Malwarebyte entdeckt Worm.AutoRun in NginuL_na.exe

#16 So hier erstmal die ComboFix Log:


ComboFix 09-07-23.02 - Jaws 24.07.2009 18:28.3.2 - NTFSx86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.49.1031.18.3066.1940 [GMT 2:00]
ausgeführt von:: c:\users\Jaws\Desktop\ComboFix.exe
SP: Lavasoft Ad-Watch Live! *disabled* (Updated) {67844DAE-4F77-4D69-9457-98E8CFFDAA22}
SP: Spybot - Search and Destroy *disabled* (Updated) {ED588FAF-1B8F-43B4-ACA8-8E3C85DADBE9}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.

(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\$recycle.bin\S-1-5-21-414578808-886828620-155863911-500
c:\windows\Installer\12654b.msi
c:\windows\Installer\1408ea1.msi
c:\windows\Installer\1408ea5.msi
c:\windows\Installer\26604.msi

.
((((((((((((((((((((((( Dateien erstellt von 2009-06-24 bis 2009-07-24 ))))))))))))))))))))))))))))))
.

2009-07-24 16:34 . 2009-07-24 16:34 -------- d-----w- c:\users\Jaws Sicher\AppData\Local\temp
2009-07-23 06:37 . 2009-07-24 16:18 11904 ----a-w- c:\windows\system32\drivers\hitmanpro35.sys
2009-07-23 06:36 . 2009-07-23 06:48 -------- d-----w- c:\programdata\Hitman Pro
2009-07-23 06:36 . 2009-07-23 06:36 -------- d-----w- c:\program files\Hitman Pro 3.5
2009-07-22 16:46 . 2009-07-22 16:46 -------- d-----w- C:\rsit
2009-07-21 18:43 . 2009-07-21 18:43 -------- d-----w- c:\users\Jaws\DoctorWeb
2009-07-21 17:27 . 2009-07-21 17:27 -------- d-----w- c:\program files\iPod
2009-07-21 17:27 . 2009-07-21 17:27 -------- d-----w- c:\program files\iTunes
2009-07-21 17:17 . 2009-07-21 17:17 75040 ----a-w- c:\programdata\Apple Computer\Installer Cache\iTunes 8.2.1.6\SetupAdmin.exe
2009-07-20 17:46 . 2009-07-22 16:46 -------- d-----w- c:\program files\HiJack
2009-07-17 16:16 . 2009-07-17 16:16 -------- d-----w- c:\program files\MSXML 4.0
2009-07-15 16:43 . 2009-06-15 14:53 156672 ----a-w- c:\windows\system32\t2embed.dll
2009-07-15 16:43 . 2009-06-15 14:52 23552 ----a-w- c:\windows\system32\lpk.dll
2009-07-15 16:43 . 2009-06-15 14:52 72704 ----a-w- c:\windows\system32\fontsub.dll
2009-07-15 16:43 . 2009-06-15 12:42 289792 ----a-w- c:\windows\system32\atmfd.dll
2009-07-15 16:42 . 2009-06-15 14:51 10240 ----a-w- c:\windows\system32\dciman32.dll
2009-06-28 10:18 . 2009-06-28 10:18 -------- d-----w- c:\users\Jaws\AppData\Roaming\InstallShield
2009-06-28 10:17 . 2009-06-28 10:17 -------- d-----w- c:\program files\Secunia
2009-06-28 10:02 . 2009-06-28 10:02 -------- d-----w- c:\program files\Windows Live SkyDrive
2009-06-28 10:02 . 2009-06-28 10:02 -------- d-----w- c:\program files\Windows Live
2009-06-28 10:02 . 2006-11-29 11:06 3426072 ----a-w- c:\windows\system32\d3dx9_32.dll
2009-06-28 10:01 . 2009-06-28 10:01 -------- d-----w- c:\program files\Microsoft SQL Server Compact Edition
2009-06-27 18:44 . 2009-07-09 18:11 -------- d-----w- c:\users\Jaws\AppData\Roaming\skypePM
2009-06-27 18:43 . 2009-07-09 18:25 -------- d-----w- c:\users\Jaws\AppData\Roaming\Skype
2009-06-27 18:43 . 2009-06-27 18:43 -------- d-----w- c:\program files\Common Files\Skype
2009-06-27 18:43 . 2009-06-27 18:43 -------- d-----r- c:\program files\Skype
2009-06-27 18:43 . 2009-06-27 18:43 -------- d-----w- c:\programdata\Skype
2009-06-27 16:20 . 2009-06-27 16:20 -------- d-----w- c:\users\Jaws\AppData\Roaming\VistaCodecs
2009-06-27 16:20 . 2009-06-27 16:20 -------- d-----w- c:\program files\VistaCodecPack

.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-07-24 16:17 . 2008-11-20 11:57 618442 ----a-w- c:\windows\system32\perfh007.dat
2009-07-24 16:17 . 2008-11-20 11:57 122842 ----a-w- c:\windows\system32\perfc007.dat
2009-07-23 19:59 . 2009-03-30 18:17 -------- d-----w- c:\users\Jaws\AppData\Roaming\dvdcss
2009-07-23 19:31 . 2009-03-09 22:35 1 ----a-w- c:\users\Jaws\AppData\Roaming\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
2009-07-23 19:28 . 2009-03-04 12:03 -------- d-----w- c:\programdata\Spybot - Search & Destroy
2009-07-23 19:06 . 2009-03-05 13:32 -------- d-----w- c:\programdata\Google Updater
2009-07-23 18:07 . 2009-03-04 13:11 -------- d-----w- c:\program files\Spyware Doctor
2009-07-23 17:50 . 2009-03-05 13:45 93608 ----a-w- c:\programdata\nvModes.dat
2009-07-23 06:23 . 2009-03-20 12:30 -------- d-----w- c:\program files\Microsoft Silverlight
2009-07-21 17:27 . 2009-03-08 13:04 -------- d-----w- c:\program files\Common Files\Apple
2009-07-19 10:00 . 2009-03-15 10:19 -------- d-----w- c:\program files\a-squared Free
2009-07-19 09:48 . 2009-03-05 13:45 7592 ----a-w- c:\users\Jaws\AppData\Local\d3d9caps.dat
2009-07-17 16:18 . 2009-03-15 14:05 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-07-17 15:47 . 2009-05-15 16:41 3775176 ----a-w- c:\programdata\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
2009-07-15 18:03 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail
2009-07-13 11:36 . 2009-03-15 14:05 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-07-13 11:36 . 2009-03-15 14:05 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-07-09 21:12 . 2009-05-25 18:05 -------- d-----w- c:\program files\Buyertools Reminder
2009-07-08 16:28 . 2009-03-05 13:58 -------- d-----w- c:\users\Jaws\AppData\Roaming\Winamp
2009-07-07 17:25 . 2009-06-17 15:08 1630560 ----a-w- c:\programdata\Lavasoft\Ad-Aware\Update\Resources.dll
2009-07-07 17:17 . 2009-03-05 13:58 -------- d-----w- c:\program files\Winamp
2009-07-06 17:25 . 2009-06-17 15:08 25440 ----a-w- c:\programdata\Lavasoft\Ad-Aware\Update\savapibridge.dll
2009-07-06 17:25 . 2009-06-17 15:08 2353480 ----a-w- c:\programdata\Lavasoft\Ad-Aware\Update\Ad-Aware.exe
2009-07-03 17:19 . 2009-07-03 17:19 0 ---ha-w- c:\windows\system32\drivers\Msft_User_WpdMtpDr_01_00_00.Wdf
2009-06-28 10:19 . 2008-11-20 03:34 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-06-28 10:03 . 2009-06-20 13:28 -------- d-----w- c:\program files\Microsoft
2009-06-27 18:44 . 2009-06-27 18:44 56 ---ha-w- c:\programdata\ezsidmv.dat
2009-06-27 16:20 . 2009-03-22 11:41 -------- d-----w- c:\programdata\VistaCodecs
2009-06-25 19:41 . 2009-03-04 13:14 -------- d-----w- c:\program files\PC Tools Firewall Plus
2009-06-20 13:23 . 2009-06-20 13:23 -------- d-----w- c:\program files\Common Files\Windows Live
2009-06-17 12:20 . 2008-12-10 14:17 12648 ----a-w- c:\windows\system32\drivers\psi_mf.sys
2009-06-15 21:39 . 2009-06-15 21:39 1035264 ----a-w- c:\windows\system32\VSFilter.dll
2009-06-11 11:42 . 2008-11-20 03:57 -------- d-----w- c:\programdata\Microsoft Help
2009-06-11 11:41 . 2008-11-20 03:59 -------- d-----w- c:\program files\Microsoft Works
2009-06-09 17:53 . 2009-06-09 17:53 -------- d-----w- c:\program files\QuickTime
2009-06-07 20:30 . 2008-11-20 04:07 36864 ----a-w- c:\programdata\Temp\{2637C347-9DAD-11D6-9EA2-00055D0CA761}\PostBuild.exe
2009-06-07 15:49 . 2009-06-07 11:03 -------- d-----w- c:\users\Jaws\AppData\Roaming\Any Video Converter
2009-06-07 11:24 . 2009-06-07 11:03 -------- d-----w- c:\program files\Any Video Converter
2009-06-07 11:11 . 2009-06-07 11:09 -------- d-----w- c:\users\Jaws\AppData\Roaming\Any Video Converter Professional
2009-06-07 11:11 . 2009-06-07 11:09 -------- d-----w- c:\program files\Any Video Converter Professional
2009-06-07 10:06 . 2009-03-04 11:40 74672 ----a-w- c:\users\Jaws\AppData\Local\GDIPFONTCACHEV1.DAT
2009-06-06 10:11 . 2009-03-08 13:26 -------- d-----w- c:\program files\OpenOffice.org 3
2009-06-06 10:03 . 2009-06-06 10:03 -------- d-----w- c:\program files\JRE
2009-06-05 18:06 . 2009-06-05 18:06 -------- d-----w- c:\program files\ConvertHelper
2009-06-01 11:44 . 2009-01-20 10:52 -------- d-----w- c:\programdata\NVIDIA
2009-06-01 11:36 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Calendar
2009-06-01 11:36 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Sidebar
2009-06-01 11:36 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Journal
2009-06-01 11:36 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Collaboration
2009-06-01 11:35 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Photo Gallery
2009-06-01 11:35 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Defender
2009-06-01 11:34 . 2006-11-02 10:25 665600 ----a-w- c:\windows\inf\drvindex.dat
2009-06-01 11:19 . 2006-11-02 12:37 37665 ----a-w- c:\windows\Fonts\GlobalUserInterface.CompositeFont
2009-05-29 14:52 . 2009-05-29 14:52 204800 ----a-w- c:\windows\system32\xvidvfw.dll
2009-05-29 14:47 . 2009-05-29 14:47 881664 ----a-w- c:\windows\system32\xvidcore.dll
2009-05-29 03:11 . 2009-05-29 03:11 85504 ----a-w- c:\windows\system32\ff_vfw.dll
2009-05-27 16:47 . 2009-05-27 16:47 15688 ----a-w- c:\programdata\Lavasoft\Ad-Aware\Update\lsdelete.exe
2009-05-27 16:36 . 2009-03-04 11:39 -------- d-----w- c:\program files\Google
2009-05-09 05:50 . 2009-06-11 03:48 915456 ----a-w- c:\windows\system32\wininet.dll
2009-05-09 05:34 . 2009-06-11 03:48 71680 ----a-w- c:\windows\system32\iesetup.dll
2009-05-08 23:14 . 2008-06-09 12:12 1418120 ----a-w- c:\windows\system32\wdfcoinstaller01005.dll
2009-05-08 23:14 . 2009-05-08 23:14 14736 ----a-w- c:\windows\system32\drivers\nuidfltr.sys
2009-05-01 18:30 . 2009-05-01 18:30 3366912 ----a-w- c:\windows\system32\GPhotos.scr
2009-04-28 15:52 . 2009-03-18 21:11 96104 ----a-w- c:\windows\system32\drivers\avipbb.sys
2009-04-28 15:52 . 2009-03-18 21:11 55640 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2009-07-24 16:15 . 2009-03-04 12:10 134648 ----a-w- c:\program files\mozilla firefox\components\brwsrcmp.dll
2006-05-03 10:06 . 2009-03-08 13:39 163328 --sh--r- c:\windows\System32\flvDX.dll
2007-02-21 11:47 . 2009-03-08 13:39 31232 --sh--r- c:\windows\System32\msfDX.dll
2008-03-16 13:30 . 2009-03-08 13:39 216064 --sh--r- c:\windows\System32\nbDX.dll
2009-03-14 22:31 . 2009-03-14 18:02 5438752 --sha-w- c:\windows\System32\drivers\fidbox.dat
.

(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP]
@="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}"
[HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}]
2008-07-29 16:52 121392 ----a-w- c:\program files\Acer\Empowering Technology\eDataSecurity\x86\PSDProtect.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RocketDock"="c:\program files\RocketDock\RocketDock.exe" [2007-09-02 495616]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-03-04 68856]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-04-25 1049896]
"BkupTray"="c:\program files\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe" [2008-04-25 28672]
"ArcadeDeluxeAgent"="c:\program files\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe" [2008-10-08 147456]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-11-22 13601312]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-11-22 92704]
"PLFSetI"="c:\windows\PLFSetI.exe" [2007-10-23 200704]
"LManager"="c:\progra~1\LAUNCH~1\LManager.exe" [2008-12-17 858632]
"ePower_DMC"="c:\program files\Acer\Empowering Technology\ePower\ePower_DMC.exe" [2008-11-28 417792]
"eDataSecurity Loader"="c:\program files\Acer\Empowering Technology\eDataSecurity\x86\eDSloader.exe" [2008-07-29 526896]
"eAudio"="c:\program files\Acer\Empowering Technology\eAudio\eAudio.exe" [2008-09-11 544768]
"PlayMovie"="c:\program files\Acer Arcade Deluxe\PlayMovie\PMVService.exe" [2008-10-17 167936]
"Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2009-03-04 24064]
"00PCTFW"="c:\program files\PC Tools Firewall Plus\FirewallGUI.exe" [2009-02-23 2652056]
"IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2008-06-10 1406024]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-29 148888]
"CLMLServer"="c:\program files\Acer Arcade Deluxe\Acer Arcade Deluxe\Kernel\CLML\CLMLSvc.exe" [2009-03-18 173352]
"Ad-Watch"="c:\program files\Lavasoft\Ad-Aware\AAWTray.exe" [2009-06-29 520024]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-05-26 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-07-13 292128]
"RtHDVCpl"="RtHDVCpl.exe" - c:\windows\RtHDVCpl.exe [2008-09-19 6294048]
"Skytel"="Skytel.exe" - c:\windows\SkyTel.exe [2008-09-19 1833504]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2009-3-12 110592]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\progra~1\Google\GOOGLE~1\GoogleDesktopNetwork3.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"VistaSp2"=hex(b):d4,e7,f2,bc,ad,e2,c9,01

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{A77DB892-D6B4-4FD7-BBAD-2901843261C6}"= UDP:c:\program files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe:SchedulerSvc.exe
"{2CC80CE2-5955-4C72-9152-A5BE4EBC4F79}"= UDP:c:\program files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe:AgentSvc.exe
"{5C6E19D7-D66F-4527-8874-F4A29E302BC6}"= TCP:c:\program files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe:SchedulerSvc.exe
"{152688F3-1D21-40C5-AF86-D38B85855A15}"= UDP:c:\program files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe:BackupSvc.exe
"{8ED7A5E9-400F-4476-933B-CF8DCA042A09}"= TCP:c:\program files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe:AgentSvc.exe
"{44484ABD-DD77-408B-8C79-E689A99E38CF}"= TCP:c:\program files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe:BackupSvc.exe
"{4D9140AE-A55D-4D42-8CC2-3F0E74E0DA6B}"= c:\program files\Cyberlink\PowerDirector\PDR.EXE:CyberLink PowerDirector
"{2EC0276E-F33B-42D4-9EF9-22AFC158B5C2}"= UDP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{F866B6BD-DCB3-46C5-AEFF-F06CB60C36CC}"= TCP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{2E1F91A0-8794-4023-BA7A-C7D75B6B537B}"= c:\program files\Acer Arcade Deluxe\Acer Arcade Deluxe\Acer Arcade Deluxe.exe:Acer Arcade Deluxe
"{29B4204A-EA44-4E0F-B0E3-F26CABF681EA}"= c:\program files\Acer Arcade Deluxe\HomeMedia\HomeMedia.exe:Acer HomeMedia
"{70A1AF16-484E-486C-8CCB-B941D1056A53}"= c:\program files\Acer Arcade Deluxe\PlayMovie\PlayMovie.exe:Acer Play Movie
"{B50A50AB-720E-4776-8424-0FE2858018DC}"= c:\program files\Acer Arcade Deluxe\PlayMovie\PMVService.exe:Acer Play Movie Resident Program
"TCP Query User{18E6AF33-F482-4C0A-BC84-F06C8F588DA9}c:\\program files\\java\\jre6\\bin\\javaw.exe"= UDP:c:\program files\java\jre6\bin\javaw.exe:Java(TM) Platform SE binary
"UDP Query User{2BEE58C6-FFB9-4C33-9B47-779F012BBBF3}c:\\program files\\java\\jre6\\bin\\javaw.exe"= TCP:c:\program files\java\jre6\bin\javaw.exe:Java(TM) Platform SE binary
"{21282FFF-8641-4FBF-A0F7-8F18F7BB9AFE}"= UDP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{5FA60B2D-DAAF-482E-8526-01B43BD24943}"= TCP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{AC124CA6-6CF5-47BC-AE3A-EF073AEEE9F4}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{BD96911B-9ED3-42B1-8CE8-04B50C5C6113}"= c:\program files\Windows Live\Sync\WindowsLiveSync.exe:Windows Live Sync
"{AB02047F-708F-4AB4-91E2-BD2EFB21555B}"= UDP:c:\program files\iTunes\iTunes.exe:iTunes
"{FBF42FD4-61E4-473A-9407-7647BC5C3234}"= TCP:c:\program files\iTunes\iTunes.exe:iTunes

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List]
"c:\\Users\\Jaws\\AppData\\Local\\Temp\\RarSFX0\\StsInstall.exe"= c:\users\Jaws\AppData\Local\Temp\RarSFX0\StsInstall.exe:*:Enabled:StsInstall
"c:\\Program Files\\Eurowin\\MaxTax Starter\\MAXTAX.exe"= c:\program files\Eurowin\MaxTax Starter\MAXTAX.exe:*:Enabled:MAXTAX
"c:\\Program Files\\Eurowin\\MaxTax Starter\\STMAXTAX.exe"= c:\program files\Eurowin\MaxTax Starter\STMAXTAX.exe:*:Enabled:STMAXTAX
"c:\\Program Files\\Eurowin\\MaxTax Starter\\EPUpdate.exe"= c:\program files\Eurowin\MaxTax Starter\EPUpdate.exe:*:Enabled:EPUpdate

R0 Lbd;Lbd;c:\windows\System32\drivers\Lbd.sys [22.04.2009 18:26 64160]
R0 PCTCore;PCTools KDS;c:\windows\System32\drivers\PCTCore.sys [04.03.2009 15:12 130936]
R1 pctgntdi;pctgntdi;c:\windows\System32\drivers\pctgntdi.sys [04.03.2009 15:12 159600]
R2 AntiVirSchedulerService;Avira AntiVir Planer;c:\program files\Avira\AntiVir Desktop\sched.exe [18.03.2009 23:11 108289]
R2 BUNAgentSvc;NTI Backup Now 5 Agent Service;c:\program files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe [03.03.2008 14:11 16384]
R2 CLHNService;CLHNService;c:\program files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\CLHNService.exe [20.11.2008 06:08 69632]
R2 ETService;Empowering Technology Service;c:\program files\Acer\Empowering Technology\Service\ETService.exe [20.11.2008 06:06 24576]
R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\McAfee\SiteAdvisor\McSACore.exe [22.03.2009 11:09 210216]
R2 NTIBackupSvc;NTI Backup Now 5 Backup Service;c:\program files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe [25.04.2008 22:36 45056]
R2 NTISchedulerSvc;NTI Backup Now 5 Scheduler Service;c:\program files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe [25.04.2008 22:36 131072]
R2 PCTAppEvent;PCTAppEvent Driver;c:\windows\System32\drivers\PCTAppEvent.sys [04.03.2009 15:12 73840]
R2 SBSDWSCService;SBSD Security Center Service;c:\program files\Spybot - Search & Destroy\SDWinSec.exe [04.03.2009 14:04 1153368]
R2 wlidsvc;Windows Live ID Sign-in Assistant;c:\program files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE [30.03.2009 16:28 1533808]
R3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\System32\drivers\b57nd60x.sys [26.06.2008 02:39 212992]
R3 hidshim;Service for HID-KMDF Shim layer;c:\windows\System32\drivers\hidshim.sys [08.10.2008 11:43 5632]
R3 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [18.01.2009 23:34 1029456]
R3 NETw5v32;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;c:\windows\System32\drivers\NETw5v32.sys [17.11.2008 07:40 3668480]
R3 nuvotonhidgeneric;Nuvoton EC Generic HID;c:\windows\System32\drivers\nuvotonhidgeneric.sys [08.10.2008 11:43 22528]
R3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\System32\drivers\nvhda32v.sys [20.01.2009 21:35 45600]
S2 gupdate1c99d96f2f1fc10;Google Update Service (gupdate1c99d96f2f1fc10);c:\program files\Google\Update\GoogleUpdate.exe [05.03.2009 15:33 133104]
S3 getPlus(R) Helper;getPlus(R) Helper;c:\program files\NOS\bin\getPlus_HelperSvc.exe [08.03.2009 17:47 33752]
S3 GoogleDesktopManager-080708-050100;Google Desktop Manager 5.7.808.7150;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [04.03.2009 13:39 24064]
S3 pctplfw;pctplfw;c:\windows\System32\drivers\pctplfw.sys [04.03.2009 15:14 95640]
S3 PSI;PSI;c:\windows\System32\drivers\psi_mf.sys [10.12.2008 16:17 12648]
S3 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [04.03.2009 15:11 348752]

--- Andere Dienste/Treiber im Speicher ---

*Deregistered* - mchInjDrv

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\System32\rundll32.exe" "c:\windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Inhalt des "geplante Tasks" Ordners

2009-07-18 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-01-18 18:26]

2009-07-24 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-03-04 17:29]

2009-07-24 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-03-05 13:33]

2009-07-24 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-03-05 13:33]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.google.de/
mStart Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&s=2&o=vp32&d=0109&m=aspire_8730
uInternet Settings,ProxyOverride = *.local
IE: &Preispiratensuche nach markiertem Text - c:\\Program Files\\Preispiraten6\\preispiraten.html
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
IE: {{27914077-B4D6-4A0E-9763-76B6E9DD9A81} - c:\program files\Buyertools Reminder\ReminderIE.exe
IE: {{9E029088-432F-4EBF-9537-0171A4C37870} - http://webtip.ch/cgi-bin/amz_track/tracker_de.pl?loc=main&site=home
IE: {{E79005A3-0F92-434B-9F7B-51131FC7168F} - http://www.preispiraten.de/e/tr_ebdestart.pl?http://www.ebay.de
IE: {{FA9B9510-9FCB-4ca0-818C-5D0987B47C4D} - c:\program files\PokerStars.NET\PokerStarsUpdate.exe
Trusted Zone: secunia.com\psi
DPF: {72376E32-8AF2-473F-BE32-E5D0F39C865D} - hxxp://docs.cyberlink.com/acer/update/prog/UpdateAdvisorV2.cab
FF - ProfilePath - c:\users\Jaws\AppData\Roaming\Mozilla\Firefox\Profiles\0caqrp3j.default\
FF - prefs.js: browser.search.selectedEngine - Wikipedia (de)
FF - prefs.js: browser.startup.homepage - hxxp://www.google.de/ig?t=0
FF - component: c:\program files\McAfee\SiteAdvisor\components\McFFPlg.dll
FF - component: c:\program files\Mozilla Firefox\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\components\NPComponent.dll
FF - plugin: c:\program files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll
FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll
FF - plugin: c:\program files\Google\Update\1.2.183.7\npGoogleOneClick8.dll
FF - plugin: c:\program files\Microsoft\Office Live\npOLW.dll
FF - plugin: c:\program files\VistaCodecPack\rm\browser\plugins\nppl3260.dll
FF - plugin: c:\program files\VistaCodecPack\rm\browser\plugins\nprpjplug.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.

**************************************************************************
Scanne versteckte Prozesse...

Scanne versteckte Autostarteinträge...

Scanne versteckte Dateien...

Scan erfolgreich abgeschlossen
versteckte Dateien:

**************************************************************************
.
--------------------- Gesperrte Registrierungsschluessel ---------------------

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Zeit der Fertigstellung: 2009-07-24 18:36
ComboFix-quarantined-files.txt 2009-07-24 16:36

Vor Suchlauf: 12 Verzeichnis(se), 81.122.705.408 Bytes frei
Nach Suchlauf: 11 Verzeichnis(se), 81.074.896.896 Bytes frei

298 --- E O F --- 2009-07-24 04:11




Der Scan mit der Superantispyware hat nix gefunden.

Wünsche schonmal ein schönes Wochenende.

Jürgen

#17 >>
Combofix entfernen:
Windows Taste + R drücken
Kopiere rein: Combofix /U - klicke "OK"
(oder, wenn es nicht funktioniert: C:\QooBox löschen)

>>
mache einen Onlinescan mit eset + poste den report
http://virus-protect.org/artikel/tools/eset-nod.html

>>
Noch Probleme?

Gruss Swiss

#18 Also der Online-Scan bricht bei 34% ab, leider. Egal ob mit IE oder Firefox ausgeführt. Malware meldet immernoch der Worm.AutoRun in der entsprechenden Datei

#19 Hast du eine exteren Festplatte oder eine USB Stick angeschlossen?

>>
Lade Dir Registry Search by Bobbi Flekman

und doppelklicken, um zu starten.
in das Feld: "Enter search strings" (reinschreiben oder reinkopieren)

NginuL

in edit und klicke "Ok".
Notepad wird sich öffnen -- kopiere den Text ab und poste ihn.

>>
Agentransack
laden + klicke: Suche.exe

kopiere in Suche:
NginuL

Klicke: Suchen

um sie abkopieren zu können , klicke oben links auf: "Datei" und dann auf "Speicher Ergebnisse... "

klicke auf "Speicher"

und poste alles, was erscheint

Gruss Swiss

#20 Registry Search log:

Windows Registry Editor Version 5.00

; Registry Search 2.0 by Bobbi Flekman © 2005
; Version: 2.0.6.0

; Results at 24.07.2009 23:58:54 for strings:
; 'nginul'
; Strings excluded from search:
; (None)
; Search in:
; Registry Keys Registry Values Registry Data
; HKEY_LOCAL_MACHINE HKEY_USERS
; End Of The Log...

Agentransack findet nix, somit ist die gespeicherte Datei leer.
Die externe Festplatte ist seit Wochen nicht angeschlossen. Kein USB Stick. Die interne Festplatte ist aud c:\ und d:\ aufgeteilt
Danke

Jürgen

#21 Es gibt bei YouTube ein Video leider slecht zu sehen was er da macht

YouTube Video (Link)

Poste Videos durch einfaches einfügen von Youtube / Vimeo Links in den Beiträgen!

__________
MfG Argus

#22 Das Video hab ich auch schon gefunden, jedoch repariert er dabei garnichts sondern stellt ads Problem dar.
Mit Malwarebytes wird der Worm gefunden, empfohlen wird ein Reboot wobei der Wurm entfernt werden soll. Dies geschiet aber nicht, den beim nächsten Scan mit Malwarebytes ist der Wurm immernoch zu finden. Der Ordner Favorites ist nur ein Verknüpfungsordner ohne Inhalt(oder existiert garnicht). Wenn man diesen einzeln scannt wird (von Malwarebytes) nix gefunden. Soweit zum Inhalt des Videos und zu meinem Problem.


Jürgen

Nachtrag: habe gerade diese Seite gefunden:
http://www.malwarebytes.org/forums/index.php?showtopic=19837

Vielleicht habe ich ja doch Glück! :-)

#23 Scanne nochmal mit MBAM und klicke am Ende auf Ingnorieren

Zitat

Please ignore this detection is this appears to be a mbam read error on Vista

Ist also ein Fehler von MBAM

Zitat

This will be fixed in the future

__________
MfG Argus