| |
| |||||||
Log-Analyse und Auswertung: Email von Telekom-Abuse-Team | Log-File anbeiWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
| |
13.02.2013, 11:30
| #1 |
| /// Malware-holic   |  Email von Telekom-Abuse-Team | Log-File anbei frage: ist das der einzige PC im Haus? bzw war zum infektionszeitpunkt evtl. n Bekannter mit Rechner bei dir? Scan mit Combofix
__________________ -Verdächtige mails bitte an uns zur Analyse weiterleiten: markusg.trojaner-board@web.de Weiterleiten Anleitung: http://markusg.trojaner-board.de Mails bitte vorerst nach obiger Anleitung an markusg.trojaner-board@web.de Weiterleiten Wenn Ihr uns unterstützen möchtet |
|
14.02.2013, 18:57
| #2 | |
 | Email von Telekom-Abuse-Team | Log-File anbeiZitat:
Kannst Du mir ein kurzes Feedback geben, wo wir gerade stehen? Ich führe ja deine Anweisungen gerne durch aber würde gerne auch wissen, ob es irgendwelche Erkenntnisse aus den Logfiles gibt. Nur so als Info für mich. Gefühlt läuft der Rechner ohne Probleme. Combofix habe ich nun ausgeführt (was genau hab ich damit nun gemacht?): Code:
ATTFilter ComboFix 13-02-13.02 - GG 14.02.2013 18:40:36.1.3 - x64
Microsoft Windows 7 Ultimate 6.1.7601.1.1252.49.1031.18.4092.2570 [GMT 1:00]
ausgeführt von:: e:\eigene dateien\Desktop\ComboFix.exe
AV: Microsoft Security Essentials *Disabled/Updated* {B140BF4E-23BB-4198-90AB-A51A4C60A69C}
SP: Microsoft Security Essentials *Disabled/Updated* {0A215EAA-0581-4E16-AA1B-9E6837E7EC21}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\GG\AppData\Local\TCB Networks\StrokeIt\Bin\StrokeIt.exe
.
.
((((((((((((((((((((((( Dateien erstellt von 2013-01-14 bis 2013-02-14 ))))))))))))))))))))))))))))))
.
.
2013-02-14 17:43 . 2013-02-14 17:43 -------- d-----w- c:\users\Default\AppData\Local\temp
2013-02-14 11:34 . 2013-01-09 01:10 996352 ----a-w- c:\program files\Common Files\Microsoft Shared\VGX\VGX.dll
2013-02-14 11:34 . 2013-01-08 22:01 768000 ----a-w- c:\program files (x86)\Common Files\Microsoft Shared\VGX\VGX.dll
2013-02-14 10:18 . 2013-02-14 10:18 -------- d-----w- c:\users\GG\AppData\Roaming\Babylon
2013-02-14 10:18 . 2013-02-14 10:18 -------- d-----w- c:\programdata\Babylon
2013-02-14 10:16 . 2013-01-08 05:32 9161176 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{F17BF10E-56CB-45A3-8D7D-ECD57C677E58}\mpengine.dll
2013-02-14 08:45 . 2013-01-05 05:53 5553512 ----a-w- c:\windows\system32\ntoskrnl.exe
2013-02-14 08:45 . 2013-01-05 05:00 3967848 ----a-w- c:\windows\SysWow64\ntkrnlpa.exe
2013-02-14 08:45 . 2013-01-05 05:00 3913064 ----a-w- c:\windows\SysWow64\ntoskrnl.exe
2013-02-14 08:45 . 2013-01-04 03:26 3153408 ----a-w- c:\windows\system32\win32k.sys
2013-02-14 08:45 . 2013-01-04 05:46 215040 ----a-w- c:\windows\system32\winsrv.dll
2013-02-14 08:45 . 2013-01-04 04:51 5120 ----a-w- c:\windows\SysWow64\wow32.dll
2013-02-14 08:45 . 2013-01-04 02:47 25600 ----a-w- c:\windows\SysWow64\setup16.exe
2013-02-14 08:45 . 2013-01-04 02:47 7680 ----a-w- c:\windows\SysWow64\instnm.exe
2013-02-14 08:45 . 2013-01-04 02:47 2048 ----a-w- c:\windows\SysWow64\user.exe
2013-02-14 08:45 . 2013-01-04 02:47 14336 ----a-w- c:\windows\SysWow64\ntvdm64.dll
2013-02-14 08:45 . 2013-01-03 06:00 1913192 ----a-w- c:\windows\system32\drivers\tcpip.sys
2013-02-14 08:45 . 2013-01-03 06:00 288088 ----a-w- c:\windows\system32\drivers\FWPKCLNT.SYS
2013-02-12 21:48 . 2013-02-12 21:48 310688 ----a-w- c:\windows\system32\javaws.exe
2013-02-12 21:48 . 2013-02-12 21:48 963488 ----a-w- c:\windows\system32\deployJava1.dll
2013-02-12 21:48 . 2013-02-12 21:48 1085344 ----a-w- c:\windows\system32\npDeployJava1.dll
2013-02-12 21:48 . 2013-02-12 21:48 108448 ----a-w- c:\windows\system32\WindowsAccessBridge-64.dll
2013-02-12 21:48 . 2013-02-12 21:48 188832 ----a-w- c:\windows\system32\javaw.exe
2013-02-12 21:48 . 2013-02-12 21:48 188320 ----a-w- c:\windows\system32\java.exe
2013-02-12 21:47 . 2013-02-12 21:48 -------- d-----w- c:\program files\Java
2013-02-12 20:50 . 2013-01-08 05:32 9161176 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2013-02-07 11:41 . 2013-02-07 11:41 -------- d-----w- c:\users\GG\AppData\Roaming\Malwarebytes
2013-02-07 11:41 . 2013-02-07 11:41 -------- d-----w- c:\programdata\Malwarebytes
2013-02-07 11:41 . 2013-02-07 11:41 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
2013-02-07 11:41 . 2012-12-14 15:49 24176 ----a-w- c:\windows\system32\drivers\mbam.sys
2013-02-06 10:39 . 2013-02-06 10:39 -------- d-----w- c:\users\GG\AppData\Local\{DFCD66BE-CB4F-42AE-A6D3-E634BBBD94E9}
2013-02-05 17:16 . 2013-02-05 17:16 -------- d-----w- c:\program files (x86)\HD Tune
2013-02-05 08:09 . 2013-02-14 10:22 -------- d-----w- c:\windows\system32\appmgmt
2013-02-04 14:18 . 2012-03-09 21:23 132096 ----a-w- c:\programdata\Microsoft\Windows\Start Menu\Programs\Media\File Renamer\Rename32.dll
2013-02-04 14:18 . 2012-03-09 21:23 132096 ----a-w- c:\programdata\Microsoft\Windows\Start Menu\Programme\Media\File Renamer\Rename32.dll
2013-02-04 14:18 . 2012-02-19 14:17 247808 ----a-w- c:\programdata\Microsoft\Windows\Start Menu\Programs\Media\File Renamer\Rename.exe
2013-02-04 14:18 . 2012-02-19 14:17 247808 ----a-w- c:\programdata\Microsoft\Windows\Start Menu\Programme\Media\File Renamer\Rename.exe
2013-02-04 14:18 . 2012-02-18 11:26 680050 ----a-w- c:\programdata\Microsoft\Windows\Start Menu\Programs\Media\File Renamer\Rename64.dll
2013-02-04 14:18 . 2012-02-18 11:26 680050 ----a-w- c:\programdata\Microsoft\Windows\Start Menu\Programme\Media\File Renamer\Rename64.dll
2013-02-04 14:08 . 2013-02-04 14:08 -------- d-----w- c:\users\GG\AppData\Local\Tools&More
2013-01-29 09:29 . 2012-10-24 13:17 67224 ----a-w- c:\windows\system32\vsocklib.dll
2013-01-29 09:29 . 2012-10-24 13:17 70296 ----a-w- c:\windows\system32\drivers\vsock.sys
2013-01-29 09:29 . 2012-10-24 13:17 63128 ----a-w- c:\windows\SysWow64\vsocklib.dll
2013-01-29 09:29 . 2012-11-01 01:34 31384 ----a-w- c:\windows\system32\drivers\VMparport.sys
2013-01-29 09:29 . 2012-11-01 01:34 67224 ----a-w- c:\windows\system32\drivers\vmx86.sys
2013-01-29 09:29 . 2012-11-01 01:35 357016 ----a-w- c:\windows\SysWow64\vmnetdhcp.exe
2013-01-29 09:29 . 2012-11-01 01:34 435864 ----a-w- c:\windows\SysWow64\vmnat.exe
2013-01-29 09:29 . 2012-11-01 01:34 30360 ----a-w- c:\windows\system32\drivers\vmnetuserif.sys
2013-01-29 09:29 . 2012-11-01 01:35 933528 ----a-w- c:\windows\system32\vnetlib64.dll
2013-01-29 09:29 . 2012-10-11 16:15 52376 ----a-w- c:\windows\system32\drivers\hcmon.sys
2013-01-29 09:28 . 2013-01-29 09:28 -------- d-----w- c:\program files\Common Files\VMware
2013-01-29 09:28 . 2013-01-29 09:28 -------- d-----w- c:\program files (x86)\Common Files\VMware
2013-01-29 09:09 . 2013-01-29 10:09 -------- d-----w- C:\Virtualisation
2013-01-29 09:03 . 2013-02-04 13:13 -------- d-----w- c:\users\GG\AppData\Roaming\VMware
2013-01-29 09:03 . 2013-02-04 13:13 -------- d-----w- c:\users\GG\AppData\Local\VMware
2013-01-29 08:57 . 2013-02-14 17:44 -------- d-----w- c:\programdata\VMware
2013-01-29 08:57 . 2013-01-29 09:28 -------- d-----w- c:\program files (x86)\VMware
2013-01-29 08:29 . 2013-01-29 08:29 -------- d-----w- c:\program files (x86)\MSXML 4.0
2013-01-28 12:39 . 2010-05-26 10:41 248672 ----a-w- c:\windows\SysWow64\d3dx11_43.dll
2013-01-28 12:39 . 2010-05-26 10:41 470880 ----a-w- c:\windows\SysWow64\d3dx10_43.dll
2013-01-28 12:39 . 2010-05-26 10:41 1998168 ----a-w- c:\windows\SysWow64\D3DX9_43.dll
2013-01-28 12:39 . 2010-05-26 10:41 1868128 ----a-w- c:\windows\SysWow64\d3dcsx_43.dll
2013-01-28 12:38 . 2010-05-26 10:41 2106216 ----a-w- c:\windows\SysWow64\D3DCompiler_43.dll
2013-01-28 11:50 . 2013-01-28 11:50 -------- d-----w- c:\users\GG\AppData\Roaming\Nero
2013-01-28 11:47 . 2013-01-28 12:42 -------- d-----w- c:\program files (x86)\Common Files\Nero
2013-01-28 11:47 . 2013-01-28 12:42 -------- d-----w- c:\program files (x86)\Nero
2013-01-28 11:47 . 2013-01-28 11:48 -------- d-----w- c:\programdata\Nero
2013-01-25 22:56 . 2013-02-07 11:41 -------- d-----w- c:\users\GG\AppData\Local\Programs
2013-01-25 22:48 . 2013-01-25 22:54 -------- d-----w- c:\users\GG\AppData\Roaming\Mp3tag
2013-01-25 22:48 . 2013-01-25 22:48 -------- d-----w- c:\program files (x86)\Mp3tag
2013-01-21 14:39 . 2013-01-21 14:39 -------- d-----w- c:\users\GG\AppData\Roaming\Buhl Data Service
2013-01-21 14:39 . 2013-01-21 14:39 -------- d-----w- c:\users\GG\AppData\Local\Buhl Data Service
2013-01-21 14:37 . 2013-01-21 14:38 -------- d-----w- c:\users\GG\AppData\Local\Buhl
2013-01-21 14:37 . 2013-01-21 14:37 -------- d-----w- c:\program files (x86)\WISO
2013-01-21 14:36 . 2013-01-21 14:49 -------- d-----w- c:\programdata\Buhl Data Service GmbH
2013-01-17 20:04 . 2013-02-14 10:14 -------- d-----w- c:\users\GG\AppData\Roaming\vlc
2013-01-17 20:04 . 2013-01-17 20:04 -------- d-----w- c:\program files\VideoLAN
2013-01-16 19:40 . 2013-01-16 19:53 -------- d-----w- c:\users\GG\AppData\Roaming\Skype
2013-01-16 19:40 . 2013-01-16 19:40 -------- d-----w- c:\program files (x86)\Common Files\Skype
2013-01-16 19:40 . 2013-01-16 19:40 -------- d-----r- c:\program files (x86)\Skype
2013-01-16 19:40 . 2013-01-16 19:40 -------- d-----w- c:\programdata\Skype
2013-01-15 22:45 . 2013-01-15 22:45 -------- d-----w- c:\users\GG\AppData\Local\Splashtop
2013-01-15 22:42 . 2013-01-15 22:42 -------- d-----w- c:\programdata\Splashtop
2013-01-15 22:41 . 2013-01-15 22:42 -------- d-----w- c:\program files (x86)\Splashtop
2013-01-15 22:41 . 2013-01-15 22:41 -------- d-----w- c:\users\GG\AppData\Local\{43C1E69E-6361-4F0D-B3B6-2659FC8E2853}
2013-01-15 22:29 . 2013-01-15 22:30 -------- d-----w- c:\program files (x86)\Tools&More
2013-01-15 22:29 . 2013-01-15 22:30 -------- d-----w- c:\windows\Downloaded Installations
2013-01-15 21:42 . 2013-01-15 21:42 -------- d-----w- c:\programdata\regid.1986-12.com.adobe
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-02-14 11:36 . 2013-01-09 10:07 70004024 ----a-w- c:\windows\system32\MRT.exe
2013-02-08 13:47 . 2013-01-08 18:37 74096 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-02-08 13:47 . 2013-01-08 18:37 697712 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2013-01-30 10:53 . 2013-01-08 18:18 273840 ------w- c:\windows\system32\MpSigStub.exe
2013-01-09 10:03 . 2013-01-09 10:03 74752 ----a-w- c:\windows\SysWow64\RegisterIEPKEYs.exe
2013-01-09 10:03 . 2013-01-09 10:03 86528 ----a-w- c:\windows\SysWow64\iesysprep.dll
2013-01-09 10:03 . 2013-01-09 10:03 76800 ----a-w- c:\windows\SysWow64\SetIEInstalledDate.exe
2013-01-09 10:03 . 2013-01-09 10:03 74752 ----a-w- c:\windows\SysWow64\iesetup.dll
2013-01-09 10:03 . 2013-01-09 10:03 63488 ----a-w- c:\windows\SysWow64\tdc.ocx
2013-01-09 10:03 . 2013-01-09 10:03 48640 ----a-w- c:\windows\SysWow64\mshtmler.dll
2013-01-09 10:03 . 2013-01-09 10:03 367104 ----a-w- c:\windows\SysWow64\html.iec
2013-01-09 10:03 . 2013-01-09 10:03 161792 ----a-w- c:\windows\SysWow64\msls31.dll
2013-01-09 10:03 . 2013-01-09 10:03 110592 ----a-w- c:\windows\SysWow64\IEAdvpack.dll
2013-01-09 10:03 . 2013-01-09 10:03 89088 ----a-w- c:\windows\system32\RegisterIEPKEYs.exe
2013-01-09 10:03 . 2013-01-09 10:03 35840 ----a-w- c:\windows\SysWow64\imgutil.dll
2013-01-09 10:03 . 2013-01-09 10:03 23552 ----a-w- c:\windows\SysWow64\licmgr10.dll
2013-01-09 10:03 . 2013-01-09 10:03 222208 ----a-w- c:\windows\system32\msls31.dll
2013-01-09 10:03 . 2013-01-09 10:03 152064 ----a-w- c:\windows\SysWow64\wextract.exe
2013-01-09 10:03 . 2013-01-09 10:03 150528 ----a-w- c:\windows\SysWow64\iexpress.exe
2013-01-09 10:03 . 2013-01-09 10:03 11776 ----a-w- c:\windows\SysWow64\mshta.exe
2013-01-09 10:03 . 2013-01-09 10:03 101888 ----a-w- c:\windows\SysWow64\admparse.dll
2013-01-09 10:03 . 2013-01-09 10:03 91648 ----a-w- c:\windows\system32\SetIEInstalledDate.exe
2013-01-09 10:03 . 2013-01-09 10:03 89088 ----a-w- c:\windows\system32\ie4uinit.exe
2013-01-09 10:03 . 2013-01-09 10:03 85504 ----a-w- c:\windows\system32\iesetup.dll
2013-01-09 10:03 . 2013-01-09 10:03 82432 ----a-w- c:\windows\system32\icardie.dll
2013-01-09 10:03 . 2013-01-09 10:03 76800 ----a-w- c:\windows\system32\tdc.ocx
2013-01-09 10:03 . 2013-01-09 10:03 65024 ----a-w- c:\windows\system32\pngfilt.dll
2013-01-09 10:03 . 2013-01-09 10:03 55296 ----a-w- c:\windows\system32\msfeedsbs.dll
2013-01-09 10:03 . 2013-01-09 10:03 534528 ----a-w- c:\windows\system32\ieapfltr.dll
2013-01-09 10:03 . 2013-01-09 10:03 49664 ----a-w- c:\windows\system32\imgutil.dll
2013-01-09 10:03 . 2013-01-09 10:03 48640 ----a-w- c:\windows\system32\mshtmler.dll
2013-01-09 10:03 . 2013-01-09 10:03 452608 ----a-w- c:\windows\system32\dxtmsft.dll
2013-01-09 10:03 . 2013-01-09 10:03 448512 ----a-w- c:\windows\system32\html.iec
2013-01-09 10:03 . 2013-01-09 10:03 39936 ----a-w- c:\windows\system32\iernonce.dll
2013-01-09 10:03 . 2013-01-09 10:03 3695416 ----a-w- c:\windows\system32\ieapfltr.dat
2013-01-09 10:03 . 2013-01-09 10:03 282112 ----a-w- c:\windows\system32\dxtrans.dll
2013-01-09 10:03 . 2013-01-09 10:03 267776 ----a-w- c:\windows\system32\ieaksie.dll
2013-01-09 10:03 . 2013-01-09 10:03 197120 ----a-w- c:\windows\system32\msrating.dll
2013-01-09 10:03 . 2013-01-09 10:03 163840 ----a-w- c:\windows\system32\ieakui.dll
2013-01-09 10:03 . 2013-01-09 10:03 160256 ----a-w- c:\windows\system32\ieakeng.dll
2013-01-09 10:03 . 2013-01-09 10:03 149504 ----a-w- c:\windows\system32\occache.dll
2013-01-09 10:03 . 2013-01-09 10:03 145920 ----a-w- c:\windows\system32\iepeers.dll
2013-01-09 10:03 . 2013-01-09 10:03 135168 ----a-w- c:\windows\system32\IEAdvpack.dll
2013-01-09 10:03 . 2013-01-09 10:03 12288 ----a-w- c:\windows\system32\mshta.exe
2013-01-09 10:03 . 2013-01-09 10:03 114176 ----a-w- c:\windows\system32\admparse.dll
2013-01-09 10:03 . 2013-01-09 10:03 111616 ----a-w- c:\windows\system32\iesysprep.dll
2013-01-09 10:03 . 2013-01-09 10:03 10752 ----a-w- c:\windows\system32\msfeedssync.exe
2013-01-09 10:03 . 2013-01-09 10:03 403248 ----a-w- c:\windows\system32\iedkcs32.dll
2013-01-09 10:03 . 2013-01-09 10:03 30720 ----a-w- c:\windows\system32\licmgr10.dll
2013-01-09 10:03 . 2013-01-09 10:03 249344 ----a-w- c:\windows\system32\webcheck.dll
2013-01-09 10:03 . 2013-01-09 10:03 165888 ----a-w- c:\windows\system32\iexpress.exe
2013-01-09 10:03 . 2013-01-09 10:03 160256 ----a-w- c:\windows\system32\wextract.exe
2013-01-09 10:03 . 2013-01-09 10:03 103936 ----a-w- c:\windows\system32\inseng.dll
2013-01-09 09:58 . 2009-07-14 02:36 175616 ----a-w- c:\windows\system32\msclmd.dll
2013-01-09 09:58 . 2009-07-14 02:36 152576 ----a-w- c:\windows\SysWow64\msclmd.dll
2013-01-08 19:12 . 2013-01-08 19:12 972264 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{196C04E3-1A66-4F20-B516-75FAEE94491C}\gapaengine.dll
2013-01-05 10:22 . 2013-01-05 10:22 50800 ----a-w- c:\windows\system32\drivers\point64.sys
2013-01-04 04:43 . 2013-02-14 08:45 44032 ----a-w- c:\windows\apppatch\acwow64.dll
2012-12-18 12:14 . 2013-01-12 23:16 114368 ----a-w- c:\windows\SysWow64\acaptuser32.dll
2012-12-16 17:11 . 2013-01-08 18:48 46080 ----a-w- c:\windows\system32\atmlib.dll
2012-12-16 14:45 . 2013-01-08 18:48 367616 ----a-w- c:\windows\system32\atmfd.dll
2012-12-16 14:13 . 2013-01-08 18:48 295424 ----a-w- c:\windows\SysWow64\atmfd.dll
2012-12-16 14:13 . 2013-01-08 18:48 34304 ----a-w- c:\windows\SysWow64\atmlib.dll
2012-12-07 13:20 . 2013-01-08 18:43 441856 ----a-w- c:\windows\system32\Wpc.dll
2012-12-07 13:15 . 2013-01-08 18:43 2746368 ----a-w- c:\windows\system32\gameux.dll
2012-12-07 12:26 . 2013-01-08 18:43 308736 ----a-w- c:\windows\SysWow64\Wpc.dll
2012-12-07 12:20 . 2013-01-08 18:43 2576384 ----a-w- c:\windows\SysWow64\gameux.dll
2012-12-07 11:20 . 2013-01-08 18:43 30720 ----a-w- c:\windows\system32\usk.rs
2012-12-07 11:20 . 2013-01-08 18:43 43520 ----a-w- c:\windows\system32\csrr.rs
2012-12-07 11:20 . 2013-01-08 18:43 23552 ----a-w- c:\windows\system32\oflc.rs
2012-12-07 11:20 . 2013-01-08 18:43 45568 ----a-w- c:\windows\system32\oflc-nz.rs
2012-12-07 11:20 . 2013-01-08 18:43 44544 ----a-w- c:\windows\system32\pegibbfc.rs
2012-12-07 11:20 . 2013-01-08 18:43 20480 ----a-w- c:\windows\system32\pegi-fi.rs
2012-12-07 11:20 . 2013-01-08 18:43 20480 ----a-w- c:\windows\system32\pegi-pt.rs
2012-12-07 11:19 . 2013-01-08 18:43 20480 ----a-w- c:\windows\system32\pegi.rs
2012-12-07 11:19 . 2013-01-08 18:43 46592 ----a-w- c:\windows\system32\fpb.rs
2012-12-07 11:19 . 2013-01-08 18:43 40960 ----a-w- c:\windows\system32\cob-au.rs
2012-12-07 11:19 . 2013-01-08 18:43 21504 ----a-w- c:\windows\system32\grb.rs
2012-12-07 11:19 . 2013-01-08 18:43 15360 ----a-w- c:\windows\system32\djctq.rs
2012-12-07 11:19 . 2013-01-08 18:43 55296 ----a-w- c:\windows\system32\cero.rs
2012-12-07 11:19 . 2013-01-08 18:43 51712 ----a-w- c:\windows\system32\esrb.rs
2012-12-07 10:46 . 2013-01-08 18:43 43520 ----a-w- c:\windows\SysWow64\csrr.rs
2012-12-07 10:46 . 2013-01-08 18:43 30720 ----a-w- c:\windows\SysWow64\usk.rs
2012-12-07 10:46 . 2013-01-08 18:43 45568 ----a-w- c:\windows\SysWow64\oflc-nz.rs
2012-12-07 10:46 . 2013-01-08 18:43 44544 ----a-w- c:\windows\SysWow64\pegibbfc.rs
2012-12-07 10:46 . 2013-01-08 18:43 20480 ----a-w- c:\windows\SysWow64\pegi-pt.rs
2012-12-07 10:46 . 2013-01-08 18:43 23552 ----a-w- c:\windows\SysWow64\oflc.rs
2012-12-07 10:46 . 2013-01-08 18:43 20480 ----a-w- c:\windows\SysWow64\pegi-fi.rs
2012-12-07 10:46 . 2013-01-08 18:43 46592 ----a-w- c:\windows\SysWow64\fpb.rs
2012-12-07 10:46 . 2013-01-08 18:43 20480 ----a-w- c:\windows\SysWow64\pegi.rs
2012-12-07 10:46 . 2013-01-08 18:43 21504 ----a-w- c:\windows\SysWow64\grb.rs
2012-12-07 10:46 . 2013-01-08 18:43 40960 ----a-w- c:\windows\SysWow64\cob-au.rs
2012-12-07 10:46 . 2013-01-08 18:43 15360 ----a-w- c:\windows\SysWow64\djctq.rs
2012-12-07 10:46 . 2013-01-08 18:43 55296 ----a-w- c:\windows\SysWow64\cero.rs
2012-12-07 10:46 . 2013-01-08 18:43 51712 ----a-w- c:\windows\SysWow64\esrb.rs
2012-11-30 05:45 . 2013-01-08 18:43 362496 ----a-w- c:\windows\system32\wow64win.dll
2012-11-30 05:45 . 2013-01-08 18:43 243200 ----a-w- c:\windows\system32\wow64.dll
2012-11-30 05:45 . 2013-01-08 18:43 13312 ----a-w- c:\windows\system32\wow64cpu.dll
2012-11-30 05:43 . 2013-01-08 18:43 16384 ----a-w- c:\windows\system32\ntvdm64.dll
2012-11-30 05:41 . 2013-01-08 18:43 424448 ----a-w- c:\windows\system32\KernelBase.dll
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2012-11-13 23:32 129272 ----a-w- c:\users\GG\AppData\Roaming\Dropbox\bin\DropboxExt.17.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2012-11-13 23:32 129272 ----a-w- c:\users\GG\AppData\Roaming\Dropbox\bin\DropboxExt.17.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2012-11-13 23:32 129272 ----a-w- c:\users\GG\AppData\Roaming\Dropbox\bin\DropboxExt.17.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"LifeCam"="c:\program files (x86)\Microsoft LifeCam\LifeExp.exe" [2010-05-20 119152]
"vmware-tray.exe"="c:\program files (x86)\VMware\VMware Workstation\vmware-tray.exe" [2012-11-01 104088]
.
c:\users\GG\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dropbox.lnk - c:\users\GG\AppData\Roaming\Dropbox\bin\Dropbox.exe [2013-1-20 28539272]
Rainmeter.lnk - c:\program files\Rainmeter\Rainmeter.exe [2012-11-4 41160]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
WISO Mein Steuer-Sparbuch heute.lnk - c:\program files (x86)\WISO\Steuersoftware 2013\mshaktuell.exe [2013-1-21 1397480]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"EnableLinkedConnections"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"mixer2"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 NAUpdate;Nero Update;c:\program files (x86)\Nero\Update\NASvc.exe [2012-07-13 769432]
R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [2012-08-30 128456]
R3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\NisSrv.exe [2012-09-12 368896]
R3 ose64;Office 64 Source Engine;c:\program files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2010-01-09 174440]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2012-08-23 19456]
R3 rt61x64;RT61 Extensible Wireless Driver;c:\windows\system32\DRIVERS\netr6164.sys [2010-04-07 446304]
R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2012-08-23 57856]
R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys [x]
R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys [x]
S0 vmci;VMware VMCI Bus Driver;c:\windows\system32\DRIVERS\vmci.sys [2012-10-24 85104]
S0 vsock;vSockets Driver;c:\windows\system32\drivers\vsock.sys [2012-10-24 70296]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2009-08-18 203264]
S2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2013-01-08 161536]
S2 SplashtopRemoteService;Splashtop® Remote Service;c:\program files (x86)\Splashtop\Splashtop Remote\Server\SRService.exe [2013-01-28 551264]
S2 SSUService;Splashtop Software Updater Service;c:\program files (x86)\Splashtop\Splashtop Software Updater\SSUService.exe [2013-01-25 583456]
S2 StarMoney 8.0 OnlineUpdate;StarMoney 8.0 OnlineUpdate;c:\program files (x86)\StarMoney 8.0\ouservice\StarMoneyOnlineUpdate.exe [2012-06-28 692432]
S2 TeamViewer8;TeamViewer 8;c:\program files (x86)\TeamViewer\Version8\TeamViewer_Service.exe [2012-12-14 3467768]
S2 VMUSBArbService;VMware USB Arbitration Service;c:\program files (x86)\Common Files\VMware\USB\vmware-usbarbitrator64.exe [2012-10-11 918680]
S2 VMwareHostd;VMware Workstation Server;c:\program files (x86)\VMware\VMware Workstation\vmware-hostd.exe [2012-11-01 13234176]
S2 vstor2-mntapi10-shared;Vstor2 MntApi 1.0 Driver (shared);SysWOW64\drivers\vstor2-mntapi10-shared.sys [x]
S3 dc3d;MS Hardware Device Detection Driver (USB);c:\windows\system32\DRIVERS\dc3d.sys [2012-11-02 75928]
S3 Point64;Microsoft Mouse and Keyboard Center Filter Driver;c:\windows\system32\DRIVERS\point64.sys [2013-01-05 50800]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2009-03-01 187392]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2013-02-02 18:41 1607120 ----a-w- c:\program files (x86)\Google\Chrome\Application\24.0.1312.57\Installer\chrmstp.exe
.
Inhalt des "geplante Tasks" Ordners
.
2013-02-14 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-01-08 13:47]
.
2013-02-14 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-01-08 18:36]
.
2013-02-14 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-01-08 18:36]
.
2013-02-14 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3922560276-2939133576-3368807774-1001Core.job
- c:\users\GG\AppData\Local\Google\Update\GoogleUpdate.exe [2013-01-25 22:56]
.
2013-02-14 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3922560276-2939133576-3368807774-1001UA.job
- c:\users\GG\AppData\Local\Google\Update\GoogleUpdate.exe [2013-01-25 22:56]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2012-11-13 23:32 162552 ----a-w- c:\users\GG\AppData\Roaming\Dropbox\bin\DropboxExt64.17.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2012-11-13 23:32 162552 ----a-w- c:\users\GG\AppData\Roaming\Dropbox\bin\DropboxExt64.17.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2012-11-13 23:32 162552 ----a-w- c:\users\GG\AppData\Roaming\Dropbox\bin\DropboxExt64.17.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2012-11-13 23:32 162552 ----a-w- c:\users\GG\AppData\Roaming\Dropbox\bin\DropboxExt64.17.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"VX1000"="c:\windows\vVX1000.exe" [2010-05-20 762736]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2012-09-12 1289704]
"BCSSync"="c:\program files\Microsoft Office\Office14\BCSSync.exe" [2010-03-13 112512]
"IntelliType Pro"="c:\program files\Microsoft Mouse and Keyboard Center\itype.exe" [2012-11-02 1464944]
"IntelliPoint"="c:\program files\Microsoft Mouse and Keyboard Center\ipoint.exe" [2012-11-02 2076272]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=c:\windows\System32\acaptuser64.dll
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.delta-search.com/?affID=119520&babsrc=HP_ss&mntrId=dce0422000000000000000241d867d72
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: An OneNote s&enden - c:\progra~1\MIF5BA~1\Office14\ONBttnIE.dll/105
IE: An vorhandene PDF-Datei anfügen - c:\program files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\AcroIEFavClient.dll/AcroIEAppend.html
IE: In Adobe PDF konvertieren - c:\program files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\AcroIEFavClient.dll/AcroIECapture.html
IE: Linkziel an vorhandene PDF-Datei anhängen - c:\program files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Linkziel in Adobe PDF konvertieren - c:\program files (x86)\Common Files\Adobe\Acrobat\WCIEActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Nach Microsoft E&xcel exportieren - c:\progra~1\MIF5BA~1\Office14\EXCEL.EXE/3000
TCP: Interfaces\{857752D2-D8AB-416B-80CC-BF532662B4BE}: NameServer = 192.168.2.1
FF - ProfilePath - c:\users\GG\AppData\Roaming\Mozilla\Firefox\Profiles\ota3u26w.default\
FF - prefs.js: browser.search.selectedEngine - Delta Search
FF - prefs.js: browser.startup.homepage - hxxp://www.delta-search.com/?affID=119520&babsrc=HP_ss&mntrId=dce0422000000000000000241d867d72
FF - ExtSQL: 2013-01-15 22:56; web2pdfextension@web2pdf.adobedotcom; c:\program files (x86)\Adobe\Acrobat 11.0\Acrobat\Browser\WCFirefoxExtn
FF - user.js: extensions.autoDisableScopes - 0
FF - user.js: extensions.shownSelectionUI - true
FF - user.js: extensions.delta.tlbrSrchUrl -
FF - user.js: extensions.delta.id - dce0422000000000000000241d867d72
FF - user.js: extensions.delta.appId - {C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}
FF - user.js: extensions.delta.instlDay - 15750
FF - user.js: extensions.delta.vrsn - 1.8.10.0
FF - user.js: extensions.delta.vrsni - 1.8.10.0
FF - user.js: extensions.delta.vrsnTs - 1.8.10.011:18
FF - user.js: extensions.delta.prtnrId - delta
FF - user.js: extensions.delta.prdct - delta
FF - user.js: extensions.delta.aflt - babsst
FF - user.js: extensions.delta.smplGrp - none
FF - user.js: extensions.delta.tlbrId - base
FF - user.js: extensions.delta.instlRef - sst
FF - user.js: extensions.delta.dfltLng - en
FF - user.js: extensions.delta.excTlbr - false
FF - user.js: extensions.delta.admin - false
FF - user.js: extensions.delta.autoRvrt - false
FF - user.js: extensions.delta.rvrt - false
FF - user.js: extensions.delta.newTab - false
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Wow6432Node-HKCU-Run-StrokeIt - c:\users\GG\AppData\Local\TCB Networks\StrokeIt\Bin\StrokeIt.exe
Wow6432Node-HKLM-Run-<NO NAME> - (no file)
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_5_502_149_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_5_502_149_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_5_502_149_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_5_502_149_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_5_502_149.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_5_502_149.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_5_502_149.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_5_502_149.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
c:\program files (x86)\Splashtop\Splashtop Remote\Server\SRServer.exe
c:\windows\SysWOW64\vmnat.exe
c:\windows\SysWOW64\vmnetdhcp.exe
c:\program files (x86)\VMware\VMware Workstation\vmware-authd.exe
c:\program files (x86)\Splashtop\Splashtop Remote\Server\SRFeature.exe
c:\program files (x86)\TeamViewer\Version8\TeamViewer.exe
c:\program files (x86)\TeamViewer\Version8\tv_w32.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2013-02-14 18:45:48 - PC wurde neu gestartet
ComboFix-quarantined-files.txt 2013-02-14 17:45
.
Vor Suchlauf: 8 Verzeichnis(se), 60.680.097.792 Bytes frei
Nach Suchlauf: 14 Verzeichnis(se), 60.455.141.376 Bytes frei
.
- - End Of File - - 736B6B0F988AA30A9BECE359B1484252
|
|
| Themen zu Email von Telekom-Abuse-Team | Log-File anbei |
| adblock, antivirus, autorun, bho, browser, email, exploit:java/blacole.gl, exploit:js/blacole.hi, festplatte, flash player, format, helper, hijack, homepage, hängen, jdownloader, karte, kreditkarte, neu aufsetzen, object, realtek, registry, robot, security, sicherheit, software, starmoney, windows |
WARNUNG an die MITLESER: 
Hybrid-Darstellung
