| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: svchost.exeWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
| |
07.06.2012, 10:30
| #1 | |
| /// Winkelfunktion /// TB-Süch-Tiger™   |  svchost.exe Dann bitte jetzt CF ausführen: ComboFix Ein Leitfaden und Tutorium zur Nutzung von ComboFix
Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat! Solltest du nach der Ausführung von Combofix Probleme beim Starten von Anwendungen haben und Meldungen erhalten wie Zitat:
__________________ Logfiles bitte immer in CODE-Tags posten  |
|
07.06.2012, 15:58
| #2 |
 | svchost.exe Hat irgend so ein komisches "Your Product" gelöscht, hab ich auch auf meinem Notebook
__________________ Hier ist das Log von ComboFix: Code:
ATTFilter ComboFix 12-06-07.03 - Lukas 07.06.2012 16:40:41.2.6 - x64
Microsoft Windows 7 Ultimate 6.1.7601.1.1252.49.1031.18.8172.5934 [GMT 2:00]
ausgeführt von:: c:\users\Lukas\Desktop\ComboFix.exe
AV: Bitdefender Virenschutz *Disabled/Updated* {50909708-FF80-02AF-F814-B28405891E92}
FW: Bitdefender Firewall *Enabled* {68AB162D-B5EF-03F7-D34B-1BB1FB5A59E9}
SP: Bitdefender Spyware-Schutz *Disabled/Updated* {EBF176EC-D9BA-0D21-C2A4-89F67E0E542F}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files (x86)\Your Product\Uninstall
c:\program files (x86)\Your Product\Uninstall\IRIMG1.JPG
c:\program files (x86)\Your Product\Uninstall\IRIMG2.JPG
c:\program files (x86)\Your Product\Uninstall\uninstall.dat
c:\program files (x86)\Your Product\Uninstall\uninstall.xml
c:\programdata\1337463435.bdinstall.bin
c:\programdata\1337464459.bdinstall.bin
c:\programdata\1337464652.bdinstall.bin
.
.
((((((((((((((((((((((( Dateien erstellt von 2012-05-07 bis 2012-06-07 ))))))))))))))))))))))))))))))
.
.
2012-06-07 14:47 . 2012-06-07 14:47 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-06-07 10:43 . 2012-06-07 10:56 -------- d-----w- c:\program files (x86)\The Elder Scrolls V Skyrim
2012-06-07 09:17 . 2012-06-07 09:17 -------- d-----w- c:\users\Public\Interface
2012-06-07 09:13 . 2012-06-07 09:16 -------- d-----w- c:\users\Public\Strings
2012-06-06 18:48 . 2008-10-15 04:22 519000 ----a-w- c:\windows\system32\d3dx10_40.dll
2012-06-06 18:48 . 2008-10-15 04:22 452440 ----a-w- c:\windows\SysWow64\d3dx10_40.dll
2012-06-06 18:48 . 2008-10-15 04:22 2605920 ----a-w- c:\windows\system32\D3DCompiler_40.dll
2012-06-06 18:48 . 2008-10-15 04:22 2036576 ----a-w- c:\windows\SysWow64\D3DCompiler_40.dll
2012-06-06 18:48 . 2008-10-15 04:22 5631312 ----a-w- c:\windows\system32\D3DX9_40.dll
2012-06-06 14:56 . 2012-06-06 14:56 -------- d-----w- C:\TDSSKiller_Quarantine
2012-06-06 14:33 . 2012-06-06 14:33 -------- d-----w- C:\_OTL
2012-06-06 11:43 . 2012-06-06 11:43 -------- d-----w- c:\windows\SysWow64\xlive
2012-06-06 11:43 . 2012-06-06 11:43 -------- d-----w- c:\program files (x86)\Microsoft Games for Windows - LIVE
2012-06-01 21:00 . 2012-05-15 10:48 2368832 ----a-w- c:\windows\SysWow64\nvapi.dll.BAK
2012-06-01 20:22 . 2009-11-20 17:18 4990056 ----a-w- c:\windows\SysWow64\NVStWiz.exe
2012-06-01 20:20 . 2012-06-02 12:44 -------- d-----w- c:\program files\NVIDIA Corporation
2012-06-01 11:17 . 2012-06-01 11:17 -------- d-----w- c:\program files (x86)\ESET
2012-06-01 11:12 . 2012-06-01 11:12 -------- d-----w- c:\programdata\Malwarebytes
2012-06-01 10:47 . 2009-11-21 02:34 930272 ----a-w- c:\windows\system32\dpinst.exe
2012-06-01 10:47 . 2009-11-21 02:34 202344 ----a-w- c:\windows\system32\nvcod178.dll
2012-05-29 15:57 . 2012-05-29 15:57 -------- d-----w- c:\program files\HashTab Shell Extension
2012-05-29 11:56 . 2012-05-29 11:56 -------- d-----w- c:\program files (x86)\EA Games
2012-05-28 16:52 . 2012-06-06 12:55 109080 ----a-w- c:\windows\SysWow64\OpenAL32.dll
2012-05-28 15:45 . 2012-05-28 16:08 -------- d-----w- c:\programdata\Spybot - Search & Destroy
2012-05-28 14:12 . 2012-05-28 14:12 -------- d-----w- c:\program files (x86)\MSI Kombustor 2.3
2012-05-28 14:11 . 2012-05-28 14:21 -------- d-----w- c:\program files (x86)\MSI Afterburner
2012-05-28 11:23 . 2012-05-28 11:23 -------- d-----w- c:\windows\symbols
2012-05-28 11:20 . 2012-05-28 11:20 -------- d-----w- c:\programdata\VS
2012-05-27 16:50 . 2012-05-27 16:50 -------- d-----w- c:\program files (x86)\Microsoft
2012-05-27 16:48 . 2012-05-28 12:53 -------- d-----w- c:\program files (x86)\Microsoft Silverlight
2012-05-27 16:45 . 2000-05-10 23:00 90112 ------w- c:\windows\Updreg.EXE
2012-05-27 16:45 . 2010-07-21 14:51 11264 ------w- c:\windows\SysWow64\ResDefA.exe
2012-05-27 16:45 . 2009-10-01 14:42 141312 ------w- c:\windows\system32\THXCfg64.exe
2012-05-27 16:45 . 2011-05-13 10:30 26624 ------w- c:\windows\system32\THXCfg64.dll
2012-05-27 16:45 . 2011-05-19 07:58 246784 ----a-w- c:\windows\system32\APOMgr64.DLL
2012-05-27 16:45 . 2011-05-19 07:56 190464 ----a-w- c:\windows\SysWow64\APOMngr.DLL
2012-05-27 16:45 . 2009-12-29 14:53 89088 ----a-w- c:\windows\system32\CmdRtr64.DLL
2012-05-27 16:45 . 2009-12-29 14:52 73728 ----a-w- c:\windows\SysWow64\CmdRtr.DLL
2012-05-27 16:45 . 2012-05-27 16:45 -------- d-----w- c:\program files (x86)\Creative
2012-05-27 11:49 . 2012-05-27 11:48 647872 ----a-w- c:\windows\SysWow64\mscomct2.ocx
2012-05-27 09:50 . 2009-09-04 15:29 453456 ----a-w- c:\windows\SysWow64\d3dx10_42.dll
2012-05-27 09:32 . 2012-05-27 12:13 -------- d-----w- c:\program files (x86)\BRS
2012-05-27 09:32 . 2011-03-19 13:16 1417216 ----a-w- c:\windows\SysWow64\rapture3d_oal.dll
2012-05-27 09:32 . 2010-09-22 11:12 19087360 ----a-w- c:\windows\SysWow64\mkl_blueripple.dll
2012-05-27 09:32 . 2012-06-06 12:55 466456 ----a-w- c:\windows\system32\wrap_oal.dll
2012-05-27 09:32 . 2012-06-06 12:55 122904 ----a-w- c:\windows\system32\OpenAL32.dll
2012-05-27 09:32 . 2012-05-27 09:32 -------- d-----w- c:\program files (x86)\OpenAL
2012-05-27 09:32 . 2012-06-06 12:55 444952 ----a-w- c:\windows\SysWow64\wrap_oal.dll
2012-05-27 08:32 . 2012-05-27 08:32 -------- d-----w- c:\programdata\Electronic Arts
2012-05-27 08:19 . 2012-05-27 08:19 -------- d-----w- c:\program files (x86)\Microsoft WSE
2012-05-27 08:05 . 2012-05-27 08:32 -------- d-----w- c:\program files (x86)\Electronic Arts
2012-05-26 12:39 . 2012-05-29 11:18 -------- d-----w- C:\Windows Photo Viewer
2012-05-26 10:50 . 2012-05-26 10:50 -------- d-----w- c:\program files (x86)\The Creative Assembly
2012-05-26 10:15 . 2012-05-26 10:54 -------- d-----w- c:\program files (x86)\Activision
2012-05-25 16:59 . 2012-06-07 14:46 -------- d-----w- c:\program files (x86)\Your Product
2012-05-25 12:30 . 2009-07-14 01:39 1402880 ----a-w- c:\windows\system32\Utilman.exe
2012-05-20 17:23 . 2005-05-25 05:00 90112 ------w- c:\windows\SDUnInst.exe
2012-05-20 17:23 . 2012-06-02 18:52 -------- d-----w- c:\program files (x86)\Software by Design
2012-05-20 12:47 . 2012-05-20 12:47 -------- d-----w- c:\program files (x86)\Microsoft SQL Server
2012-05-20 12:46 . 2012-05-20 12:46 -------- d-----w- c:\program files\Microsoft Synchronization Services
2012-05-20 12:46 . 2012-05-20 12:46 -------- d-----w- c:\program files\Microsoft SQL Server Compact Edition
2012-05-20 12:46 . 2012-05-20 12:46 -------- d-----w- c:\program files (x86)\Microsoft Synchronization Services
2012-05-20 12:46 . 2012-05-20 12:46 -------- d-----w- c:\program files (x86)\Microsoft SQL Server Compact Edition
2012-05-20 12:46 . 2012-05-28 16:57 207008 ----a-w- c:\programdata\Microsoft\VBExpress\10.0\1031\ResourceCache.dll
2012-05-20 12:45 . 2012-05-20 12:47 -------- d-----w- c:\program files (x86)\Microsoft Visual Studio 10.0
2012-05-20 12:44 . 2012-05-20 12:44 -------- d-----w- c:\program files\Microsoft Visual Studio 10.0
2012-05-20 12:44 . 2012-05-20 12:44 -------- d-----w- c:\program files\Microsoft Help Viewer
2012-05-20 12:44 . 2012-05-20 12:44 -------- d-----w- c:\program files (x86)\Microsoft SDKs
2012-05-20 08:59 . 2012-05-20 08:59 -------- d-----w- c:\windows\system32\config\systemprofile\AppData\Roaming\QuickScan
2012-05-20 08:30 . 2009-10-16 01:10 303616 ----a-w- c:\windows\system32\RaCoInstx.dll
2012-05-20 08:30 . 2012-05-20 08:30 -------- d-----w- c:\programdata\Edimax Driver
2012-05-19 21:59 . 2012-05-19 21:59 -------- d-----w- c:\programdata\BDLogging
2012-05-19 21:59 . 2012-05-19 21:59 -------- d-----w- c:\programdata\Bitdefender
2012-05-19 21:57 . 2011-08-16 12:59 442088 ----a-w- c:\windows\system32\drivers\bdfsfltr.sys
2012-05-19 21:57 . 2011-10-27 13:07 329800 ------w- c:\windows\system32\drivers\trufos.sys
2012-05-19 21:54 . 2012-05-19 21:54 -------- d-----w- c:\program files\Bitdefender
2012-05-19 21:35 . 2012-05-19 21:57 -------- d-----w- c:\program files\Common Files\Bitdefender
2012-05-19 21:32 . 2012-05-19 21:32 -------- d-----w- c:\program files (x86)\Common Files\Bitdefender
2012-05-19 15:59 . 2012-05-19 16:01 -------- d-----w- c:\program files (x86)\Common Files\Nero
2012-05-19 15:58 . 2012-05-19 16:04 -------- d-----w- c:\programdata\Nero
2012-05-19 15:38 . 2011-12-01 09:42 15920 ------w- c:\windows\system32\drivers\NBVolUp.sys
2012-05-19 15:37 . 2012-05-19 16:03 -------- d-----w- c:\program files (x86)\Nero
2012-05-19 15:37 . 2011-12-01 09:42 72240 ------w- c:\windows\system32\drivers\NBVol.sys
2012-05-19 15:37 . 2009-09-04 15:29 1974616 ----a-w- c:\windows\SysWow64\D3DCompiler_42.dll
2012-05-19 15:36 . 2009-09-04 15:29 1892184 ----a-w- c:\windows\SysWow64\D3DX9_42.dll
2012-05-19 15:35 . 2008-10-15 04:22 4379984 ----a-w- c:\windows\SysWow64\D3DX9_40.dll
2012-05-19 11:48 . 2012-05-19 11:48 -------- d-----w- c:\program files (x86)\Alcohol Soft
2012-05-19 11:47 . 2012-05-19 11:47 -------- d--h--w- c:\programdata\Common Files
2012-05-18 18:06 . 2012-05-25 12:15 -------- d-----w- c:\program files (x86)\Inno Setup 5
2012-05-18 14:28 . 2012-05-18 14:28 560184 ------w- c:\windows\system32\drivers\sptd.sys
2012-05-18 14:27 . 2012-05-29 16:31 500 ----a-w- C:\user.js
2012-05-18 14:27 . 2012-05-18 14:27 -------- d-----w- c:\programdata\Babylon
2012-05-18 14:08 . 2011-01-17 11:09 197120 ----a-w- c:\windows\system32\d3d10_1.dll
2012-05-18 14:08 . 2011-01-17 05:47 161792 ----a-w- c:\windows\SysWow64\d3d10_1.dll
2012-05-18 13:02 . 2012-05-25 12:15 -------- d-----w- c:\program files (x86)\Common Files\Skype
2012-05-18 13:02 . 2012-05-18 13:02 -------- d-----r- c:\program files (x86)\Skype
2012-05-18 12:54 . 2012-05-08 17:02 8955792 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{3B7A242F-D942-48BD-9A7A-41BE132B043E}\mpengine.dll
2012-05-18 12:53 . 2012-01-25 06:38 77312 ----a-w- c:\windows\system32\rdpwsx.dll
2012-05-18 12:53 . 2012-01-25 06:38 149504 ----a-w- c:\windows\system32\rdpcorekmts.dll
2012-05-17 12:27 . 2012-05-17 12:28 -------- d-----w- c:\programdata\boost_interprocess
2012-05-17 12:26 . 2012-05-18 13:02 -------- d-----w- c:\programdata\Skype
2012-05-17 08:29 . 2012-05-17 08:29 -------- d-----w- C:\AMD
2012-05-16 17:33 . 2012-05-16 17:33 -------- d-----w- c:\programdata\Divinity 2
2012-05-16 17:28 . 2012-05-16 17:28 -------- d-----w- C:\cabs
2012-05-16 17:21 . 2012-05-25 12:15 -------- d-----w- c:\program files (x86)\Divinity II - Ego Draconis
2012-05-16 16:38 . 2012-05-16 16:38 -------- d-----w- c:\programdata\PDVD
2012-05-16 16:38 . 2012-05-19 14:09 -------- d-----w- c:\users\Public\CyberLink
2012-05-16 16:35 . 2012-05-16 16:35 -------- d-----w- c:\programdata\install_clap
2012-05-16 15:23 . 2012-05-19 14:06 -------- d-----w- c:\programdata\CyberLink
2012-05-16 15:19 . 2012-05-16 15:19 -------- d-----w- c:\windows\system32\SPReview
2012-05-16 14:40 . 2012-05-16 14:40 -------- d-----w- c:\windows\system32\EventProviders
2012-05-16 14:25 . 2011-03-11 06:41 189824 ----a-w- c:\windows\system32\drivers\storport.sys
2012-05-16 14:25 . 2011-03-11 06:41 166272 ----a-w- c:\windows\system32\drivers\nvstor.sys
2012-05-16 14:25 . 2011-03-11 06:41 1659776 ----a-w- c:\windows\system32\drivers\ntfs.sys
2012-05-16 14:25 . 2011-03-11 06:41 148352 ----a-w- c:\windows\system32\drivers\nvraid.sys
2012-05-16 14:25 . 2011-03-11 06:41 107904 ----a-w- c:\windows\system32\drivers\amdsata.sys
2012-05-16 14:25 . 2011-03-11 06:33 2565632 ----a-w- c:\windows\system32\esent.dll
2012-05-16 14:25 . 2011-03-11 05:33 1699328 ----a-w- c:\windows\SysWow64\esent.dll
2012-05-16 14:25 . 2011-03-11 06:41 410496 ----a-w- c:\windows\system32\drivers\iaStorV.sys
2012-05-16 14:25 . 2011-03-11 06:41 27008 ----a-w- c:\windows\system32\drivers\amdxata.sys
2012-05-16 14:25 . 2011-03-11 06:30 96768 ----a-w- c:\windows\system32\fsutil.exe
2012-05-16 14:25 . 2011-03-11 05:31 74240 ----a-w- c:\windows\SysWow64\fsutil.exe
2012-05-16 14:24 . 2011-03-25 03:29 343040 ----a-w- c:\windows\system32\drivers\usbhub.sys
2012-05-16 14:24 . 2011-03-25 03:29 325120 ----a-w- c:\windows\system32\drivers\usbport.sys
2012-05-16 14:24 . 2011-03-25 03:29 52736 ----a-w- c:\windows\system32\drivers\usbehci.sys
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-05-16 15:22 . 2009-07-14 02:36 175616 ----a-w- c:\windows\system32\msclmd.dll
2012-05-16 15:22 . 2009-07-14 02:36 152576 ----a-w- c:\windows\SysWow64\msclmd.dll
2012-04-06 02:20 . 2011-07-08 03:28 1067520 ----a-w- c:\windows\system32\aticfx64.dll
2012-04-06 01:54 . 2011-07-08 03:10 7479296 ----a-w- c:\windows\system32\atidxx64.dll
2012-04-06 01:34 . 2011-07-08 03:05 4731904 ----a-w- c:\windows\system32\atiumd6a.dll
2012-04-06 01:23 . 2011-07-08 02:54 7431680 ----a-w- c:\windows\system32\atiumd64.dll
2012-04-06 01:09 . 2011-07-08 02:46 54784 ----a-w- c:\windows\system32\atiuxp64.dll
2012-04-06 01:09 . 2011-07-08 02:46 44544 ----a-w- c:\windows\system32\atiu9p64.dll
2012-04-05 20:34 . 2012-04-05 20:34 187392 ----a-w- c:\windows\system32\clinfo.exe
2012-04-05 20:34 . 2012-04-05 20:34 74752 ----a-w- c:\windows\system32\OpenVideo64.dll
2012-04-05 20:34 . 2012-04-05 20:34 64512 ----a-w- c:\windows\SysWow64\OpenVideo.dll
2012-04-05 20:33 . 2012-04-05 20:33 63488 ----a-w- c:\windows\system32\OVDecode64.dll
2012-04-05 20:33 . 2012-04-05 20:33 56320 ----a-w- c:\windows\SysWow64\OVDecode.dll
2012-04-05 20:33 . 2012-04-05 20:33 16457216 ----a-w- c:\windows\system32\amdocl64.dll
2012-04-05 20:32 . 2012-04-05 20:32 13007872 ----a-w- c:\windows\SysWow64\amdocl.dll
2012-03-20 18:22 . 2012-03-20 18:22 691896 ----a-w- c:\windows\system32\drivers\avc3.sys
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Steam"="c:\program files (x86)\Steam\Steam.exe" [2012-05-16 1242448]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1475584]
"AlcoholAutomount"="c:\program files (x86)\Alcohol Soft\Alcohol 52\AxAutoMntSrv.exe" [2012-01-05 75624]
"HydraVisionDesktopManager"="c:\program files (x86)\ATI Technologies\HydraVision\HydraDM.exe" [2011-07-07 393216]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"THX TruStudio NB Settings"="c:\program files (x86)\Creative\THX TruStudio\THXNBSet\THXAudNB.exe" [2011-05-19 909824]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2012-04-05 641664]
"RemoteControl"="c:\program files (x86)\CyberLink\PowerDVD\PDVDServ.exe" [2004-11-02 32768]
"PowerDVD12DMREngine"="c:\program files (x86)\CyberLink\PowerDVD12\Kernel\DMR\PowerDVD12DMREngine.exe" [2012-01-02 501544]
"PowerDVD12Agent"="c:\program files (x86)\CyberLink\PowerDVD12\PowerDVD12Agent.exe" [2012-01-12 371256]
"NBAgent"="c:\program files (x86)\Nero\Nero 11\Nero BackItUp\NBAgent.exe" [2012-01-13 1493288]
"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
R2 AxAutoMntSrv;Alcohol Virtual Drive Auto-mount Service;c:\program files (x86)\Alcohol Soft\Alcohol 52\AxAutoMntSrv.exe [2012-01-05 75624]
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-05-12 136176]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2012-05-03 158856]
R3 AmdLLD64;AMD Low Level Device Driver;c:\windows\system32\DRIVERS\AmdLLD64.sys [x]
R3 bdsandbox;bdsandbox;c:\windows\system32\drivers\bdsandbox.sys [x]
R3 Futuremark SystemInfo Service;Futuremark SystemInfo Service;c:\program files (x86)\Common Files\Futuremark Shared\Futuremark SystemInfo\FMSISvc.exe [2012-04-26 135584]
R3 gupdatem;Google Update-Dienst (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-05-12 136176]
R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-05-13 129976]
R3 netr28ux;RT2870 USB Extensible Wireless LAN Card Driver;c:\windows\system32\DRIVERS\netr28ux.sys [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [x]
R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys [x]
R3 Update Server;BitDefender Update Server v2;c:\program files\Common Files\Bitdefender\Bitdefender Arrakis Server\bin\arrakis3.exe [2011-10-14 466736]
R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys [x]
S0 avc3;avc3;c:\windows\system32\DRIVERS\avc3.sys [x]
S0 NBVol;Nero Backup Volume Filter Driver;c:\windows\system32\DRIVERS\NBVol.sys [x]
S0 NBVolUp;Nero Backup Volume Upper Filter Driver;c:\windows\system32\DRIVERS\NBVolUp.sys [x]
S0 sptd;sptd;c:\windows\\SystemRoot\System32\Drivers\sptd.sys [x]
S1 BdfNdisf;BitDefender Firewall NDIS 6 Filter Driver;c:\program files\common files\bitdefender\bitdefender firewall\bdfndisf6.sys [2011-11-14 90192]
S1 bdfwfpf;bdfwfpf;c:\program files\Common Files\Bitdefender\Bitdefender Firewall\bdfwfpf.sys [2011-11-14 103504]
S1 BDVEDISK;BDVEDISK;c:\windows\system32\DRIVERS\bdvedisk.sys [x]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]
S2 {329F96B6-DF1E-4328-BFDA-39EA953C1312};Power Control [2012/05/19 15:58];c:\program files (x86)\CyberLink\PowerDVD12\Common\NavFilter\000.fcl [2012-01-11 20:57 146928]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x]
S2 AMD FUEL Service;AMD FUEL Service;c:\program files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [2012-04-05 361984]
S2 AMDFusionSVC;AMD Fusion Utility Service;c:\program files (x86)\AMD\AMD Fusion Utility for Desktops\FusionSVC.exe [2009-09-08 383544]
S2 AODDriver4.1;AODDriver4.1;c:\program files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [2012-03-05 53888]
S2 CLHNServiceForPowerDVD12;CLHNServiceForPowerDVD12;c:\program files (x86)\CyberLink\PowerDVD12\Kernel\DMP\CLHNServer\CLHNServiceForPowerDVD12.exe [2012-01-12 87336]
S2 CyberLink PowerDVD 12 Media Server Monitor Service;CyberLink PowerDVD 12 Media Server Monitor Service;c:\program files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSMonitorServicePDVD12.exe [2012-01-12 75048]
S2 CyberLink PowerDVD 12 Media Server Service;CyberLink PowerDVD 12 Media Server Service;c:\program files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSServerPDVD12.exe [2012-01-12 296232]
S2 NAUpdate;Nero Update;c:\program files (x86)\Nero\Update\NASvc.exe [2011-11-25 687400]
S2 ntk_PowerDVD12;ntk_PowerDVD12;c:\program files (x86)\CyberLink\PowerDVD12\Kernel\DMP\CLHNServer\ntk_PowerDVD12_64.sys [2011-10-27 82928]
S2 UPDATESRV;BitDefender Desktop Update Service;c:\program files\Bitdefender\Bitdefender 2012\updatesrv.exe [2012-03-13 66096]
S3 ALSysIO;ALSysIO;c:\users\Lukas\AppData\Local\Temp\ALSysIO64.sys [x]
S3 amdiox64;AMD IO Driver;c:\windows\system32\DRIVERS\amdiox64.sys [x]
S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [x]
S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [x]
S3 asmthub3;ASMedia USB3 Hub Service;c:\windows\system32\DRIVERS\asmthub3.sys [x]
S3 asmtxhci;ASMEDIA XHCI Service;c:\windows\system32\DRIVERS\asmtxhci.sys [x]
S3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys [x]
S3 avchv;avchv Function Driver;c:\windows\system32\DRIVERS\avchv.sys [x]
S3 avckf;avckf;c:\windows\system32\DRIVERS\avckf.sys [x]
S3 MBfilt;MBfilt;c:\windows\system32\drivers\MBfilt64.sys [x]
S3 rt61x64;RT61 Extensible Wireless Driver;c:\windows\system32\DRIVERS\netr6164.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [x]
S3 usbfilter;AMD USB Filter Driver;c:\windows\system32\DRIVERS\usbfilter.sys [x]
.
.
Inhalt des "geplante Tasks" Ordners
.
2012-06-07 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-05-12 08:16]
.
2012-06-07 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-05-12 08:16]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"THXCfg64"="c:\windows\system32\RunDLL32.exe" [2009-07-14 45568]
"RTHDVCPL"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2011-05-18 11855976]
"BDAgent"="c:\program files\Bitdefender\Bitdefender 2012\bdagent.exe" [2012-03-22 1067256]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x0
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page =
mStart Page = about:blank
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: Google Sidewiki... - c:\program files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_6CE5017F567343CA.dll/cmsidewiki.html
IE: Nach Microsoft &Excel exportieren - c:\progra~2\MICROS~1\OFFICE11\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.2.1
FF - ProfilePath - c:\users\Lukas\AppData\Roaming\Mozilla\Firefox\Profiles\wionzyv9.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxps://www.google.de/
FF - prefs.js: network.proxy.type - 0
user_pref(security.warn_submit_insecure,false);user_pref(security.warn_viewing_mixed,false);FF - user.js: extensions.BabylonToolbar_i.babTrack - affID=113480&tt=100512_1_
FF - user.js: extensions.BabylonToolbar_i.babExt -
FF - user.js: extensions.BabylonToolbar_i.srcExt - ss
FF - user.js: extensions.BabylonToolbar_i.id - 9ac4fba1000000000000001f1f607b79
FF - user.js: extensions.BabylonToolbar_i.hardId - 9ac4fba1000000000000001f1f607b79
FF - user.js: extensions.BabylonToolbar_i.instlDay - 15489
FF - user.js: extensions.BabylonToolbar_i.vrsn - 1.5.3.17
FF - user.js: extensions.BabylonToolbar_i.vrsni - 1.5.3.17
FF - user.js: extensions.BabylonToolbar_i.vrsnTs - 1.5.3.1718:31
FF - user.js: extensions.BabylonToolbar_i.prtnrId - babylon
FF - user.js: extensions.BabylonToolbar_i.prdct - BabylonToolbar
FF - user.js: extensions.BabylonToolbar_i.aflt - babsst
FF - user.js: extensions.BabylonToolbar_i.smplGrp - none
FF - user.js: extensions.BabylonToolbar_i.tlbrId - tb9
FF - user.js: extensions.BabylonToolbar_i.instlRef - sst
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Wow6432Node-HKCU-Run-Argus Monitor - c:\program files (x86)\ArgusMonitor\ArgusMonitor.exe
WebBrowser-{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - (no file)
.
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\{329F96B6-DF1E-4328-BFDA-39EA953C1312}]
"ImagePath"="\??\c:\program files (x86)\CyberLink\PowerDVD12\Common\NavFilter\000.fcl"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_2_202_235_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_2_202_235_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_235.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_235.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_235.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_235.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2012-06-07 16:51:22
ComboFix-quarantined-files.txt 2012-06-07 14:51
.
Vor Suchlauf: 14 Verzeichnis(se), 771.367.337.984 Bytes frei
Nach Suchlauf: 18 Verzeichnis(se), 770.987.421.696 Bytes frei
.
- - End Of File - - ED19E0E5D9B6E44F0A5D16598F4F51A8
|
|
| Themen zu svchost.exe |
| .exe, appdata, ausprobiert, babylontoolbar, benutzerkonto, bitdefender, block, blockt, datei, defender, folge, folgendes, kurzem, namens, nichts, problem, programme, prozess, roaming, spybot, svchost.exe, system, system32, systemscan, windows-explorer |
Hybrid-Darstellung
