c:\program files\Mozilla Firefox\components\browsercomps.dll

2011-03-27 12:38 . 2011-03-27 12:38        1975768        ----a-w-        c:\program files\Mozilla Firefox\D3DCompiler_42.dll

.

.

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2011-03-07 05:33 . 2009-12-29 18:05        692736        ----a-w-        c:\windows\system32\inetcomm.dll

2011-03-04 06:37 . 2002-06-25 19:30        420864        ----a-w-        c:\windows\system32\vbscript.dll

2011-03-03 13:21 . 2002-06-25 19:32        1857920        ----a-w-        c:\windows\system32\win32k.sys

2011-02-27 20:00 . 2010-07-03 19:46        138664        ----a-w-        c:\windows\system32\drivers\PnkBstrK.sys

2011-02-27 20:00 . 2010-07-03 19:46        214864        ----a-w-        c:\windows\system32\PnkBstrB.exe

2011-02-27 20:00 . 2010-07-03 19:46        214864        ----a-w-        c:\windows\system32\PnkBstrB.xtr

2011-02-22 23:06 . 2002-06-25 19:11        43520        ----a-w-        c:\windows\system32\licmgr10.dll

2011-02-22 23:06 . 2002-06-25 19:08        1469440        ------w-        c:\windows\system32\inetcpl.cpl

2011-02-22 23:06 . 2002-03-05 07:56        916480        ----a-w-        c:\windows\system32\wininet.dll

2011-02-22 11:41 . 2004-08-04 05:59        385024        ----a-w-        c:\windows\system32\html.iec

2011-02-17 13:18 . 2002-06-25 19:14        455936        ----a-w-        c:\windows\system32\drivers\mrxsmb.sys

2011-02-17 13:18 . 2002-06-25 19:27        357888        ----a-w-        c:\windows\system32\drivers\srv.sys

2011-02-17 12:32 . 2009-12-29 19:05        5120        ----a-w-        c:\windows\system32\xpsp4res.dll

2011-02-15 12:56 . 2002-06-25 18:59        290432        ----a-w-        c:\windows\system32\atmfd.dll

2011-02-09 13:53 . 2004-08-04 07:56        270848        ------w-        c:\windows\system32\sbe.dll

2011-02-09 13:53 . 2004-08-04 07:56        186880        ------w-        c:\windows\system32\encdec.dll

2011-02-08 13:33 . 2002-06-25 19:13        974848        ----a-w-        c:\windows\system32\mfc42u.dll

2011-02-08 13:33 . 2002-06-25 19:13        978944        ----a-w-        c:\windows\system32\mfc42.dll

2011-02-02 07:58 . 2009-12-29 18:03        2067456        ----a-w-        c:\windows\system32\mstscax.dll

2011-01-27 11:57 . 2009-12-29 18:03        677888        ----a-w-        c:\windows\system32\mstsc.exe

2011-01-21 14:44 . 2002-06-25 19:25        439296        ----a-w-        c:\windows\system32\shimgvw.dll

2011-03-27 12:38 . 2011-03-27 12:38        142296        ----a-w-        c:\program files\mozilla firefox\components\browsercomps.dll

.

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"AdobeUpdater"="c:\program files\Common Files\Adobe\Updater5\AdobeUpdater.exe" [2010-11-22 2356088]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"RTHDCPL"="RTHDCPL.EXE" [2007-05-10 16342528]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-03-27 13684736]

"nwiz"="nwiz.exe" [2009-03-27 1657376]

"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-03-27 86016]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-10-03 35696]

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-21 932288]

"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-12 161328]

"Acrobat Assistant 8.0"="c:\program files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe" [2006-10-22 620152]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]

"AvgUninstallURL"="start http:" [X]

.

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360]

.

c:\documents and settings\All Users\Start Menu\Programs\Startup\

Adobe Acrobat - Schnellstart.lnk - c:\windows\Installer\{AC76BA86-1033-F400-7760-000000000003}\_SC_Acrobat.exe [2010-11-22 295606]

Adobe Reader Synchronizer.lnk - c:\program files\Adobe\Acrobat 8.0\Acrobat\AdobeCollabSync.exe [2006-10-23 734872]

Skyr@cer Configuration Utility.lnk - c:\program files\Skyr@cer Utility\WLANMON.exe [2009-12-29 393216]

Windows Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [2008-5-26 123904]

.

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]

"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-24 304128]

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

@="Driver"

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EA Core]

2007-04-17 05:59        2887680        ----a-w-        c:\program files\Electronic Arts\EA Link\Core.exe

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Program Files\\Java\\jre6\\bin\\javaw.exe"=

"c:\\Program Files\\Java\\jre6\\bin\\java.exe"=

"c:\\Program Files\\Sony Ericsson\\Update Service\\Update Service.exe"=

"c:\\spiele\\BattleForge\\Bootstrapper.exe"=

"c:\\spiele\\BattleForge\\BattleForge.exe"=

"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=

"c:\\spiele\\Steam\\Steam.exe"=

"c:\\spiele\\AoE III\\age3.exe"=

"c:\\spiele\\Battlefield 2142\\BF2142.exe"=

"c:\\spiele\\StarCraft II\\StarCraft II.exe"=

"c:\\spiele\\StarCraft II\\Versions\\Base15405\\SC2.exe"=

"c:\\spiele\\Battlefield\\BF2.exe"=

"c:\\spiele\\World of Warcraft\\Launcher.exe"=

"c:\\spiele\\World of Warcraft\\WoW-3.2.0-deDE-downloader.exe"=

"c:\\spiele\\World of Warcraft\\Blizzard Downloader.exe"=

"c:\\Program Files\\WS_FTP\\WS_FTP95.exe"=

"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"3724:TCP"= 3724:TCP:Blizzard Downloader: 3724

.

R2 SampleScanner;USB-Flachbettscanner;c:\windows\system32\drivers\ArtecGT.sys [21.06.2010 19:16 18120]

R3 seehcri;Sony Ericsson seehcri Device Driver;c:\windows\system32\drivers\seehcri.sys [13.01.2010 13:52 27632]

S2 OMSI download service;Sony Ericsson OMSI download service;c:\program files\Sony Ericsson\Sony Ericsson PC Suite\SupServ.exe [14.01.2010 14:27 90112]

S3 ggflt;SEMC USB Flash Driver Filter;c:\windows\system32\drivers\ggflt.sys [14.01.2010 14:36 13224]

S3 massfilter;ZTE Mass Storage Filter Driver;c:\windows\system32\drivers\massfilter.sys --> c:\windows\system32\drivers\massfilter.sys [?]

S3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des -service --> c:\windows\system32\GameMon.des -service [?]

S3 s1029bus;Sony Ericsson Device 1029 driver (WDM);c:\windows\system32\drivers\s1029bus.sys [13.01.2010 13:45 90280]

S3 s1029mdfl;Sony Ericsson Device 1029 USB WMC Modem Filter;c:\windows\system32\drivers\s1029mdfl.sys [13.01.2010 13:45 15016]

S3 s1029mdm;Sony Ericsson Device 1029 USB WMC Modem Driver;c:\windows\system32\drivers\s1029mdm.sys [13.01.2010 13:45 122280]

S3 s1029mgmt;Sony Ericsson Device 1029 USB WMC Device Management Drivers (WDM);c:\windows\system32\drivers\s1029mgmt.sys [13.01.2010 13:45 115880]

S3 s1029nd5;Sony Ericsson Device 1029 USB Ethernet Emulation (NDIS);c:\windows\system32\drivers\s1029nd5.sys [13.01.2010 13:45 26024]

S3 s1029obex;Sony Ericsson Device 1029 USB WMC OBEX Interface;c:\windows\system32\drivers\s1029obex.sys [13.01.2010 13:45 111912]

S3 s1029unic;Sony Ericsson Device 1029 USB Ethernet Emulation (WDM);c:\windows\system32\drivers\s1029unic.sys [13.01.2010 13:45 116904]

S3 SetupNTGLM7X;SetupNTGLM7X;\??\d:\ntglm7x.sys --> d:\NTGLM7X.sys [?]

.

.

------- Zusätzlicher Suchlauf -------

.

uStart Page = hxxp://www.google.de/

IE: An vorhandenes PDF anfügen - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

IE: Ausgewählte Verknüpfungen in Adobe PDF konvertieren - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html

IE: Ausgewählte Verknüpfungen in vorhandene PDF-Datei konvertieren - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html

IE: Auswahl in Adobe PDF konvertieren - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

IE: Auswahl in vorhandene PDF-Datei konvertieren - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

IE: Free YouTube to MP3 Converter - c:\documents and settings\xxxxxxx\Application Data\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm

IE: In Adobe PDF konvertieren - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000

IE: Verknüpfungsziel in Adobe PDF konvertieren - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

IE: Verknüpfungsziel in vorhandene PDF-Datei konvertieren - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab

FF - ProfilePath - c:\documents and settings\xxxxxxx\Application Data\Mozilla\Firefox\Profiles\ux1i20jh.default\

.

- - - - Entfernte verwaiste Registrierungseinträge - - - -

.

WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)

.

.

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net

Rootkit scan 2011-04-18 22:33

Windows 5.1.2600 Service Pack 3 NTFS

.

Scanne versteckte Prozesse... 

.

Scanne versteckte Autostarteinträge... 

.

Scanne versteckte Dateien... 

.

Scan erfolgreich abgeschlossen

versteckte Dateien: 0

.

**************************************************************************

.

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\npggsvc]

"ImagePath"="c:\windows\system32\GameMon.des -service"

.

--------------------- Gesperrte Registrierungsschluessel ---------------------

.

[HKEY_USERS\S-1-5-21-1220945662-688789844-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.* m*k*v*\OpenWithList]

@Class="Shell"

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]

@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]

@Denied: (A 2) (Everyone)

@="IFlashBroker4"

.

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

Zeit der Fertigstellung: 2011-04-18  22:34:08

ComboFix-quarantined-files.txt  2011-04-18 20:34

.

Vor Suchlauf: 34.575.544.320 bytes free

Nach Suchlauf: 34.540.834.816 bytes free

.

WindowsXP-KB310994-SP2-Pro-BootDisk-DEU.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS

[operating systems]

c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

UnsupportedDebug="do not select this" /debug

multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /NoExecute=OptIn

.

- - End Of File - - 216C9FD2071BB458F8C55BFC4D45F4CE