Hallo Combofiy hat mir folgende Datei ausgespuckt:
ComboFix 08-10-08.02 - USER 2008-10-09 10:36:05.1 - NTFSx86
Running from: C:\Documents and Settings\USER\Desktop\ComboFix.exe
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\WINDOWS\IE4 Error Log.txt
C:\WINDOWS\jestertb.dll
C:\WINDOWS\msettings.ini
C:\WINDOWS\system32\conf.dat
C:\WINDOWS\system32\csqkgpho.dll
C:\WINDOWS\system32\gfeOYcfe.ini
C:\WINDOWS\system32\gfeOYcfe.ini2
C:\WINDOWS\system32\hhpebhqq.ini
C:\WINDOWS\system32\kofnaxok.ini
C:\WINDOWS\system32\ohpgkqsc.ini
C:\WINDOWS\system32\qqhbephh.dll
C:\WINDOWS\system32\tuwwayxx.ini
C:\WINDOWS\system32\tuwwayxx.ini2
C:\WINDOWS\system32\xxyATKDT.dll
C:\WINDOWS\system32\xxyawwut.dll
.
((((((((((((((((((((((((( Files Created from 2008-09-09 to 2008-10-09 )))))))))))))))))))))))))))))))
.
2008-10-08 15:27 . 2008-10-08 15:27 <DIR> d-------- C:\Program Files\uTorrent
2008-10-08 15:27 . 2008-10-08 15:34 <DIR> d-------- C:\Documents and Settings\USER\Application Data\uTorrent
2008-09-30 09:40 . 2008-09-30 09:49 <DIR> d-------- C:\WINDOWS\system32\CatRoot_bak
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-10-09 08:41 --------- d-----w C:\Program Files\Steam
2008-10-08 20:27 --------- d-----w C:\Program Files\Spybot - Search & Destroy
2008-10-08 13:34 --------- d-----w C:\Program Files\Common Files\Adobe
2008-10-02 09:35 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-09-25 05:56 --------- d-----w C:\Program Files\ICQ6
2008-09-25 05:56 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-01-05 12:23 32 ----a-w C:\Documents and Settings\All Users\Application Data\ezsid.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"igndlm.exe"="C:\Program Files\Download Manager\DLM.exe" [2007-03-05 1103480]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-09-16 1833296]
"Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2007-12-12 21686568]
"Steam"="C:\Program Files\Steam\Steam.exe" [2008-10-08 1410296]
"ICQ"="C:\Program Files\ICQ6\ICQ.exe" [2008-09-01 173304]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe" [2006-09-25 90112]
"RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2003-12-08 32768]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2004-02-12 49152]
"HP Component Manager"="C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" [2004-05-12 241664]
"avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-07-17 266497]
"RTHDCPL"="RTHDCPL.EXE" [2006-08-01 C:\WINDOWS\RTHDCPL.exe]
"SkyTel"="SkyTel.EXE" [2006-05-16 C:\WINDOWS\SkyTel.exe]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2006-02-28 15360]
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Reader - Schnellstart.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 29696]
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2004-05-28 241664]
HP Image Zone Fast Start.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe [2004-05-28 53248]
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\NVIDIA Corporation\\NetworkAccessManager\\Apache Group\\Apache2\\bin\\Apache.exe"=
"C:\\Program Files\\ICQ6\\ICQ.exe"=
"C:\\Anciens disques\\Old D\\World of Warcraft\\BackgroundDownloader.exe"=
"C:\\Spiele\\CoH\\RelicCOH.exe"=
"C:\\Spiele\\Flagship Studios\\Hellgate London\\Launcher.exe"=
"C:\\Spiele\\Neverwinter Nights 2\\nwn2main.exe"=
"C:\\Spiele\\Neverwinter Nights 2\\nwn2main_amdxp.exe"=
"C:\\Spiele\\Neverwinter Nights 2\\nwupdate.exe"=
"C:\\Spiele\\Neverwinter Nights 2\\nwn2server.exe"=
"C:\\Spiele\\Sins of a Solar Empire\\Sins of a Solar Empire.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=
"C:\\Spiele\\Firaxis Games\\Sid Meier's Civilization IV Colonization\\Colonization.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3724:TCP"= 3724:TCP:Blizzard Downloader: 3724
"3389:TCP"= 3389:TCP
xpsp2res.dll,-22009
R2 ACEDRV09;ACEDRV09;C:\WINDOWS\system32\drivers\ACEDRV09.sys [2007-09-12 110304]
S3 gAGP440p;gAGP440p;C:\DOCUME~1\USER\LOCALS~1\Temp\gAGP440p.sys [ ]
.
- - - - ORPHANS REMOVED - - - -
BHO-{00F53620-736E-4AE9-9A38-BB79D731D36A} - C:\WINDOWS\system32\xxyATKDT.dll
BHO-{5E723E65-D9E3-4489-8865-6BFEAE5ACD0F} - C:\WINDOWS\system32\xxyawwut.dll
BHO-{669CFA6D-450B-4d88-A9D7-D2371E845370} - (no file)
BHO-{85589B5D-D53D-4237-A677-46B82EA275F3} - (no file)
BHO-{9D6720FE-C9C7-46D9-ABDE-48B5238207BD} - (no file)
BHO-{B4763E05-B989-4C9E-8D8A-7EC8241BFF1D} - C:\WINDOWS\system32\efcYOefg.dll
ShellExecuteHooks-{00F53620-736E-4AE9-9A38-BB79D731D36A} - C:\WINDOWS\system32\xxyATKDT.dll
Notify-xxyATKDT - (no file)
.
------- Supplementary Scan -------
.
FireFox -: Profile - C:\Documents and Settings\USER\Application Data\Mozilla\Firefox\Profiles\98fmg7ee.default\
FireFox -: prefs.js - STARTUP.HOMEPAGE - about:blank
FF -: plugin - C:\Program Files\Adobe\Acrobat 7.0\Reader\browser\nppdf32.dll
FF -: plugin - C:\Program Files\Download Manager\npfpdlm.dll
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.net
Rootkit scan 2008-10-09 10:41:44
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\WINDOWS\system32\ati2evxx.exe
C:\WINDOWS\system32\ati2evxx.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\Apache.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\Apache.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
.
**************************************************************************
.
Completion time: 2008-10-09 10:45:40 - machine was rebooted
ComboFix-quarantined-files.txt 2008-10-09 08:45:37
Pre-Run: 144.042.205.184 bytes free
Post-Run: 149,479,288,832 bytes free
134 --- E O F --- 2008-09-12 23:30:04
