ComboFix 11-10-21.06 - Ich 23.10.2011 13:17:22.1.2 - x86
Microsoft® Windows Vista™ Ultimate 6.0.6002.2.1252.49.1033.18.3069.1813 [GMT 2:00]
ausgeführt von:: c:\users\Ich\Downloads\ComboFix.exe
AV: Avira Desktop *Enabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
SP: Avira Desktop *Enabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\33218296.exe
c:\programdata\egoNuSIECuXAXgI.exe
C:\Recycle.Bin
c:\recycle.bin\config.bin
c:\users\Ich\AppData\Roaming\1&1
c:\users\Ich\AppData\Roaming\1&1\1&1 EasyLogin\customer.xml
c:\users\Ich\AppData\Roaming\1&1\1&1 EasyLogin\EasyLogin.log
c:\users\Ich\AppData\Roaming\1&1\1&1 EasyLogin\update\EasyLogin_setup_DE.exe
c:\users\Ich\AppData\Roaming\Microsoft\Windows\Sta rt Menu\Internet Explorer.lnk
c:\users\Ich\Desktop\Windows Vista Recovery.lnk
c:\windows\Fonts\Eurosymb.TTF
c:\windows\IsUn0407.exe
.
.
((((((((((((((((((((((( Dateien erstellt von 2011-09-23 bis 2011-10-23 ))))))))))))))))))))))))))))))
.
.
2011-10-23 11:23 . 2011-10-23 11:23 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-10-23 10:57 . 2011-10-23 10:57 56200 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{AE159C83-A8CB-40CC-B5E5-D60DB8609060}\offreg.dll
2011-10-23 10:34 . 2011-10-23 10:34 -------- d--h--w- c:\users\Ich\AppData\Roaming\Avira
2011-10-23 10:32 . 2011-10-11 13:00 74640 ---ha-w- c:\windows\system32\drivers\avgntflt.sys
2011-10-23 10:32 . 2011-10-11 13:00 36000 ---ha-w- c:\windows\system32\drivers\avkmgr.sys
2011-10-23 10:32 . 2011-10-11 13:00 134344 ---ha-w- c:\windows\system32\drivers\avipbb.sys
2011-10-23 10:32 . 2011-10-23 10:32 -------- d--h--w- c:\programdata\Avira
2011-10-23 10:32 . 2011-10-23 10:32 -------- d-----w- c:\program files\Avira
2011-10-23 10:13 . 2011-10-23 10:13 -------- d-----w- c:\program files\CCleaner
2011-10-23 09:14 . 2011-10-18 00:28 6668624 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{AE159C83-A8CB-40CC-B5E5-D60DB8609060}\mpengine.dll
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht )))))))))))))))))))))))))))))))))))))))))))))))))) ))))
.
2011-05-22 13:41 . 2011-04-04 07:35 142296 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]
"ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\I SUSPM.exe" [2005-02-16 221184]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
"FreePDF Assistant"="c:\program files\FreePDF_XP\fpassist.exe" [2007-06-26 312320]
"NvSvc"="c:\windows\system32\nvsvc.dll" [2008-01-04 86016]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-01-04 8530464]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2005-02-16 81920]
"CanonSolutionMenu"="c:\program files\Canon\SolutionMenu\CNSLMAIN.exe" [2008-03-11 689488]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2007-08-01 1282048]
"Easy-PrintToolBox"="c:\program files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE" [2006-10-17 398944]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-10-29 249064]
"AVMWlanClient"="c:\program files\avmwlanstick\wlangui.exe" [2010-10-22 2105344]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2011-10-11 258512]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Monitor Apache Servers.lnk - c:\program files\Apache Software Foundation\Apache2.2\bin\ApacheMonitor.exe [2008-12-10 41042]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\curr entversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Wind ows^Start Menu^Programs^Startup^LaunchU3.exe.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\LaunchU3.exe.lnk
backup=c:\windows\pss\LaunchU3.exe.lnk.CommonStart up
backupExtension=.CommonStartup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2008-10-14 23:04 39792 ----a-w- c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CanonMyPrinter]
2008-03-18 01:06 1848648 ----a-w- c:\program files\Canon\MyPrinter\BJMYPRT.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
2008-02-28 15:07 1828136 ----a-w- c:\program files\Common Files\Nero\Lib\NMIndexStoreSvr.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NBKeyScan]
2008-02-18 14:29 2221352 ----a-w- c:\program files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
2008-01-04 09:18 81920 ----a-w- c:\windows\System32\nvmctray.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Packard Bell Data Secure]
2006-06-20 13:15 2361856 ---ha-w- c:\program files\Packard Bell Data Secure\PBDataSecure.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2010-11-29 16:38 421888 ----a-w- c:\program files\QuickTime\QTTask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2010-10-29 12:49 249064 ----a-w- c:\program files\Common Files\Java\Java Update\jusched.exe
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\ v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2011-10-23 136176]
R3 avmeject;AVM Eject;c:\windows\system32\drivers\avmeject.sys [2010-10-22 4352]
R3 ewusbnet;HUAWEI USB-NDIS miniport;c:\windows\system32\DRIVERS\ewusbnet.sys [x]
R3 fwlanusbn;FRITZ!WLAN N;c:\windows\system32\DRIVERS\fwlanusbn.sys [2010-10-22 586752]
R3 gupdatem;Google Update-Dienst (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2011-10-23 136176]
R3 hasplms;HASP License Manager;c:\windows\system32\hasplms.exe -run [x]
R3 hwusbdev;Huawei DataCard USB PNP Device;c:\windows\system32\DRIVERS\ewusbdev.sys [x]
R3 massfilter;ZTE Mass Storage Filter Driver;c:\windows\system32\DRIVERS\massfilter.sys [2009-06-30 9216]
R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30 319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
R3 ZTEusbnet;ZTE USB-NDIS miniport;c:\windows\system32\DRIVERS\ZTEusbnet.sys [2009-08-18 114688]
R3 ZTEusbvoice;ZTE VoUSB Port;c:\windows\system32\DRIVERS\ZTEusbvoice.sys [2009-08-18 105088]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.s ys [2011-10-11 36000]
S2 AntiVirSchedulerService;Avira Planer;c:\program files\Avira\AntiVir Desktop\sched.exe [2011-10-11 86224]
S2 Apache2.2;Apache2.2;c:\program files\Apache Software Foundation\Apache2.2\bin\httpd.exe [2008-12-09 24636]
S3 b57nd60x;%SvcDispName%;c:\windows\system32\DRIVERS \b57nd60x.sys [2008-01-19 179712]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7070D8E0-650A-46b3-B03C-9497582E6A74}]
2008-04-11 15:23 38400 ----a-w- c:\windows\System32\SoundSchemes.exe
.
Inhalt des "geplante Tasks" Ordners
.
2011-10-23 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-10-23 10:12]
.
2011-10-23 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-10-23 10:12]
.
2011-05-23 c:\windows\Tasks\Packard Bell Data Secure for Ich.job
- c:\program files\Packard Bell Data Secure\DSMsg.exe [2006-04-13 12:50]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.blickwinkel-media.de/
uInternet Settings,ProxyOverride = *.local
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_E117 12C84EA7E12B.dll/cmsidewiki.html
IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.178.1
FF - ProfilePath - c:\users\Ich\AppData\Roaming\Mozilla\Firefox\Profi les\vwywh8ye.default\
FF - user.
js: network.cookie.cookieBehavior - 0
FF - user.
js: privacy.clearOnShutdown.cookies - false
FF - user.
js: security.warn_viewing_mixed - false
FF - user.
js: security.warn_viewing_mixed.show_once - false
FF - user.
js: security.warn_submit_insecure - false
FF - user.
js: security.warn_submit_insecure.show_once - false
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
HKCU-Run-Treeadv - c:\users\Ich\AppData\Roaming\D3dtab\dvdtwain.exe
MSConfigStartUp-iTunesHelper - c:\program files\iTunes\iTunesHelper.exe
MSConfigStartUp-swg - c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNo tifier.exe
MSConfigStartUp-Treeadv - c:\users\Ich\AppData\Roaming\D3dtab\dvdtwain.exe
MSConfigStartUp-{A1924F4B-DF07-01ED-2034-057C112E9881} - c:\users\Ich\AppData\Roaming\Nuguo\gihag.exe
MSConfigStartUp-{AF471ACB-F98E-4EA3-B5BB-732373F55ADF} - c:\users\Ich\AppData\Roaming\Mocu\yhfeu.exe
MSConfigStartUp-{B1F1965D-547B-7315-073C-D01FBE2BDBAE} - c:\users\Ich\AppData\Roaming\Oksanu\syuh.exe
AddRemove-Digital Image Recovery_is1 - c:\programme\Digital Image Recovery\unins000.exe
AddRemove-Redirection Port Monitor - c:\windows\system32\unredmon.exe
.
.
.
************************************************** ************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
GMER - Rootkit Detector and Remover
Rootkit scan 2011-10-23 13:23
Windows 6.0.6002 Service Pack 2 NTFS
.
Scanne versteckte Prozesse...
.
Scanne versteckte Autostarteinträge...
.
Scanne versteckte Dateien...
.
Scan erfolgreich abgeschlossen
versteckte Dateien: 0
.
************************************************** ************************
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Cl ass\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Zeit der Fertigstellung: 2011-10-23 13:28:22
ComboFix-quarantined-files.txt 2011-10-23 11:28
.
Vor Suchlauf: 6 Verzeichnis(se), 437.290.405.888 Bytes frei
Nach Suchlauf: 20 Verzeichnis(se), 437.299.650.560 Bytes frei
.
- - End Of File - - 98E9A003FCE18EB649F915D2E691B0E0
pc performance & stability analysis report 
Linear-Darstellung
