| |
| |||||||
Log-Analyse und Auswertung: Inet-Browser extrem langsam, Ständig abstürze mit FFWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
| |
25.11.2012, 12:03
| #1 |
 |  Inet-Browser extrem langsam, Ständig abstürze mit FF Hallo zusammen Ich hab seit kurzem Probleme mit meinem Internet-Browser. Ich surfe meistens mit dem Firefox. Er hat einfach lange, um eine Seite zu laden (30-50s) vorallem bei einer Bildersuche bei Google. Auch mit dem Inetexplorer 64bit habe ich das selbe Problem. Habe schon mit dem aktuellsten Avira einen Scan gemacht. keinen Erfolg, super sauber  Durch andere Foren-beiträge bei Google gefunden, habe ich den Avira komplett entfernt und mit Kaspersky einen Check gemacht. Da dieser angeblich besser sei. Doch auch hier habe ich nichts gefunden. Ich dachte zuerst, es liege am Internet selbst, habe denn meine WLan Antenne an einem besseren ort plaziert, habe eine Signalstärke von 55% (Normal) Mit dem Internetspeed test bekam ich auch super ergebnisse: UPC Cablecom 25mbit Leitung Download 23580kbit Upload 2,58mbit Ping 12ms Was eventuell noch erwähneswert ist, ich habe vor längerer zeit eine scheiss Toolbar abgekriegt, weiss aber nicht mehr wie sie hiess. Ich entfernte diese mit dem Software Manager in der Systemsteuerung. Auch Firefox habe ich deinstalliert, alle spuren beseitigt und den aktuellsten neuinstalliert. Hier noch das MBM Logfile: Malwarebytes Anti-Malware 1.65.1.1000 www.malwarebytes.org Datenbank Version: v2012.11.25.01 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 9.0.8112.16421 Dominic :: DOPORTI [Administrator] 25.11.2012 11:48:01 mbam-log-2012-11-25 (11-48-01).txt Art des Suchlaufs: Quick-Scan Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 216346 Laufzeit: 3 Minute(n), 41 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 0 (Keine bösartigen Objekte gefunden) (Ende) Vielen Dank für eure Hilfe! Mfg DoPorti |
|
25.11.2012, 12:36
| #2 | |
| /// TB-Ausbilder  | Inet-Browser extrem langsam, Ständig abstürze mit FF Ich werde dir bei deinem Problem helfen. Eine Bereinigung ist mitunter mit viel Arbeit für Dich (und mich) verbunden. Bevor es los geht, habe ich etwas Lesestoff für dich. Schritt 1: AdwCleaner: Werbeprogramme suchen und löschen Schritt 2: Scan mit DDS (+ attach) Downloade dir bitte DDS (von sUBs) von einem der folgenden Downloadspiegel und speichere die Datei auf deinem Desktop.
__________________ |
|
25.11.2012, 13:18
| #3 |
| | Inet-Browser extrem langsam, Ständig abstürze mit FF Danke!
__________________Also, neues Problem: Ich kann keine Downloads via FF machen, stürzt immer ab. Im Logfile von von ADW hiess es, die Browser wären sauber. dds-file DDS Logfile: Code:
ATTFilter DDS (Ver_2012-11-20.01) - NTFS_AMD64
Internet Explorer: 9.0.8112.16421 BrowserJavaVersion: 1.6.0_27
Run by Dominic at 13:07:57 on 2012-11-25
Microsoft Windows 7 Ultimate 6.1.7601.1.1252.41.1031.18.8191.6234 [GMT 1:00]
.
AV: Kaspersky Anti-Virus *Enabled/Updated* {2EAA32A5-1EE1-1B22-95DA-337730C6E984}
SP: Kaspersky Anti-Virus *Enabled/Updated* {95CBD341-38DB-14AC-AF6A-08054B41A339}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
============== Running Processes ===============
.
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\system32\atiesrxx.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\atieclxx.exe
C:\Windows\System32\WUDFHost.exe
C:\Windows\System32\WUDFHost.exe
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\WLANExt.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
D:\Kaspersky Lab\Kaspersky Anti-Virus 2012\avp.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe
C:\Windows\SysWOW64\PnkBstrA.exe
C:\Program Files (x86)\Edimax\Common\RaRegistry64.exe
C:\Windows\system32\srchbdmin.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted
D:\TomTom HOME 2\TomTomHOMEService.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Program Files\Logitech\GamePanel Software\LGDevAgt.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\System32\WUDFHost.exe
C:\Program Files\Logitech\GamePanel Software\LCD Manager\lcdmon.exe
C:\Program Files\Windows Media Player\WMPSideShowGadget.exe
C:\Program Files (x86)\Windows Media Player\wmplayer.exe
C:\Program Files\Logitech\GamePanel Software\G-series Software\LGDCore.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\system32\taskhost.exe
C:\Program Files (x86)\DAEMON Tools Pro\DTAgent.exe
C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe
C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe
D:\Creative\SBAudigy\Surround Mixer\CTSysVol.exe
C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe
C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
D:\Kaspersky Lab\Kaspersky Anti-Virus 2012\avp.exe
C:\Program Files (x86)\AMD AVT\bin\kdbsync.exe
C:\Program Files (x86)\Edimax\Common\RaUI.exe
C:\Windows\SysWOW64\WerFault.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
D:\Mozilla Firefox\firefox.exe
C:\Windows\system32\sppsvc.exe
C:\Windows\System32\svchost.exe -k secsvcs
D:\Mozilla Firefox\plugin-container.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\System32\cscript.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.google.de/ncr
mStart Page = about:blank
BHO: IEVkbdBHO Class: {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - D:\Kaspersky Lab\Kaspersky Anti-Virus 2012\ievkbd.dll
BHO: FilterBHO Class: {E33CF602-D945-461A-83F0-819F76A199F8} - D:\Kaspersky Lab\Kaspersky Anti-Virus 2012\klwtbbho.dll
uRun: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
uRun: [MobileDocuments] C:\Program Files (x86)\Common Files\Apple\Internet Services\ubd.exe
uRun: [DAEMON Tools Pro Agent] "C:\Program Files (x86)\DAEMON Tools Pro\DTAgent.exe" -autorun
uRun: [iCloudServices] C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe
uRun: [ApplePhotoStreams] C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe
mRun: [CTSysVol] D:\Creative\SBAudigy\Surround Mixer\CTSysVol.exe /r
mRun: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
mRun: [AppleSyncNotifier] C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe
mRun: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
mRun: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
mRun: [AMD AVT] Cmd.exe /c start "AMD Accelerated Video Transcoding device initialization" /min "C:\Program Files (x86)\AMD AVT\bin\kdbsync.exe" aml
mRun: [AVP] "D:\Kaspersky Lab\Kaspersky Anti-Virus 2012\avp.exe"
dRun: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\WIRELE~1.LNK - C:\Program Files (x86)\Edimax\Common\RaUI.exe
uPolicies-Explorer: NoDriveTypeAutoRun = dword:145
mPolicies-Explorer: NoActiveDesktop = dword:1
mPolicies-Explorer: NoDriveTypeAutoRun = dword:28
mPolicies-System: ConsentPromptBehaviorAdmin = dword:0
mPolicies-System: ConsentPromptBehaviorUser = dword:3
mPolicies-System: EnableLUA = dword:0
mPolicies-System: EnableUIADesktopToggle = dword:0
mPolicies-System: PromptOnSecureDesktop = dword:0
IE: Nach Microsoft E&xel exportieren - D:\MICROS~1\Office12\EXCEL.EXE/3000
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files (x86)\Microsoft Office\Office12\ONBttnIE.dll
IE: {4248FE82-7FCB-46AC-B270-339F08212110} - {4248FE82-7FCB-46AC-B270-339F08212110} - D:\Kaspersky Lab\Kaspersky Anti-Virus 2012\ievkbd.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503}
IE: {CCF151D8-D089-449F-A5A4-D9909053F20F} - {CCF151D8-D089-449F-A5A4-D9909053F20F} - D:\Kaspersky Lab\Kaspersky Anti-Virus 2012\klwtbbho.dll
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0027-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab
TCP: NameServer = 192.168.0.1
TCP: Interfaces\{45F5EACF-1814-4F16-AA12-34BF42197693} : DHCPNameServer = 194.230.1.39 194.230.1.71
TCP: Interfaces\{5C08627E-7D63-47E7-B054-9558A623DD6A} : DHCPNameServer = 192.168.0.1
TCP: Interfaces\{5C08627E-7D63-47E7-B054-9558A623DD6A}\3596475636F6D6141323331434 : DHCPNameServer = 192.168.0.1
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll
Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
SSODL: WebCheck - <orphaned>
mASetup: {10880D85-AAD9-4558-ABDC-2AB1552D831F} - "C:\Program Files (x86)\Common Files\LightScribe\LSRunOnce.exe"
x64-BHO: IEVkbdBHO Class: {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - D:\Kaspersky Lab\Kaspersky Anti-Virus 2012\x64\ievkbd.dll
x64-BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
x64-BHO: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll
x64-BHO: FilterBHO Class: {E33CF602-D945-461A-83F0-819F76A199F8} - D:\Kaspersky Lab\Kaspersky Anti-Virus 2012\x64\klwtbbho.dll
x64-Run: [Launch LgDeviceAgent] "C:\Program Files\Logitech\GamePanel Software\LgDevAgt.exe"
x64-Run: [Launch LCDMon] "C:\Program Files\Logitech\GamePanel Software\LCD Manager\LCDMon.exe"
x64-Run: [Launch LGDCore] "C:\Program Files\Logitech\GamePanel Software\G-series Software\LGDCore.exe" /SHOWHIDE
x64-IE: {4248FE82-7FCB-46AC-B270-339F08212110} - {4248FE82-7FCB-46AC-B270-339F08212110} - D:\Kaspersky Lab\Kaspersky Anti-Virus 2012\x64\ievkbd.dll
x64-IE: {CCF151D8-D089-449F-A5A4-D9909053F20F} - {CCF151D8-D089-449F-A5A4-D9909053F20F} - D:\Kaspersky Lab\Kaspersky Anti-Virus 2012\x64\klwtbbho.dll
x64-DPF: {CAFEEFAC-0017-0000-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_03-windows-i586.cab
x64-DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_03-windows-i586.cab
x64-DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
x64-Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - <orphaned>
x64-Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - <orphaned>
x64-Notify: klogon - C:\Windows\System32\klogon.dll
x64-SSODL: WebCheck - <orphaned>
.
================= FIREFOX ===================
.
FF - ProfilePath - C:\Users\Dominic\AppData\Roaming\Mozilla\Firefox\Profiles\6ud5bzf4.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.google.de/ncr
FF - plugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll
FF - plugin: C:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrlui.dll
FF - plugin: C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll
FF - plugin: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
FF - plugin: C:\Users\Dominic\AppData\Roaming\Facebook\npfbplugin_1_0_3.dll
FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_2_202_228.dll
FF - plugin: D:\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll
FF - plugin: D:\Adobe\Reader 10.0\Reader\browser\nppdf32.dll
FF - plugin: D:\DivX\DivX Player\npDivxPlayerPlugin.dll
FF - plugin: D:\DivX\DivX Web Player\npdivx32.dll
FF - plugin: D:\iTunes\Mozilla Plugins\npitunes.dll
FF - plugin: D:\VideoLAN\npvlc.dll
FF - ExtSQL: 2012-11-25 01:38; virtualKeyboard@kaspersky.ru; D:\Kaspersky Lab\Kaspersky Anti-Virus 2012\FFExt\virtualKeyboard@kaspersky.ru
FF - ExtSQL: 2012-11-25 01:38; linkfilter@kaspersky.ru; D:\Kaspersky Lab\Kaspersky Anti-Virus 2012\FFExt\linkfilter@kaspersky.ru
.
============= SERVICES / DRIVERS ===============
.
R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;C:\Windows\System32\drivers\dtsoftbus01.sys [2012-6-15 283200]
R1 kl2;kl2;C:\Windows\System32\drivers\kl2.sys [2011-3-4 11864]
R1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter;C:\Windows\System32\drivers\klim6.sys [2011-3-10 29488]
R2 AMD External Events Utility;AMD External Events Utility;C:\Windows\System32\atiesrxx.exe [2012-4-6 236544]
R2 AVP;Kaspersky Anti-Virus Service;D:\Kaspersky Lab\Kaspersky Anti-Virus 2012\avp.exe [2011-4-24 206448]
R2 RalinkRegistryWriter64;Ralink Registry Writer 64;C:\Program Files (x86)\Edimax\Common\RaRegistry64.exe [2011-1-24 211232]
R2 sdiahnhost;Anschlussumleitung AGPv3.5 für;C:\Windows\System32\srchbdmin.exe [2012-11-14 113152]
R2 TomTomHOMEService;TomTomHOMEService;D:\TomTom HOME 2\TomTomHOMEService.exe [2012-1-23 92592]
R3 AtiHDAudioService;AMD Function Driver for HD Audio Service;C:\Windows\System32\drivers\AtihdW76.sys [2012-5-14 96896]
R3 klmouflt;Kaspersky Lab KLMOUFLT;C:\Windows\System32\drivers\klmouflt.sys [2009-11-2 22544]
R3 LGBusEnum;Logitech GamePanel Virtual Bus Enumerator Driver;C:\Windows\System32\drivers\LGBusEnum.sys [2009-11-23 22408]
R3 LGVirHid;Logitech Gamepanel Virtual HID Device Driver;C:\Windows\System32\drivers\LGVirHid.sys [2009-11-23 16008]
R3 RTL8167;Realtek 8167 NT Driver;C:\Windows\System32\drivers\Rt64win7.sys [2011-6-10 539240]
R3 RTL8187;Realtek RTL8187 Wireless 802.11b/g 54Mbps USB 2.0 Network Adapter;C:\Windows\System32\drivers\RTL8187.sys [2010-1-7 448512]
R3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;C:\Windows\System32\drivers\yk62x64.sys [2009-9-28 395264]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]
S2 SkypeUpdate;Skype Updater;C:\Program Files (x86)\Skype\Updater\Updater.exe [2012-7-13 160944]
S3 fssfltr;fssfltr;C:\Windows\System32\drivers\fssfltr.sys [2011-7-11 48488]
S3 Netaapl;Apple Mobile Device Ethernet Service;C:\Windows\System32\drivers\netaapl64.sys [2011-8-2 22528]
S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;C:\Windows\System32\drivers\rdpvideominiport.sys [2012-3-17 20992]
S3 TsUsbFlt;TsUsbFlt;C:\Windows\System32\drivers\TsUsbFlt.sys [2011-6-21 59392]
S3 USBAAPL64;Apple Mobile USB Driver;C:\Windows\System32\drivers\usbaapl64.sys [2012-7-9 52736]
S3 WatAdminSvc;Windows-Aktivierungstechnologieservice;C:\Windows\System32\Wat\WatAdminSvc.exe [2010-6-7 1255736]
S4 Droppix Service;Droppix Service;C:\Program Files (x86)\Common Files\Droppix\DxService.exe [2010-12-23 221184]
.
=============== Created Last 30 ================
.
2012-11-25 10:46:15 39984 ----a-w- C:\Windows\SysWow64\drivers\mbamswissarmy.sys
2012-11-25 10:46:12 25928 ----a-w- C:\Windows\System32\drivers\mbam.sys
2012-11-25 00:38:14 -------- d-----w- C:\ProgramData\Kaspersky Lab
2012-11-23 13:53:59 9125352 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{13A6806F-3B2C-4DA6-98E5-6E4DF226BF1A}\mpengine.dll
2012-11-14 23:01:14 9728 ----a-w- C:\Windows\System32\Wdfres.dll
2012-11-14 23:01:14 785512 ----a-w- C:\Windows\System32\drivers\Wdf01000.sys
2012-11-14 23:01:14 54376 ----a-w- C:\Windows\System32\drivers\WdfLdr.sys
2012-11-14 23:01:14 2560 ----a-w- C:\Windows\System32\drivers\de-DE\wdf01000.sys.mui
2012-11-14 22:49:51 87040 ----a-w- C:\Windows\System32\drivers\WUDFPf.sys
2012-11-14 22:49:51 198656 ----a-w- C:\Windows\System32\drivers\WUDFRd.sys
2012-11-14 22:49:50 84992 ----a-w- C:\Windows\System32\WUDFSvc.dll
2012-11-14 22:49:50 45056 ----a-w- C:\Windows\System32\WUDFCoinstaller.dll
2012-11-14 22:49:50 229888 ----a-w- C:\Windows\System32\WUDFHost.exe
2012-11-14 22:49:50 194048 ----a-w- C:\Windows\System32\WUDFPlatform.dll
2012-11-14 22:49:49 744448 ----a-w- C:\Windows\System32\WUDFx.dll
2012-11-14 19:10:42 -------- d-----w- C:\Windows\de
2012-11-14 19:09:49 -------- d-----w- C:\Program Files (x86)\Microsoft SQL Server Compact Edition
2012-11-14 19:02:54 89944 ----a-w- C:\Program Files (x86)\Common Files\Windows Live\.cache\a562333d1cdc29a04\DSETUP.dll
2012-11-14 19:02:54 537432 ----a-w- C:\Program Files (x86)\Common Files\Windows Live\.cache\a562333d1cdc29a04\DXSETUP.exe
2012-11-14 19:02:54 1801048 ----a-w- C:\Program Files (x86)\Common Files\Windows Live\.cache\a562333d1cdc29a04\dsetup32.dll
2012-11-14 19:02:50 94040 ----a-w- C:\Program Files (x86)\Common Files\Windows Live\.cache\a2fac72a1cdc29a03\DSETUP.dll
2012-11-14 19:02:50 525656 ----a-w- C:\Program Files (x86)\Common Files\Windows Live\.cache\a2fac72a1cdc29a03\DXSETUP.exe
2012-11-14 19:02:50 1691480 ----a-w- C:\Program Files (x86)\Common Files\Windows Live\.cache\a2fac72a1cdc29a03\dsetup32.dll
2012-11-14 19:02:46 89944 ----a-w- C:\Program Files (x86)\Common Files\Windows Live\.cache\a15c7a691cdc29a02\DSETUP.dll
2012-11-14 19:02:46 537432 ----a-w- C:\Program Files (x86)\Common Files\Windows Live\.cache\a15c7a691cdc29a02\DXSETUP.exe
2012-11-14 19:02:46 1801048 ----a-w- C:\Program Files (x86)\Common Files\Windows Live\.cache\a15c7a691cdc29a02\dsetup32.dll
2012-11-14 19:02:44 5659096 ----a-w- C:\Program Files (x86)\Common Files\Windows Live\.cache\9d793e361cdc29a01\skydrivesetup.exe
2012-11-14 18:47:21 -------- d-----w- C:\Users\Dominic\AppData\Local\InstallShare
2012-11-14 18:47:16 113152 ----a-w- C:\Windows\System32\srchbdmin.exe
2012-11-14 18:46:04 -------- d-----w- C:\ProgramData\AVS4YOU
2012-11-14 18:45:40 -------- d-----w- C:\Users\Dominic\AppData\Roaming\AVS4YOU
2012-11-14 18:45:08 -------- d-----w- C:\Program Files (x86)\AVS4YOU
2012-11-14 18:44:28 -------- d-----w- C:\Program Files (x86)\Common Files\AVSMedia
2012-11-14 18:44:25 24576 ----a-w- C:\Windows\SysWow64\msxml3a.dll
2012-11-14 18:44:25 1700352 ----a-w- C:\Windows\SysWow64\GdiPlus.dll
2012-11-13 22:59:59 -------- d-----w- C:\ProgramData\Uniblue
2012-11-13 22:56:50 -------- d-----w- C:\Users\Dominic\AppData\Roaming\4Free
.
==================== Find3M ====================
.
2012-11-23 18:16:02 73656 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
2012-11-23 18:16:02 697272 ----a-w- C:\Windows\SysWow64\FlashPlayerApp.exe
2012-10-18 18:25:58 3149824 ----a-w- C:\Windows\System32\win32k.sys
2012-10-09 18:17:13 55296 ----a-w- C:\Windows\System32\dhcpcsvc6.dll
2012-10-09 18:17:13 226816 ----a-w- C:\Windows\System32\dhcpcore6.dll
2012-10-09 17:40:31 44032 ----a-w- C:\Windows\SysWow64\dhcpcsvc6.dll
2012-10-09 17:40:31 193536 ----a-w- C:\Windows\SysWow64\dhcpcore6.dll
2012-10-03 17:56:54 1914248 ----a-w- C:\Windows\System32\drivers\tcpip.sys
2012-10-03 17:44:21 70656 ----a-w- C:\Windows\System32\nlaapi.dll
2012-10-03 17:44:21 303104 ----a-w- C:\Windows\System32\nlasvc.dll
2012-10-03 17:44:17 246272 ----a-w- C:\Windows\System32\netcorehc.dll
2012-10-03 17:44:17 18944 ----a-w- C:\Windows\System32\netevent.dll
2012-10-03 17:44:16 216576 ----a-w- C:\Windows\System32\ncsi.dll
2012-10-03 17:42:16 569344 ----a-w- C:\Windows\System32\iphlpsvc.dll
2012-10-03 16:42:24 18944 ----a-w- C:\Windows\SysWow64\netevent.dll
2012-10-03 16:42:24 175104 ----a-w- C:\Windows\SysWow64\netcorehc.dll
2012-10-03 16:42:23 156672 ----a-w- C:\Windows\SysWow64\ncsi.dll
2012-10-03 16:07:26 45568 ----a-w- C:\Windows\System32\drivers\tcpipreg.sys
2012-09-28 13:37:02 221696 ----a-w- C:\Windows\System32\clinfo.exe
2012-09-28 13:36:44 75776 ----a-w- C:\Windows\System32\OpenVideo64.dll
2012-09-28 13:36:40 65536 ----a-w- C:\Windows\SysWow64\OpenVideo.dll
2012-09-28 13:36:36 63488 ----a-w- C:\Windows\System32\OVDecode64.dll
2012-09-28 13:36:34 56320 ----a-w- C:\Windows\SysWow64\OVDecode.dll
2012-09-28 13:36:24 32635904 ----a-w- C:\Windows\System32\amdocl64.dll
2012-09-28 13:32:16 27341824 ----a-w- C:\Windows\SysWow64\amdocl.dll
2012-09-25 22:47:43 78336 ----a-w- C:\Windows\SysWow64\synceng.dll
2012-09-25 22:46:17 95744 ----a-w- C:\Windows\System32\synceng.dll
2012-09-14 19:19:29 2048 ----a-w- C:\Windows\System32\tzres.dll
2012-09-14 18:28:53 2048 ----a-w- C:\Windows\SysWow64\tzres.dll
2012-09-12 15:07:44 58368 ----a-w- C:\Windows\SysWow64\sirenacm.dll
2012-09-12 14:57:44 322048 ----a-w- C:\Windows\WLXPGSS.SCR
2012-08-31 18:19:35 1659760 ----a-w- C:\Windows\System32\drivers\ntfs.sys
2012-08-30 18:03:45 5559664 ----a-w- C:\Windows\System32\ntoskrnl.exe
2012-08-30 17:12:02 3968880 ----a-w- C:\Windows\SysWow64\ntkrnlpa.exe
2012-08-30 17:12:02 3914096 ----a-w- C:\Windows\SysWow64\ntoskrnl.exe
.
============= FINISH: 13:08:46.64 ===============
--- --- --- --- --- --- attach-file: Code:
ATTFilter .
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2012-11-20.01)
.
Microsoft Windows 7 Ultimate
Boot Device: \Device\HarddiskVolume3
Install Date: 22.02.2010 20:18:48
System Uptime: 25.11.2012 13:04:32 (0 hours ago)
.
Motherboard: ASUSTeK Computer INC. | | P5K3 Deluxe
Processor: Intel(R) Core(TM)2 Quad CPU @ 2.40GHz | LGA775 | 2394/266mhz
.
==== Disk Partitions =========================
.
A: is Removable
C: is FIXED (NTFS) - 60 GiB total, 11.643 GiB free.
D: is FIXED (NTFS) - 218 GiB total, 50.83 GiB free.
F: is CDROM ()
G: is FIXED (NTFS) - 100 GiB total, 13.229 GiB free.
H: is FIXED (NTFS) - 0 GiB total, 0.07 GiB free.
I: is FIXED (NTFS) - 348 GiB total, 84.51 GiB free.
J: is FIXED (NTFS) - 248 GiB total, 94.661 GiB free.
K: is CDROM (CDFS)
L: is FIXED (NTFS) - 189 GiB total, 184.834 GiB free.
M: is Removable
Q: is CDROM (CDFS)
.
==== Disabled Device Manager Items =============
.
Class GUID: {4D36E97B-E325-11CE-BFC1-08002BE10318}
Description: AJPJ8BHJ IDE Controller
Device ID: ACPI\PNPA000\4&5D18F2DF&0
Manufacturer: (Standard mass storage controllers)
Name: AJPJ8BHJ IDE Controller
PNP Device ID: ACPI\PNPA000\4&5D18F2DF&0
Service: a2vggo7z
.
Class GUID: {4d36e96b-e325-11ce-bfc1-08002be10318}
Description: Standardtastatur (PS/2)
Device ID: ACPI\PNP0303\4&23F9C1E3&0
Manufacturer: (Standardtastaturen)
Name: Standardtastatur (PS/2)
PNP Device ID: ACPI\PNP0303\4&23F9C1E3&0
Service: i8042prt
.
==== System Restore Points ===================
.
No restore point in system.
.
==== Installed Programs ======================
.
Update for Microsoft Office 2007 (KB2508958)
3DMark06
4Free Video Converter 2
Adobe Flash Player 11 ActiveX
Adobe Flash Player 11 Plugin 64-bit
Adobe Reader X (10.1.1) - Deutsch
AegisPanel2
AMD Accelerated Video Transcoding
AMD APP SDK Runtime
AMD Catalyst Install Manager
AMD Drag and Drop Transcoding
AMD Media Foundation Decoders
ANNO 2070
Apple Application Support
Apple Mobile Device Support
Apple Software Update
ArmA 2 Free Uninstall
ATI Catalyst Registration
AVS Update Manager 1.0
BOILING POINT
Bonjour
Canon MP270 series MP Drivers
Catalyst Control Center
Catalyst Control Center - Branding
Catalyst Control Center Graphics Previews Common
Catalyst Control Center Localization All
ccc-utility64
CCC Help Chinese Standard
CCC Help Chinese Traditional
CCC Help Czech
CCC Help Danish
CCC Help Dutch
CCC Help English
CCC Help Finnish
CCC Help French
CCC Help German
CCC Help Greek
CCC Help Hungarian
CCC Help Italian
CCC Help Japanese
CCC Help Korean
CCC Help Norwegian
CCC Help Polish
CCC Help Portuguese
CCC Help Russian
CCC Help Spanish
CCC Help Swedish
CCC Help Thai
CCC Help Turkish
CCleaner
Cisco EAP-FAST Module
Cisco LEAP Module
Cisco PEAP Module
ColorKey 1
Counter-Strike: Global Offensive
Counter-Strike: Global Offensive - SDK
Creative Software AutoUpdate
Crysis(R)
CutWizard
D3DX10
Die Sims 2
Die Sims 2: Nightlife
Die Sims 2: Open For Business
Die Sims™ 2 IKEA® Home-Accessoires
Die Sims™ 2 Vier Jahreszeiten
DivX
DivX Converter
DivX Player
DivX Web Player
Droppix Label Maker 2.x
EDIMAX Edimax Wireless LAN
F1 2010
Facebook Plug-In
Fotogalerie
Free Audio CD Burner version 1.4
Free DVD Video Burner version 2.1
Free DVD Video Converter version 1.5.12
Free Studio version 5.7.7.1031
Free Video Flip and Rotate version 2.1.4.1031
Free Video to DVD Converter version 1.2
Free YouTube Download version 3.1.38.1005
Free YouTube to MP3 Converter version 3.7
Futuremark SystemInfo
Google Earth
Google Update Helper
Grand Theft Auto IV
Grand Theft Auto San Andreas
GRID
HijackThis 1.99.1
HTML TADS Player Kit
iCloud
ImgBurn
Inkscape 0.48.2
iTunes
Java Auto Updater
Java(TM) 6 Update 27
Java(TM) 7 Update 3 (64-bit)
Junk Mail filter update
Kaspersky Anti-Virus 2012
LevelR
LightScribe System Software 1.14.25.1
Logitech GamePanel Software 3.04.137
Malwarebytes Anti-Malware Version 1.65.1.1000
Microsoft .NET Framework 4 Client Profile
Microsoft Application Error Reporting
Microsoft Flight Simulator X
Microsoft Games for Windows - LIVE Redistributable
Microsoft Games for Windows Marketplace
Microsoft Office 2007 Service Pack 3 (SP3)
Microsoft Office Excel MUI (German) 2007
Microsoft Office File Validation Add-In
Microsoft Office Home and Student 2007
Microsoft Office Live Add-in 1.5
Microsoft Office Office 64-bit Components 2007
Microsoft Office OneNote MUI (German) 2007
Microsoft Office PowerPoint MUI (German) 2007
Microsoft Office PowerPoint Viewer 2003
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (German) 2007
Microsoft Office Proof (Italian) 2007
Microsoft Office Proofing (German) 2007
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
Microsoft Office Shared 64-bit MUI (German) 2007
Microsoft Office Shared MUI (German) 2007
Microsoft Office Word MUI (German) 2007
Microsoft Silverlight
Microsoft SQL Server 2005 Compact Edition [ENU]
Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2005 Redistributable (x64)
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
Microsoft_VC100_CRT_SP1_x64
Microsoft_VC100_CRT_SP1_x86
MobileMe Control Panel
Movie Maker
Mozilla Firefox 17.0 (x86 en-US)
MSVC80_x64_v2
MSVC80_x86_v2
MSVC90_x64
MSVC90_x86
MSVCRT
MSVCRT_amd64
MSVCRT110
MSVCRT110_amd64
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
MSXML 4.0 SP2 Parser and SDK
Multi-Card Reader & Flash Disk
Nail'd
NCIS Game
Need For Speed Underground
Need for Speed(TM) Hot Pursuit
Need For Speed™ World
Nero 7 Ultra Edition
Photo Common
Photo Gallery
PS3 Media Server
PunkBuster Services
QuickTime
Recover My Files
Rockstar Games Social Club
RollerCoaster Tycoon 2
Security Update for Microsoft .NET Framework 4 Client Profile (KB2160841)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368v2)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656405)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2686827)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2729449)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2737019)
Security Update for Microsoft Office 2007 suites (KB2596615) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596672) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596744) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596754) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596785) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596792) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596856) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596871) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2597969) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2687311) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2687314) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2687441) 32-Bit Edition
Security Update for Microsoft Office Excel 2007 (KB2687307) 32-Bit Edition
Security Update for Microsoft Office InfoPath 2007 (KB2687440) 32-Bit Edition
Security Update for Microsoft Office PowerPoint 2007 (KB2596764) 32-Bit Edition
Security Update for Microsoft Office PowerPoint 2007 (KB2596912) 32-Bit Edition
Security Update for Microsoft Office Word 2007 (KB2687315) 32-Bit Edition
Skype™ 5.10
Sound Blaster Audigy
Star Wars(TM): Knights of the Old Republic (TM)
Tales of Monkey Island
TeamSpeak 3 Client
TeraCopy 2.12
The Lord of the Rings FREE Trial
Tom Clancy's Splinter Cell Conviction
TomTom HOME 2.8.3.2499
TomTom HOME Visual Studio Merge Modules
Tunatic
TuneUp Utilities
TuneUp Utilities Language Pack (de-DE)
Ubisoft Game Launcher
Uninstall 1.0.0.1
Update für Microsoft Office Excel 2007 Help (KB963678)
Update für Microsoft Office Powerpoint 2007 Help (KB963669)
Update für Microsoft Office Word 2007 Help (KB963665)
Update for 2007 Microsoft Office System (KB967642)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217)
Update for Microsoft Office 2007 suites (KB2596660) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2596848) 32-Bit Edition
VLC media player 1.1.8
Vuze
Windows Live Communications Platform
Windows Live Essentials
Windows Live ID Sign-in Assistant
Windows Live Installer
Windows Live Mail
Windows Live Messenger
Windows Live MIME IFilter
Windows Live Photo Common
Windows Live PIMT Platform
Windows Live SOXE
Windows Live SOXE Definitions
Windows Live UX Platform
Windows Live UX Platform Language Pack
Windows Live Writer
Windows Live Writer Resources
WinRAR Archivierer
World of Tanks
World of Warcraft
.
==== End Of File ===========================
Ist auch nicht in der Software- Liste aufgeführt... Edit1: Zweiter Spoiler funktionierte nicht. Geändert von DoPorti (25.11.2012 um 13:29 Uhr) |
|
25.11.2012, 13:44
| #4 | ||
| /// TB-Ausbilder | Inet-Browser extrem langsam, Ständig abstürze mit FF Na dann gehts weiter: Schritt 1: Windows-Defender abschalten Da du einen anderen Virenscanner benutzt solltest du dringend den windowseigenen Scanner abschalten:
Schritt 2: Deinstalliere Tuneup Utilities, HIjackthis, beide Java-Installationen (du brauchst ausserdem nur die 32bit Version, die andere funktioniert oft nicht). Schritt 3: Java Update (Windows XP, Vista, 7) Dein Java ist nicht mehr aktuell. Ältere Versionen enthalten Sicherheitslücken, die von Malware missbraucht werden können.Schritt 4: Scan mit Combofix
__________________  Digitale Freibeuter gegen Malware! Keine Hilfe per PM! |
|
25.11.2012, 15:16
| #5 |
| | Inet-Browser extrem langsam, Ständig abstürze mit FF Danke. Hat alles geklappt. Bis jetzt hat er einen Trojaner gefunden und eliminiert. Code:
ATTFilter ComboFix 12-11-25.01 - Dominic 25.11.2012 15:01:08.1.4 - x64
Microsoft Windows 7 Ultimate 6.1.7601.1.1252.41.1031.18.8191.5930 [GMT 1:00]
ausgeführt von:: c:\users\Dominic\Desktop\ComboFix.exe
AV: Kaspersky Anti-Virus *Enabled/Updated* {2EAA32A5-1EE1-1B22-95DA-337730C6E984}
SP: Kaspersky Anti-Virus *Enabled/Updated* {95CBD341-38DB-14AC-AF6A-08054B41A339}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\SysWow64\tmp3458.tmp
c:\windows\SysWow64\tmp3C19.tmp
c:\windows\SysWow64\tmp3C49.tmp
c:\windows\SysWow64\tmp9D6B.tmp
c:\windows\SysWow64\tmpB165.tmp
c:\windows\SysWow64\tmpB1D3.tmp
.
.
((((((((((((((((((((((( Dateien erstellt von 2012-10-25 bis 2012-11-25 ))))))))))))))))))))))))))))))
.
.
2012-11-25 14:09 . 2012-11-25 14:09 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-11-25 13:50 . 2012-11-25 13:50 821736 ----a-w- c:\windows\SysWow64\npDeployJava1.dll
2012-11-25 13:50 . 2012-11-25 13:50 95208 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll
2012-11-25 13:50 . 2012-11-25 13:50 -------- d-----w- c:\program files (x86)\lib
2012-11-25 13:50 . 2012-11-25 13:50 -------- d-----w- c:\program files (x86)\bin
2012-11-25 10:46 . 2011-05-29 08:11 39984 ----a-w- c:\windows\SysWow64\drivers\mbamswissarmy.sys
2012-11-25 10:46 . 2012-09-29 18:54 25928 ----a-w- c:\windows\system32\drivers\mbam.sys
2012-11-25 00:38 . 2012-11-25 13:55 -------- d-----w- c:\programdata\Kaspersky Lab
2012-11-25 00:38 . 2012-11-25 10:30 637272 ----a-w- c:\windows\system32\drivers\klif.sys
2012-11-23 18:21 . 2012-11-23 18:21 -------- d-----w- c:\windows\Sun
2012-11-23 13:53 . 2012-11-08 17:24 9125352 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{13A6806F-3B2C-4DA6-98E5-6E4DF226BF1A}\mpengine.dll
2012-11-14 23:01 . 2012-07-26 07:46 2560 ----a-w- c:\windows\system32\drivers\de-DE\wdf01000.sys.mui
2012-11-14 23:01 . 2012-07-26 04:55 785512 ----a-w- c:\windows\system32\drivers\Wdf01000.sys
2012-11-14 23:01 . 2012-07-26 04:55 54376 ----a-w- c:\windows\system32\drivers\WdfLdr.sys
2012-11-14 23:01 . 2012-07-26 02:36 9728 ----a-w- c:\windows\system32\Wdfres.dll
2012-11-14 22:49 . 2012-07-26 02:26 87040 ----a-w- c:\windows\system32\drivers\WUDFPf.sys
2012-11-14 22:49 . 2012-07-26 02:26 198656 ----a-w- c:\windows\system32\drivers\WUDFRd.sys
2012-11-14 22:49 . 2012-07-26 03:08 229888 ----a-w- c:\windows\system32\WUDFHost.exe
2012-11-14 22:49 . 2012-07-26 03:08 84992 ----a-w- c:\windows\system32\WUDFSvc.dll
2012-11-14 22:49 . 2012-07-26 03:08 45056 ----a-w- c:\windows\system32\WUDFCoinstaller.dll
2012-11-14 22:49 . 2012-07-26 03:08 194048 ----a-w- c:\windows\system32\WUDFPlatform.dll
2012-11-14 22:49 . 2012-07-26 03:08 744448 ----a-w- c:\windows\system32\WUDFx.dll
2012-11-14 19:10 . 2012-11-14 19:10 -------- d-----w- c:\windows\de
2012-11-14 19:09 . 2012-11-14 19:09 -------- d-----w- c:\program files (x86)\Microsoft SQL Server Compact Edition
2012-11-14 19:08 . 2012-11-14 19:08 -------- d-----w- c:\program files\Windows Live
2012-11-14 19:02 . 2012-11-14 19:02 89944 ----a-w- c:\program files (x86)\Common Files\Windows Live\.cache\a562333d1cdc29a04\DSETUP.dll
2012-11-14 19:02 . 2012-11-14 19:02 537432 ----a-w- c:\program files (x86)\Common Files\Windows Live\.cache\a562333d1cdc29a04\DXSETUP.exe
2012-11-14 19:02 . 2012-11-14 19:02 1801048 ----a-w- c:\program files (x86)\Common Files\Windows Live\.cache\a562333d1cdc29a04\dsetup32.dll
2012-11-14 19:02 . 2012-11-14 19:02 94040 ----a-w- c:\program files (x86)\Common Files\Windows Live\.cache\a2fac72a1cdc29a03\DSETUP.dll
2012-11-14 19:02 . 2012-11-14 19:02 525656 ----a-w- c:\program files (x86)\Common Files\Windows Live\.cache\a2fac72a1cdc29a03\DXSETUP.exe
2012-11-14 19:02 . 2012-11-14 19:02 1691480 ----a-w- c:\program files (x86)\Common Files\Windows Live\.cache\a2fac72a1cdc29a03\dsetup32.dll
2012-11-14 19:02 . 2012-11-14 19:02 89944 ----a-w- c:\program files (x86)\Common Files\Windows Live\.cache\a15c7a691cdc29a02\DSETUP.dll
2012-11-14 19:02 . 2012-11-14 19:02 537432 ----a-w- c:\program files (x86)\Common Files\Windows Live\.cache\a15c7a691cdc29a02\DXSETUP.exe
2012-11-14 19:02 . 2012-11-14 19:02 1801048 ----a-w- c:\program files (x86)\Common Files\Windows Live\.cache\a15c7a691cdc29a02\dsetup32.dll
2012-11-14 19:02 . 2012-11-14 19:02 5659096 ----a-w- c:\program files (x86)\Common Files\Windows Live\.cache\9d793e361cdc29a01\skydrivesetup.exe
2012-11-14 18:47 . 2012-11-14 18:47 -------- d-----w- c:\users\Dominic\AppData\Local\InstallShare
2012-11-14 18:47 . 2012-11-14 18:47 113152 ----a-w- c:\windows\system32\srchbdmin.exe
2012-11-14 18:46 . 2012-11-14 18:46 -------- d-----w- c:\programdata\AVS4YOU
2012-11-14 18:45 . 2012-11-14 18:45 -------- d-----w- c:\users\Dominic\AppData\Roaming\AVS4YOU
2012-11-14 18:45 . 2012-11-23 18:20 -------- d-----w- c:\program files (x86)\AVS4YOU
2012-11-14 18:44 . 2012-11-23 18:20 -------- d-----w- c:\program files (x86)\Common Files\AVSMedia
2012-11-14 18:44 . 2011-06-23 12:26 1700352 ----a-w- c:\windows\SysWow64\GdiPlus.dll
2012-11-14 18:44 . 2011-06-23 12:25 24576 ----a-w- c:\windows\SysWow64\msxml3a.dll
2012-11-13 22:59 . 2012-11-13 22:59 -------- d-----w- c:\programdata\Uniblue
2012-11-13 22:56 . 2012-11-13 22:56 -------- d-----w- c:\users\Dominic\AppData\Roaming\4Free
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-11-25 13:50 . 2012-01-26 20:48 746984 ----a-w- c:\windows\SysWow64\deployJava1.dll
2012-11-23 18:16 . 2012-04-07 19:38 73656 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2012-11-23 18:16 . 2012-04-07 19:38 697272 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2012-11-14 22:50 . 2012-03-26 15:11 66395536 ----a-w- c:\windows\system32\MRT.exe
2012-09-28 13:37 . 2012-09-28 13:37 221696 ----a-w- c:\windows\system32\clinfo.exe
2012-09-28 13:36 . 2012-09-28 13:36 75776 ----a-w- c:\windows\system32\OpenVideo64.dll
2012-09-28 13:36 . 2012-09-28 13:36 65536 ----a-w- c:\windows\SysWow64\OpenVideo.dll
2012-09-28 13:36 . 2012-09-28 13:36 63488 ----a-w- c:\windows\system32\OVDecode64.dll
2012-09-28 13:36 . 2012-09-28 13:36 56320 ----a-w- c:\windows\SysWow64\OVDecode.dll
2012-09-28 13:36 . 2012-09-28 13:36 32635904 ----a-w- c:\windows\system32\amdocl64.dll
2012-09-28 13:32 . 2012-09-28 13:32 27341824 ----a-w- c:\windows\SysWow64\amdocl.dll
2012-09-14 19:19 . 2012-10-11 15:21 2048 ----a-w- c:\windows\system32\tzres.dll
2012-09-14 18:28 . 2012-10-11 15:21 2048 ----a-w- c:\windows\SysWow64\tzres.dll
2012-09-12 15:07 . 2012-09-12 15:07 58368 ----a-w- c:\windows\SysWow64\sirenacm.dll
2012-09-12 14:57 . 2012-09-12 14:57 322048 ----a-w- c:\windows\WLXPGSS.SCR
2012-08-31 18:19 . 2012-10-11 15:23 1659760 ----a-w- c:\windows\system32\drivers\ntfs.sys
2012-08-30 18:03 . 2012-10-11 15:23 5559664 ----a-w- c:\windows\system32\ntoskrnl.exe
2012-08-30 17:12 . 2012-10-11 15:23 3968880 ----a-w- c:\windows\SysWow64\ntkrnlpa.exe
2012-08-30 17:12 . 2012-10-11 15:23 3914096 ----a-w- c:\windows\SysWow64\ntoskrnl.exe
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1475584]
"MobileDocuments"="c:\program files (x86)\Common Files\Apple\Internet Services\ubd.exe" [2012-02-23 59240]
"DAEMON Tools Pro Agent"="c:\program files (x86)\DAEMON Tools Pro\DTAgent.exe" [2012-04-26 3111744]
"iCloudServices"="c:\program files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe" [2012-08-29 59280]
"ApplePhotoStreams"="c:\program files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe" [2012-09-10 59280]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"AMD AVT"="start AMD Accelerated Video Transcoding device initialization" [X]
"CTSysVol"="d:\creative\SBAudigy\Surround Mixer\CTSysVol.exe" [2005-10-31 57344]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2012-04-05 641664]
"AppleSyncNotifier"="c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2011-09-27 59240]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-10-11 59280]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2011-10-24 421888]
"AVP"="d:\kaspersky lab\Kaspersky Anti-Virus 2012\avp.exe" [2012-11-25 206448]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1475584]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Wireless Utility.lnk - c:\program files (x86)\Edimax\Common\RaUI.exe [2012-9-14 1794048]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoActiveDesktop"= 1 (0x1)
"ForceActiveDesktopOn"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux6"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\run-]
"UpdReg"=c:\windows\UpdReg.EXE
"ATICustomerCare"="c:\program files (x86)\ATI\ATICustomerCare\ATICustomerCare.exe"
"iTunesHelper"="d:\itunes\iTunesHelper.exe"
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
.
R1 74402144;74402144;c:\windows\system32\DRIVERS\74402144.sys [x]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2012-07-13 160944]
R3 cpuz130;cpuz130;c:\users\Dominic\AppData\Local\Temp\cpuz130\cpuz_x64.sys [x]
R3 EverestDriver;Lavalys EVEREST Kernel Driver;d:\everest ultimate edition\kerneld.amd64 [x]
R3 Netaapl;Apple Mobile Device Ethernet Service;c:\windows\system32\DRIVERS\netaapl64.sys [2011-08-02 22528]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2010-11-20 20992]
R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 59392]
R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys [x]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [2012-07-09 52736]
R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys [x]
R3 WatAdminSvc;Windows-Aktivierungstechnologieservice;c:\windows\system32\Wat\WatAdminSvc.exe [2010-06-07 1255736]
R4 Droppix Service;Droppix Service;c:\program files (x86)\Common Files\Droppix\DxService.exe [2009-03-12 221184]
S0 sptd;sptd;c:\windows\\SystemRoot\System32\Drivers\sptd.sys [x]
S1 kl2;kl2;c:\windows\system32\DRIVERS\kl2.sys [2011-03-04 11864]
S1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter;c:\windows\system32\DRIVERS\klim6.sys [2011-03-10 29488]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2012-04-06 236544]
S2 RalinkRegistryWriter64;Ralink Registry Writer 64;c:\program files (x86)\Edimax\Common\RaRegistry64.exe [2009-07-14 211232]
S2 sdiahnhost;Anschlussumleitung AGPv3.5 für;c:\windows\system32\srchbdmin.exe [2012-11-14 113152]
S2 TomTomHOMEService;TomTomHOMEService;d:\tomtom home 2\TomTomHOMEService.exe [2012-01-23 92592]
S3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys [2012-05-14 96896]
S3 klmouflt;Kaspersky Lab KLMOUFLT;c:\windows\system32\DRIVERS\klmouflt.sys [2009-11-02 22544]
S3 LGBusEnum;Logitech GamePanel Virtual Bus Enumerator Driver;c:\windows\system32\drivers\LGBusEnum.sys [2009-11-23 22408]
S3 LGVirHid;Logitech Gamepanel Virtual HID Device Driver;c:\windows\system32\drivers\LGVirHid.sys [2009-11-23 16008]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2011-06-10 539240]
S3 RTL8187;Realtek RTL8187 Wireless 802.11b/g 54Mbps USB 2.0 Network Adapter;c:\windows\system32\DRIVERS\rtl8187.sys [2010-01-07 448512]
S3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x64.sys [2009-09-28 395264]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2008-08-22 13:11 451872 ----a-w- c:\program files (x86)\Common Files\LightScribe\LSRunOnce.exe
.
Inhalt des "geplante Tasks" Ordners
.
2012-04-01 c:\windows\Tasks\Driver Robot.job
- c:\program files (x86)\Driver Robot\Driver Robot.lnk [2012-04-01 10:45]
.
2012-11-25 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-06-25 12:30]
.
2012-11-25 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-06-25 12:30]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Launch LgDeviceAgent"="c:\program files\Logitech\GamePanel Software\LgDevAgt.exe" [2009-12-10 415752]
"Launch LCDMon"="c:\program files\Logitech\GamePanel Software\LCD Manager\LCDMon.exe" [2009-12-10 2093064]
"Launch LGDCore"="c:\program files\Logitech\GamePanel Software\G-series Software\LGDCore.exe" [2009-12-10 4271624]
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.google.de/ncr
mStart Page = about:blank
mLocal Page = c:\windows\SYSTEM32\blank.htm
IE: Nach Microsoft E&xel exportieren - d:\micros~1\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\users\Dominic\AppData\Roaming\Mozilla\Firefox\Profiles\6ud5bzf4.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.google.de/ncr
FF - ExtSQL: 2012-11-25 01:38; virtualKeyboard@kaspersky.ru; d:\kaspersky lab\Kaspersky Anti-Virus 2012\FFExt\virtualKeyboard@kaspersky.ru
FF - ExtSQL: 2012-11-25 01:38; linkfilter@kaspersky.ru; d:\kaspersky lab\Kaspersky Anti-Virus 2012\FFExt\linkfilter@kaspersky.ru
FF - user.js: browser.search.defaultenginename - Google
FF - user.js: browser.search.selectedEngine - Google
FF - user.js: browser.startup.homepage - hxxp://www.google.de/ncr
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
SafeBoot-40726849.sys
AddRemove-PunkBusterSvc - c:\windows\system32\pbsvc.exe
.
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EverestDriver]
"ImagePath"="\??\d:\everest ultimate edition\kerneld.amd64"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\S-1-5-21-2015671977-4043839625-2418745644-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eml\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLiveMail.Email.1"
.
[HKEY_USERS\S-1-5-21-2015671977-4043839625-2418745644-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vcf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLiveMail.VCard.1"
.
[HKEY_USERS\S-1-5-21-2015671977-4043839625-2418745644-1001\Software\SecuROM\License information*]
@Allowed: (Read) (RestrictedCode)
"datasecu"=hex:1e,33,e3,c4,58,81,a8,78,3e,8c,68,09,71,27,37,af,24,ea,f2,f1,ac,
42,52,65,2a,54,a7,b2,b9,54,65,58,7a,86,d3,77,0b,98,e4,d0,02,2d,3c,55,8e,1e,\
"rkeysecu"=hex:d2,d2,5a,db,fa,eb,9d,a8,14,59,5a,9c,fa,a4,cb,98
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_5_502_110_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_5_502_110_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_5_502_110_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_5_502_110_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_5_502_110.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_5_502_110.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_5_502_110.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_5_502_110.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2012-11-25 15:14:12
ComboFix-quarantined-files.txt 2012-11-25 14:14
.
Vor Suchlauf: 15 Verzeichnis(se), 11'537'076'224 Bytes frei
Nach Suchlauf: 20 Verzeichnis(se), 11'413'512'192 Bytes frei
.
- - End Of File - - 8A7C5F16F63054B897477FF6338A741E
|
|
25.11.2012, 15:57
| #6 | ||
| /// TB-Ausbilder | Inet-Browser extrem langsam, Ständig abstürze mit FF Dann weiter: Am Ende bitte den Upload zulassen. Combofix-Skript
__________________ --> Inet-Browser extrem langsam, Ständig abstürze mit FF |
|
25.11.2012, 23:29
| #7 |
| | Inet-Browser extrem langsam, Ständig abstürze mit FF Done! Combofix Logfile: Code:
ATTFilter ComboFix 12-11-25.01 - Dominic 25.11.2012 23:16:41.2.4 - x64
Microsoft Windows 7 Ultimate 6.1.7601.1.1252.41.1031.18.8191.6266 [GMT 1:00]
ausgeführt von:: c:\users\Dominic\Desktop\ComboFix.exe
Benutzte Befehlsschalter :: c:\users\Dominic\Desktop\CFScript.txt
AV: Kaspersky Anti-Virus *Disabled/Updated* {2EAA32A5-1EE1-1B22-95DA-337730C6E984}
SP: Kaspersky Anti-Virus *Disabled/Updated* {95CBD341-38DB-14AC-AF6A-08054B41A339}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
.
((((((((((((((((((((((((((((((((((((((( Treiber/Dienste )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Service_74402144
-------\Service_sdiahnhost
.
.
((((((((((((((((((((((( Dateien erstellt von 2012-10-25 bis 2012-11-25 ))))))))))))))))))))))))))))))
.
.
2012-11-25 22:23 . 2012-11-25 22:23 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-11-25 13:50 . 2012-11-25 13:50 821736 ----a-w- c:\windows\SysWow64\npDeployJava1.dll
2012-11-25 13:50 . 2012-11-25 13:50 95208 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll
2012-11-25 13:50 . 2012-11-25 13:50 -------- d-----w- c:\program files (x86)\lib
2012-11-25 13:50 . 2012-11-25 13:50 -------- d-----w- c:\program files (x86)\bin
2012-11-25 10:46 . 2011-05-29 08:11 39984 ----a-w- c:\windows\SysWow64\drivers\mbamswissarmy.sys
2012-11-25 10:46 . 2012-09-29 18:54 25928 ----a-w- c:\windows\system32\drivers\mbam.sys
2012-11-25 00:38 . 2012-11-25 22:24 -------- d-----w- c:\programdata\Kaspersky Lab
2012-11-25 00:38 . 2012-11-25 10:30 637272 ----a-w- c:\windows\system32\drivers\klif.sys
2012-11-23 18:21 . 2012-11-23 18:21 -------- d-----w- c:\windows\Sun
2012-11-23 13:53 . 2012-11-08 17:24 9125352 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{13A6806F-3B2C-4DA6-98E5-6E4DF226BF1A}\mpengine.dll
2012-11-14 23:01 . 2012-07-26 07:46 2560 ----a-w- c:\windows\system32\drivers\de-DE\wdf01000.sys.mui
2012-11-14 23:01 . 2012-07-26 04:55 785512 ----a-w- c:\windows\system32\drivers\Wdf01000.sys
2012-11-14 23:01 . 2012-07-26 04:55 54376 ----a-w- c:\windows\system32\drivers\WdfLdr.sys
2012-11-14 23:01 . 2012-07-26 02:36 9728 ----a-w- c:\windows\system32\Wdfres.dll
2012-11-14 22:49 . 2012-07-26 02:26 87040 ----a-w- c:\windows\system32\drivers\WUDFPf.sys
2012-11-14 22:49 . 2012-07-26 02:26 198656 ----a-w- c:\windows\system32\drivers\WUDFRd.sys
2012-11-14 22:49 . 2012-07-26 03:08 229888 ----a-w- c:\windows\system32\WUDFHost.exe
2012-11-14 22:49 . 2012-07-26 03:08 84992 ----a-w- c:\windows\system32\WUDFSvc.dll
2012-11-14 22:49 . 2012-07-26 03:08 45056 ----a-w- c:\windows\system32\WUDFCoinstaller.dll
2012-11-14 22:49 . 2012-07-26 03:08 194048 ----a-w- c:\windows\system32\WUDFPlatform.dll
2012-11-14 22:49 . 2012-07-26 03:08 744448 ----a-w- c:\windows\system32\WUDFx.dll
2012-11-14 19:10 . 2012-11-14 19:10 -------- d-----w- c:\windows\de
2012-11-14 19:09 . 2012-11-14 19:09 -------- d-----w- c:\program files (x86)\Microsoft SQL Server Compact Edition
2012-11-14 19:08 . 2012-11-14 19:08 -------- d-----w- c:\program files\Windows Live
2012-11-14 19:02 . 2012-11-14 19:02 89944 ----a-w- c:\program files (x86)\Common Files\Windows Live\.cache\a562333d1cdc29a04\DSETUP.dll
2012-11-14 19:02 . 2012-11-14 19:02 537432 ----a-w- c:\program files (x86)\Common Files\Windows Live\.cache\a562333d1cdc29a04\DXSETUP.exe
2012-11-14 19:02 . 2012-11-14 19:02 1801048 ----a-w- c:\program files (x86)\Common Files\Windows Live\.cache\a562333d1cdc29a04\dsetup32.dll
2012-11-14 19:02 . 2012-11-14 19:02 94040 ----a-w- c:\program files (x86)\Common Files\Windows Live\.cache\a2fac72a1cdc29a03\DSETUP.dll
2012-11-14 19:02 . 2012-11-14 19:02 525656 ----a-w- c:\program files (x86)\Common Files\Windows Live\.cache\a2fac72a1cdc29a03\DXSETUP.exe
2012-11-14 19:02 . 2012-11-14 19:02 1691480 ----a-w- c:\program files (x86)\Common Files\Windows Live\.cache\a2fac72a1cdc29a03\dsetup32.dll
2012-11-14 19:02 . 2012-11-14 19:02 89944 ----a-w- c:\program files (x86)\Common Files\Windows Live\.cache\a15c7a691cdc29a02\DSETUP.dll
2012-11-14 19:02 . 2012-11-14 19:02 537432 ----a-w- c:\program files (x86)\Common Files\Windows Live\.cache\a15c7a691cdc29a02\DXSETUP.exe
2012-11-14 19:02 . 2012-11-14 19:02 1801048 ----a-w- c:\program files (x86)\Common Files\Windows Live\.cache\a15c7a691cdc29a02\dsetup32.dll
2012-11-14 19:02 . 2012-11-14 19:02 5659096 ----a-w- c:\program files (x86)\Common Files\Windows Live\.cache\9d793e361cdc29a01\skydrivesetup.exe
2012-11-14 18:47 . 2012-11-14 18:47 -------- d-----w- c:\users\Dominic\AppData\Local\InstallShare
2012-11-14 18:47 . 2012-11-14 18:47 113152 ----a-w- c:\windows\system32\srchbdmin.exe
2012-11-14 18:46 . 2012-11-14 18:46 -------- d-----w- c:\programdata\AVS4YOU
2012-11-14 18:45 . 2012-11-14 18:45 -------- d-----w- c:\users\Dominic\AppData\Roaming\AVS4YOU
2012-11-14 18:45 . 2012-11-23 18:20 -------- d-----w- c:\program files (x86)\AVS4YOU
2012-11-14 18:44 . 2012-11-23 18:20 -------- d-----w- c:\program files (x86)\Common Files\AVSMedia
2012-11-14 18:44 . 2011-06-23 12:26 1700352 ----a-w- c:\windows\SysWow64\GdiPlus.dll
2012-11-14 18:44 . 2011-06-23 12:25 24576 ----a-w- c:\windows\SysWow64\msxml3a.dll
2012-11-13 22:59 . 2012-11-13 22:59 -------- d-----w- c:\programdata\Uniblue
2012-11-13 22:56 . 2012-11-13 22:56 -------- d-----w- c:\users\Dominic\AppData\Roaming\4Free
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-11-25 13:50 . 2012-01-26 20:48 746984 ----a-w- c:\windows\SysWow64\deployJava1.dll
2012-11-23 18:16 . 2012-04-07 19:38 73656 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2012-11-23 18:16 . 2012-04-07 19:38 697272 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2012-11-14 22:50 . 2012-03-26 15:11 66395536 ----a-w- c:\windows\system32\MRT.exe
2012-09-28 13:37 . 2012-09-28 13:37 221696 ----a-w- c:\windows\system32\clinfo.exe
2012-09-28 13:36 . 2012-09-28 13:36 75776 ----a-w- c:\windows\system32\OpenVideo64.dll
2012-09-28 13:36 . 2012-09-28 13:36 65536 ----a-w- c:\windows\SysWow64\OpenVideo.dll
2012-09-28 13:36 . 2012-09-28 13:36 63488 ----a-w- c:\windows\system32\OVDecode64.dll
2012-09-28 13:36 . 2012-09-28 13:36 56320 ----a-w- c:\windows\SysWow64\OVDecode.dll
2012-09-28 13:36 . 2012-09-28 13:36 32635904 ----a-w- c:\windows\system32\amdocl64.dll
2012-09-28 13:32 . 2012-09-28 13:32 27341824 ----a-w- c:\windows\SysWow64\amdocl.dll
2012-09-14 19:19 . 2012-10-11 15:21 2048 ----a-w- c:\windows\system32\tzres.dll
2012-09-14 18:28 . 2012-10-11 15:21 2048 ----a-w- c:\windows\SysWow64\tzres.dll
2012-09-12 15:07 . 2012-09-12 15:07 58368 ----a-w- c:\windows\SysWow64\sirenacm.dll
2012-09-12 14:57 . 2012-09-12 14:57 322048 ----a-w- c:\windows\WLXPGSS.SCR
2012-08-31 18:19 . 2012-10-11 15:23 1659760 ----a-w- c:\windows\system32\drivers\ntfs.sys
2012-08-30 18:03 . 2012-10-11 15:23 5559664 ----a-w- c:\windows\system32\ntoskrnl.exe
2012-08-30 17:12 . 2012-10-11 15:23 3968880 ----a-w- c:\windows\SysWow64\ntkrnlpa.exe
2012-08-30 17:12 . 2012-10-11 15:23 3914096 ----a-w- c:\windows\SysWow64\ntoskrnl.exe
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1475584]
"MobileDocuments"="c:\program files (x86)\Common Files\Apple\Internet Services\ubd.exe" [2012-02-23 59240]
"DAEMON Tools Pro Agent"="c:\program files (x86)\DAEMON Tools Pro\DTAgent.exe" [2012-04-26 3111744]
"iCloudServices"="c:\program files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe" [2012-08-29 59280]
"ApplePhotoStreams"="c:\program files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe" [2012-09-10 59280]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"AMD AVT"="start AMD Accelerated Video Transcoding device initialization" [X]
"CTSysVol"="d:\creative\SBAudigy\Surround Mixer\CTSysVol.exe" [2005-10-31 57344]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2012-04-05 641664]
"AppleSyncNotifier"="c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2011-09-27 59240]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-10-11 59280]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2011-10-24 421888]
"AVP"="d:\kaspersky lab\Kaspersky Anti-Virus 2012\avp.exe" [2012-11-25 206448]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1475584]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Wireless Utility.lnk - c:\program files (x86)\Edimax\Common\RaUI.exe [2012-9-14 1794048]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux6"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\run-]
"UpdReg"=c:\windows\UpdReg.EXE
"ATICustomerCare"="c:\program files (x86)\ATI\ATICustomerCare\ATICustomerCare.exe"
"iTunesHelper"="d:\itunes\iTunesHelper.exe"
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2012-07-13 160944]
R3 cpuz130;cpuz130;c:\users\Dominic\AppData\Local\Temp\cpuz130\cpuz_x64.sys [x]
R3 EverestDriver;Lavalys EVEREST Kernel Driver;d:\everest ultimate edition\kerneld.amd64 [x]
R3 Netaapl;Apple Mobile Device Ethernet Service;c:\windows\system32\DRIVERS\netaapl64.sys [2011-08-02 22528]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2010-11-20 20992]
R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 59392]
R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys [x]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [2012-07-09 52736]
R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys [x]
R3 WatAdminSvc;Windows-Aktivierungstechnologieservice;c:\windows\system32\Wat\WatAdminSvc.exe [2010-06-07 1255736]
R4 Droppix Service;Droppix Service;c:\program files (x86)\Common Files\Droppix\DxService.exe [2009-03-12 221184]
S0 sptd;sptd;c:\windows\\SystemRoot\System32\Drivers\sptd.sys [x]
S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [2012-06-15 283200]
S1 kl2;kl2;c:\windows\system32\DRIVERS\kl2.sys [2011-03-04 11864]
S1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter;c:\windows\system32\DRIVERS\klim6.sys [2011-03-10 29488]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2012-04-06 236544]
S2 RalinkRegistryWriter64;Ralink Registry Writer 64;c:\program files (x86)\Edimax\Common\RaRegistry64.exe [2009-07-14 211232]
S2 TomTomHOMEService;TomTomHOMEService;d:\tomtom home 2\TomTomHOMEService.exe [2012-01-23 92592]
S3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys [2012-05-14 96896]
S3 klmouflt;Kaspersky Lab KLMOUFLT;c:\windows\system32\DRIVERS\klmouflt.sys [2009-11-02 22544]
S3 LGBusEnum;Logitech GamePanel Virtual Bus Enumerator Driver;c:\windows\system32\drivers\LGBusEnum.sys [2009-11-23 22408]
S3 LGVirHid;Logitech Gamepanel Virtual HID Device Driver;c:\windows\system32\drivers\LGVirHid.sys [2009-11-23 16008]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2011-06-10 539240]
S3 RTL8187;Realtek RTL8187 Wireless 802.11b/g 54Mbps USB 2.0 Network Adapter;c:\windows\system32\DRIVERS\rtl8187.sys [2010-01-07 448512]
S3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x64.sys [2009-09-28 395264]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2008-08-22 13:11 451872 ----a-w- c:\program files (x86)\Common Files\LightScribe\LSRunOnce.exe
.
Inhalt des "geplante Tasks" Ordners
.
2012-04-01 c:\windows\Tasks\Driver Robot.job
- c:\program files (x86)\Driver Robot\Driver Robot.lnk [2012-04-01 10:45]
.
2012-11-25 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-06-25 12:30]
.
2012-11-25 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-06-25 12:30]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Launch LgDeviceAgent"="c:\program files\Logitech\GamePanel Software\LgDevAgt.exe" [2009-12-10 415752]
"Launch LCDMon"="c:\program files\Logitech\GamePanel Software\LCD Manager\LCDMon.exe" [2009-12-10 2093064]
"Launch LGDCore"="c:\program files\Logitech\GamePanel Software\G-series Software\LGDCore.exe" [2009-12-10 4271624]
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.google.de/ncr
mStart Page = about:blank
mLocal Page = c:\windows\SYSTEM32\blank.htm
IE: Nach Microsoft E&xel exportieren - d:\micros~1\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.0.1
FF - ProfilePath - c:\users\Dominic\AppData\Roaming\Mozilla\Firefox\Profiles\6ud5bzf4.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.google.de/ncr
FF - ExtSQL: 2012-11-25 01:38; virtualKeyboard@kaspersky.ru; d:\kaspersky lab\Kaspersky Anti-Virus 2012\FFExt\virtualKeyboard@kaspersky.ru
FF - ExtSQL: 2012-11-25 01:38; linkfilter@kaspersky.ru; d:\kaspersky lab\Kaspersky Anti-Virus 2012\FFExt\linkfilter@kaspersky.ru
FF - user.js: browser.search.defaultenginename - Google
FF - user.js: browser.search.selectedEngine - Google
FF - user.js: browser.startup.homepage - hxxp://www.google.de/ncr
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
AddRemove-PunkBusterSvc - c:\windows\system32\pbsvc.exe
.
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EverestDriver]
"ImagePath"="\??\d:\everest ultimate edition\kerneld.amd64"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\S-1-5-21-2015671977-4043839625-2418745644-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eml\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLiveMail.Email.1"
.
[HKEY_USERS\S-1-5-21-2015671977-4043839625-2418745644-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vcf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLiveMail.VCard.1"
.
[HKEY_USERS\S-1-5-21-2015671977-4043839625-2418745644-1001\Software\SecuROM\License information*]
@Allowed: (Read) (RestrictedCode)
"datasecu"=hex:1e,33,e3,c4,58,81,a8,78,3e,8c,68,09,71,27,37,af,24,ea,f2,f1,ac,
42,52,65,2a,54,a7,b2,b9,54,65,58,7a,86,d3,77,0b,98,e4,d0,02,2d,3c,55,8e,1e,\
"rkeysecu"=hex:d2,d2,5a,db,fa,eb,9d,a8,14,59,5a,9c,fa,a4,cb,98
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_5_502_110_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_5_502_110_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_5_502_110_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_5_502_110_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_5_502_110.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_5_502_110.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_5_502_110.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_5_502_110.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files (x86)\Common Files\LightScribe\LSSrvc.exe
c:\windows\SysWOW64\PnkBstrA.exe
d:\mozilla firefox\firefox.exe
d:\mozilla firefox\plugin-container.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2012-11-25 23:28:37 - PC wurde neu gestartet
ComboFix-quarantined-files.txt 2012-11-25 22:28
ComboFix2.txt 2012-11-25 14:14
.
Vor Suchlauf: 19 Verzeichnis(se), 11'527'163'904 Bytes frei
Nach Suchlauf: 20 Verzeichnis(se), 11'069'587'456 Bytes frei
.
- - End Of File - - 173B13D738F8F4016E6D945589046D1B
Hochladen war erfolgreich [/code] |
|
27.11.2012, 18:32
| #8 | |
| /// TB-Ausbilder | Inet-Browser extrem langsam, Ständig abstürze mit FF Gut!  Wir müssen jetzt noch ein paar Kontrollen machen. Schritt 1: Quick-Scan mit Malwarebytes Schritt 2: ESET Online Scanner Zitat:
Schritt 3: Java Update (Windows XP, Vista, 7) Dein Java ist nicht mehr aktuell. Ältere Versionen enthalten Sicherheitslücken, die von Malware missbraucht werden können.Schritt 4: Scan mit SecurityCheck Downloade Dir bitte SecurityCheck
__________________ Digitale Freibeuter gegen Malware! Keine Hilfe per PM! |
|
28.11.2012, 11:14
| #9 |
| | Inet-Browser extrem langsam, Ständig abstürze mit FF Okay, hier die logs: Code:
ATTFilter Malwarebytes Anti-Malware 1.65.1.1000 www.malwarebytes.org Datenbank Version: v2012.11.28.01 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 9.0.8112.16421 Dominic :: DOPORTI [Administrator] 28.11.2012 02:45:34 mbam-log-2012-11-28 (02-45-34).txt Art des Suchlaufs: Quick-Scan Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 228846 Laufzeit: 1 Minute(n), 50 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 0 (Keine bösartigen Objekte gefunden) (Ende)  Code:
ATTFilter C:\Users\Dominic\AppData\Local\InstallShare\2_18772_installer.exe a variant of Win32/InstallShare.A application
C:\Windows\System32\AscConTest.dll Win32/Adware.Ascentive application
C:\Windows\SysWOW64\AscConTest.dll Win32/Adware.Ascentive application
Code:
ATTFilter Results of screen317's Security Check version 0.99.56 Windows 7 Service Pack 1 x64 (UAC is disabled!) Internet Explorer 9 ``````````````Antivirus/Firewall Check:`````````````` Kaspersky Anti-Virus Antivirus up to date! (On Access scanning disabled!) `````````Anti-malware/Other Utilities Check:````````` Malwarebytes Anti-Malware Version 1.65.1.1000 Java 7 Update 9 Adobe Flash Player 11.2.202.228 Flash Player out of Date! Adobe Reader 10.1.1 Adobe Reader out of Date! Mozilla Firefox (17.0) ````````Process Check: objlist.exe by Laurent```````` Kaspersky Anti-Virus 2012 avp.exe `````````````````System Health check````````````````` Total Fragmentation on Drive C: ````````````````````End of Log`````````````````````` Jedesmal wenn ich im Explorer einen Ordner aufmache, öffnet der sich in einem neuen Fenster. In Ordneroptionen ist dies bereits ausgeschalten, laut foren ist die Registry auch i.O. Danke nochmals! |
|
28.11.2012, 14:27
| #10 |
| /// TB-Ausbilder | Inet-Browser extrem langsam, Ständig abstürze mit FF Schritt 1: Die gefunden Dateien einfach löschen. Ist nur Werbung. Schritt 2: Update: Adobe Reader
Probiere einen alternativen Viewer für pdf-Dokumente aus. Diese sind meist schlanker, schneller und schleusen sehr viel seltener Schädlinge ein. Mein Vorschlag:
Update: Adobe Flash Player
Hintergrundwächter von Kaspersky aktivieren. Schritt 5: Benutzerkontensteuerung aktivieren Systemsteuerung > Benutzer > Einstellungen > Mittel Schritt 6: Scan mit SecurityCheck Downloade Dir bitte SecurityCheck
__________________ Digitale Freibeuter gegen Malware! Keine Hilfe per PM! |
|
02.12.2012, 14:40
| #11 |
| | Inet-Browser extrem langsam, Ständig abstürze mit FF Soo hat gepasst. Danke fürs warten  Code:
ATTFilter Results of screen317's Security Check version 0.99.56 Windows 7 Service Pack 1 x64 (UAC is disabled!) Internet Explorer 9 ``````````````Antivirus/Firewall Check:`````````````` Kaspersky Anti-Virus Antivirus up to date! `````````Anti-malware/Other Utilities Check:````````` Malwarebytes Anti-Malware Version 1.65.1.1000 Java(TM) 6 Update 27 Java 7 Update 9 Adobe Flash Player 11.5.502.110 Adobe Reader XI Mozilla Firefox (17.0) ````````Process Check: objlist.exe by Laurent```````` Kaspersky Anti-Virus 2012 avp.exe `````````````````System Health check````````````````` Total Fragmentation on Drive C: ````````````````````End of Log`````````````````````` |
|
29.11.2012, 09:50
| #12 |
| /// TB-Ausbilder | Inet-Browser extrem langsam, Ständig abstürze mit FF Hallo, benötigst Du noch weiterhin Hilfe ? Sollte ich innerhalb der nächsten 24 Stunden keine Antwort von dir erhalten, werde ich dein Thema aus meinen Abos nehmen und bekomme dadurch keine Nachricht über neue Antworten. Das Verschwinden der Symptome bedeutet nicht, dass dein System schon sauber ist
__________________ Digitale Freibeuter gegen Malware! Keine Hilfe per PM! |
|
30.11.2012, 01:08
| #13 |
| | Inet-Browser extrem langsam, Ständig abstürze mit FF Hallo ryder. Danke für deine hilfe. Ich bin leider die letzten 2tage nicht dazu gekommen. Werde heute abend die nächsten schritte erledigen. Vielen dank und einen schönen abend! |
|
02.12.2012, 15:28
| #14 |
| /// TB-Ausbilder | Inet-Browser extrem langsam, Ständig abstürze mit FF Wie da öffnet sich was? Beschreibe bitte genauer. Schritt 1: Benutzerkontensteuerung aktivieren Die Benutzerkontensteuerung warnt dich davor, wenn ein Programm Administratorrechte anfordert. Sie ist vielleicht etwas nervig, aber sie schützt dich unter Umständen davor, dass sich ein Schädling bei dir einnistet.Schritt 2: Deinstalliere Java 6 U 27 Schritt 3: Adware entfernen mit JRT Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.  Bitte lade Junkware Removal Tool auf Deinen Desktop.
__________________ Digitale Freibeuter gegen Malware! Keine Hilfe per PM! |
|
04.12.2012, 15:40
| #15 |
| /// TB-Ausbilder | Inet-Browser extrem langsam, Ständig abstürze mit FF Hallo, benötigst Du noch weiterhin Hilfe ? Sollte ich innerhalb der nächsten 24 Stunden keine Antwort von dir erhalten, werde ich dein Thema aus meinen Abos nehmen und bekomme dadurch keine Nachricht über neue Antworten. Das Verschwinden der Symptome bedeutet nicht, dass dein System schon sauber ist
__________________ Digitale Freibeuter gegen Malware! Keine Hilfe per PM! |
|
| Themen zu Inet-Browser extrem langsam, Ständig abstürze mit FF |
| abstürze, administrator, anti-malware, autostart, avira, besser, check, dateien, explorer, gen, kaspersky, laden, langsam, logfile, nicht mehr, probleme, scan, seite, service, software, speicher, super, test, version, wlan |
Button.
und dann 
Hybrid-Darstellung
