| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: browsermngr.exe*32 im Taskmanager lässt sich nicht schließen :(Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
02.12.2012, 04:39
| #1 |
 |  browsermngr.exe*32 im Taskmanager lässt sich nicht schließen :( Hallo, Habe folgendes Problem, hatte vor einigen Wochen bei meinem AntiVirenprogramm ne Virusmelden hab das Ding natürlich direkt gelöscht! VORNEWEG: Ich habe wirklich keine große Ahnung von Computern!Anleitungen werd ich noch befolgen können und bissl mehr als Facebook versteh ich dann auch  Also hatte diesen Virus nun gelöscht-an dem Tag hatte ich den Namen och im Kopf war aber auch was mit exe.*32...War aufjedenfall ein Trojaner-muss zugeben dachte wenn ich den so lösche is das gut ... Habe direkt mein Onlinebanking gesperrt! Nun ist mein PC wirklich ultra langsam und im Taskmanager lässt sich das Programm browsermngr exe*32 nicht schließen... ist C:\ProgramData\Browser Manager\2.4.897.175\{61d8b74e-8d89-46ff-afa6-33382c54ac73} Is mein Laptop nu noch infiziert? Und kann ich das irgendwie feststellen? Würde mich bedanken wenn mir jmd helfen kann.... Danke  Malware Logdatei... Defogger is a tool to disable CD Emulator Drivers that interfere with Anti-Rootkit programs and other Anti-Malware tools. If you are using this in conjunction with assistance from a Malware Removal´professional ,please wait until they have finishes assisting you before clicking `re-enable`,. Die auswertungen |
|
02.12.2012, 16:00
| #2 | |
| /// TB-Ausbilder  |  browsermngr.exe*32 im Taskmanager lässt sich nicht schließen :( Ich werde dir bei deinem Problem helfen. Eine Bereinigung ist mitunter mit viel Arbeit für Dich (und mich) verbunden. Bevor es los geht, habe ich etwas Lesestoff für dich. Schritt 1: Wer hat dir gesagt, dass du Combofix laufen lassen sollst? DAS IST KEIN SPIELZEUG! Bitte das Logfile dazu posten. Normalerweise unter c:\combofix.txt Schritt 2: AdwCleaner: Werbeprogramme suchen und löschen Schritt 3: Combofix vom Desktop löschen Schritt 4: Scan mit Farbar's Recovery Scan Tool (FRST 64bit)
__________________ |
|
03.12.2012, 15:13
| #3 |
| | browsermngr.exe*32 im Taskmanager lässt sich nicht schließen :( Hallo und vielen Dank!
__________________Hatte vorher nach einer Lösung gesucht un dachte das kann ja nnicht so schwer sein und irgendwo hatte ich gelesen ich soll combofix runterladen  habe es aber auch schon wieder gelöscht (glaube ich) ...Werde nun die Dinge zusammensuchen und posten... schonmal vielen Dank für deine Mühe und Zeit das ist alles nicht so einfach wies aussieht =) "Downloade dir bitte Farbar Recovery Scan Tool 64-Bit und speichere diese auf einen USB Stick. Schließe den USB Stick an das infizierte System an" Soll ich den Tool von einem andren Pc downloaden auf nen Usb Stick oder direkt auf meinem Laptop auf den Usb Stick? |
|
04.12.2012, 01:42
| #4 |
| | browsermngr.exe*32 im Taskmanager lässt sich nicht schließen :( So von Combofix habe ich nichts mehr gefunden... adwcleaner hat funktioniert Hier die Auswertung des Tools: Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 02-12-2012 Ran by SYSTEM at 04-12-2012 01:26:07 Running from F:\ Windows 7 Home Premium (X64) OS Language: English(US) The current controlset is ControlSet001 ==================== Registry (Whitelisted) =================== HKLM\...\Run: [MSC] "C:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey [1289704 2012-09-12] (Microsoft Corporation) HKLM-x32\...\Run: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [59280 2012-10-11] (Apple Inc.) HKLM-x32\...\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [919008 2012-07-11] (Adobe Systems Incorporated) HKLM-x32\...\Run: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [38872 2012-07-31] (Adobe Systems Incorporated) HKLM-x32\...\Run: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe" [421776 2012-09-09] (Apple Inc.) HKLM-x32\...\Run: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime [421888 2012-10-24] (Apple Inc.) HKLM-x32\...\Run: [AppleSyncNotifier] C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe [59240 2011-11-01] (Apple Inc.) HKLM-x32\...\Run: [HControlUser] C:\Program Files (x86)\ASUS\ATK Hotkey\HControlUser.exe [105016 2009-06-19] (ASUS) HKLM-x32\...\Run: [] [x] HKU\Franziska\...\Run: [ABBYY Screenshot Reader Bonus] "C:\Program Files (x86)\ABBYY FineReader 9.0 Sprint\Bonus.ScreenshotReader.exe" -autorun [x] HKU\Franziska\...\Run: [msnmsgr] "C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe" /background [3882312 2008-12-02] (Microsoft Corporation) Tcpip\Parameters: [DhcpNameServer] 192.168.178.1 ==================== Services (Whitelisted) =================== 4 ASUSRDVDService; C:\Program Files (x86)\ASUS\AI Recovery\ServiceSimple2.exe [109184 2009-09-10] () 4 ATKGFNEXSrv; C:\Program Files\ATKGFNEX\GFNEXSrv.exe [94208 2007-08-07] () 4 FastBootAgent; "C:\Windows\SysWOW64\Fast Boot\FastBootAgent.exe" [306232 2009-07-23] (ASUSTeK Computer Inc.) 2 MBAMScheduler; "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe" [399432 2012-09-29] (Malwarebytes Corporation) 2 MBAMService; "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe" [676936 2012-09-29] (Malwarebytes Corporation) 2 MsMpSvc; "C:\Program Files\Microsoft Security Client\MsMpEng.exe" [22072 2012-09-12] (Microsoft Corporation) 3 NisSrv; "C:\Program Files\Microsoft Security Client\NisSrv.exe" [368896 2012-09-12] (Microsoft Corporation) ==================== Drivers (Whitelisted) ===================== 2 ASMMAP64; \??\C:\Program Files\ATKGFNEX\ASMMAP64.sys [14904 2007-07-24] () 3 kbfiltr; C:\Windows\System32\Drivers\kbfiltr.sys [15416 2009-07-20] ( ) 3 MBAMProtector; \??\C:\Windows\system32\drivers\mbam.sys [25928 2012-09-29] (Malwarebytes Corporation) 0 MpFilter; C:\Windows\System32\Drivers\MpFilter.sys [228768 2012-08-30] (Microsoft Corporation) 2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [128456 2012-08-30] (Microsoft Corporation) 3 SNP2UVC; C:\Windows\System32\Drivers\SNP2UVC.sys [1806400 2009-06-05] () 3 catchme; \??\C:\ComboFix\catchme.sys [x] 3 tmlwf; [x] 3 tmwfp; [x] ==================== NetSvcs (Whitelisted) ==================== ==================== One Month Created Files and Folders ======== 2012-12-03 16:17 - 2011-06-21 03:35 - 733820928 ____A C:\Users\Franziska\Desktop\Ich.Einfach.unverbesserlich.German.2010.AC3.DVDRip.XviD-QoM.avi 2012-12-03 15:45 - 2012-12-03 15:45 - 00006991 ___AC C:\AdwCleaner[S1].txt 2012-12-03 15:41 - 2012-12-03 15:41 - 00540743 ____A C:\Users\Franziska\Desktop\adwcleaner.exe 2012-12-03 12:58 - 2012-12-03 14:02 - 00285704 ____A C:\Users\Franziska\Documents\Ein schönes Chaos.comicdoc 2012-12-03 11:24 - 2012-12-03 15:08 - 00000000 ____D C:\Users\Franziska\Desktop\story 2012-12-01 23:29 - 2012-12-03 14:00 - 00014066 ____A C:\Users\Franziska\Desktop\OpenDocument Text (neu).odt 2012-12-01 22:37 - 2012-12-01 22:45 - 00058056 ____A C:\Users\Franziska\Desktop\Extras.Txt 2012-12-01 22:34 - 2012-12-02 05:43 - 00126200 ____A C:\Users\Franziska\Desktop\OTL.Txt 2012-12-01 22:23 - 2012-12-01 22:23 - 00602112 ____A (OldTimer Tools) C:\Users\Franziska\Desktop\OTL.exe 2012-12-01 22:11 - 2012-12-01 22:22 - 00000480 ____A C:\Users\Franziska\Desktop\defogger_disable.log 2012-12-01 22:11 - 2012-12-01 22:13 - 00050477 ____A C:\Users\Franziska\Desktop\Defogger.exe 2012-12-01 22:11 - 2012-12-01 22:11 - 00000000 ____A C:\Users\Franziska\defogger_reenable 2012-12-01 20:30 - 2012-12-01 20:30 - 00000000 ____D C:\Users\Franziska\Desktop\hhhhhhhhhhhhhhh 2012-12-01 19:56 - 2012-12-01 19:56 - 00001111 ____A C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2012-12-01 19:56 - 2012-12-01 19:56 - 00000000 ____D C:\Users\Franziska\AppData\Roaming\Malwarebytes 2012-12-01 19:56 - 2012-12-01 19:56 - 00000000 ____D C:\Users\All Users\Malwarebytes 2012-12-01 19:56 - 2012-12-01 19:56 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware 2012-12-01 19:56 - 2012-09-29 10:54 - 00025928 ____A (Malwarebytes Corporation) C:\Windows\System32\Drivers\mbam.sys 2012-12-01 09:47 - 2012-12-03 14:11 - 00000000 ____D C:\Users\Franziska\Documents\Comic Life 2012-12-01 09:46 - 2012-12-01 09:46 - 00000004 __RSH C:\Users\All Users\sysqcl1129139270.dat 2012-12-01 09:44 - 2012-12-01 09:44 - 00000987 ____A C:\Users\Public\Desktop\Comic Life.lnk 2012-12-01 09:44 - 2012-12-01 09:44 - 00000000 ____D C:\Program Files (x86)\plasq 2012-12-01 09:24 - 2012-12-01 09:25 - 00000000 ____D C:\Users\Franziska\Desktop\klick klack 2012-11-26 18:17 - 2012-08-23 06:13 - 00243200 ____A (Microsoft Corporation) C:\Windows\System32\rdpudd.dll 2012-11-26 18:17 - 2012-08-23 06:10 - 00019456 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\rdpvideominiport.sys 2012-11-26 18:17 - 2012-08-23 06:07 - 00057856 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\TsUsbFlt.sys 2012-11-26 18:17 - 2012-08-23 05:47 - 00046592 ____A (Microsoft Corporation) C:\Windows\SysWOW64\MsRdpWebAccess.dll 2012-11-26 18:17 - 2012-08-23 05:46 - 00016896 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wksprtPS.dll 2012-11-26 18:17 - 2012-08-23 05:41 - 00013312 ____A (Microsoft Corporation) C:\Windows\System32\TsUsbRedirectionGroupPolicyControl.exe 2012-11-26 18:17 - 2012-08-23 05:40 - 00013312 ____A (Microsoft Corporation) C:\Windows\System32\TsUsbRedirectionGroupPolicyExtension.dll 2012-11-26 18:17 - 2012-08-23 05:24 - 00015360 ____A (Microsoft Corporation) C:\Windows\System32\RdpGroupPolicyExtension.dll 2012-11-26 18:17 - 2012-08-23 05:20 - 00054272 ____A (Microsoft Corporation) C:\Windows\System32\MsRdpWebAccess.dll 2012-11-26 18:17 - 2012-08-23 05:18 - 00037376 ____A (Microsoft Corporation) C:\Windows\SysWOW64\tsgqec.dll 2012-11-26 18:17 - 2012-08-23 05:17 - 00018432 ____A (Microsoft Corporation) C:\Windows\System32\wksprtPS.dll 2012-11-26 18:17 - 2012-08-23 05:06 - 00043520 ____A (Microsoft Corporation) C:\Windows\System32\TsUsbGDCoInstaller.dll 2012-11-26 18:17 - 2012-08-23 04:52 - 00044032 ____A (Microsoft Corporation) C:\Windows\System32\tsgqec.dll 2012-11-26 18:17 - 2012-08-23 03:20 - 00062976 ____A (Microsoft Corporation) C:\Windows\System32\TSWbPrxy.exe 2012-11-26 18:17 - 2012-08-23 03:15 - 00269312 ____A (Microsoft Corporation) C:\Windows\SysWOW64\aaclient.dll 2012-11-26 18:17 - 2012-08-23 03:14 - 00384000 ____A (Microsoft Corporation) C:\Windows\System32\wksprt.exe 2012-11-26 18:17 - 2012-08-23 03:12 - 00192000 ____A (Microsoft Corporation) C:\Windows\SysWOW64\rdpendp_winip.dll 2012-11-26 18:17 - 2012-08-23 02:54 - 00322560 ____A (Microsoft Corporation) C:\Windows\System32\aaclient.dll 2012-11-26 18:17 - 2012-08-23 02:51 - 00228864 ____A (Microsoft Corporation) C:\Windows\System32\rdpendp_winip.dll 2012-11-26 18:17 - 2012-08-23 02:39 - 01048064 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mstsc.exe 2012-11-26 18:17 - 2012-08-23 02:22 - 01123840 ____A (Microsoft Corporation) C:\Windows\System32\mstsc.exe 2012-11-26 18:17 - 2012-08-23 01:51 - 03174912 ____A (Microsoft Corporation) C:\Windows\System32\rdpcorets.dll 2012-11-26 18:17 - 2012-08-23 00:19 - 04916224 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll 2012-11-26 18:17 - 2012-08-23 00:13 - 05773824 ____A (Microsoft Corporation) C:\Windows\System32\mstscax.dll 2012-11-26 18:15 - 2012-08-24 10:13 - 00154480 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\ksecpkg.sys 2012-11-26 18:15 - 2012-08-24 10:09 - 00458712 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\cng.sys 2012-11-26 18:15 - 2012-08-24 10:05 - 00340992 ____A (Microsoft Corporation) C:\Windows\System32\schannel.dll 2012-11-26 18:15 - 2012-08-24 10:04 - 00307200 ____A (Microsoft Corporation) C:\Windows\System32\ncrypt.dll 2012-11-26 18:15 - 2012-08-24 10:03 - 01448448 ____A (Microsoft Corporation) C:\Windows\System32\lsasrv.dll 2012-11-26 18:15 - 2012-08-24 08:57 - 00247808 ____A (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll 2012-11-26 18:15 - 2012-08-24 08:57 - 00220160 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll 2012-11-26 18:15 - 2012-08-24 08:57 - 00022016 ____A (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll 2012-11-26 18:15 - 2012-08-24 08:53 - 00096768 ____A (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll 2012-11-26 18:15 - 2012-05-04 03:00 - 00366592 ____A (Microsoft Corporation) C:\Windows\System32\qdvd.dll 2012-11-26 18:15 - 2012-05-04 01:59 - 00514560 ____A (Microsoft Corporation) C:\Windows\SysWOW64\qdvd.dll 2012-11-16 23:57 - 2012-11-16 23:58 - 00039644 ____A C:\Users\Franziska\Documents\cc_20121117_085744.reg 2012-11-16 23:33 - 2012-11-16 23:33 - 00000000 ____D C:\Users\Franziska\AppData\Roaming\Adobe 2012-11-16 21:32 - 2012-11-16 21:39 - 00002016 ____A C:\Users\Public\Desktop\Adobe Reader 9.lnk 2012-11-16 19:58 - 2012-11-16 19:58 - 00006622 ____A C:\Users\Franziska\Desktop\startup.txt 2012-11-16 13:45 - 2012-11-16 13:45 - 00001847 ____A C:\Users\Public\Desktop\QuickTime Player.lnk 2012-11-16 13:44 - 2012-11-16 13:45 - 00000000 ____D C:\Program Files (x86)\QuickTime 2012-11-15 21:50 - 2012-03-23 11:59 - 373380506 ____A C:\Users\Franziska\Desktop\s2 e13.avi.avi 2012-11-15 21:50 - 2012-03-17 03:40 - 365892792 ____A C:\Users\Franziska\Desktop\s2 e12.avi.avi 2012-11-15 17:31 - 2012-11-15 17:31 - 00181604 ___AH C:\Windows\SysWOW64\mlfcache.dat 2012-11-15 01:51 - 2012-06-02 06:35 - 00000003 ____A C:\Windows\System32\Drivers\MsftWdf_Kernel_01011_Inbox_Critical.Wdf 2012-11-15 01:50 - 2012-07-25 20:55 - 00785512 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\Wdf01000.sys 2012-11-15 01:50 - 2012-07-25 20:55 - 00054376 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\WdfLdr.sys 2012-11-15 01:50 - 2012-07-25 18:36 - 00009728 ____A (Microsoft Corporation) C:\Windows\System32\Wdfres.dll 2012-11-15 00:28 - 2012-10-08 03:13 - 02382848 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb 2012-11-15 00:28 - 2012-10-08 03:13 - 00096768 ____A (Microsoft Corporation) C:\Windows\System32\mshtmled.dll 2012-11-15 00:28 - 2012-10-07 23:41 - 00073216 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll 2012-11-15 00:28 - 2012-10-07 23:40 - 02382848 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2012-11-15 00:27 - 2012-10-08 04:19 - 17811968 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll 2012-11-15 00:27 - 2012-10-08 03:42 - 10925568 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll 2012-11-15 00:27 - 2012-10-08 03:31 - 02312704 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll 2012-11-15 00:27 - 2012-10-08 03:24 - 01346048 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll 2012-11-15 00:27 - 2012-10-08 03:23 - 01392128 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll 2012-11-15 00:27 - 2012-10-08 03:22 - 01494528 ____A (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl 2012-11-15 00:27 - 2012-10-08 03:22 - 00237056 ____A (Microsoft Corporation) C:\Windows\System32\url.dll 2012-11-15 00:27 - 2012-10-08 03:20 - 00085504 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll 2012-11-15 00:27 - 2012-10-08 03:18 - 00173056 ____A (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe 2012-11-15 00:27 - 2012-10-08 03:17 - 00816640 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll 2012-11-15 00:27 - 2012-10-08 03:17 - 00599040 ____A (Microsoft Corporation) C:\Windows\System32\vbscript.dll 2012-11-15 00:27 - 2012-10-08 03:15 - 02144768 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll 2012-11-15 00:27 - 2012-10-08 03:15 - 00729088 ____A (Microsoft Corporation) C:\Windows\System32\msfeeds.dll 2012-11-15 00:27 - 2012-10-08 03:09 - 00248320 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll 2012-11-15 00:27 - 2012-10-08 00:28 - 12320768 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2012-11-15 00:27 - 2012-10-08 00:02 - 09738240 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2012-11-15 00:27 - 2012-10-07 23:56 - 01800704 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2012-11-15 00:27 - 2012-10-07 23:48 - 01129472 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2012-11-15 00:27 - 2012-10-07 23:48 - 01103872 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2012-11-15 00:27 - 2012-10-07 23:47 - 01427968 ____A (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl 2012-11-15 00:27 - 2012-10-07 23:46 - 00231936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\url.dll 2012-11-15 00:27 - 2012-10-07 23:45 - 00065024 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll 2012-11-15 00:27 - 2012-10-07 23:44 - 00142848 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe 2012-11-15 00:27 - 2012-10-07 23:43 - 00717824 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll 2012-11-15 00:27 - 2012-10-07 23:43 - 00420864 ____A (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll 2012-11-15 00:27 - 2012-10-07 23:42 - 00607744 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2012-11-15 00:27 - 2012-10-07 23:41 - 01793024 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2012-11-15 00:27 - 2012-10-07 23:37 - 00176640 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll 2012-11-15 00:26 - 2012-10-18 10:25 - 03149824 ____A (Microsoft Corporation) C:\Windows\System32\win32k.sys 2012-11-15 00:26 - 2012-10-09 10:17 - 00226816 ____A (Microsoft Corporation) C:\Windows\System32\dhcpcore6.dll 2012-11-15 00:26 - 2012-10-09 10:17 - 00055296 ____A (Microsoft Corporation) C:\Windows\System32\dhcpcsvc6.dll 2012-11-15 00:26 - 2012-10-09 09:40 - 00193536 ____A (Microsoft Corporation) C:\Windows\SysWOW64\dhcpcore6.dll 2012-11-15 00:26 - 2012-10-09 09:40 - 00044032 ____A (Microsoft Corporation) C:\Windows\SysWOW64\dhcpcsvc6.dll 2012-11-15 00:26 - 2012-10-03 09:56 - 01914248 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\tcpip.sys 2012-11-15 00:26 - 2012-10-03 09:44 - 00303104 ____A (Microsoft Corporation) C:\Windows\System32\nlasvc.dll 2012-11-15 00:26 - 2012-10-03 09:44 - 00246272 ____A (Microsoft Corporation) C:\Windows\System32\netcorehc.dll 2012-11-15 00:26 - 2012-10-03 09:44 - 00216576 ____A (Microsoft Corporation) C:\Windows\System32\ncsi.dll 2012-11-15 00:26 - 2012-10-03 09:44 - 00070656 ____A (Microsoft Corporation) C:\Windows\System32\nlaapi.dll 2012-11-15 00:26 - 2012-10-03 09:44 - 00018944 ____A (Microsoft Corporation) C:\Windows\System32\netevent.dll 2012-11-15 00:26 - 2012-10-03 09:42 - 00569344 ____A (Microsoft Corporation) C:\Windows\System32\iphlpsvc.dll 2012-11-15 00:26 - 2012-10-03 08:42 - 00175104 ____A (Microsoft Corporation) C:\Windows\SysWOW64\netcorehc.dll 2012-11-15 00:26 - 2012-10-03 08:42 - 00156672 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ncsi.dll 2012-11-15 00:26 - 2012-10-03 08:42 - 00018944 ____A (Microsoft Corporation) C:\Windows\SysWOW64\netevent.dll 2012-11-15 00:26 - 2012-10-03 08:07 - 00045568 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\tcpipreg.sys 2012-11-15 00:26 - 2012-01-12 23:12 - 00052224 ____A (Microsoft Corporation) C:\Windows\SysWOW64\nlaapi.dll 2012-11-15 00:25 - 2012-09-25 14:47 - 00078336 ____A (Microsoft Corporation) C:\Windows\SysWOW64\synceng.dll 2012-11-15 00:25 - 2012-09-25 14:46 - 00095744 ____A (Microsoft Corporation) C:\Windows\System32\synceng.dll 2012-11-15 00:23 - 2012-07-25 19:08 - 00744448 ____A (Microsoft Corporation) C:\Windows\System32\WUDFx.dll 2012-11-15 00:23 - 2012-07-25 19:08 - 00229888 ____A (Microsoft Corporation) C:\Windows\System32\WUDFHost.exe 2012-11-15 00:23 - 2012-07-25 19:08 - 00194048 ____A (Microsoft Corporation) C:\Windows\System32\WUDFPlatform.dll 2012-11-15 00:23 - 2012-07-25 19:08 - 00084992 ____A (Microsoft Corporation) C:\Windows\System32\WUDFSvc.dll 2012-11-15 00:23 - 2012-07-25 19:08 - 00045056 ____A (Microsoft Corporation) C:\Windows\System32\WUDFCoinstaller.dll 2012-11-15 00:23 - 2012-07-25 18:26 - 00198656 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\WUDFRd.sys 2012-11-15 00:23 - 2012-07-25 18:26 - 00087040 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\WUDFPf.sys 2012-11-15 00:23 - 2012-06-02 06:57 - 00000003 ____A C:\Windows\System32\Drivers\MsftWdf_User_01_11_00_Inbox_Critical.Wdf 2012-11-13 07:12 - 2012-11-13 07:12 - 00000000 ____D C:\Users\Franziska\AppData\Local\Apple_Inc 2012-11-13 07:07 - 2012-11-13 07:07 - 00000000 ____D C:\Program Files (x86)\iPhone-Konfigurationsprogramm 2012-11-13 07:01 - 2012-11-13 07:04 - 45546424 ____A (Apple Inc.) C:\Users\Franziska\Downloads\iPhoneConfigUtilitySetup.exe 2012-11-11 08:44 - 2012-11-12 16:48 - 00000000 ____D C:\Users\Franziska\Desktop\muuuuuuuu 2012-11-10 05:46 - 2012-12-03 16:13 - 00002083 ____A C:\Windows\setupact.log 2012-11-10 05:46 - 2012-11-10 05:46 - 00007174 ____A C:\Windows\PFRO.log 2012-11-10 05:46 - 2012-11-10 05:46 - 00000000 ____A C:\Windows\setuperr.log 2012-11-06 09:54 - 2012-11-06 10:25 - 00000000 ____D C:\Users\All Users\Browser Manager 2012-11-06 09:54 - 2012-11-06 09:54 - 00000000 ____D C:\Windows\SysWOW64\searchplugins 2012-11-06 09:54 - 2012-11-06 09:54 - 00000000 ____D C:\Windows\SysWOW64\Extensions 2012-11-06 09:21 - 2006-06-19 04:01 - 00069632 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ztvcabinet.dll 2012-11-06 09:21 - 2006-05-25 06:52 - 00162304 ____A C:\Windows\SysWOW64\ztvunrar36.dll 2012-11-06 09:21 - 2005-08-25 16:50 - 00077312 ____A C:\Windows\SysWOW64\ztvunace26.dll 2012-11-06 09:21 - 2003-02-02 11:06 - 00153088 ____A C:\Windows\SysWOW64\UNRAR3.dll 2012-11-06 09:21 - 2002-03-05 16:00 - 00075264 ____A C:\Windows\SysWOW64\unacev2.dll 2012-11-06 09:12 - 2012-11-06 09:15 - 00000000 __SDC C:\ComboFix 2012-11-06 08:50 - 2012-11-06 08:50 - 00000000 ____D C:\Program Files\CCleaner 2012-11-06 08:25 - 2012-11-06 08:25 - 00388608 ____A (Trend Micro Inc.) C:\Users\Franziska\Desktop\HiJackThis204.exe 2012-11-06 08:16 - 2011-06-25 22:45 - 00256000 ____A C:\Windows\PEV.exe 2012-11-06 08:16 - 2010-11-07 09:20 - 00208896 ____A C:\Windows\MBR.exe 2012-11-06 08:16 - 2009-04-19 20:56 - 00060416 ____A (NirSoft) C:\Windows\NIRCMD.exe 2012-11-06 08:16 - 2000-08-30 16:00 - 00518144 ____A (SteelWerX) C:\Windows\SWREG.exe 2012-11-06 08:16 - 2000-08-30 16:00 - 00406528 ____A (SteelWerX) C:\Windows\SWSC.exe 2012-11-06 08:16 - 2000-08-30 16:00 - 00098816 ____A C:\Windows\sed.exe 2012-11-06 08:16 - 2000-08-30 16:00 - 00080412 ____A C:\Windows\grep.exe 2012-11-06 08:16 - 2000-08-30 16:00 - 00068096 ____A C:\Windows\zip.exe 2012-11-06 08:13 - 2012-11-06 09:12 - 00000000 ___DC C:\Qoobox 2012-11-06 08:13 - 2012-11-06 08:34 - 00000000 ____D C:\Windows\erdnt 2012-11-05 13:11 - 2012-11-06 05:27 - 00000000 ____D C:\Users\Franziska\Desktop\kalender ==================== One Month Modified Files and Folders ======= 2012-12-03 16:21 - 2009-09-19 00:28 - 01556932 ____A C:\Windows\WindowsUpdate.log 2012-12-03 16:21 - 2009-07-13 20:45 - 00010016 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2012-12-03 16:21 - 2009-07-13 20:45 - 00010016 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2012-12-03 16:20 - 2012-12-03 16:20 - 00000000 ___DC C:\FRST 2012-12-03 16:14 - 2012-10-17 13:58 - 00000374 ____A C:\Windows\System32\Drivers\etc\hosts.ics 2012-12-03 16:13 - 2012-11-10 05:46 - 00002083 ____A C:\Windows\setupact.log 2012-12-03 16:13 - 2009-07-13 21:08 - 00000006 ___AH C:\Windows\Tasks\SA.DAT 2012-12-03 15:54 - 2009-08-04 01:51 - 00662220 ____A C:\Windows\System32\perfh007.dat 2012-12-03 15:54 - 2009-08-04 01:51 - 00134410 ____A C:\Windows\System32\perfc007.dat 2012-12-03 15:54 - 2009-07-13 21:13 - 01521732 ____A C:\Windows\System32\PerfStringBackup.INI 2012-12-03 15:45 - 2012-12-03 15:45 - 00006991 ___AC C:\AdwCleaner[S1].txt 2012-12-03 15:41 - 2012-12-03 15:41 - 00540743 ____A C:\Users\Franziska\Desktop\adwcleaner.exe 2012-12-03 15:35 - 2012-08-10 09:35 - 00000884 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job 2012-12-03 15:08 - 2012-12-03 11:24 - 00000000 ____D C:\Users\Franziska\Desktop\story 2012-12-03 14:11 - 2012-12-01 09:47 - 00000000 ____D C:\Users\Franziska\Documents\Comic Life 2012-12-03 14:02 - 2012-12-03 12:58 - 00285704 ____A C:\Users\Franziska\Documents\Ein schönes Chaos.comicdoc 2012-12-03 14:00 - 2012-12-01 23:29 - 00014066 ____A C:\Users\Franziska\Desktop\OpenDocument Text (neu).odt 2012-12-03 14:00 - 2009-11-30 15:30 - 00000000 ____D C:\Users\Franziska\Documents\sprüche 2012-12-03 12:00 - 2009-11-12 06:09 - 00000000 ____D C:\Users\Franziska\AppData\Roaming\Skype 2012-12-03 11:40 - 2012-08-29 16:52 - 00000000 ____D C:\Users\Franziska\Desktop\Originals 2012-12-02 05:43 - 2012-12-01 22:34 - 00126200 ____A C:\Users\Franziska\Desktop\OTL.Txt 2012-12-01 22:55 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\System32\NDF 2012-12-01 22:45 - 2012-12-01 22:37 - 00058056 ____A C:\Users\Franziska\Desktop\Extras.Txt 2012-12-01 22:23 - 2012-12-01 22:23 - 00602112 ____A (OldTimer Tools) C:\Users\Franziska\Desktop\OTL.exe 2012-12-01 22:22 - 2012-12-01 22:11 - 00000480 ____A C:\Users\Franziska\Desktop\defogger_disable.log 2012-12-01 22:13 - 2012-12-01 22:11 - 00050477 ____A C:\Users\Franziska\Desktop\Defogger.exe 2012-12-01 22:11 - 2012-12-01 22:11 - 00000000 ____A C:\Users\Franziska\defogger_reenable 2012-12-01 22:11 - 2009-11-10 07:25 - 00000000 ____D C:\users\Franziska 2012-12-01 20:30 - 2012-12-01 20:30 - 00000000 ____D C:\Users\Franziska\Desktop\hhhhhhhhhhhhhhh 2012-12-01 19:56 - 2012-12-01 19:56 - 00001111 ____A C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2012-12-01 19:56 - 2012-12-01 19:56 - 00000000 ____D C:\Users\Franziska\AppData\Roaming\Malwarebytes 2012-12-01 19:56 - 2012-12-01 19:56 - 00000000 ____D C:\Users\All Users\Malwarebytes 2012-12-01 19:56 - 2012-12-01 19:56 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware 2012-12-01 09:46 - 2012-12-01 09:46 - 00000004 __RSH C:\Users\All Users\sysqcl1129139270.dat 2012-12-01 09:44 - 2012-12-01 09:44 - 00000987 ____A C:\Users\Public\Desktop\Comic Life.lnk 2012-12-01 09:44 - 2012-12-01 09:44 - 00000000 ____D C:\Program Files (x86)\plasq 2012-12-01 09:25 - 2012-12-01 09:24 - 00000000 ____D C:\Users\Franziska\Desktop\klick klack 2012-11-28 05:19 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\rescache 2012-11-26 18:48 - 2012-06-21 19:12 - 00032768 __ASH C:\Users\Franziska\AppData\Roaming\Thumbs.db 2012-11-26 18:19 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\PolicyDefinitions 2012-11-26 17:50 - 2012-07-08 23:01 - 00007663 ____A C:\Users\Franziska\AppData\Local\Resmon.ResmonCfg 2012-11-26 17:19 - 2012-09-02 12:00 - 00000000 ___DC C:\Users\Franziska\AppData\Local\MigWiz 2012-11-16 23:58 - 2012-11-16 23:57 - 00039644 ____A C:\Users\Franziska\Documents\cc_20121117_085744.reg 2012-11-16 23:33 - 2012-11-16 23:33 - 00000000 ____D C:\Users\Franziska\AppData\Roaming\Adobe 2012-11-16 21:39 - 2012-11-16 21:32 - 00002016 ____A C:\Users\Public\Desktop\Adobe Reader 9.lnk 2012-11-16 20:03 - 2009-11-11 01:10 - 00000000 ____D C:\Windows\pss 2012-11-16 19:58 - 2012-11-16 19:58 - 00006622 ____A C:\Users\Franziska\Desktop\startup.txt 2012-11-16 13:45 - 2012-11-16 13:45 - 00001847 ____A C:\Users\Public\Desktop\QuickTime Player.lnk 2012-11-16 13:45 - 2012-11-16 13:44 - 00000000 ____D C:\Program Files (x86)\QuickTime 2012-11-16 00:46 - 2011-08-22 11:11 - 00000000 ____D C:\Users\Franziska\Desktop\bee 2012-11-16 00:32 - 2012-09-27 05:11 - 00000000 ____D C:\Users\Franziska\Desktop\LLLLL 2012-11-15 17:31 - 2012-11-15 17:31 - 00181604 ___AH C:\Windows\SysWOW64\mlfcache.dat 2012-11-15 08:31 - 2009-11-10 07:25 - 00138648 ____A C:\Users\Franziska\AppData\Local\GDIPFONTCACHEV1.DAT 2012-11-15 08:31 - 2009-07-13 20:45 - 00491024 ____A C:\Windows\System32\FNTCACHE.DAT 2012-11-15 00:24 - 2009-11-11 01:20 - 66395536 ____A (Microsoft Corporation) C:\Windows\System32\MRT.exe 2012-11-13 07:12 - 2012-11-13 07:12 - 00000000 ____D C:\Users\Franziska\AppData\Local\Apple_Inc 2012-11-13 07:12 - 2010-02-24 01:28 - 00000000 ____D C:\Users\Franziska\AppData\Local\Apple Computer 2012-11-13 07:07 - 2012-11-13 07:07 - 00000000 ____D C:\Program Files (x86)\iPhone-Konfigurationsprogramm 2012-11-13 07:04 - 2012-11-13 07:01 - 45546424 ____A (Apple Inc.) C:\Users\Franziska\Downloads\iPhoneConfigUtilitySetup.exe 2012-11-12 16:48 - 2012-11-11 08:44 - 00000000 ____D C:\Users\Franziska\Desktop\muuuuuuuu 2012-11-12 15:48 - 2011-07-17 02:41 - 00000000 ___RD C:\Users\Franziska\Desktop\Casper 2012-11-10 05:46 - 2012-11-10 05:46 - 00007174 ____A C:\Windows\PFRO.log 2012-11-10 05:46 - 2012-11-10 05:46 - 00000000 ____A C:\Windows\setuperr.log 2012-11-10 05:46 - 2010-08-12 02:09 - 00000000 ____D C:\Program Files\WinRAR 2012-11-08 13:23 - 2009-11-12 06:18 - 00000000 ____D C:\Users\Franziska\Tracing 2012-11-06 10:25 - 2012-11-06 09:54 - 00000000 ____D C:\Users\All Users\Browser Manager 2012-11-06 10:22 - 2010-02-25 03:34 - 00000000 ____D C:\Users\Franziska\AppData\Local\Apps\2.0 2012-11-06 09:54 - 2012-11-06 09:54 - 00000000 ____D C:\Windows\SysWOW64\searchplugins 2012-11-06 09:54 - 2012-11-06 09:54 - 00000000 ____D C:\Windows\SysWOW64\Extensions 2012-11-06 09:54 - 2009-11-12 06:09 - 00000000 ____D C:\Users\Franziska\AppData\Local\Google 2012-11-06 09:15 - 2012-11-06 09:12 - 00000000 __SDC C:\ComboFix 2012-11-06 09:12 - 2012-11-06 08:13 - 00000000 ___DC C:\Qoobox 2012-11-06 09:07 - 2009-07-28 22:03 - 00000000 ____D C:\Windows\Panther 2012-11-06 08:50 - 2012-11-06 08:50 - 00000000 ____D C:\Program Files\CCleaner 2012-11-06 08:38 - 2009-07-13 19:20 - 00000000 __RHD C:\users\Default 2012-11-06 08:34 - 2012-11-06 08:13 - 00000000 ____D C:\Windows\erdnt 2012-11-06 08:33 - 2009-07-13 18:34 - 00000215 ___AC C:\Windows\system.ini 2012-11-06 08:25 - 2012-11-06 08:25 - 00388608 ____A (Trend Micro Inc.) C:\Users\Franziska\Desktop\HiJackThis204.exe 2012-11-06 05:27 - 2012-11-05 13:11 - 00000000 ____D C:\Users\Franziska\Desktop\kalender ==================== Known DLLs (Whitelisted) ================= ==================== Bamital & volsnap Check ================= C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\SysWOW64\wininit.exe => MD5 is legit C:\Windows\explorer.exe => MD5 is legit C:\Windows\SysWOW64\explorer.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\SysWOW64\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\SysWOW64\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\SysWOW64\userinit.exe => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit ==================== EXE ASSOCIATION ===================== HKLM\...\.exe: exefile => OK HKLM\...\exefile\DefaultIcon: %1 => OK HKLM\...\exefile\open\command: "%1" %* => OK ==================== Restore Points ========================= Restore point made on: 2012-12-01 09:01:36 Restore point made on: 2012-12-01 09:44:16 Restore point made on: 2012-12-01 19:01:04 ==================== Memory info =========================== Percentage of memory in use: 23% Total physical RAM: 2013.09 MB Available physical RAM: 1532.59 MB Total Pagefile: 2013.09 MB Available Pagefile: 1516.27 MB Total Virtual: 8192 MB Available Virtual: 8191.91 MB ==================== Partitions ============================= 1 Drive c: (OS) (Fixed) (Total:116.45 GB) (Free:9.05 GB) NTFS ==>[Drive with boot components (obtained from BCD)] 2 Drive d: (DATA) (Fixed) (Total:101.79 GB) (Free:90.48 GB) NTFS 4 Drive f: () (Removable) (Total:1.9 GB) (Free:1.9 GB) FAT 5 Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS Disk ### Status Size Free Dyn Gpt -------- ------------- ------- ------- --- --- Disk 0 Online 232 GB 1024 KB Disk 1 Online 1951 MB 0 B Partitions of Disk 0: =============== Partition ### Type Size Offset ------------- ---------------- ------- ------- Partition 1 Primary 14 GB 1024 KB Partition 2 Primary 116 GB 14 GB Partition 0 Extended 101 GB 131 GB Partition 3 Logical 101 GB 131 GB ================================================================================== Disk: 0 Partition 1 Type : 1C Hidden: Yes Active: No There is no volume associated with this partition. ========================================================= Disk: 0 Partition 2 Type : 07 Hidden: No Active: Yes Volume ### Ltr Label Fs Type Size Status Info ---------- --- ----------- ----- ---------- ------- --------- -------- * Volume 1 C OS NTFS Partition 116 GB Healthy ========================================================= Disk: 0 Partition 3 Type : 07 Hidden: No Active: No Volume ### Ltr Label Fs Type Size Status Info ---------- --- ----------- ----- ---------- ------- --------- -------- * Volume 2 D DATA NTFS Partition 101 GB Healthy ========================================================= Partitions of Disk 1: =============== Partition ### Type Size Offset ------------- ---------------- ------- ------- Partition 1 Primary 1949 MB 1641 KB ================================================================================== Disk: 1 Partition 1 Type : 06 Hidden: No Active: No Volume ### Ltr Label Fs Type Size Status Info ---------- --- ----------- ----- ---------- ------- --------- -------- * Volume 3 F FAT Removable 1949 MB Healthy ========================================================= Last Boot: 2012-11-25 07:58 ==================== End Of Log ============================= |
|
04.12.2012, 05:21
| #5 |
| | browsermngr.exe*32 im Taskmanager lässt sich nicht schließen :( Habe doch noch was zu ComboFix gefunden vll hilft es weiter Combofix Logfile: Code:
ATTFilter ComboFix 12-11-06.03 - Franziska 06.11.2012 17:19:20.1.2 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.49.1031.18.2013.918 [GMT 1:00]
ausgeführt von:: c:\users\Franziska\Desktop\ComboFix.exe
AV: Microsoft Security Essentials *Disabled/Updated* {B140BF4E-23BB-4198-90AB-A51A4C60A69C}
SP: Microsoft Security Essentials *Disabled/Updated* {0A215EAA-0581-4E16-AA1B-9E6837E7EC21}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\jdsfjsdijf.exe
c:\program files (x86)\Common Files\ASPG_icon.ico
c:\program files (x86)\Search Guard Plus
c:\program files (x86)\Search Guard Plus\fbsProtection.xml
c:\program files (x86)\Search Guard Plus\fbsProtectionI.xml
c:\program files (x86)\Search Guard Plus\fbsSearchProvider.xml
c:\program files (x86)\Search Guard Plus\FbsSearchProviderIE8.exe
c:\program files (x86)\Search Guard Plus\SearchGuardPlus.exe
c:\program files (x86)\Search Guard Plus\SearchGuardPlus.ico
c:\program files (x86)\Search Guard Plus\uninstalSGP.exe
c:\program files (x86)\Search Guard PlusU
c:\program files (x86)\Search Guard PlusU\SGPU.ico
c:\program files (x86)\Search Guard PlusU\sgpUpdater.exe
c:\program files (x86)\Search Guard PlusU\sgpUpdater.xml
c:\program files (x86)\Search Guard PlusU\sgpUpdaters.exe
c:\program files (x86)\Search Guard PlusU\uninstalSGPU.exe
c:\program files (x86)\SGPSA
c:\program files (x86)\SGPSA\ie3sh.exe
c:\program files (x86)\SGPSA\mtwb3sh.dll
c:\program files (x86)\SGPSA\SeARchassistant.dll
c:\users\Franziska\AppData\Local\uninstall.tmp
.
.
((((((((((((((((((((((( Dateien erstellt von 2012-10-06 bis 2012-11-06 ))))))))))))))))))))))))))))))
.
.
2012-11-06 15:56 . 2012-11-06 15:56 69000 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{B97A9734-987A-41A2-8822-27D07D32B816}\offreg.dll
2012-11-05 18:20 . 2012-10-12 07:19 9291768 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{B97A9734-987A-41A2-8822-27D07D32B816}\mpengine.dll
2012-11-03 18:18 . 2012-11-03 18:19 -------- d-----w- c:\users\Franziska\AppData\Roaming\dvdcss
2012-11-03 11:20 . 2012-10-12 07:19 9291768 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2012-10-31 02:04 . 2012-11-03 18:21 -------- d-----w- c:\users\Franziska\AppData\Roaming\vlc
2012-10-21 14:58 . 2012-10-25 08:33 -------- d-----w- c:\program files\Google
2012-10-21 10:50 . 2012-10-02 00:34 972192 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{CD0C0FE0-49C5-4CB6-ACF1-6D5896FE53BD}\gapaengine.dll
2012-10-10 11:13 . 2012-08-24 18:05 220160 ----a-w- c:\windows\system32\wintrust.dll
2012-10-10 11:13 . 2012-08-24 16:57 172544 ----a-w- c:\windows\SysWow64\wintrust.dll
2012-10-10 11:13 . 2012-09-14 19:19 2048 ----a-w- c:\windows\system32\tzres.dll
2012-10-10 11:13 . 2012-09-14 18:28 2048 ----a-w- c:\windows\SysWow64\tzres.dll
2012-10-10 11:13 . 2012-08-11 00:56 715776 ----a-w- c:\windows\system32\kerberos.dll
2012-10-10 11:13 . 2012-08-10 23:56 542208 ----a-w- c:\windows\SysWow64\kerberos.dll
2012-10-10 11:12 . 2012-06-02 05:41 1464320 ----a-w- c:\windows\system32\crypt32.dll
2012-10-10 11:12 . 2012-06-02 05:41 184320 ----a-w- c:\windows\system32\cryptsvc.dll
2012-10-10 11:12 . 2012-06-02 04:36 1159680 ----a-w- c:\windows\SysWow64\crypt32.dll
2012-10-10 11:12 . 2012-06-02 05:41 140288 ----a-w- c:\windows\system32\cryptnet.dll
2012-10-10 11:12 . 2012-06-02 04:36 140288 ----a-w- c:\windows\SysWow64\cryptsvc.dll
2012-10-10 11:12 . 2012-06-02 04:36 103936 ----a-w- c:\windows\SysWow64\cryptnet.dll
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-10-21 14:56 . 2012-08-10 17:35 696760 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2012-10-21 14:56 . 2011-06-30 15:22 73656 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2012-10-11 12:16 . 2009-11-11 09:20 65309168 ----a-w- c:\windows\system32\MRT.exe
2012-10-02 00:34 . 2012-10-02 00:34 972192 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\NISBackup\gapaengine.dll
2012-08-30 20:03 . 2012-08-30 20:03 228768 ----a-w- c:\windows\system32\drivers\MpFilter.sys
2012-08-30 20:03 . 2012-03-20 18:44 128456 ----a-w- c:\windows\system32\drivers\NisDrvWFP.sys
2012-08-27 23:49 . 2012-09-15 18:54 9310152 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{519137BF-B46A-449C-9BE3-1034705EFAA5}\mpengine.dll
2012-08-24 11:15 . 2012-09-25 09:21 17810944 ----a-w- c:\windows\system32\mshtml.dll
2012-08-24 10:39 . 2012-09-25 09:21 10925568 ----a-w- c:\windows\system32\ieframe.dll
2012-08-24 10:31 . 2012-09-25 09:21 2312704 ----a-w- c:\windows\system32\jscript9.dll
2012-08-24 10:22 . 2012-09-25 09:21 1346048 ----a-w- c:\windows\system32\urlmon.dll
2012-08-24 10:21 . 2012-09-25 09:21 1392128 ----a-w- c:\windows\system32\wininet.dll
2012-08-24 10:20 . 2012-09-25 09:21 1494528 ----a-w- c:\windows\system32\inetcpl.cpl
2012-08-24 10:18 . 2012-09-25 09:21 237056 ----a-w- c:\windows\system32\url.dll
2012-08-24 10:17 . 2012-09-25 09:21 85504 ----a-w- c:\windows\system32\jsproxy.dll
2012-08-24 10:14 . 2012-09-25 09:21 173056 ----a-w- c:\windows\system32\ieUnatt.exe
2012-08-24 10:14 . 2012-09-25 09:21 816640 ----a-w- c:\windows\system32\jscript.dll
2012-08-24 10:13 . 2012-09-25 09:21 599040 ----a-w- c:\windows\system32\vbscript.dll
2012-08-24 10:12 . 2012-09-25 09:21 2144768 ----a-w- c:\windows\system32\iertutil.dll
2012-08-24 10:11 . 2012-09-25 09:21 729088 ----a-w- c:\windows\system32\msfeeds.dll
2012-08-24 10:10 . 2012-09-25 09:21 96768 ----a-w- c:\windows\system32\mshtmled.dll
2012-08-24 10:09 . 2012-09-25 09:21 2382848 ----a-w- c:\windows\system32\mshtml.tlb
2012-08-24 10:04 . 2012-09-25 09:21 248320 ----a-w- c:\windows\system32\ieui.dll
2012-08-24 06:59 . 2012-09-25 09:21 1800704 ----a-w- c:\windows\SysWow64\jscript9.dll
2012-08-24 06:51 . 2012-09-25 09:21 1129472 ----a-w- c:\windows\SysWow64\wininet.dll
2012-08-24 06:51 . 2012-09-25 09:21 1427968 ----a-w- c:\windows\SysWow64\inetcpl.cpl
2012-08-24 06:47 . 2012-09-25 09:21 142848 ----a-w- c:\windows\SysWow64\ieUnatt.exe
2012-08-24 06:47 . 2012-09-25 09:21 420864 ----a-w- c:\windows\SysWow64\vbscript.dll
2012-08-24 06:43 . 2012-09-25 09:21 2382848 ----a-w- c:\windows\SysWow64\mshtml.tlb
2012-08-22 18:12 . 2012-09-12 16:51 1913200 ----a-w- c:\windows\system32\drivers\tcpip.sys
2012-08-22 18:12 . 2012-09-12 16:51 950128 ----a-w- c:\windows\system32\drivers\ndis.sys
2012-08-22 18:12 . 2012-09-12 16:51 376688 ----a-w- c:\windows\system32\drivers\netio.sys
2012-08-22 18:12 . 2012-09-12 16:51 288624 ----a-w- c:\windows\system32\drivers\FWPKCLNT.SYS
2012-08-21 21:01 . 2012-09-26 18:01 245760 ----a-w- c:\windows\system32\OxpsConverter.exe
2012-08-21 11:01 . 2012-10-01 08:50 33240 ----a-w- c:\windows\system32\drivers\GEARAspiWDM.sys
2012-08-21 11:01 . 2010-02-24 09:27 125872 ----a-w- c:\windows\system32\GEARAspi64.dll
2012-08-21 11:01 . 2010-02-24 09:27 106928 ----a-w- c:\windows\SysWow64\GEARAspi.dll
2012-08-20 17:38 . 2012-10-10 11:14 44032 ----a-w- c:\windows\apppatch\acwow64.dll
2012-08-18 14:29 . 2012-08-18 13:52 3993600 ----a-w- c:\program files (x86)\GUT5206.tmp
2012-08-18 14:29 . 2012-08-18 13:52 3993600 ----a-w- c:\program files (x86)\GUTEDD8.tmp
2009-04-08 17:31 . 2009-04-08 17:31 106496 ----a-w- c:\program files (x86)\Common Files\CPInstallAction.dll
2008-08-12 04:45 . 2008-08-12 04:45 155648 ----a-w- c:\program files (x86)\Common Files\MSIactionall.dll
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{00000000-6E41-4FD3-8538-502F5495E5FC}"= "c:\program files (x86)\Ask.com\GenericAskToolbar.dll" [2012-06-20 1519824]
.
[HKEY_CLASSES_ROOT\clsid\{00000000-6e41-4fd3-8538-502f5495e5fc}]
.
[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
2012-06-20 11:18 1519824 ----a-w- c:\program files (x86)\Ask.com\GenericAskToolbar.dll
.
[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{EEE6C35C-6118-11DC-9C72-001320C79847}]
2012-06-04 14:12 1310040 ----a-w- c:\program files (x86)\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files (x86)\Ask.com\GenericAskToolbar.dll" [2012-06-20 1519824]
"{EEE6C35B-6118-11DC-9C72-001320C79847}"= "c:\program files (x86)\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll" [2012-06-04 1310040]
.
[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
.
[HKEY_CLASSES_ROOT\clsid\{eee6c35b-6118-11dc-9c72-001320c79847}]
[HKEY_CLASSES_ROOT\SWEETIE.IEToolbar.1]
[HKEY_CLASSES_ROOT\TypeLib\{EEE6C35E-6118-11DC-9C72-001320C79847}]
[HKEY_CLASSES_ROOT\SWEETIE.IEToolbar]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1475584]
"ABBYY Screenshot Reader Bonus"="c:\program files (x86)\ABBYY FineReader 9.0 Sprint\Bonus.ScreenshotReader.exe" [2009-11-25 939272]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2012-04-18 421888]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-08-27 59280]
"ApnUpdater"="c:\program files (x86)\Ask.com\Updater\Updater.exe" [2012-06-20 1568976]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-07-11 919008]
"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2012-07-31 38872]
"SweetIM"="c:\program files (x86)\SweetIM\Messenger\SweetIM.exe" [2012-05-29 115032]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2012-09-09 421776]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2012-07-31 11:20 38872 ----a-w- c:\program files (x86)\Adobe\Reader 9.0\Reader\reader_sl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ASUS Screen Saver Protector]
2009-09-19 09:15 3054136 ----a-w- c:\windows\AsScrPro.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CLMLServer]
2008-07-19 02:52 104936 ----a-w- c:\program files (x86)\CyberLink\Power2Go\CLMLSvc.exe
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2012-07-13 160944]
R3 androidusb;SAMSUNG Android Composite ADB Interface Driver;c:\windows\system32\Drivers\ssadadb.sys [2011-05-13 36328]
R3 Netaapl;Apple Mobile Device Ethernet Service;c:\windows\system32\DRIVERS\netaapl64.sys [2011-08-02 22528]
R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [2012-08-30 128456]
R3 NisSrv;Microsoft-Netzwerkinspektion;c:\program files\Microsoft Security Client\NisSrv.exe [2012-09-12 368896]
R3 SiSGbeLH;SiS191/SiS190 Ethernet Device NDIS 6.0 Driver;c:\windows\system32\DRIVERS\SiSG664.sys [2009-06-10 56832]
R3 ssadbus;SAMSUNG Android USB Composite Device driver (WDM);c:\windows\system32\DRIVERS\ssadbus.sys [2011-05-13 157672]
R3 ssadmdfl;SAMSUNG Android USB Modem (Filter);c:\windows\system32\DRIVERS\ssadmdfl.sys [2011-05-13 16872]
R3 ssadmdm;SAMSUNG Android USB Modem Drivers;c:\windows\system32\DRIVERS\ssadmdm.sys [2011-05-13 177640]
R3 ssadserd;SAMSUNG Android USB Diagnostic Serial Port (WDM);c:\windows\system32\DRIVERS\ssadserd.sys [2011-05-13 146920]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 59392]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [2012-07-09 52736]
R4 ABBYY.Licensing.FineReader.Sprint.9.0;ABBYY FineReader 9.0 Sprint Licensing Service;c:\program files (x86)\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe [2009-05-14 759048]
R4 AFBAgent;AFBAgent;c:\windows\system32\FBAgent.exe [2009-09-15 359552]
R4 ASUSRDVDService;ASUSRDVD Service;c:\program files (x86)\ASUS\AI Recovery\ServiceSimple2.exe [2009-09-11 109184]
R4 FastBootAgent;FastBootAgent;c:\windows\SysWOW64\Fast Boot\FastBootAgent.exe [2009-07-24 306232]
S0 lullaby;lullaby;c:\windows\system32\DRIVERS\lullaby.sys [2009-06-18 15928]
S2 ASMMAP64;ASMMAP64;c:\program files\ATKGFNEX\ASMMAP64.sys [2007-07-24 14904]
S2 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [2010-06-25 35344]
S3 AmUStor;AM USB Stroage Driver;c:\windows\system32\drivers\AmUStor.SYS [2009-05-26 40448]
S3 ETD;ELAN PS/2 Port Input Device;c:\windows\system32\DRIVERS\ETD.sys [2009-06-12 112128]
S3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:\windows\system32\drivers\viahduaa.sys [2009-07-09 1222144]
.
.
Inhalt des "geplante Tasks" Ordners
.
2012-11-06 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-08-10 14:56]
.
2012-11-03 c:\windows\Tasks\Norton Security Scan for Franziska.job
- c:\program files (x86)\Norton Security Scan\Engine\2.7.3.34\Nss.exe [2010-10-05 00:27]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2012-09-12 1289704]
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.google.de/
uLocal Page = c:\windows\system32\blank.htm
mDefault_Page_URL = hxxp://www.maxiwe.com/
mStart Page = hxxp://www.maxiwe.com/
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000
IE: {{7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - c:\program files (x86)\ICQ7.5\ICQ.exe
TCP: DhcpNameServer = 192.168.178.1
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
BHO-{8A9D74F9-560B-4FE7-ABEB-3B2E638E5CD6} - c:\program files (x86)\SGPSA\SearchAssistant.dll
BHO-{F0626A63-410B-45E2-99A1-3F2475B2D695} - c:\program files (x86)\SGPSA\BHO.dll
Toolbar-Locked - (no file)
Wow6432Node-HKCU-Run-MobileDocuments - c:\program files (x86)\Common Files\Apple\Internet Services\ubd.exe
Wow6432Node-HKLM-Run-<NO NAME> - (no file)
MSConfigStartUp-ASUS Camera ScreenSaver - c:\windows\AsScrProlog.exe
Toolbar-Locked - (no file)
WebBrowser-{EEE6C35B-6118-11DC-9C72-001320C79847} - (no file)
WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
AddRemove-Search Guard Plus - c:\program files (x86)\Search Guard Plus\uninstalSGP.exe
AddRemove-Search Guard Plus Updater - c:\program files (x86)\Search Guard PlusU\uninstalSGPU.exe
AddRemove-Zylom Games Player Plugin - c:\program files (x86)\Zylom Games\UninstallPlugin.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_4_402_287_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_4_402_287_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_4_402_287_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_4_402_287_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_287.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_287.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_287.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_287.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2012-11-06 17:38:45
ComboFix-quarantined-files.txt 2012-11-06 16:38
.
Vor Suchlauf: 9 Verzeichnis(se), 12.744.212.480 Bytes frei
Nach Suchlauf: 14 Verzeichnis(se), 12.850.114.560 Bytes frei
.
- - End Of File - - FE886501F876B4AA8D6C7F072C53A4C7
|
|
04.12.2012, 14:18
| #6 |
| /// TB-Ausbilder | browsermngr.exe*32 im Taskmanager lässt sich nicht schließen :( Fix mit FRST
__________________ --> browsermngr.exe*32 im Taskmanager lässt sich nicht schließen :( |
|
05.12.2012, 00:02
| #7 |
| | browsermngr.exe*32 im Taskmanager lässt sich nicht schließen :( Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 02-12-2012 Ran by SYSTEM at 2012-12-04 23:56:19 Run:1 Running from F:\ ============================================== C:\Users\All Users\Browser Manager moved successfully. ==== End of Fixlog ==== |
|
05.12.2012, 14:40
| #8 | ||
| /// TB-Ausbilder | browsermngr.exe*32 im Taskmanager lässt sich nicht schließen :( Sehr schön, dann bitte: Schritt 1: AdwCleaner: Werbeprogramme suchen und löschen Schritt 2: Adware entfernen mit JRT Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.  Bitte lade Junkware Removal Tool auf Deinen Desktop.
Scan mit Combofix
__________________  Digitale Freibeuter gegen Malware! Keine Hilfe per PM! |
|
07.12.2012, 23:30
| #9 |
| | browsermngr.exe*32 im Taskmanager lässt sich nicht schließen :( Adwcleaner hat funktioniert |
|
07.12.2012, 23:31
| #10 |
| | browsermngr.exe*32 im Taskmanager lässt sich nicht schließen :( combofix ist auch durch.. was sind Code tags? |
|
08.12.2012, 10:23
| #11 | |
| /// TB-Ausbilder | browsermngr.exe*32 im Taskmanager lässt sich nicht schließen :( sowas
__________________ Digitale Freibeuter gegen Malware! Keine Hilfe per PM! |
|
08.12.2012, 20:26
| #12 |
| | browsermngr.exe*32 im Taskmanager lässt sich nicht schließen :(Code:
ATTFilter ComboFix 12-12-04.01 - Franziska 07.12.2012 20:03:34.3.2 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.49.1031.18.2013.863 [GMT 1:00]
ausgeführt von:: c:\users\Franziska\Desktop\ComboFix.exe
AV: Microsoft Security Essentials *Disabled/Updated* {B140BF4E-23BB-4198-90AB-A51A4C60A69C}
SP: Microsoft Security Essentials *Disabled/Updated* {0A215EAA-0581-4E16-AA1B-9E6837E7EC21}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((( Dateien erstellt von 2012-11-07 bis 2012-12-07 ))))))))))))))))))))))))))))))
.
.
2012-12-07 19:15 . 2012-12-07 19:15 -------- d-----w- c:\users\Public\AppData\Local\temp
2012-12-07 19:15 . 2012-12-07 19:15 -------- d-----w- c:\users\Franziska\AppData\Local\temp
2012-12-07 19:15 . 2012-12-07 19:15 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-12-07 18:54 . 2012-11-08 17:24 9125352 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{5BB1C9EC-000D-459A-8565-D81F698C6063}\mpengine.dll
2012-12-07 18:45 . 2012-12-07 18:45 -------- d-----w- c:\windows\ERUNT
2012-12-07 18:44 . 2012-12-07 18:45 -------- dc----w- C:\JRT
2012-12-04 21:37 . 2012-11-08 17:24 9125352 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2012-12-04 05:09 . 2012-12-04 05:09 -------- d-----w- c:\users\Franziska\AppData\Local\Microsoft_Corporation
2012-12-04 00:20 . 2012-12-04 00:20 -------- dc----w- C:\FRST
2012-12-02 03:56 . 2012-12-02 03:56 -------- d-----w- c:\users\Franziska\AppData\Roaming\Malwarebytes
2012-12-02 03:56 . 2012-12-02 03:56 -------- d-----w- c:\programdata\Malwarebytes
2012-12-02 03:56 . 2012-12-02 03:56 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
2012-12-02 03:56 . 2012-09-29 18:54 25928 ----a-w- c:\windows\system32\drivers\mbam.sys
2012-12-01 17:44 . 2012-12-01 17:44 -------- d-----w- c:\program files (x86)\plasq
2012-12-01 17:43 . 2012-12-01 17:43 -------- d-----w- c:\program files (x86)\Common Files\Wise Installation Wizard
2012-11-28 12:54 . 2012-11-28 12:53 972264 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{70F65355-C46E-4E3A-99A9-46759875947A}\gapaengine.dll
2012-11-27 02:15 . 2012-08-24 18:13 154480 ----a-w- c:\windows\system32\drivers\ksecpkg.sys
2012-11-27 02:15 . 2012-08-24 18:09 458712 ----a-w- c:\windows\system32\drivers\cng.sys
2012-11-27 02:15 . 2012-08-24 18:05 340992 ----a-w- c:\windows\system32\schannel.dll
2012-11-27 02:15 . 2012-08-24 18:04 307200 ----a-w- c:\windows\system32\ncrypt.dll
2012-11-27 02:15 . 2012-08-24 16:57 247808 ----a-w- c:\windows\SysWow64\schannel.dll
2012-11-27 02:15 . 2012-08-24 18:03 1448448 ----a-w- c:\windows\system32\lsasrv.dll
2012-11-27 02:15 . 2012-08-24 16:57 220160 ----a-w- c:\windows\SysWow64\ncrypt.dll
2012-11-27 02:15 . 2012-08-24 16:57 22016 ----a-w- c:\windows\SysWow64\secur32.dll
2012-11-27 02:15 . 2012-08-24 16:53 96768 ----a-w- c:\windows\SysWow64\sspicli.dll
2012-11-27 02:15 . 2012-05-04 09:59 514560 ----a-w- c:\windows\SysWow64\qdvd.dll
2012-11-27 02:15 . 2012-05-04 11:00 366592 ----a-w- c:\windows\system32\qdvd.dll
2012-11-27 02:04 . 2012-11-27 02:04 -------- d-----w- c:\program files (x86)\Microsoft.NET
2012-11-16 21:45 . 2012-11-16 21:45 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin7.dll
2012-11-16 21:45 . 2012-11-16 21:45 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin6.dll
2012-11-16 21:45 . 2012-11-16 21:45 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin5.dll
2012-11-16 21:45 . 2012-11-16 21:45 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin4.dll
2012-11-16 21:45 . 2012-11-16 21:45 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin3.dll
2012-11-16 21:45 . 2012-11-16 21:45 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin2.dll
2012-11-16 21:45 . 2012-11-16 21:45 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin.dll
2012-11-16 21:44 . 2012-11-16 21:45 -------- d-----w- c:\program files (x86)\QuickTime
2012-11-15 09:51 . 2012-07-26 07:46 2560 ----a-w- c:\windows\system32\drivers\de-DE\wdf01000.sys.mui
2012-11-15 09:50 . 2012-07-26 04:55 785512 ----a-w- c:\windows\system32\drivers\Wdf01000.sys
2012-11-15 09:50 . 2012-07-26 04:55 54376 ----a-w- c:\windows\system32\drivers\WdfLdr.sys
2012-11-15 09:50 . 2012-07-26 02:36 9728 ----a-w- c:\windows\system32\Wdfres.dll
2012-11-15 08:28 . 2012-10-08 11:13 2382848 ----a-w- c:\windows\system32\mshtml.tlb
2012-11-15 08:28 . 2012-10-08 07:40 2382848 ----a-w- c:\windows\SysWow64\mshtml.tlb
2012-11-15 08:28 . 2012-10-08 11:13 96768 ----a-w- c:\windows\system32\mshtmled.dll
2012-11-15 08:28 . 2012-10-08 12:29 174216 ----a-w- c:\program files\Internet Explorer\sqmapi.dll
2012-11-15 08:28 . 2012-10-08 08:37 140960 ----a-w- c:\program files (x86)\Internet Explorer\sqmapi.dll
2012-11-15 08:26 . 2012-10-09 18:17 55296 ----a-w- c:\windows\system32\dhcpcsvc6.dll
2012-11-15 08:25 . 2012-09-25 22:47 78336 ----a-w- c:\windows\SysWow64\synceng.dll
2012-11-15 08:25 . 2012-09-25 22:46 95744 ----a-w- c:\windows\system32\synceng.dll
2012-11-15 08:23 . 2012-07-26 02:26 87040 ----a-w- c:\windows\system32\drivers\WUDFPf.sys
2012-11-15 08:23 . 2012-07-26 02:26 198656 ----a-w- c:\windows\system32\drivers\WUDFRd.sys
2012-11-15 08:23 . 2012-07-26 03:08 84992 ----a-w- c:\windows\system32\WUDFSvc.dll
2012-11-15 08:23 . 2012-07-26 03:08 194048 ----a-w- c:\windows\system32\WUDFPlatform.dll
2012-11-15 08:23 . 2012-07-26 03:08 45056 ----a-w- c:\windows\system32\WUDFCoinstaller.dll
2012-11-15 08:23 . 2012-07-26 03:08 229888 ----a-w- c:\windows\system32\WUDFHost.exe
2012-11-15 08:23 . 2012-07-26 03:08 744448 ----a-w- c:\windows\system32\WUDFx.dll
2012-11-13 15:12 . 2012-11-13 15:12 -------- d-----w- c:\users\Franziska\AppData\Local\Apple_Inc
2012-11-13 15:07 . 2012-11-13 15:07 -------- d-----w- c:\program files (x86)\iPhone-Konfigurationsprogramm
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-11-15 08:24 . 2009-11-11 09:20 66395536 ----a-w- c:\windows\system32\MRT.exe
2012-10-25 02:12 . 2012-10-25 02:12 94208 ----a-w- c:\windows\SysWow64\QuickTimeVR.qtx
2012-10-25 02:12 . 2012-10-25 02:12 69632 ----a-w- c:\windows\SysWow64\QuickTime.qts
2012-10-21 14:56 . 2012-08-10 17:35 696760 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2012-10-21 14:56 . 2011-06-30 15:22 73656 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2012-10-16 08:38 . 2012-12-01 16:58 135168 ----a-w- c:\windows\apppatch\AppPatch64\AcXtrnal.dll
2012-10-16 08:38 . 2012-12-01 16:58 350208 ----a-w- c:\windows\apppatch\AppPatch64\AcLayers.dll
2012-10-16 07:39 . 2012-12-01 16:58 561664 ----a-w- c:\windows\apppatch\AcLayers.dll
2012-10-02 00:34 . 2012-10-02 00:34 972192 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\NISBackup\gapaengine.dll
2012-09-28 09:32 . 2012-09-28 09:32 5989776 ----a-w- c:\windows\system32\usbaaplrc.dll
2012-09-28 09:32 . 2012-09-28 09:32 53760 ----a-w- c:\windows\system32\drivers\usbaapl64.sys
2012-09-14 19:19 . 2012-10-10 11:13 2048 ----a-w- c:\windows\system32\tzres.dll
2012-09-14 18:28 . 2012-10-10 11:13 2048 ----a-w- c:\windows\SysWow64\tzres.dll
2012-08-18 14:29 . 2012-08-18 13:52 3993600 ----a-w- c:\program files (x86)\GUT5206.tmp
2012-08-18 14:29 . 2012-08-18 13:52 3993600 ----a-w- c:\program files (x86)\GUTEDD8.tmp
2009-04-08 17:31 . 2009-04-08 17:31 106496 ----a-w- c:\program files (x86)\Common Files\CPInstallAction.dll
2008-08-12 04:45 . 2008-08-12 04:45 155648 ----a-w- c:\program files (x86)\Common Files\MSIactionall.dll
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1475584]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-10-11 59280]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-07-11 919008]
"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2012-07-31 38872]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2012-09-09 421776]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2012-10-25 421888]
"AppleSyncNotifier"="c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2011-11-02 59240]
"HControlUser"="c:\program files (x86)\ASUS\ATK Hotkey\HControlUser.exe" [2009-06-19 105016]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2012-07-31 11:20 38872 ----a-w- c:\program files (x86)\Adobe\Reader 9.0\Reader\reader_sl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ASUS Screen Saver Protector]
2009-09-19 09:15 3054136 ----a-w- c:\windows\AsScrPro.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CLMLServer]
2008-07-19 02:52 104936 ----a-w- c:\program files (x86)\CyberLink\Power2Go\CLMLSvc.exe
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-09-29 676936]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2012-07-13 160944]
R3 AmUStor;AM USB Stroage Driver;c:\windows\system32\drivers\AmUStor.SYS [2009-05-26 40448]
R3 androidusb;SAMSUNG Android Composite ADB Interface Driver;c:\windows\system32\Drivers\ssadadb.sys [2011-05-13 36328]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2012-09-29 25928]
R3 Netaapl;Apple Mobile Device Ethernet Service;c:\windows\system32\DRIVERS\netaapl64.sys [2011-08-02 22528]
R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [2012-08-30 128456]
R3 NisSrv;Microsoft-Netzwerkinspektion;c:\program files\Microsoft Security Client\NisSrv.exe [2012-09-12 368896]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2012-08-23 19456]
R3 SiSGbeLH;SiS191/SiS190 Ethernet Device NDIS 6.0 Driver;c:\windows\system32\DRIVERS\SiSG664.sys [2009-06-10 56832]
R3 ssadbus;SAMSUNG Android USB Composite Device driver (WDM);c:\windows\system32\DRIVERS\ssadbus.sys [2011-05-13 157672]
R3 ssadmdfl;SAMSUNG Android USB Modem (Filter);c:\windows\system32\DRIVERS\ssadmdfl.sys [2011-05-13 16872]
R3 ssadmdm;SAMSUNG Android USB Modem Drivers;c:\windows\system32\DRIVERS\ssadmdm.sys [2011-05-13 177640]
R3 ssadserd;SAMSUNG Android USB Diagnostic Serial Port (WDM);c:\windows\system32\DRIVERS\ssadserd.sys [2011-05-13 146920]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2012-08-23 57856]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [2012-09-28 53760]
R4 AFBAgent;AFBAgent;c:\windows\system32\FBAgent.exe [2009-09-15 359552]
R4 ASUSRDVDService;ASUSRDVD Service;c:\program files (x86)\ASUS\AI Recovery\ServiceSimple2.exe [2009-09-11 109184]
R4 FastBootAgent;FastBootAgent;c:\windows\SysWOW64\Fast Boot\FastBootAgent.exe [2009-07-24 306232]
S0 lullaby;lullaby;c:\windows\system32\DRIVERS\lullaby.sys [2009-06-18 15928]
S2 ASMMAP64;ASMMAP64;c:\program files\ATKGFNEX\ASMMAP64.sys [2007-07-24 14904]
S2 MBAMScheduler;MBAMScheduler;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [2012-09-29 399432]
S3 ETD;ELAN PS/2 Port Input Device;c:\windows\system32\DRIVERS\ETD.sys [2009-06-12 112128]
S3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:\windows\system32\drivers\viahduaa.sys [2009-07-09 1222144]
.
.
Inhalt des "geplante Tasks" Ordners
.
2012-12-04 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-08-10 14:56]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2012-09-12 1289704]
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = https://www.google.de/
uLocal Page = c:\windows\system32\blank.htm
mDefault_Page_URL = hxxp://www.maxiwe.com/
mStart Page = hxxp://www.maxiwe.com/
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.178.1
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Toolbar-Locked - (no file)
Wow6432Node-HKCU-Run-ABBYY Screenshot Reader Bonus - c:\program files (x86)\ABBYY FineReader 9.0 Sprint\Bonus.ScreenshotReader.exe
Wow6432Node-HKLM-Run-<NO NAME> - (no file)
MSConfigStartUp-ASUS Camera ScreenSaver - c:\windows\AsScrProlog.exe
AddRemove-EPSON Scanner - c:\program files (x86)\epson\escndv\setup\setup.exe
AddRemove-EPSON SX218 Series Manual - c:\program files (x86)\Epson\TpManual\EPSON SX218 Series\de\Useg\DocUnins.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_4_402_287_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_4_402_287_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_4_402_287_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_4_402_287_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_287.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_287.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_287.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_287.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2012-12-07 20:23:49
ComboFix-quarantined-files.txt 2012-12-07 19:23
.
Vor Suchlauf: 9.393.397.760 Bytes frei
Nach Suchlauf: 16 Verzeichnis(se), 10.022.907.904 Bytes frei
.
- - End Of File - - 671DA2B5FF40A8D0CAEEFE8740D4B464
|
|
08.12.2012, 21:13
| #13 | |
| /// TB-Ausbilder | browsermngr.exe*32 im Taskmanager lässt sich nicht schließen :( Gut!  Wir müssen jetzt noch ein paar Kontrollen machen. Schritt 1: Quick-Scan mit Malwarebytes Schritt 2: ESET Online Scanner Zitat:
Schritt 3: Java Update (Windows XP, Vista, 7) Dein Java ist nicht mehr aktuell. Ältere Versionen enthalten Sicherheitslücken, die von Malware missbraucht werden können.Schritt 4: Scan mit SecurityCheck Downloade Dir bitte SecurityCheck: LINK1 LINK2
__________________ Digitale Freibeuter gegen Malware! Keine Hilfe per PM! |
|
08.12.2012, 22:23
| #14 |
| | browsermngr.exe*32 im Taskmanager lässt sich nicht schließen :( Datenbank Version: v2012.12.08.07 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 9.0.8112.16421 Franziska :: SCHABLONIEEE [Administrator] Schutz: Aktiviert 08.12.2012 22:16:36 mbam-log-2012-12-08 (22-16-36).txt Art des Suchlaufs: Quick-Scan Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 208139 Laufzeit: 4 Minute(n), 35 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 1 C:\Users\Franziska\AppData\Roaming\usernt.dat (Malware.Trace) -> Erfolgreich gelöscht und in Quarantäne gestellt. (Ende) Schritt 2: wurde nichts gefunden Schritt 3: java installiert und alles ausgeführt Schritt 4: Code:
ATTFilter Results of screen317's Security Check version 0.99.56 Windows 7 Service Pack 1 x64 (UAC is enabled) Internet Explorer 9 ``````````````Antivirus/Firewall Check:`````````````` Microsoft Security Essentials Antivirus up to date! `````````Anti-malware/Other Utilities Check:````````` Malwarebytes Anti-Malware Version 1.65.1.1000 Java 7 Update 9 Adobe Flash Player 11.4.402.287 Flash Player out of Date! Adobe Reader 9 Adobe Reader out of Date! ````````Process Check: objlist.exe by Laurent```````` Microsoft Security Essentials MSMpEng.exe Microsoft Security Essentials msseces.exe Malwarebytes Anti-Malware mbamservice.exe Malwarebytes Anti-Malware mbamgui.exe Malwarebytes' Anti-Malware mbamscheduler.exe `````````````````System Health check````````````````` Total Fragmentation on Drive C: ````````````````````End of Log`````````````````````` |
|
09.12.2012, 17:02
| #15 | ||||
| /// TB-Ausbilder | browsermngr.exe*32 im Taskmanager lässt sich nicht schließen :( Prima! Damit wären wir fertig. Wir räumen jetzt noch ein wenig auf und dann habe ich am Ende etwas Lesestoff für dich. Schritt 1: Tools deinstallieren
Schritt 2: ESET deinstallieren (Optional) Schritt 3: Update: Adobe Flash Player
Update: Adobe Reader
Probiere einen alternativen Viewer für pdf-Dokumente aus. Diese sind meist schlanker, schneller und schleusen sehr viel seltener Schädlinge ein. Mein Vorschlag:
Abschließend noch Tipps zu folgenden Themen:
Damit wünsche ich dir noch viel Spaß beim Surfen im Internet ... und vielleicht möchtest du ja das Trojaner-Board unterstützen? Eine Bitte: Gib mir eine kurze Rückmeldung, wenn alles erledigt ist und keine Fragen mehr vorhanden sind, damit ich diesen Thread aus meinen Abos löschen kann.
__________________ Digitale Freibeuter gegen Malware! Keine Hilfe per PM! |
|
| Themen zu browsermngr.exe*32 im Taskmanager lässt sich nicht schließen :( |
| ahnung, antivirenprogramm, bedanken, browser manager, computer, computern, direkt, ebanking, folge, folgendes, gelöscht, gesperrt, infiziert, infiziert?, langsam, laptop, namen, natürlich, nicht schließen, onlinebanking, problem, programm, schließe, schließen, stelle, taskmanager, wirklich, woche, wochen |
+ R Taste und schreibe notepad in das Ausführen Fenster.
Button.
und dann 
Linear-Darstellung
