Combofix Logfile:
Code:
Alles auswählen Aufklappen ATTFilter
ComboFix 12-05-02.03 - Torsten 03.05.2012 0:00.1.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.49.1031.18.3069.1892 [GMT 2:00]
ausgeführt von:: c:\users\Torsten\Downloads\ComboFix.exe
AV: F-Secure Internet Security 2011 10.50 *Disabled/Updated* {15414183-282E-D62C-CA37-EF24860A2F17}
FW: F-Secure Internet Security 2011 10.50 *Disabled* {2D7AC0A6-6241-D774-E168-461178D9686C}
SP: F-Secure Internet Security 2011 10.50 *Disabled/Updated* {AE20A067-0E14-D9A2-F087-D456FD8D65AA}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Torsten\AppData\Local\Temp\6573b3c6-4299-4ce1-bc75-7f3a9cd9d739\CliSecureRT.dll
c:\users\Torsten\Documents\~WRL0005.tmp
c:\windows\IsUn0407.exe
c:\windows\pkunzip.pif
c:\windows\pkzip.pif
c:\windows\system32\muzapp.exe
c:\windows\system32\system32
c:\windows\system32\system32\3DAudio.ax
c:\windows\system32\system32\avrt.dll
c:\windows\system32\system32\cis-2.4.dll
c:\windows\system32\system32\issacapi_bs-2.3.dll
c:\windows\system32\system32\issacapi_pe-2.3.dll
c:\windows\system32\system32\issacapi_se-2.3.dll
c:\windows\system32\system32\MACXMLProto.dll
c:\windows\system32\system32\MaDRM.dll
c:\windows\system32\system32\MaJGUILib.dll
c:\windows\system32\system32\MAMACExtract.dll
c:\windows\system32\system32\MASetupCleaner.exe
c:\windows\system32\system32\MaXMLProto.dll
c:\windows\system32\system32\mfplat.dll
c:\windows\system32\system32\MK_Lyric.dll
c:\windows\system32\system32\MSCLib.dll
c:\windows\system32\system32\MSFLib.dll
c:\windows\system32\system32\MSLUR71.dll
c:\windows\system32\system32\msvcp60.dll
c:\windows\system32\system32\MTTELECHIP.dll
c:\windows\system32\system32\MTXSYNCICON.dll
c:\windows\system32\system32\muzaf1.dll
c:\windows\system32\system32\muzapp.dll
c:\windows\system32\system32\muzapp.exe
c:\windows\system32\system32\muzdecode.ax
c:\windows\system32\system32\muzeffect.ax
c:\windows\system32\system32\muzmp4sp.ax
c:\windows\system32\system32\muzmpgsp.ax
c:\windows\system32\system32\muzoggsp.ax
c:\windows\system32\system32\muzwmts.dll
c:\windows\system32\system32\psapi.dll
.
.
((((((((((((((((((((((((((((((((((((((( Treiber/Dienste )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Service_WinDriver
.
.
((((((((((((((((((((((( Dateien erstellt von 2012-04-02 bis 2012-05-02 ))))))))))))))))))))))))))))))
.
.
2012-05-02 22:06 . 2012-05-02 22:11 -------- d-----w- c:\users\Torsten\AppData\Local\temp
2012-05-02 22:06 . 2012-05-02 22:06 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-05-02 18:27 . 2012-05-02 18:27 -------- d-----w- C:\_OTL
2012-05-01 13:36 . 2012-05-01 13:36 -------- d-----w- c:\program files\Common Files\Java
2012-05-01 13:35 . 2012-05-01 13:35 476960 ----a-w- c:\windows\system32\npdeployJava1.dll
2012-05-01 13:26 . 2012-05-01 13:26 -------- d-----w- c:\programdata\McAfee Security Scan
2012-05-01 13:26 . 2012-05-01 13:26 -------- d-----w- c:\programdata\McAfee
2012-05-01 13:26 . 2012-05-01 13:26 -------- d-----w- c:\program files\McAfee Security Scan
2012-05-01 13:26 . 2012-05-01 13:37 418464 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2012-05-01 13:15 . 2012-05-01 13:15 -------- d-----w- C:\totalcmd
2012-05-01 13:15 . 2012-05-01 13:15 -------- d-----w- c:\users\Torsten\AppData\Roaming\GHISLER
2012-05-01 13:15 . 2012-04-27 06:00 545 ----a-w- c:\windows\UC.PIF
2012-05-01 13:15 . 2012-04-27 06:00 545 ----a-w- c:\windows\RAR.PIF
2012-05-01 13:15 . 2012-04-27 06:00 545 ----a-w- c:\windows\LHA.PIF
2012-05-01 13:15 . 2012-04-27 06:00 545 ----a-w- c:\windows\ARJ.PIF
2012-05-01 12:24 . 2012-05-01 12:24 -------- d-----w- c:\program files\fahrtenbuch.de
2012-05-01 12:05 . 2012-05-01 12:05 -------- d-----w- C:\Fahrtenbuch 2009 Essential
2012-05-01 06:38 . 2012-04-13 07:36 6734704 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{F09A6A0B-3A5A-4BF8-A5E8-5514E6077005}\mpengine.dll
2012-04-24 21:15 . 2012-04-24 21:15 -------- d-----w- c:\program files\Mozilla Maintenance Service
2012-04-24 21:15 . 2012-04-24 21:15 157352 ----a-w- c:\program files\Mozilla Firefox\maintenanceservice_installer.exe
2012-04-24 21:15 . 2012-04-24 21:15 129976 ----a-w- c:\program files\Mozilla Firefox\maintenanceservice.exe
2012-04-23 19:34 . 2012-04-23 19:34 -------- d-----w- c:\program files\ESET
2012-04-23 18:41 . 2012-04-23 18:41 -------- d-----w- c:\users\Torsten\AppData\Roaming\Malwarebytes
2012-04-23 18:40 . 2012-04-23 18:40 -------- d-----w- c:\programdata\Malwarebytes
2012-04-23 18:40 . 2012-05-01 16:54 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2012-04-23 18:40 . 2012-04-04 13:56 22344 ----a-w- c:\windows\system32\drivers\mbam.sys
2012-04-22 20:50 . 2012-04-22 20:50 -------- d-----w- c:\users\Torsten\AppData\Local\Frey Software
2012-04-21 23:30 . 2012-04-22 20:50 -------- d-----w- c:\users\Torsten\AppData\Local\Frey_Software
2012-04-21 23:30 . 2012-04-21 23:30 -------- d-----w- c:\users\Torsten\AppData\Roaming\Frey Software
2012-04-21 23:22 . 2012-04-21 23:22 -------- d-----w- c:\programdata\FrMethods
2012-04-21 23:19 . 2012-04-21 23:19 -------- d-----w- c:\program files\Frey Software
2012-04-21 16:34 . 2012-04-21 16:34 -------- d-----w- c:\windows\Downloaded Installations
2012-04-19 17:17 . 2012-04-19 17:17 -------- d-----w- c:\program files\Microsoft
2012-04-11 23:41 . 2012-02-29 15:11 5120 ----a-w- c:\windows\system32\wmi.dll
2012-04-11 23:41 . 2012-02-29 15:11 172032 ----a-w- c:\windows\system32\wintrust.dll
2012-04-11 23:41 . 2012-02-29 15:09 157696 ----a-w- c:\windows\system32\imagehlp.dll
2012-04-11 23:41 . 2012-02-29 13:32 12800 ----a-w- c:\windows\system32\drivers\fs_rec.sys
2012-04-11 23:41 . 2012-03-06 06:39 3602816 ----a-w- c:\windows\system32\ntkrnlpa.exe
2012-04-11 23:41 . 2012-03-06 06:39 3550080 ----a-w- c:\windows\system32\ntoskrnl.exe
2012-04-10 17:31 . 2011-09-23 12:43 1623552 ----a-w- c:\program files\Mozilla Firefox\plugins\NpFv530.dll
2012-04-10 17:31 . 2012-04-10 17:31 715038 ----a-w- c:\windows\unins000.exe
2012-04-04 05:53 . 2012-04-04 05:53 182160 ----a-w- c:\program files\Mozilla Firefox\plugins\nppdf32.dll
2012-04-04 05:53 . 2012-04-04 05:53 182160 ----a-w- c:\program files\Internet Explorer\Plugins\nppdf32.dll
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-05-01 13:37 . 2011-09-08 15:08 70304 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-05-01 13:35 . 2010-05-31 20:00 472864 ----a-w- c:\windows\system32\deployJava1.dll
2012-02-23 08:18 . 2010-05-31 04:34 237072 ------w- c:\windows\system32\MpSigStub.exe
2012-02-15 19:37 . 2009-05-21 18:21 499712 ----a-w- c:\windows\system32\msvcp71.dll
2012-02-15 19:37 . 2009-05-21 16:57 348160 ----a-w- c:\windows\system32\msvcr71.dll
2012-02-14 15:45 . 2012-03-14 05:27 219648 ----a-w- c:\windows\system32\d3d10_1core.dll
2012-02-14 15:45 . 2012-03-14 05:27 160768 ----a-w- c:\windows\system32\d3d10_1.dll
2012-02-13 14:12 . 2012-03-14 05:27 1172480 ----a-w- c:\windows\system32\d3d10warp.dll
2012-02-13 13:47 . 2012-03-14 05:27 683008 ----a-w- c:\windows\system32\d2d1.dll
2012-02-13 13:44 . 2012-03-14 05:27 1068544 ----a-w- c:\windows\system32\DWrite.dll
2012-04-24 21:15 . 2011-09-30 17:03 97208 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952]
"KiesPDLR"="c:\program files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe" [2012-03-18 21416]
"KiesHelper"="c:\program files\Samsung\Kies\KiesHelper.exe" [2012-02-22 943504]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"F-Secure Manager"="c:\program files\F-Secure\Common\FSM32.EXE" [2011-12-23 200360]
"F-Secure TNB"="c:\program files\F-Secure\FSGUI\TNBUtil.exe" [2011-12-23 1654440]
"WPCUMI"="c:\windows\system32\WpcUmi.exe" [2006-11-02 176128]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-02-20 59240]
"KiesTrayAgent"="c:\program files\Samsung\Kies\KiesTrayAgent.exe" [2012-02-22 3508624]
"TkBellExe"="c:\program files\Real\RealPlayer\Update\realsched.exe" [2012-02-15 296056]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2011-10-24 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2012-03-06 421736]
"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-04-04 462408]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-04-04 843712]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-01-18 254696]
.
c:\users\Torsten\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OpenOffice.org 3.3.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2010-12-13 1198592]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2007-10-14 214360]
McAfee Security Scan Plus.lnk - c:\program files\McAfee Security Scan\3.0.207\SSScheduler.exe [2011-6-17 272528]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-05-01 253088]
S2 ACEDRV06;ACEDRV06;c:\windows\system32\drivers\ACEDRV06.sys [2011-01-08 99840]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-04-04 63928]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
.
Inhalt des "geplante Tasks" Ordners
.
2012-05-02 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-05-01 13:37]
.
2010-11-04 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-10-03 15:32]
.
2010-11-04 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-10-03 15:32]
.
2012-05-02 c:\windows\Tasks\Scheduled scanning task.job
- c:\progra~1\F-Secure\ANTI-V~1\fsav.exe [2010-05-30 10:00]
.
2010-12-15 c:\windows\Tasks\User_Feed_Synchronization-{3EDFA3D9-1562-4873-ADA8-334CF0195835}.job
- c:\windows\system32\msfeedssync.exe [2008-01-21 02:24]
.
2012-05-02 c:\windows\Tasks\User_Feed_Synchronization-{47ABB4EA-925E-41EE-A0C4-5EBEF7038EBF}.job
- c:\windows\system32\msfeedssync.exe [2008-01-21 02:24]
.
2012-05-02 c:\windows\Tasks\User_Feed_Synchronization-{EA7F53D4-0A73-4954-A944-6867BA99D162}.job
- c:\windows\system32\msfeedssync.exe [2008-01-21 02:24]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page =
uInternet Settings,ProxyOverride = *.local
IE: Free YouTube to Mp3 Converter - c:\users\Torsten\AppData\Roaming\DVDVideoSoftIEHelpers\youtubetomp3.htm
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html
IE: Nach Microsoft &Excel exportieren - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
LSP: c:\windows\system32\wpclsp.dll
LSP: c:\program files\F-Secure\FSPS\program\FSLSP.DLL
TCP: DhcpNameServer = 192.168.2.1
FF - ProfilePath - c:\users\Torsten\AppData\Roaming\Mozilla\Firefox\Profiles\rf4l1rup.default\
FF - prefs.js: browser.search.selectedEngine - Ixquick HTTPS - Deutsch
FF - prefs.js: browser.startup.homepage - hxxp://www.arcor.de/
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
AddRemove-01_Simmental - c:\program files\Samsung\USB Drivers\01_Simmental\Uninstall.exe
AddRemove-02_Siberian - c:\program files\Samsung\USB Drivers\02_Siberian\Uninstall.exe
AddRemove-03_Swallowtail - c:\program files\Samsung\USB Drivers\03_Swallowtail\Uninstall.exe
AddRemove-04_semseyite - c:\program files\Samsung\USB Drivers\04_semseyite\Uninstall.exe
AddRemove-05_Sloan - c:\program files\Samsung\USB Drivers\05_Sloan\Uninstall.exe
AddRemove-06_Spencer - c:\program files\Samsung\USB Drivers\06_Spencer\Uninstall.exe
AddRemove-07_Schorl - c:\program files\Samsung\USB Drivers\07_Schorl\Uninstall.exe
AddRemove-08_EMPChipset - c:\program files\Samsung\USB Drivers\08_EMPChipset\Uninstall.exe
AddRemove-09_Hsp - c:\program files\Samsung\USB Drivers\09_Hsp\Uninstall.exe
AddRemove-11_HSP_Plus_Default - c:\program files\Samsung\USB Drivers\11_HSP_Plus_Default\Uninstall.exe
AddRemove-16_Shrewsbury - c:\program files\Samsung\USB Drivers\16_Shrewsbury\Uninstall.exe
AddRemove-17_EMP_Chipset2 - c:\program files\Samsung\USB Drivers\17_EMP_Chipset2\Uninstall.exe
AddRemove-18_Zinia_Serial_Driver - c:\program files\Samsung\USB Drivers\18_Zinia_Serial_Driver\Uninstall.exe
AddRemove-19_VIA_driver - c:\program files\Samsung\USB Drivers\19_VIA_driver\Uninstall.exe
AddRemove-20_NXP_Driver - c:\program files\Samsung\USB Drivers\20_NXP_Driver\Uninstall.exe
AddRemove-22_WiBro_WiMAX - c:\program files\Samsung\USB Drivers\22_WiBro_WiMAX\Uninstall.exe
AddRemove-24_flashusbdriver - c:\program files\Samsung\USB Drivers\24_flashusbdriver\Uninstall.exe
AddRemove-25_escape - c:\program files\Samsung\USB Drivers\25_escape\Uninstall.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2012-05-03 00:11
Windows 6.0.6002 Service Pack 2 NTFS
.
Scanne versteckte Prozesse...
.
Scanne versteckte Autostarteinträge...
.
Scanne versteckte Dateien...
.
Scan erfolgreich abgeschlossen
versteckte Dateien: 0
.
**************************************************************************
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\S-1-5-21-2580248882-1228754705-3639742418-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*j*z* \OpenWithList]
@Class="Shell"
.
[HKEY_USERS\S-1-5-21-2580248882-1228754705-3639742418-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*ü*l* \OpenWithList]
@Class="Shell"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------
.
- - - - - - - > 'Explorer.exe'(5676)
c:\program files\F-Secure\Spam Control\fsscoepl.dll
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\windows\system32\nvvsvc.exe
c:\windows\system32\nvvsvc.exe
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\F-Secure\Anti-Virus\fsgk32st.exe
c:\program files\F-Secure\Anti-Virus\FSGK32.EXE
c:\program files\F-Secure\Common\FSMA32.EXE
c:\program files\F-Secure\Common\FSHDLL32.EXE
c:\windows\system32\WUDFHost.exe
c:\program files\F-Secure\Anti-Virus\fssm32.exe
c:\windows\System32\rundll32.exe
c:\program files\F-Secure\ORSP Client\fsorsp.exe
c:\program files\F-Secure\FWES\Program\fsdfwd.exe
c:\windows\system32\conime.exe
c:\program files\F-Secure\Anti-Virus\fsav32.exe
c:\windows\ehome\ehmsas.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\program files\iPod\bin\iPodService.exe
c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe
c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2012-05-03 00:16:57 - PC wurde neu gestartet
ComboFix-quarantined-files.txt 2012-05-02 22:16
.
Vor Suchlauf: 17 Verzeichnis(se), 525.637.353.472 Bytes frei
Nach Suchlauf: 23 Verzeichnis(se), 525.978.996.736 Bytes frei
.
- - End Of File - - 1293B0ED88C7F65954DFA9DE44B57AB0
--- --- ---
02.05.2012, 23:25
Baum-Darstellung