| SirBacke | 10.06.2011 09:10 |
ComboFix läuft nicht durch, hat sich irgendwann bei Stufe 50 mit Blauem Hintergrund verabschiedet. Folge PC Startet neu...:headbang:
EDIT: ComboFix nochmal gestartet und nun habe ich auch ein Log Code:
ComboFix 11-06-09.06 - Heide 10.06.2011 10:17:22.2.3 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.49.1031.18.3327.2170 [GMT 2:00]
ausgeführt von:: c:\users\Alexander\Desktop\cofi.exe
AV: AntiVir Desktop *Disabled/Updated* {090F9C29-64CE-6C6F-379C-5901B49A85B7}
SP: AntiVir Desktop *Disabled/Updated* {B26E7DCD-42F4-63E1-0D2C-6273CF1DCF0A}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Alexander\Documents\Readiris.DUS
c:\users\Heide_2\Documents\Readiris.DUS
.
.
((((((((((((((((((((((( Dateien erstellt von 2011-05-10 bis 2011-06-10 ))))))))))))))))))))))))))))))
.
.
2011-06-10 08:23 . 2011-06-10 08:23 -------- d-----w- c:\users\UpdatusUser\AppData\Local\temp
2011-06-10 08:23 . 2011-06-10 08:23 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-06-10 08:23 . 2011-06-10 08:23 -------- d-----w- c:\users\Alexander\AppData\Local\temp
2011-06-10 08:23 . 2011-06-10 08:24 -------- d-----w- c:\users\Heide\AppData\Local\temp
2011-06-10 08:23 . 2011-06-10 08:23 -------- d-----w- c:\users\Heide_2\AppData\Local\temp
2011-06-10 07:48 . 2011-06-10 08:00 -------- d-----w- C:\cofi
2011-06-10 07:47 . 2011-06-10 08:15 -------- d-----w- C:\32788R22FWJFW
2011-06-09 19:20 . 2011-06-09 19:20 -------- d-----w- c:\users\Heide\AppData\Roaming\Malwarebytes
2011-06-09 19:20 . 2011-05-29 07:11 39984 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-06-09 19:20 . 2011-06-09 19:20 -------- d-----w- c:\programdata\Malwarebytes
2011-06-09 19:20 . 2011-05-29 07:11 22712 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-06-09 19:20 . 2011-06-09 19:20 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2011-06-07 06:12 . 2011-05-09 20:46 6962000 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{9B1C04F0-C80D-4C4F-8395-4A5CE73495D5}\mpengine.dll
2011-06-03 22:44 . 2011-06-03 22:44 -------- d-----w- c:\users\Alexander\AppData\Roaming\.minecraft_xray
2011-05-22 19:13 . 2011-05-22 19:13 1138440 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll
2011-05-22 19:05 . 2011-05-22 19:05 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-04-08 05:14 . 2011-05-05 13:55 944232 ----a-w- c:\windows\system32\nvdispco3220140.dll
2011-04-08 05:14 . 2011-05-05 13:55 855656 ----a-w- c:\windows\system32\nvgenco322060.dll
2011-04-08 05:14 . 2011-05-05 13:55 57960 ----a-w- c:\windows\system32\OpenCL.dll
2011-04-08 05:14 . 2011-05-05 13:55 5180824 ----a-w- c:\windows\system32\nvcuda.dll
2011-04-08 05:14 . 2011-05-05 13:55 2765928 ----a-w- c:\windows\system32\nvcuvid.dll
2011-04-08 05:14 . 2011-05-05 13:55 2074216 ----a-w- c:\windows\system32\nvcuvenc.dll
2011-04-08 05:14 . 2011-05-05 13:55 15227496 ----a-w- c:\windows\system32\nvoglv32.dll
2011-04-08 05:14 . 2011-05-05 13:55 10690024 ----a-w- c:\windows\system32\drivers\nvlddmkm.sys
2011-04-08 05:14 . 2011-05-05 13:55 13007464 ----a-w- c:\windows\system32\nvcompiler.dll
2011-04-08 05:14 . 2011-05-05 13:55 10920 ----a-w- c:\windows\system32\drivers\nvBridge.kmd
2011-04-08 05:14 . 2010-09-02 13:35 6299752 ----a-w- c:\windows\system32\nvwgf2um.dll
2011-04-08 05:14 . 2008-05-12 22:27 10071656 ----a-w- c:\windows\system32\nvd3dum.dll
2011-04-08 05:14 . 2008-05-12 22:27 2034280 ----a-w- c:\windows\system32\nvapi.dll
2011-04-07 20:43 . 2011-04-07 20:43 580200 ----a-w- c:\windows\system32\easyUpdatusAPIU.dll
2011-04-07 20:43 . 2011-04-07 20:43 612456 ----a-w- c:\windows\system32\nvvsvc.exe
2011-04-07 20:43 . 2011-04-07 20:43 2582120 ----a-w- c:\windows\system32\nvsvcr.dll
2011-04-07 20:43 . 2011-04-07 20:43 111208 ----a-w- c:\windows\system32\nvmctray.dll
2011-04-07 20:43 . 2011-04-07 20:43 3701352 ----a-w- c:\windows\system32\nvcpl.dll
2011-04-07 20:43 . 2011-04-07 20:43 2565224 ----a-w- c:\windows\system32\nvsvc.dll
2011-03-31 19:22 . 2011-03-31 19:22 161792 ----a-w- c:\windows\system32\msls31.dll
2011-03-31 19:22 . 2011-03-31 19:22 1126912 ----a-w- c:\windows\system32\wininet.dll
2011-03-31 19:22 . 2011-03-31 19:22 86528 ----a-w- c:\windows\system32\iesysprep.dll
2011-03-31 19:22 . 2011-03-31 19:22 76800 ----a-w- c:\windows\system32\SetIEInstalledDate.exe
2011-03-31 19:22 . 2011-03-31 19:22 74752 ----a-w- c:\windows\system32\RegisterIEPKEYs.exe
2011-03-31 19:22 . 2011-03-31 19:22 74752 ----a-w- c:\windows\system32\iesetup.dll
2011-03-31 19:22 . 2011-03-31 19:22 63488 ----a-w- c:\windows\system32\tdc.ocx
2011-03-31 19:22 . 2011-03-31 19:22 48640 ----a-w- c:\windows\system32\mshtmler.dll
2011-03-31 19:22 . 2011-03-31 19:22 367104 ----a-w- c:\windows\system32\html.iec
2011-03-31 19:22 . 2011-03-31 19:22 23552 ----a-w- c:\windows\system32\licmgr10.dll
2011-03-31 19:22 . 2011-03-31 19:22 152064 ----a-w- c:\windows\system32\wextract.exe
2011-03-31 19:22 . 2011-03-31 19:22 1427456 ----a-w- c:\windows\system32\inetcpl.cpl
2011-03-31 19:22 . 2011-03-31 19:22 420864 ----a-w- c:\windows\system32\vbscript.dll
2011-03-31 19:22 . 2011-03-31 19:22 2382848 ----a-w- c:\windows\system32\mshtml.tlb
2011-03-31 19:22 . 2011-03-31 19:22 1797632 ----a-w- c:\windows\system32\jscript9.dll
2011-03-31 19:22 . 2011-03-31 19:22 150528 ----a-w- c:\windows\system32\iexpress.exe
2011-03-31 19:22 . 2011-03-31 19:22 142848 ----a-w- c:\windows\system32\ieUnatt.exe
2011-03-31 19:22 . 2011-03-31 19:22 11776 ----a-w- c:\windows\system32\mshta.exe
2011-03-31 19:22 . 2011-03-31 19:22 101888 ----a-w- c:\windows\system32\admparse.dll
2011-03-31 19:22 . 2011-03-31 19:22 35840 ----a-w- c:\windows\system32\imgutil.dll
2011-03-31 19:22 . 2011-03-31 19:22 110592 ----a-w- c:\windows\system32\IEAdvpack.dll
2011-03-24 09:12 . 2011-03-24 00:00 472808 ----a-w- c:\windows\system32\deployJava1.dll
2011-03-12 21:55 . 2011-04-13 20:50 876032 ----a-w- c:\windows\system32\XpsPrint.dll
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\HardLinkMenu]
@="{0A479751-02BC-11d3-A855-0004AC2568AA}"
[HKEY_CLASSES_ROOT\CLSID\{0A479751-02BC-11d3-A855-0004AC2568AA}]
2010-08-03 06:44 256200 ----a-w- c:\program files\LinkShellExtension\HardlinkShellExt.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\IconOverlayHardLink]
@="{0A479751-02BC-11d3-A855-0004AC2568DD}"
[HKEY_CLASSES_ROOT\CLSID\{0A479751-02BC-11d3-A855-0004AC2568DD}]
2010-08-03 06:44 256200 ----a-w- c:\program files\LinkShellExtension\HardlinkShellExt.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]
"WindowsWelcomeCenter"="oobefldr.dll" [2009-04-11 2153472]
"fsc-reg"="c:\programdata\fsc-reg\fscreg.exe" [2007-11-08 533264]
"AutoStartNPSAgent"="c:\program files\Samsung\Samsung New PC Studio\NPSAgent.exe" [2010-07-04 95576]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240]
"FileZilla Server Interface"="d:\ftp server\FileZilla Server Interface.exe" [2010-10-17 1259008]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="RtHDVCpl.exe" [2008-05-07 6139904]
"avgnt"="d:\avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"GrooveMonitor"="d:\office2007\Office12\GrooveMonitor.exe" [2008-10-25 31072]
"Windows Mobile Device Center"="c:\windows\WindowsMobile\wmdc.exe" [2007-05-31 648072]
"VX1000"="c:\windows\vVX1000.exe" [2010-05-20 762736]
"LifeCam"="c:\program files\Microsoft LifeCam\LifeExp.exe" [2010-05-20 119152]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-11-29 421888]
"iTunesHelper"="d:\itunes\iTunesHelper.exe" [2011-01-25 421160]
"MaxMenuMgr"="d:\seagate manager\FreeAgent Status\StxMenuMgr.exe" [2009-09-25 185640]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2011-01-22 40368]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-21 932288]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-10-29 249064]
"Skytel"="Skytel.exe" [2007-11-20 1826816]
"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2011-05-29 449584]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"*WerKernelReporting"="c:\windows\SYSTEM32\WerFault.exe" [2009-04-11 217088]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"fsc-reg"="c:\programdata\fsc-reg\fscreg.exe" [2007-11-08 533264]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R3 DrvAgent32;DrvAgent32;c:\windows\system32\Drivers\DrvAgent32.sys [2011-02-27 23456]
R3 ss_bbus;SAMSUNG USB Mobile Device (WDM);c:\windows\system32\DRIVERS\ss_bbus.sys [2010-04-27 98432]
R3 ss_bmdfl;SAMSUNG USB Mobile Modem (Filter);c:\windows\system32\DRIVERS\ss_bmdfl.sys [2010-04-27 14848]
R3 ss_bmdm;SAMSUNG USB Mobile Modem;c:\windows\system32\DRIVERS\ss_bmdm.sys [2010-04-27 123648]
R3 STC2DFU;STCII DFU Adapter;c:\windows\system32\DRIVERS\Stc2Dfu.SYS [2004-10-24 7796]
R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
S0 OODrvled;OODrvled;c:\windows\system32\DRIVERS\OODrvled.sys [2009-09-28 25608]
S2 AntiVirSchedulerService;Avira AntiVir Planer;d:\avira\AntiVir Desktop\sched.exe [2009-05-13 108289]
S2 FreeAgentGoNext Service;Seagate Service;d:\seagate manager\Sync\FreeAgentService.exe [2009-09-25 189736]
S2 FsUsbExService;FsUsbExService;c:\windows\system32\FsUsbExService.Exe [2010-07-04 238952]
S2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [2011-05-29 366640]
S2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [2011-04-08 2218600]
S2 O&O DriveLED;O&O DriveLED Service;c:\program files\OO Software\DriveLED\oodlag.exe [2009-09-28 529664]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2011-04-07 378472]
S3 FsUsbExDisk;FsUsbExDisk;c:\windows\system32\FsUsbExDisk.SYS [2010-06-14 36608]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2011-05-29 22712]
S3 SCR3XX2K;SCR3xx USB SmartCardReader;c:\windows\system32\DRIVERS\SCR3XX2K.sys [2010-01-06 57856]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
WindowsMobile REG_MULTI_SZ wcescomm rapimgr
LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr
bthsvcs REG_MULTI_SZ BthServ
hpdevmgmt REG_MULTI_SZ hpqcxs08
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = about:blank
mStart Page = hxxp://www.google.com/ig/redirectdomain?brand=FUJD&bmod=FUJD
uInternet Settings,ProxyOverride = *.local
IE: &Winamp Search - c:\programdata\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html
IE: Nach Microsoft E&xel exportieren - d:\office~1\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.178.1
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
HKLM-Run-NPSStartup - (no file)
HKU-Default-Run-Picasa Media Detector - c:\program files\Picasa2\PicasaMediaDetector.exe
AddRemove-EVE - d:\eve online tranquility\Uninstall.exe
AddRemove-EVEMon - d:\evemon\uninstall.exe
AddRemove-REHADAT-Elan 2009_is1 - c:\users\Heide_2\Documents\Neuer Ordner\REHADAT_Elan09\.\unins000.exe
AddRemove-Steam App 340 - d:\steam\steam.exe
AddRemove-Streamripper - d:\streamripper\Uninstall.exe
AddRemove-01_Simmental - c:\program files\Samsung\USB Drivers\01_Simmental\Uninstall.exe
AddRemove-02_Siberian - c:\program files\Samsung\USB Drivers\02_Siberian\Uninstall.exe
AddRemove-03_Swallowtail - c:\program files\Samsung\USB Drivers\03_Swallowtail\Uninstall.exe
AddRemove-04_semseyite - c:\program files\Samsung\USB Drivers\04_semseyite\Uninstall.exe
AddRemove-05_Sloan - c:\program files\Samsung\USB Drivers\05_Sloan\Uninstall.exe
AddRemove-06_Spencer - c:\program files\Samsung\USB Drivers\06_Spencer\Uninstall.exe
AddRemove-07_Schorl - c:\program files\Samsung\USB Drivers\07_Schorl\Uninstall.exe
AddRemove-08_EMPChipset - c:\program files\Samsung\USB Drivers\08_EMPChipset\Uninstall.exe
AddRemove-09_Hsp - c:\program files\Samsung\USB Drivers\09_Hsp\Uninstall.exe
AddRemove-11_HSP_Plus_Default - c:\program files\Samsung\USB Drivers\11_HSP_Plus_Default\Uninstall.exe
AddRemove-16_Shrewsbury - c:\program files\Samsung\USB Drivers\16_Shrewsbury\Uninstall.exe
AddRemove-17_EMP_Chipset2 - c:\program files\Samsung\USB Drivers\17_EMP_Chipset2\Uninstall.exe
AddRemove-18_Zinia_Serial_Driver - c:\program files\Samsung\USB Drivers\18_Zinia_Serial_Driver\Uninstall.exe
AddRemove-19_VIA_driver - c:\program files\Samsung\USB Drivers\19_VIA_driver\Uninstall.exe
AddRemove-20_NXP_Driver - c:\program files\Samsung\USB Drivers\20_NXP_Driver\Uninstall.exe
AddRemove-21_Searsburg - c:\program files\Samsung\USB Drivers\21_Searsburg\Uninstall.exe
AddRemove-22_WiBro_WiMAX - c:\program files\Samsung\USB Drivers\22_WiBro_WiMAX\Uninstall.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2011-06-10 10:24
Windows 6.0.6002 Service Pack 2 NTFS
.
Scanne versteckte Prozesse...
.
Scanne versteckte Autostarteinträge...
.
Scanne versteckte Dateien...
.
Scan erfolgreich abgeschlossen
versteckte Dateien: 0
.
**************************************************************************
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\S-1-5-21-3850008624-4010597577-377463275-1001\Software\SecuROM\License information*]
"datasecu"=hex:40,93,ce,97,c4,83,35,d3,c8,2c,67,a8,49,b6,bb,58,27,65,ba,0a,b3,
cb,87,ba,53,df,28,a2,25,f8,f7,e2,c5,f9,82,57,79,4b,88,d2,14,f6,07,0c,22,69,\
"rkeysecu"=hex:39,cc,8a,da,7f,44,84,09,da,b7,e2,0c,b8,a9,a5,33
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Zeit der Fertigstellung: 2011-06-10 10:26:44
ComboFix-quarantined-files.txt 2011-06-10 08:26
.
Vor Suchlauf: 16 Verzeichnis(se), 142.192.136.192 Bytes frei
Nach Suchlauf: 20 Verzeichnis(se), 143.953.223.680 Bytes frei
.
- - End Of File - - F25488137EBE620F608C72CF0BDEBCBA
:EDIT |
