| |
| |||||||
Log-Analyse und Auswertung: Firefox leitet auf andere Seiten um [Logfiles inside]Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
30.01.2012, 23:00
| #16 | |
| /// Winkelfunktion /// TB-Süch-Tiger™   | ![Firefox leitet auf andere Seiten um [Logfiles inside] - Standard](images/icons/icon1.gif){kind=icon} Firefox leitet auf andere Seiten um [Logfiles inside] Dann bitte jetzt CF ausführen: ComboFix Ein Leitfaden und Tutorium zur Nutzung von ComboFix
Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat! Solltest du nach der Ausführung von Combofix Probleme beim Starten von Anwendungen haben und Meldungen erhalten wie Zitat:
__________________ Logfiles bitte immer in CODE-Tags posten  |
|
02.02.2012, 15:21
| #17 |
 | Firefox leitet auf andere Seiten um [Logfiles inside]Code:
ATTFilter ComboFix 12-01-30.02 - Alex 02.02.2012 14:48:40.3.2 - x64
Microsoft Windows 7 Ultimate 6.1.7601.1.1252.49.1031.18.4061.2588 [GMT 1:00]
ausgeführt von:: c:\users\Alex\Desktop\ComboFix.exe
AV: AntiVir Desktop *Disabled/Updated* {090F9C29-64CE-6C6F-379C-5901B49A85B7}
SP: AntiVir Desktop *Disabled/Updated* {B26E7DCD-42F4-63E1-0D2C-6273CF1DCF0A}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Alex\AppData\Local\Mozilla\Firefox\firefox.exe
C:\WinLogon
c:\winlogon\D61660BF391C2B1
.
.
((((((((((((((((((((((( Dateien erstellt von 2012-01-02 bis 2012-02-02 ))))))))))))))))))))))))))))))
.
.
2012-02-02 14:11 . 2012-02-02 14:11 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-02-01 00:08 . 2012-01-06 05:15 8602168 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{093CE9F6-C89B-4114-AF35-56ED1F7F514F}\mpengine.dll
2012-01-31 16:23 . 2012-01-31 16:23 -------- d-----w- c:\program files\iPod
2012-01-31 16:23 . 2012-01-31 16:24 -------- d-----w- c:\program files\iTunes
2012-01-31 16:23 . 2012-01-31 16:24 -------- d-----w- c:\program files (x86)\iTunes
2012-01-31 16:14 . 2012-01-31 16:14 159744 ----a-w- c:\program files (x86)\Mozilla Firefox\plugins\npqtplugin7.dll
2012-01-31 16:14 . 2012-01-31 16:14 159744 ----a-w- c:\program files (x86)\Mozilla Firefox\plugins\npqtplugin6.dll
2012-01-31 16:14 . 2012-01-31 16:14 159744 ----a-w- c:\program files (x86)\Mozilla Firefox\plugins\npqtplugin5.dll
2012-01-31 16:14 . 2012-01-31 16:14 159744 ----a-w- c:\program files (x86)\Mozilla Firefox\plugins\npqtplugin4.dll
2012-01-31 16:14 . 2012-01-31 16:14 159744 ----a-w- c:\program files (x86)\Mozilla Firefox\plugins\npqtplugin3.dll
2012-01-31 16:14 . 2012-01-31 16:14 159744 ----a-w- c:\program files (x86)\Mozilla Firefox\plugins\npqtplugin2.dll
2012-01-31 16:14 . 2012-01-31 16:14 159744 ----a-w- c:\program files (x86)\Mozilla Firefox\plugins\npqtplugin.dll
2012-01-30 21:49 . 2012-01-30 21:49 -------- d-----w- C:\TDSSKiller_Quarantine
2012-01-30 20:47 . 2012-01-30 20:47 -------- d-----w- C:\_OTL
2012-01-30 13:35 . 2012-01-30 13:35 -------- d-----w- c:\program files (x86)\ESET
2012-01-27 11:41 . 2012-01-27 11:41 -------- d-----w- c:\users\Alex\AppData\Roaming\Malwarebytes
2012-01-27 11:41 . 2012-01-27 11:41 -------- d-----w- c:\programdata\Malwarebytes
2012-01-27 11:41 . 2012-01-27 11:41 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
2012-01-26 20:17 . 2012-01-26 20:17 -------- d-----w- c:\program files (x86)\Common Files\Windows Live
2012-01-26 17:14 . 2012-01-26 17:14 -------- d-----w- c:\program files\CCleaner
2012-01-11 17:42 . 2012-02-02 12:38 626688 ----a-w- c:\program files (x86)\Mozilla Firefox\msvcr80.dll
2012-01-11 17:42 . 2012-02-02 12:38 548864 ----a-w- c:\program files (x86)\Mozilla Firefox\msvcp80.dll
2012-01-11 17:42 . 2012-02-02 12:38 479232 ----a-w- c:\program files (x86)\Mozilla Firefox\msvcm80.dll
2012-01-11 17:42 . 2012-02-02 12:38 45016 ----a-w- c:\program files (x86)\Mozilla Firefox\mozutils.dll
2012-01-11 01:52 . 2011-10-26 05:25 1572864 ----a-w- c:\windows\system32\quartz.dll
2012-01-11 01:52 . 2011-10-26 04:32 514560 ----a-w- c:\windows\SysWow64\qdvd.dll
2012-01-11 01:52 . 2011-10-26 04:32 1328128 ----a-w- c:\windows\SysWow64\quartz.dll
2012-01-11 01:52 . 2011-10-26 05:25 366592 ----a-w- c:\windows\system32\qdvd.dll
2012-01-11 01:51 . 2011-11-17 06:41 1731920 ----a-w- c:\windows\system32\ntdll.dll
2012-01-11 01:51 . 2011-11-17 05:38 1292080 ----a-w- c:\windows\SysWow64\ntdll.dll
2012-01-11 01:51 . 2011-11-19 14:58 77312 ----a-w- c:\windows\system32\packager.dll
2012-01-11 01:51 . 2011-11-19 14:01 67072 ----a-w- c:\windows\SysWow64\packager.dll
2012-01-06 09:05 . 2012-01-14 17:08 -------- d-----w- c:\program files (x86)\Common Files\Symantec Shared
2012-01-05 17:25 . 2012-01-16 10:28 -------- d-----w- c:\programdata\Symantec
2012-01-05 17:25 . 2012-01-16 10:28 -------- d-----w- c:\programdata\Norton
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-02-02 14:12 . 2011-08-02 17:20 42496 ----a-w- c:\windows\system32\drivers\oem-drv64.sys
2012-01-26 20:22 . 2011-03-28 17:36 18328 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
2011-12-07 09:39 . 2010-11-21 03:27 279096 ------w- c:\windows\system32\MpSigStub.exe
2011-11-24 04:52 . 2011-12-14 18:41 3145216 ----a-w- c:\windows\system32\win32k.sys
2011-11-05 05:32 . 2011-12-14 18:41 2048 ----a-w- c:\windows\system32\tzres.dll
2011-11-05 04:26 . 2011-12-14 18:41 2048 ----a-w- c:\windows\SysWow64\tzres.dll
.
.
((((((((((((((((((((((((((((( SnapShot@2012-01-27_16.05.00 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-07-14 04:54 . 2012-02-01 21:50 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2009-07-14 04:54 . 2012-01-26 13:57 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2009-07-14 04:54 . 2012-01-26 13:57 49152 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2009-07-14 04:54 . 2012-02-01 21:50 49152 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2009-07-14 04:54 . 2012-01-26 13:57 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2009-07-14 04:54 . 2012-02-01 21:50 32768 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2010-11-21 03:09 . 2012-01-30 21:52 32754 c:\windows\system32\wdi\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2009-07-14 05:10 . 2012-01-30 21:52 41784 c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin
+ 2009-07-14 04:46 . 2012-01-29 11:06 83864 c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform\Cache\cache.dat
+ 2011-08-03 07:28 . 2012-01-30 21:52 9236 c:\windows\system32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-3562432153-2537355380-1562762292-1000_UserData.bin
+ 2012-02-02 14:12 . 2012-02-02 14:12 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
- 2012-01-27 16:02 . 2012-01-27 16:02 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2012-02-02 14:12 . 2012-02-02 14:12 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
- 2012-01-27 16:02 . 2012-01-27 16:02 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2011-08-04 00:37 . 2012-02-02 13:36 220936 c:\windows\system32\wdi\SuspendPerformanceDiagnostics_SystemData_S3.bin
+ 2009-07-14 02:36 . 2012-02-02 13:46 616008 c:\windows\system32\perfh009.dat
- 2009-07-14 02:36 . 2012-01-14 17:51 616008 c:\windows\system32\perfh009.dat
+ 2010-11-21 06:50 . 2012-02-02 13:46 654166 c:\windows\system32\perfh007.dat
- 2010-11-21 06:50 . 2012-01-14 17:51 654166 c:\windows\system32\perfh007.dat
+ 2009-07-14 02:36 . 2012-02-02 13:46 106388 c:\windows\system32\perfc009.dat
- 2009-07-14 02:36 . 2012-01-14 17:51 106388 c:\windows\system32\perfc009.dat
- 2010-11-21 06:50 . 2012-01-14 17:51 130006 c:\windows\system32\perfc007.dat
+ 2010-11-21 06:50 . 2012-02-02 13:46 130006 c:\windows\system32\perfc007.dat
+ 2009-07-14 05:01 . 2012-02-02 14:11 375084 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
- 2009-07-14 05:01 . 2012-01-27 16:02 375084 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
+ 2012-01-31 16:24 . 2012-01-31 16:24 380928 c:\windows\Installer\{5E11C972-1E76-45FE-8F92-14E0D1140B1B}\iTunesIco.exe
+ 2011-09-14 03:54 . 2011-09-14 03:54 236904 c:\windows\Installer\$PatchCache$\Managed\638401577CACE4443AE9F3455191245F\4.0.0\OutlookChangeNotifierAddIn_x64.dll
+ 2011-09-14 03:54 . 2011-09-14 03:54 227176 c:\windows\Installer\$PatchCache$\Managed\638401577CACE4443AE9F3455191245F\4.0.0\OutlookChangeNotifierAddIn.dll
- 2011-08-03 17:22 . 2012-01-27 16:02 1294496 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-3562432153-2537355380-1562762292-1000-8192.dat
+ 2011-08-03 17:22 . 2012-02-02 14:11 1294496 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-3562432153-2537355380-1562762292-1000-8192.dat
+ 2011-08-11 13:23 . 2012-01-30 20:48 3282044 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-3562432153-2537355380-1562762292-1000-12288.dat
- 2011-08-11 13:23 . 2012-01-26 22:08 3282044 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-3562432153-2537355380-1562762292-1000-12288.dat
+ 2012-01-31 16:21 . 2012-01-31 16:21 44700672 c:\windows\Installer\3f222da.msi
+ 2012-01-31 16:17 . 2012-01-31 16:17 11081728 c:\windows\Installer\3f2173a.msi
+ 2012-01-31 16:16 . 2012-01-31 16:16 20304896 c:\windows\Installer\3f21710.msi
+ 2012-01-31 16:13 . 2012-01-31 16:13 26820096 c:\windows\Installer\3f216e8.msi
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2011-04-21 281768]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2011-10-24 421888]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2011-11-01 59240]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2012-01-16 421736]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux5"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys [x]
R3 netw5v64;Intel(R) Wireless WiFi Link 5000 Series - Adaptertreiber für Windows Vista 64 Bit;c:\windows\system32\DRIVERS\netw5v64.sys [x]
R3 phonic_FF808U_usb;phonic_FF808U_usb;c:\windows\system32\Drivers\phonic_FF808U_usb_x64.sys [x]
R3 phonic_FF808U_usb_avs;phonic_FF808U_usb_avs;c:\windows\system32\Drivers\phonic_FF808U_usb_avs_x64.sys [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [x]
R3 SwitchBoard;SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
R3 Synth3dVsc;Microsoft Virtual 3D Video Transport Driver;c:\windows\system32\drivers\Synth3dVsc.sys [x]
R3 terminpt;Microsoft Remote Desktop Input Driver;c:\windows\system32\drivers\terminpt.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 TsUsbGD;%TsUsbGD.DeviceDesc.Generic%;c:\windows\system32\drivers\TsUsbGD.sys [x]
R3 tsusbhub;Remote Deskotop USB Hub;c:\windows\system32\drivers\tsusbhub.sys [x]
R3 US122;US122 Driver;c:\windows\system32\Drivers\US122x64.sys [x]
R3 US122DL;US122 Firmware Downloader;c:\windows\system32\Drivers\US122DLx64.sys [x]
R3 US122WdmService;US122 Wdm Audio;c:\windows\system32\Drivers\US122Wdmx64.sys [x]
R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys [x]
S0 oem-drv64;OEM-SLP2.1 Driver (HPD64);c:\windows\system32\DRIVERS\oem-drv64.sys [x]
S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [x]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-06-06 64952]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x]
S2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [2011-04-21 136360]
S2 NIHardwareService;NIHardwareService;c:\program files\Common Files\Native Instruments\Hardware\NIHardwareService.exe [2011-04-07 5352960]
S3 NETw5s64;Intel(R) Wireless WiFi Link Adaptertreiber für Windows 7 64-Bit;c:\windows\system32\DRIVERS\NETw5s64.sys [x]
S3 RTL8167;Realtek 8167 NT-Treiber;c:\windows\system32\DRIVERS\Rt64win7.sys [x]
.
.
Inhalt des "geplante Tasks" Ordners
.
2012-02-01 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3562432153-2537355380-1562762292-1000Core.job
- c:\users\Alex\AppData\Local\Google\Update\GoogleUpdate.exe [2011-08-08 18:29]
.
2012-02-02 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3562432153-2537355380-1562762292-1000UA.job
- c:\users\Alex\AppData\Local\Google\Update\GoogleUpdate.exe [2011-08-08 18:29]
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe" [BU]
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page =
IE: {{7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - c:\program files (x86)\ICQ7.5\ICQ.exe
TCP: DhcpNameServer = 192.168.1.22
FF - ProfilePath - c:\users\Alex\AppData\Roaming\Mozilla\Firefox\Profiles\dihdoogs.default\
FF - prefs.js: browser.search.selectedEngine - Google Deutschland
FF - prefs.js: browser.startup.homepage - hxxp://www.google.de/
FF - prefs.js: keyword.URL - hxxp://www.google.de/
FF - prefs.js: network.proxy.gopher -
FF - prefs.js: network.proxy.gopher_port - 0
FF - prefs.js: network.proxy.type - 0
FF - user.js: network.cookie.cookieBehavior - 0
FF - user.js: privacy.clearOnShutdown.cookies - false
FF - user.js: security.warn_viewing_mixed - false
FF - user.js: security.warn_viewing_mixed.show_once - false
FF - user.js: security.warn_submit_insecure - false
FF - user.js: security.warn_submit_insecure.show_once - false
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE09CC1-42E0-11DD-AE16-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10b.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE09CC1-42E0-11DD-AE16-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE09CC1-42E0-11DD-AE16-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\FlashUtil10b.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE09CC1-42E0-11DD-AE16-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10b.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10b.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10b.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10b.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{DDF4CE26-4BDA-42BC-B0F0-0E75243AD285}]
@Denied: (A 2) (Everyone)
@="IFlashBroker2"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{DDF4CE26-4BDA-42BC-B0F0-0E75243AD285}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{DDF4CE26-4BDA-42BC-B0F0-0E75243AD285}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\program files (x86)\Avira\AntiVir Desktop\avguard.exe
c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files (x86)\Mozilla Thunderbird\thunderbird.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2012-02-02 15:17:14 - PC wurde neu gestartet
ComboFix-quarantined-files.txt 2012-02-02 14:17
ComboFix2.txt 2012-01-27 16:24
.
Vor Suchlauf: 12 Verzeichnis(se), 169.206.603.776 Bytes frei
Nach Suchlauf: 13 Verzeichnis(se), 170.526.138.368 Bytes frei
.
- - End Of File - - 8FBBE0AB072526EFE81B596C280426D9
|
|
02.02.2012, 16:40
| #18 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Firefox leitet auf andere Seiten um [Logfiles inside] Downloade dir bitte aswMBR.exe und speichere die Datei auf deinem Desktop.
__________________
__________________ |
|
04.02.2012, 15:48
| #19 |
| | Firefox leitet auf andere Seiten um [Logfiles inside]Code:
ATTFilter aswMBR version 0.9.9.1532 Copyright(c) 2011 AVAST Software
Run date: 2012-02-04 14:41:50
-----------------------------
14:41:50.817 OS Version: Windows x64 6.1.7601 Service Pack 1
14:41:50.818 Number of processors: 2 586 0x170A
14:41:50.818 ComputerName: ALEX-PC UserName: Alex
14:41:53.485 Initialize success
14:48:01.798 AVAST engine defs: 12020400
14:50:06.250 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP1T0L0-1
14:50:06.256 Disk 0 Vendor: TOSHIBA_MK4055GSX FG011M Size: 381554MB BusType: 11
14:50:06.325 Disk 0 MBR read successfully
14:50:06.333 Disk 0 MBR scan
14:50:06.350 Disk 0 Windows 7 default MBR code
14:50:06.383 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 100 MB offset 2048
14:50:06.437 Disk 0 Partition 2 00 07 HPFS/NTFS NTFS 300452 MB offset 206848
14:50:06.492 Disk 0 Partition 3 00 07 HPFS/NTFS NTFS 80999 MB offset 615532544
14:50:06.500 Service scanning
14:50:12.253 Modules scanning
14:50:12.257 Disk 0 trace - called modules:
14:50:12.269 xNtKrnl.exe CLASSPNP.SYS disk.sys ataport.SYS PCIIDEX.SYS hal.dll msahci.sys
14:50:12.274 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa8004c02060]
14:50:12.280 3 CLASSPNP.SYS[fffff8800160143f] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP1T0L0-1[0xfffffa8004a79680]
14:50:13.258 AVAST engine scan C:\Windows
14:50:19.760 AVAST engine scan C:\Windows\system32
14:54:18.102 AVAST engine scan C:\Windows\system32\drivers
14:54:33.714 AVAST engine scan C:\Users\Alex
15:03:58.458 AVAST engine scan C:\ProgramData
15:05:37.785 Scan finished successfully
15:47:38.037 Disk 0 MBR has been saved successfully to "C:\Users\Alex\Desktop\MBR.dat"
15:47:38.043 The log file has been saved successfully to "C:\Users\Alex\Desktop\aswMBR.txt"
|
|
05.02.2012, 19:01
| #20 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Firefox leitet auf andere Seiten um [Logfiles inside] Sieht ok aus. Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SUPERAntiSpyware und poste die Logs. Denk dran beide Tools zu updaten vor dem Scan!!
__________________ Logfiles bitte immer in CODE-Tags posten |
|
| Themen zu Firefox leitet auf andere Seiten um [Logfiles inside] |
| acrobat update, adobe, antivir, antivir guard, autorun, avira, bho, bonjour, build 7601, defender, desktop.ini, device driver, explorer, firefox, format, free download, helper, kaspersky, langs, leitet, mozilla thunderbird, nodrives, plug-in, programme, realtek, registry, scan, secur, security, seiten, software, studio, symantec, usb, vice city, windows, windows 7 ultimate |
![Firefox leitet auf andere Seiten um [Logfiles inside]](iconimages/log-analyse-auswertung/firefox-leitet-andere-seiten-um-logfiles-inside_ltr.gif)
Linear-Darstellung
