| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Problem mit Windows 7 Sicherheitscenterdienst und Windows Defender, infektion?Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
| |
08.06.2011, 21:09
| #1 |
| /// Winkelfunktion /// TB-Süch-Tiger™   |  Problem mit Windows 7 Sicherheitscenterdienst und Windows Defender, infektion? Combofix - Scripten 1. Starte das Notepad (Start / Ausführen / notepad[Enter]) 2. Jetzt füge mit copy/paste den ganzen Inhalt der untenstehenden Codebox in das Notepad Fenster ein. Hinweis: Falls Du Deinen Benutzernamen unkenntlich gemacht hast, musst Du das Ausgesternte in Deinen richtigen Benutzernamen wieder verwandeln, sonst funktioniert das Script nicht!! Code:
ATTFilter Filelook::
c:\windows\system32\drivers\rimssn64.sys
c:\windows\snymsico.dll
c:\windows\Installer\1dd59.msi
Folder::
c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies
c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5
4. Deaktivere den Guard Deines Antivirenprogramms und eine eventuell vorhandene Software Firewall. (Auch Guards von Ad-, Spyware Programmen und den Tea Timer (wenn vorhanden) !) 5. Dann ziehe die CFScript.txt auf die cofi.exe, so wie es im unteren Bild zu sehen ist. Damit wird Combofix neu gestartet.  6. Nach dem Neustart (es wird gefragt ob Du neustarten willst), poste bitte die folgenden Log Dateien: Combofix.txt Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!
__________________ Logfiles bitte immer in CODE-Tags posten  |
|
09.06.2011, 12:57
| #2 |
 | Problem mit Windows 7 Sicherheitscenterdienst und Windows Defender, infektion? Hab ich gemacht, hier das Log:
__________________Combofix Logfile: Code:
ATTFilter ComboFix 11-06-07.03 - NeRo 06/09/2011 13:50:05.3.2 - x64
Microsoft Windows 7 Ultimate 6.1.7600.0.1252.1.1033.18.4063.3020 [GMT -7:00]
Running from: c:\users\NeRo\Desktop\cofi.exe
Command switches used :: c:\users\NeRo\Desktop\cfscript.txt
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Created a new restore point
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5
c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0PS72R2M\desktop.ini
c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1HAS8O7N\desktop.ini
c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1OZJFJ72\desktop.ini
c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\54OUKNXR\desktop.ini
c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\desktop.ini
c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JEKFMCXJ\desktop.ini
c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies
c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
.
.
((((((((((((((((((((((((( Files Created from 2011-05-09 to 2011-06-09 )))))))))))))))))))))))))))))))
.
.
2011-06-09 20:53 . 2011-06-09 20:53 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-06-03 04:56 . 2011-06-03 04:57 -------- d-----w- C:\cofi
2011-06-03 04:37 . 2011-06-03 04:37 -------- d-----w- c:\program files\CCleaner
2011-05-26 19:46 . 2011-05-26 19:46 -------- d-----w- C:\_OTL
2011-05-26 19:15 . 2011-05-26 19:15 -------- d-----w- c:\users\NeRo\AppData\Roaming\Malwarebytes
2011-05-26 19:15 . 2011-05-29 16:11 39984 ----a-w- c:\windows\SysWow64\drivers\mbamswissarmy.sys
2011-05-26 19:15 . 2011-05-26 19:15 -------- d-----w- c:\programdata\Malwarebytes
2011-05-26 19:15 . 2011-06-03 05:37 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
2011-05-26 19:15 . 2011-05-29 16:11 25912 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-05-25 04:16 . 2011-04-09 06:45 5509504 ----a-w- c:\windows\system32\ntoskrnl.exe
2011-05-25 04:16 . 2011-04-09 06:13 3957632 ----a-w- c:\windows\SysWow64\ntkrnlpa.exe
2011-05-25 04:16 . 2011-04-09 06:13 3901824 ----a-w- c:\windows\SysWow64\ntoskrnl.exe
2011-05-19 03:55 . 2011-06-03 04:40 -------- d-----w- c:\programdata\Spybot - Search & Destroy
2011-05-19 03:55 . 2011-05-24 17:03 -------- d-----w- c:\program files (x86)\Spybot - Search & Destroy
2011-05-16 23:24 . 2011-05-16 23:24 -------- d-----w- c:\program files\DIFX
2011-05-16 23:23 . 2009-09-24 23:28 86528 ----a-w- c:\windows\system32\drivers\rimssn64.sys
2011-05-16 23:23 . 2009-09-24 23:28 623616 ----a-w- c:\windows\snymsico.dll
2011-05-16 07:23 . 2011-05-16 07:23 -------- d-----w- c:\users\NeRo\AppData\Roaming\Sony Corporation
2011-05-16 05:46 . 2011-05-16 05:46 404640 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2011-05-15 20:47 . 2011-05-15 20:47 -------- d-----w- c:\users\NeRo\AppData\Local\Broadcom
2011-05-15 20:46 . 2009-10-22 17:41 21160 ----a-w- c:\windows\system32\drivers\btwrchid.sys
2011-05-15 20:46 . 2009-10-22 17:41 132648 ----a-w- c:\windows\system32\drivers\btwavdt.sys
2011-05-15 20:46 . 2009-10-22 17:41 98344 ----a-w- c:\windows\system32\drivers\btwaudio.sys
2011-05-15 20:46 . 2009-10-22 17:38 35104 ----a-w- c:\windows\system32\drivers\btwl2cap.sys
2011-05-15 20:46 . 2011-05-15 20:46 -------- d-----w- c:\program files\WIDCOMM
2011-05-15 20:41 . 2011-05-15 20:41 -------- d-----w- c:\program files\Common Files\Sony Shared
2011-05-15 20:41 . 2011-05-15 20:41 -------- d-----w- c:\program files (x86)\Common Files\Sony Shared
2011-05-15 20:41 . 2011-05-15 20:43 -------- d--h--w- c:\program files (x86)\InstallShield Installation Information
2011-05-15 20:41 . 2011-05-15 20:42 -------- d-----w- c:\program files (x86)\Sony
2011-05-15 20:41 . 2011-05-15 20:42 -------- d-----w- c:\programdata\Sony Corporation
2011-05-13 18:20 . 2011-05-13 18:20 -------- d-----w- c:\users\NeRo\AppData\Local\WinZip
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-04-18 17:15 . 2011-04-22 19:15 8802128 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{D5108C76-743C-476A-A716-8358BD0AA312}\mpengine.dll
.
.
(((((((((((((((((((((((((((((((((((((((((((( Look )))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
--- c:\windows\Installer\1dd59.msi ---
Company: ------
File Description: ------
File Version: ------
Product Name: ------
Copyright: ------
Original Filename: ------
File size: 25088
Created time: 2011-06-04 04:08
Modified time: 2011-06-04 04:08
MD5: CA1C1F1D727D052F025D6D1555EFAA80
SHA1: 4CE8401C1AD8D96A6AE384FF553BCFB28A87DA70
.
.
--- c:\windows\snymsico.dll ---
Company: Sony Corporation
File Description: msico
File Version: 1, 0, 2, 10200
Product Name: Sony Memory Stick ICON for Windows Vista
Copyright: Copyright (C) 2006 Sony Corporation
Original Filename: snymsico.dll
File size: 623616
Created time: 2011-05-16 23:23
Modified time: 2009-09-24 23:28
MD5: 2B1E1F5273FAE6CC775149ED57DB4433
SHA1: 426EF7728167886E7C14248A3147AE65344FA305
.
.
--- c:\windows\system32\drivers\rimssn64.sys ---
Company: REDC
File Description: RICOH MS Driver
File Version: 6.03.00.0061
Product Name: Ricoh Memorystick Controller
Copyright: Copyright c 2001-2009, Ricoh Company Ltd.,
Original Filename: rimsptsk.sys
File size: 86528
Created time: 2011-05-16 23:23
Modified time: 2009-09-24 23:28
MD5: 258AADB43E3F3468B5CF8CB0F84872C2
SHA1: 0AEC524D07D2D767A08D856585CCA212115B8C07
.
.
((((((((((((((((((((((((((((( SnapShot@2011-06-03_05.03.00 )))))))))))))))))))))))))))))))))))))))))
.
- 2009-07-14 04:54 . 2011-06-03 04:11 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2009-07-14 04:54 . 2011-06-08 21:43 16384 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2011-04-22 07:13 . 2011-06-09 20:42 25432 c:\windows\system32\wdi\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2009-07-14 05:10 . 2011-06-09 20:42 31932 c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin
+ 2011-01-22 05:42 . 2011-06-06 02:58 16384 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2011-01-22 05:42 . 2011-06-03 04:37 16384 c:\windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2011-06-02 20:44 . 2011-06-03 04:37 49152 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2011-06-02 20:44 . 2011-06-06 02:58 49152 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2009-07-14 04:54 . 2011-06-03 04:37 16384 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2009-07-14 04:54 . 2011-06-06 02:58 16384 c:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2011-06-04 04:08 . 2011-06-04 04:08 25088 c:\windows\Installer\1dd59.msi
+ 2011-01-22 06:47 . 2011-06-09 20:42 5846 c:\windows\system32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-985815843-2064436585-970596046-1000_UserData.bin
+ 2011-06-09 20:40 . 2011-06-09 20:40 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
- 2011-06-03 04:10 . 2011-06-03 04:10 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2011-06-09 20:40 . 2011-06-09 20:40 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
- 2011-06-03 04:10 . 2011-06-03 04:10 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2011-04-26 19:45 . 2011-06-09 00:56 210048 c:\windows\system32\wdi\SuspendPerformanceDiagnostics_SystemData_S3.bin
- 2009-07-14 02:36 . 2011-06-03 04:15 615360 c:\windows\system32\perfh009.dat
+ 2009-07-14 02:36 . 2011-06-09 20:44 615360 c:\windows\system32\perfh009.dat
- 2011-01-22 06:21 . 2011-06-03 04:15 641706 c:\windows\system32\perfh007.dat
+ 2011-01-22 06:21 . 2011-06-09 20:44 641706 c:\windows\system32\perfh007.dat
+ 2009-07-14 02:36 . 2011-06-09 20:44 103702 c:\windows\system32\perfc009.dat
- 2009-07-14 02:36 . 2011-06-03 04:15 103702 c:\windows\system32\perfc009.dat
- 2011-01-22 06:21 . 2011-06-03 04:15 126062 c:\windows\system32\perfc007.dat
+ 2011-01-22 06:21 . 2011-06-09 20:44 126062 c:\windows\system32\perfc007.dat
- 2009-07-14 05:01 . 2011-06-03 02:06 382420 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
+ 2009-07-14 05:01 . 2011-06-09 17:17 382420 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
+ 2011-01-22 06:44 . 2011-06-09 17:17 1873561 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-985815843-2064436585-970596046-1000-8192.dat
- 2011-04-22 19:01 . 2011-05-26 20:01 3330728 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-985815843-2064436585-970596046-1000-12288.dat
+ 2011-04-22 19:01 . 2011-06-03 05:10 3330728 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-985815843-2064436585-970596046-1000-12288.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2011-01-22 39408]
"SpybotSD TeaTimer"="c:\program files (x86)\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"BCSSync"="c:\program files (x86)\Microsoft Office\Office14\BCSSync.exe" [2010-03-13 91520]
"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe" [2011-01-30 35736]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-11-10 932288]
"ISBMgr.exe"="c:\program files (x86)\Sony\ISB Utility\ISBMgr.exe" [2009-05-26 317288]
"Malwarebytes' Anti-Malware"="c:\program files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" [2011-05-29 449584]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2009-7-1 1079584]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
R2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-01-22 136176]
R2 SBSDWSCService;SBSD Security Center Service;c:\program files (x86)\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368]
R3 gupdatem;Google Update Service (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-01-22 136176]
R3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files (x86)\Microsoft Office\Office14\GROOVE.EXE [2010-03-25 30969208]
R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-10 4925184]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x]
S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2011-05-29 366640]
S2 RtkAudioService;Realtek Audio Service;c:\program files\Realtek\Audio\HDA\RtkAudioService64.exe [2009-10-22 189984]
S3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys [x]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [x]
S3 netw5v64;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 64 Bit;c:\windows\system32\DRIVERS\netw5v64.sys [x]
S3 SFEP;Sony Firmware Extension Parser;c:\windows\system32\DRIVERS\SFEP.sys [x]
S3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL6.SYS [x]
S3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV6.SYS [x]
S3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT6.SYS [x]
S3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x64.sys [x]
.
.
Contents of the 'Scheduled Tasks' folder
.
2011-06-09 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-01-22 05:54]
.
2011-06-09 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-01-22 05:54]
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2009-10-22 7938080]
"Skytel"="c:\program files\Realtek\Audio\HDA\Skytel.exe" [2009-10-22 1833504]
.
------- Supplementary Scan -------
.
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: An OneNote s&enden - c:\progra~2\MICROS~1\Office14\ONBttnIE.dll/105
IE: Bild an &Bluetooth-Gerät senden... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Google Sidewiki... - c:\program files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_D183CA64F05FDD98.dll/cmsidewiki.html
IE: Nach Microsoft E&xcel exportieren - c:\progra~2\MICROS~1\Office14\EXCEL.EXE/3000
IE: Seite an &Bluetooth-Gerät senden... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
TCP: DhcpNameServer = 192.168.2.1
FF - ProfilePath - c:\users\NeRo\AppData\Roaming\Mozilla\Firefox\Profiles\w0uwtwyf.default\
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10q_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10q_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10q.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10q.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10q.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10q.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
@Denied: (A) (Everyone)
"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
"Key"="ActionsPane3"
"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Completion time: 2011-06-09 13:55:56
ComboFix-quarantined-files.txt 2011-06-09 20:55
ComboFix2.txt 2011-06-08 23:32
ComboFix3.txt 2011-06-03 05:05
.
Pre-Run: 358,403,481,600 bytes free
Post-Run: 14 Verzeichnis(se), 358,334,521,344 Bytes frei
.
- - End Of File - - EF319B349AA1974D5D1642DF12D479B2
|
|
| Themen zu Problem mit Windows 7 Sicherheitscenterdienst und Windows Defender, infektion? |
| 4d36e972-e325-11ce-bfc1-08002be10318, adobe, alternate, autorun, bho, c:\windows\system32\rundll32.exe, defender, document, error, explorer, fehler, firefox, format, google, helper, hijack.zones, installation, internet, internet explorer, langs, logfile, mozilla, nvstor.sys, oldtimer, problem, realtek, registry, rundll, safer networking, searchplugins, sicherheitscenterdienst, software, start menu, starten, syswow64, temp, trojan.fakealert.sa, trojan.fraudpack.gen, webcheck, windows, wrapper |
Hybrid-Darstellung
