ComboFix 10-12-08.04 - Klaus 09.12.2010 19:39:56.1.2 - x86 Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.49.1031.18.2046.978 [GMT 1:00] ausgeführt von:: c:\users\Klaus\Desktop\bleepingComputer.exe SP: Spybot - Search and Destroy *disabled* (Updated) {ED588FAF-1B8F-43B4-ACA8-8E3C85DADBE9} SP: Windows-Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46} . (((((((((((((((((((((((((((((((((((( Weitere Löschungen )))))))))))))))))))))))))))))))))))))))))))))))) . c:\program files\INSTALL.LOG c:\programdata\hpeCBC9.dll . ((((((((((((((((((((((( Dateien erstellt von 2010-11-09 bis 2010-12-09 )))))))))))))))))))))))))))))) . 2010-12-09 18:46 . 2010-12-09 18:47 -------- d-----w- c:\users\Klaus\AppData\Local\temp 2010-12-09 18:46 . 2010-12-09 18:46 -------- d-----w- c:\users\Default\AppData\Local\temp 2010-12-07 19:48 . 2010-11-10 04:33 6273872 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{89FDD0B0-7592-4F35-A3DB-9A60CA0BD38D}\mpengine.dll 2010-12-05 14:21 . 2010-12-05 14:21 -------- d-----w- c:\users\Klaus\AppData\Roaming\Malwarebytes 2010-12-05 14:20 . 2010-11-29 16:42 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2010-12-05 14:20 . 2010-12-05 14:20 -------- d-----w- c:\programdata\Malwarebytes 2010-12-05 14:20 . 2010-12-05 16:40 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware 2010-12-05 14:20 . 2010-11-29 16:42 20952 ----a-w- c:\windows\system32\drivers\mbam.sys 2010-12-05 14:17 . 2010-12-05 14:17 -------- d-----w- C:\_OTL . (((((((((((((((((((((((((((((((((((( Find3M Bericht )))))))))))))))))))))))))))))))))))))))))))))))))))))) . 2010-10-19 09:41 . 2009-10-02 18:45 222080 ------w- c:\windows\system32\MpSigStub.exe 2010-09-13 13:56 . 2010-10-13 22:53 8147456 ----a-w- c:\windows\system32\wmploc.DLL 2006-08-17 07:50 . 2007-10-13 20:50 4194304 ----a-w- c:\program files\hrpjna01.dat 2006-08-14 09:02 . 2007-10-13 20:49 12242944 ----a-w- c:\program files\Videodeluxe.exe 2006-08-04 13:23 . 2007-10-13 20:50 587249 ----a-w- c:\program files\addoninstall.exe 2006-07-17 11:30 . 2007-10-13 20:50 129024 ----a-w- c:\program files\uninstall.exe 2006-07-17 09:10 . 2007-10-13 20:50 176128 ----a-w- c:\program files\unwise.exe 2006-07-17 09:09 . 2007-10-13 20:50 81920 ----a-w- c:\program files\unwise.adf 2006-07-17 09:01 . 2007-10-13 20:50 196608 ----a-w- c:\program files\reinstall3rdParty.exe 2006-07-17 08:58 . 2007-10-13 20:50 184320 ----a-w- c:\program files\instslct.exe 2006-06-28 08:55 . 2007-10-13 20:50 315392 ----a-w- c:\program files\eModeUpgradeDlg.dll 2006-05-19 08:54 . 2007-10-13 20:49 1740800 ----a-w- c:\program files\DVDMaker.dll 2006-04-28 08:12 . 2007-10-13 20:49 65536 ----a-w- c:\program files\MxHelpParser.dll 2006-04-28 05:05 . 2007-10-13 20:49 499712 ----a-w- c:\program files\MXTLC.dll 2006-04-26 06:08 . 2007-10-13 20:49 90112 ----a-w- c:\program files\MagixOFA-ger.dll 2006-04-26 06:07 . 2007-10-13 20:49 704512 ----a-w- c:\program files\MagixOFA.dll 2006-04-04 18:55 . 2007-10-13 20:49 256000 ----a-w- c:\program files\mdabase.dll 2006-03-30 15:13 . 2007-10-13 20:49 106496 ----a-w- c:\program files\RemoveWaggle.dll 2006-02-14 13:03 . 2007-10-13 20:50 24576 ----a-w- c:\program files\Validation.exe 2006-01-19 09:19 . 2007-10-13 20:49 69632 ----a-w- c:\program files\Trayserver.exe 2006-01-18 14:00 . 2007-10-13 20:49 139264 ----a-w- c:\program files\EPG.dll 2005-12-13 16:18 . 2007-10-13 20:49 442368 ----a-w- c:\program files\MFL.dll 2005-08-15 15:30 . 2007-10-13 20:49 237568 ----a-w- c:\program files\MxAutoUpdate.dll 2005-03-09 14:17 . 2007-10-13 20:50 34304 ----a-w- c:\program files\CDBurnProfiler.exe 2004-08-17 15:11 . 2007-10-13 20:49 460800 ----a-w- c:\program files\DynDVDMenu.dll 2004-04-15 13:48 . 2007-10-13 20:50 32768 ----a-w- c:\program files\MagixUpdater.exe 2003-04-03 10:09 . 2007-10-13 20:49 49152 ----a-w- c:\program files\CPUINF32.DLL 2003-02-12 09:20 . 2007-10-13 20:49 28672 ----a-w- c:\program files\explore.exe 2002-12-11 09:58 . 2007-10-13 20:49 60416 ----a-w- c:\program files\DSETUP.dll 2002-09-12 08:40 . 2007-10-13 20:49 181248 ----a-w- c:\program files\Lfpng13n.dll 2002-09-12 08:39 . 2007-10-13 20:49 392704 ----a-w- c:\program files\LFCMP13n.DLL 2002-09-12 08:39 . 2007-10-13 20:49 126464 ----a-w- c:\program files\LFTIF13N.DLL 2002-09-12 08:37 . 2007-10-13 20:49 55296 ----a-w- c:\program files\LFPSD13N.DLL 2002-09-12 08:37 . 2007-10-13 20:49 31232 ----a-w- c:\program files\LFPNM13n.dll 2002-09-12 08:37 . 2007-10-13 20:49 24576 ----a-w- c:\program files\LFTGA13N.DLL 2002-09-12 08:37 . 2007-10-13 20:49 20480 ----a-w- c:\program files\LFRAS13N.DLL 2002-09-12 08:36 . 2007-10-13 20:49 26112 ----a-w- c:\program files\LFPCX13N.DLL 2002-09-12 08:36 . 2007-10-13 20:49 19968 ----a-w- c:\program files\LFPCD13N.DLL 2002-09-12 08:36 . 2007-10-13 20:49 18944 ----a-w- c:\program files\LFMSP13N.DLL 2002-09-12 08:36 . 2007-10-13 20:49 30208 ----a-w- c:\program files\LFBMP13N.DLL 2002-09-12 08:36 . 2007-10-13 20:49 73216 ----a-w- c:\program files\LFFAX13N.DLL 2002-09-12 08:36 . 2007-10-13 20:49 445952 ----a-w- c:\program files\LTIMG13N.DLL 2002-09-12 08:36 . 2007-10-13 20:49 205312 ----a-w- c:\program files\LTEFX13N.DLL 2002-09-12 08:36 . 2007-10-13 20:49 139264 ----a-w- c:\program files\LTFIL13N.DLL 2002-09-12 08:36 . 2007-10-13 20:49 265728 ----a-w- c:\program files\LTDIS13n.dll 2002-09-12 08:35 . 2007-10-13 20:49 445440 ----a-w- c:\program files\LTKRN13N.DLL 2002-09-11 10:26 . 2007-10-13 20:49 1684992 ----a-w- c:\program files\LTCLR13n.dll 2001-11-16 17:50 . 2007-10-13 20:49 35840 ----a-w- c:\program files\lfgif13n.dll 2001-09-05 15:23 . 2007-10-13 20:49 55808 ----a-w- c:\program files\MP3UTIL.DLL 2001-05-23 10:03 . 2007-10-13 20:50 372808 ----a-w- c:\program files\VstConfig.exe 2000-04-11 14:53 . 2007-10-13 20:49 90112 ----a-w- c:\program files\DAC37.DLL 1999-12-10 11:00 . 2007-10-13 20:50 431376 ----a-w- c:\program files\riched20.dll 1999-02-09 09:46 . 2007-10-13 20:49 137728 ----a-w- c:\program files\IJL10.DLL 1998-11-05 15:07 . 2007-10-13 20:49 102400 ----a-w- c:\program files\Rn5b3260.dll 1997-12-22 00:30 . 2007-10-13 20:49 94208 ----a-w- c:\program files\UNZDLL.DLL 2008-09-26 23:36 . 2008-09-26 23:36 122880 ----a-w- c:\program files\mozilla firefox\components\GoogleDesktopMozilla.dll . (((((((((((((((((((((((((((( Autostartpunkte der Registrierung )))))))))))))))))))))))))))))))))))))))) . . *Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-18 125952] "WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-18 202240] "SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "RoxWatchTray"="c:\program files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe" [2006-11-05 221184] "LXBTCATS"="c:\windows\system32\spool\DRIVERS\W32X86\3\LXBTtime.dll" [2007-02-22 73728] "Windows Mobile Device Center"="c:\windows\WindowsMobile\wmdc.exe" [2007-05-31 648072] "AVP"="c:\program files\Kaspersky Lab\Kaspersky Internet Security 2011\avp.exe" [2010-09-26 352976] c:\users\Klaus\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ OneNote Inhaltsverzeichnis.onetoc2 [2008-7-1 3656] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "EnableUIADesktopToggle"= 0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=c:\progra~1\Google\GOOGLE~1\GoogleDesktopNetwork3.dll c:\progra~1\Google\GOOGLE~1\GoogleDesktopNetwork3.dll c:\progra~1\KASPER~2\KASPER~3\mzvkbd3.dll c:\progra~1\KASPER~2\KASPER~3\kloehk.dll [HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Adobe Reader - Schnellstart.lnk] backup=c:\windows\pss\Adobe Reader - Schnellstart.lnk.CommonStartup backupExtension=.CommonStartup path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Reader - Schnellstart.lnk [HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Digital Line Detect.lnk] path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Digital Line Detect.lnk backup=c:\windows\pss\Digital Line Detect.lnk.CommonStartup backupExtension=.CommonStartup [HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^FRITZ!DSL Startcenter.lnk] path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\FRITZ!DSL Startcenter.lnk backup=c:\windows\pss\FRITZ!DSL Startcenter.lnk.CommonStartup backupExtension=.CommonStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM] 2010-06-09 08:06 976832 ----a-w- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher] 2010-06-20 02:04 35760 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AppleSyncNotifier] 2009-08-13 13:51 177440 ----a-w- c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DellSupport] 2007-03-15 11:09 460784 ----a-w- c:\program files\DellSupport\DSAgnt.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ECenter] 2007-03-16 10:50 17920 ----a-w- c:\dell\E-Center\EULALauncher.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ehTray.exe] 2008-01-18 21:33 125952 ----a-w- c:\windows\ehome\ehtray.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FreePDF Assistant] 2008-07-22 21:44 357376 ----a-w- c:\program files\FreePDF_XP\fpassist.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Desktop Search] 2008-09-26 23:36 29744 ----a-w- c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InCD] 2004-06-04 11:33 1400944 ----a-w- c:\program files\Ahead\InCD\InCD.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler] 2006-10-03 10:37 81920 ----a-w- c:\program files\Common Files\InstallShield\UpdateService\issch.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] 2009-09-21 14:36 305440 ----a-w- c:\program files\iTunes\iTunesHelper.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LexwareInfoService] 2008-11-03 12:21 339240 ----a-w- c:\program files\Common Files\Lexware\Update Manager\LxUpdateManager.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LXBTCATS] 2007-02-22 03:46 73728 ----a-w- c:\windows\System32\spool\drivers\w32x86\3\lxbttime.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MultiScreen] 2008-06-30 08:41 114688 ----a-w- c:\program files\MultiScreen\MultiScreen.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] 2009-09-04 23:54 417792 ----a-w- c:\program files\QuickTime\QTTask.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl] 2004-11-02 18:24 32768 ----a-w- c:\program files\PowerDVD\PDVDServ.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RoxioDragToDisc] 2006-08-17 08:00 1116920 ----a-w- c:\program files\Roxio\Drag-to-Disc\DrgToDsc.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RoxWatchTray] 2006-11-05 10:22 221184 ----a-w- c:\program files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RtHDVCpl] 2007-03-15 13:32 4390912 ----a-w- c:\windows\RtHDVCpl.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sony Ericsson PC Suite] 2009-09-24 13:41 434176 ----a-w- c:\program files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StartCCC] 2006-11-10 11:35 90112 ----a-w- c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] 2007-09-24 23:11 132496 ----a-w- c:\program files\Java\jre1.6.0_03\bin\jusched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UnlockerAssistant] 2008-05-02 04:15 15872 ----a-w- c:\program files\Unlocker\UnlockerAssistant.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Mobile Device Center] 2007-05-31 07:21 648072 ----a-w- c:\windows\WindowsMobile\wmdc.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WMPNSCFG] 2008-01-18 21:33 202240 ----a-w- c:\program files\Windows Media Player\wmpnscfg.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus] "DisableMonitoring"=dword:00000001 R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384] R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-04-22 136176] R3 FXUSBASE;Arcor-Talk & Surf Box;c:\windows\system32\DRIVERS\fxusbase.sys [2003-07-15 545920] R3 HRService;Haufe iDesk-Service in c:\program files\Haufe\iDesk\iDeskService\Zope;c:\program files\Haufe\iDesk\iDeskService\iDeskService.exe [2008-08-20 70336] R3 klmouflt;Kaspersky Lab KLMOUFLT;c:\windows\system32\DRIVERS\klmouflt.sys [2009-11-02 19984] R3 s0017bus;Sony Ericsson Device 0017 driver (WDM);c:\windows\system32\DRIVERS\s0017bus.sys [2008-10-21 86824] R3 s0017mdfl;Sony Ericsson Device 0017 USB WMC Modem Filter;c:\windows\system32\DRIVERS\s0017mdfl.sys [2008-10-21 15016] R3 s0017mdm;Sony Ericsson Device 0017 USB WMC Modem Driver;c:\windows\system32\DRIVERS\s0017mdm.sys [2008-10-21 114600] R3 s0017mgmt;Sony Ericsson Device 0017 USB WMC Device Management Drivers (WDM);c:\windows\system32\DRIVERS\s0017mgmt.sys [2008-10-21 108328] R3 s0017nd5;Sony Ericsson Device 0017 USB Ethernet Emulation SEMC0017 (NDIS);c:\windows\system32\DRIVERS\s0017nd5.sys [2008-10-21 26024] R3 s0017obex;Sony Ericsson Device 0017 USB WMC OBEX Interface;c:\windows\system32\DRIVERS\s0017obex.sys [2008-10-21 104616] R3 s0017unic;Sony Ericsson Device 0017 USB Ethernet Emulation SEMC0017 (WDM);c:\windows\system32\DRIVERS\s0017unic.sys [2008-10-21 109736] R3 SCREAMINGBDRIVER;Screaming Bee Audio;c:\windows\system32\drivers\ScreamingBAudio.sys [2010-07-01 34896] R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504] R4 GoogleDesktopManager-061008-081103;Google Desktop Manager 5.7.806.10245;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [2008-09-26 29744] R4 OMSI download service;Sony Ericsson OMSI download service;c:\program files\Sony Ericsson\Sony Ericsson PC Suite\SupServ.exe [2009-04-30 90112] S1 kl2;kl2;c:\windows\system32\DRIVERS\kl2.sys [2010-06-09 11352] S1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter;c:\windows\system32\DRIVERS\klim6.sys [2010-04-22 22104] S2 AVMPORT;AVMPORT;c:\windows\System32\drivers\avmport.sys [2001-10-22 59520] S2 IGDCTRL;AVM IGD CTRL Service;c:\program files\FRITZ!DSL\IGDCTRL.EXE [2007-09-04 87344] S2 SBSDWSCService;SBSD Security Center Service;c:\program files\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368] S3 AVMCOWAN;AVMCOWAN;c:\windows\system32\DRIVERS\AVMCOWAN.sys [2003-07-15 51456] S3 seehcri;Sony Ericsson seehcri Device Driver;c:\windows\system32\DRIVERS\seehcri.sys [2008-01-09 27632] S3 VCSVADHWSer;Avnex Virtual Audio Device (WDM);c:\windows\system32\DRIVERS\vcsvad.sys [2008-12-26 17792] --- Andere Dienste/Treiber im Speicher --- *Deregistered* - klbg [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] WindowsMobile REG_MULTI_SZ wcescomm rapimgr LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache . Inhalt des "geplante Tasks" Ordners 2010-12-09 c:\windows\Tasks\Google Software Updater.job - c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-08-28 00:29] 2010-12-09 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files\Google\Update\GoogleUpdate.exe [2010-04-22 21:56] 2010-12-09 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files\Google\Update\GoogleUpdate.exe [2010-04-22 21:56] 2010-12-08 c:\windows\Tasks\User_Feed_Synchronization-{20D0F6ED-BDE1-4796-A9BA-20D3A9A3342E}.job - c:\windows\system32\msfeedssync.exe [2009-01-31 10:01] . . ------- Zusätzlicher Suchlauf ------- . uStart Page = hxxp://www.google.de/ IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200 FF - ProfilePath - c:\users\Klaus\AppData\Roaming\Mozilla\Firefox\Profiles\l0dsw7vv.default\ FF - prefs.js: browser.startup.homepage - hxxp://www.google.de FF - component: c:\program files\Mozilla Firefox\components\GoogleDesktopMozilla.dll FF - component: c:\program files\Mozilla Firefox\extensions\KavAntiBanner@Kaspersky.ru\components\abhelperxpcom.dll FF - component: c:\program files\Mozilla Firefox\extensions\linkfilter@kaspersky.ru\components\kavlinkfilter.dll FF - plugin: c:\program files\Google\Google Earth\plugin\npgeplugin.dll FF - plugin: c:\program files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll FF - plugin: c:\program files\Google\Update\1.2.183.39\npGoogleOneClick8.dll FF - plugin: c:\program files\Microsoft\Office Live\npOLW.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll FF - plugin: c:\program files\Picasa2\npPicasa2.dll FF - plugin: c:\program files\Picasa2\npPicasa3.dll FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ FF - Extension: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} FF - Extension: Java Console: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} FF - Extension: Java Console: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} FF - Extension: Modul zur Link-Untersuchung: linkfilter@kaspersky.ru - c:\program files\Mozilla Firefox\extensions\linkfilter@kaspersky.ru FF - Extension: Anti-Banner: KavAntiBanner@Kaspersky.ru - c:\program files\Mozilla Firefox\extensions\KavAntiBanner@Kaspersky.ru FF - Extension: SwitchProxy Tool: {27A2FD41-CB23-4518-AB5C-C25BAFFDE531} - c:\users\Klaus\AppData\Roaming\Mozilla\Firefox\Profiles\l0dsw7vv.default\extensions\{27A2FD41-CB23-4518-AB5C-C25BAFFDE531} FF - Extension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\users\Klaus\AppData\Roaming\Mozilla\Firefox\Profiles\l0dsw7vv.default\extensions\{20a82645-c095-46ed-80e3-08825760534b} FF - Extension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension . - - - - Entfernte verwaiste Registrierungseinträge - - - - MSConfigStartUp-NeroFilterCheck - c:\windows\system32\NeroCheck.exe MSConfigStartUp-NWEReboot - c:\program files\Ahead\Nero\Uninstall\Unnero.exe AddRemove-Redirection Port Monitor - c:\windows\system32\unredmon.exe AddRemove-SecondLifeViewer2 - d:\unser-pc\Backup 12.10 AddRemove-{87C3E969-3342-4E64-8A60-9C506CD29C75}_is1 - d:\unser-pc\Backup 08.09\BDSM Island\unins000.exe ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2010-12-09 19:47 Windows 6.0.6002 Service Pack 2 NTFS Scanne versteckte Prozesse... Scanne versteckte Autostarteinträge... HKLM\Software\Microsoft\Windows\CurrentVersion\Run LXBTCATS = rundll32 c:\windows\system32\spool\DRIVERS\W32X86\3\LXBTtime.dll,_RunDLLEntry@16??????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????? Scanne versteckte Dateien... Scan erfolgreich abgeschlossen versteckte Dateien: 0 ************************************************************************** . --------------------- Gesperrte Registrierungsschluessel --------------------- [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe,-101" [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation] "Enabled"=dword:00000001 [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32] @="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe" [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}] @Denied: (A 2) (Everyone) @="IFlashBroker4" [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" [HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . Zeit der Fertigstellung: 2010-12-09 19:49:49 ComboFix-quarantined-files.txt 2010-12-09 18:49 Vor Suchlauf: 24 Verzeichnis(se), 174.432.133.120 Bytes frei Nach Suchlauf: 28 Verzeichnis(se), 174.348.288.000 Bytes frei Current=1 Default=1 Failed=0 LastKnownGood=8 Sets=1,2,3,4,5,6,7,8 - - End Of File - - 5A2D58A578FE57257642E47CBB1C2016