| xan1m0rphx | 07.03.2012 16:24 |
ComboFix durchrattern lassen!
Maus und tastertur nicht angerührt :)
Combofix Logfile: Code:
ComboFix 12-03-07.03 - Manuel 07.03.2012 16:07:49.1.4 - x64
Microsoft Windows 7 Ultimate 6.1.7600.0.1252.49.1031.18.4606.3248 [GMT 1:00]
ausgeführt von:: c:\users\Manuel\Desktop\ComboFix.exe
AV: Kaspersky Internet Security *Disabled/Updated* {2EAA32A5-1EE1-1B22-95DA-337730C6E984}
FW: Kaspersky Internet Security *Disabled* {1691B380-548E-1A7A-BE85-9A42CE15AEFF}
SP: Kaspersky Internet Security *Disabled/Updated* {95CBD341-38DB-14AC-AF6A-08054B41A339}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Manuel\AppData\Local\assembly\tmp
c:\users\Manuel\AppData\Roaming\InstallDir
c:\users\Manuel\AppData\Roaming\Microsoft\Windows\lARkr8tK0VXpuGMp8L.dat
c:\users\Manuel\AppData\Roaming\Microsoft\Windows\lARkr8tK0VXpuGMp8L.xtr
.
.
((((((((((((((((((((((( Dateien erstellt von 2012-02-07 bis 2012-03-07 ))))))))))))))))))))))))))))))
.
.
2012-03-07 15:17 . 2012-03-07 15:17 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-03-07 05:30 . 2012-03-07 05:31 -------- d-----w- c:\program files (x86)\Wireshark
2012-03-07 05:27 . 2012-03-07 05:27 -------- d-----w- c:\program files (x86)\Common Files\Java
2012-03-07 05:27 . 2012-03-07 05:27 -------- d-----w- c:\program files (x86)\Java
2012-03-07 05:05 . 2012-03-07 05:05 -------- d-----w- c:\users\Manuel\AppData\Local\Secunia PSI
2012-03-07 05:05 . 2012-03-07 05:05 -------- d-----w- c:\program files (x86)\Secunia
2012-03-07 04:57 . 2012-03-07 04:57 -------- d-----w- c:\users\Manuel\AppData\Roaming\SUPERAntiSpyware.com
2012-03-07 04:57 . 2012-03-07 04:59 -------- d-----w- c:\program files\SUPERAntiSpyware
2012-03-07 04:57 . 2012-03-07 04:57 -------- d-----w- c:\programdata\SUPERAntiSpyware.com
2012-03-07 03:31 . 2012-03-07 03:31 -------- d-----w- C:\_OTL
2012-03-06 20:07 . 2012-03-06 20:07 -------- d-----w- c:\program files (x86)\Screaming Bee
2012-03-06 14:34 . 2012-03-07 03:47 -------- d-----r- C:\Javascript
2012-03-04 14:19 . 2012-03-04 14:19 -------- d-----w- c:\users\Manuel\AppData\Local\Vitalwerks
2012-03-04 14:10 . 2012-03-04 14:10 -------- d-----w- c:\program files (x86)\No-IP
2012-03-04 13:21 . 2012-03-04 13:21 -------- d-----w- c:\program files (x86)\VirtualDJ
2012-03-04 12:38 . 2012-03-04 12:38 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
2012-03-04 12:38 . 2011-12-10 14:24 23152 ----a-w- c:\windows\system32\drivers\mbam.sys
2012-03-04 02:02 . 2012-03-04 02:02 -------- d-sh--w- c:\windows\SysWow64\%APPDATA%
2012-03-03 18:37 . 2012-03-03 18:37 -------- d-----w- c:\users\Manuel\AppData\Roaming\Malwarebytes
2012-03-03 18:37 . 2012-03-03 18:37 -------- d-----w- c:\programdata\Malwarebytes
2012-03-03 11:21 . 2012-03-03 11:21 -------- d-----w- c:\windows\SysWow64\wbem\en-US
2012-03-03 11:20 . 2012-03-03 11:20 -------- d-----w- c:\windows\system32\wbem\en-US
2012-03-03 03:54 . 2012-03-03 03:56 -------- d-----w- c:\users\Manuel\AppData\Roaming\Tunngle
2012-03-03 03:54 . 2012-03-03 03:54 -------- d-----w- c:\programdata\Tunngle
2012-03-03 03:54 . 2009-09-16 06:02 31232 ----a-w- c:\windows\system32\drivers\tap0901t.sys
2012-03-03 03:54 . 2012-03-03 03:56 -------- d-----w- c:\program files (x86)\Tunngle
2012-03-03 02:52 . 2012-03-03 02:52 -------- d-----w- c:\program files (x86)\Common Files\Skype
2012-03-02 17:45 . 2010-09-14 06:45 367104 ----a-w- c:\windows\system32\wcncsvc.dll
2012-03-02 17:45 . 2010-09-14 06:07 276992 ----a-w- c:\windows\SysWow64\wcncsvc.dll
2012-03-02 17:16 . 2012-03-02 17:16 -------- d-----w- c:\program files (x86)\Winamp Detect
2012-03-02 17:15 . 2012-03-02 17:15 -------- d-----w- c:\program files (x86)\Common Files\PX Storage Engine
2012-03-02 17:15 . 2012-03-06 17:37 -------- d-----w- c:\users\Manuel\AppData\Roaming\Winamp
2012-03-02 17:15 . 2012-03-02 17:16 -------- d-----w- c:\program files (x86)\Winamp
2012-03-02 17:14 . 2012-03-02 17:15 -------- d-----w- c:\program files\Virtual Audio Cable
2012-03-02 17:14 . 2012-03-02 17:14 66728 ----a-w- c:\windows\system32\drivers\vrtaucbl.sys
2012-03-02 17:09 . 2009-09-10 06:28 311808 ----a-w- c:\windows\system32\msv1_0.dll
2012-03-02 17:09 . 2009-09-10 05:52 257024 ----a-w- c:\windows\SysWow64\msv1_0.dll
2012-03-02 16:30 . 2009-10-10 03:17 14336 ----a-w- c:\windows\system32\drivers\sffp_sd.sys
2012-03-02 16:30 . 2012-03-02 16:30 -------- d-----w- c:\program files (x86)\Microsoft CAPICOM 2.1.0.2
2012-03-02 16:18 . 2010-02-23 08:16 294912 ----a-w- c:\windows\system32\browserchoice.exe
2012-03-02 15:48 . 2012-03-04 02:22 -------- d-----w- c:\program files (x86)\Microsoft Silverlight
2012-03-02 15:10 . 2010-03-04 04:40 184832 ----a-w- c:\windows\system32\drivers\usbvideo.sys
2012-03-02 15:10 . 2010-03-04 04:32 243712 ----a-w- c:\windows\system32\drivers\ks.sys
2012-03-02 15:08 . 2009-09-03 07:36 1975296 ----a-w- c:\windows\system32\CertEnroll.dll
2012-03-02 15:08 . 2009-09-03 07:04 1320960 ----a-w- c:\windows\SysWow64\CertEnroll.dll
2012-03-02 15:06 . 2012-01-14 04:02 3143168 ----a-w- c:\windows\system32\win32k.sys
2012-03-02 15:05 . 2010-07-29 06:30 82944 ----a-w- c:\windows\SysWow64\iccvid.dll
2012-03-02 15:04 . 2011-11-05 05:17 2048 ----a-w- c:\windows\system32\tzres.dll
2012-03-02 14:53 . 2011-12-16 08:42 634368 ----a-w- c:\windows\system32\msvcrt.dll
2012-03-02 14:53 . 2011-12-16 07:59 690688 ----a-w- c:\windows\SysWow64\msvcrt.dll
2012-03-02 14:51 . 2011-06-23 05:29 5507968 ----a-w- c:\windows\system32\ntoskrnl.exe
2012-03-02 14:51 . 2011-06-23 04:38 3957120 ----a-w- c:\windows\SysWow64\ntkrnlpa.exe
2012-03-02 14:51 . 2011-06-23 04:38 3902336 ----a-w- c:\windows\SysWow64\ntoskrnl.exe
2012-03-02 14:47 . 2011-11-19 15:07 77312 ----a-w- c:\windows\system32\packager.dll
2012-03-02 14:47 . 2011-11-19 14:06 67072 ----a-w- c:\windows\SysWow64\packager.dll
2012-03-02 14:45 . 2009-12-29 08:03 220672 ----a-w- c:\windows\system32\wintrust.dll
2012-03-02 14:45 . 2009-12-29 06:55 172032 ----a-w- c:\windows\SysWow64\wintrust.dll
2012-03-02 14:45 . 2010-01-09 07:19 139264 ----a-w- c:\windows\system32\cabview.dll
2012-03-02 14:45 . 2010-01-09 06:52 132608 ----a-w- c:\windows\SysWow64\cabview.dll
2012-03-02 14:32 . 2012-02-08 07:13 8643640 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{5DDF34F3-52EA-4A34-9495-2FF642A099B0}\mpengine.dll
2012-03-02 03:13 . 2009-06-18 11:55 18816 ------w- c:\windows\SysWow64\SAVRKBootTasks.sys
2012-03-02 01:32 . 2012-03-07 03:31 -------- d-----w- c:\program files (x86)\Spybot - Search & Destroy
2012-03-02 01:32 . 2012-03-03 04:39 -------- d-----w- c:\programdata\Spybot - Search & Destroy
2012-03-02 01:21 . 2012-03-02 01:22 -------- d-----w- c:\users\Manuel\AppData\Roaming\Spamihilator
2012-03-02 01:20 . 2006-06-19 12:01 69632 ----a-w- c:\windows\SysWow64\ztvcabinet.dll
2012-03-02 01:20 . 2006-05-25 14:52 162304 ----a-w- c:\windows\SysWow64\ztvunrar36.dll
2012-03-02 01:20 . 2005-08-26 00:50 77312 ----a-w- c:\windows\SysWow64\ztvunace26.dll
2012-03-02 01:20 . 2003-02-02 19:06 153088 ----a-w- c:\windows\SysWow64\UNRAR3.dll
2012-03-02 01:20 . 2002-03-06 00:00 75264 ----a-w- c:\windows\SysWow64\unacev2.dll
2012-03-02 01:20 . 2012-03-02 11:24 -------- d-----w- c:\program files (x86)\Trojan Remover
2012-03-02 01:20 . 2012-03-02 01:20 -------- d-----w- c:\users\Manuel\AppData\Roaming\Simply Super Software
2012-03-02 01:20 . 2012-03-02 01:20 -------- d-----w- c:\programdata\Simply Super Software
2012-03-01 23:32 . 2012-03-02 00:53 -------- d-sh--r- c:\users\Manuel\AppData\Roaming\MicroUpdate
2012-03-01 21:29 . 2012-03-01 21:29 -------- d-----w- c:\program files (x86)\LogMeIn Hamachi
2012-03-01 21:28 . 2012-03-06 14:06 -------- d-----w- c:\users\Manuel\AppData\Local\LogMeIn Hamachi
2012-03-01 16:11 . 2012-03-01 16:11 -------- d-----w- c:\users\Manuel\AppData\Local\Downloaded Installations
2012-03-01 00:06 . 2012-03-01 00:06 -------- d-----w- c:\program files (x86)\Midway Home Entertainment
2012-02-29 20:39 . 2012-02-29 22:09 -------- d-----w- c:\users\Manuel\AppData\Roaming\DarknessII
2012-02-29 20:11 . 2012-03-04 19:09 -------- d-----w- c:\programdata\regid.1986-12.com.adobe
2012-02-29 19:14 . 2012-02-29 19:18 -------- d-----w- c:\program files\Common Files\Adobe
2012-02-29 19:12 . 2012-02-29 19:12 -------- d-----w- c:\program files (x86)\Adobe Media Player
2012-02-29 19:09 . 2012-03-07 05:38 -------- d-----w- c:\program files (x86)\Common Files\Adobe AIR
2012-02-29 03:04 . 2012-02-29 03:04 -------- d-----w- c:\users\Manuel\AppData\Roaming\Serif
2012-02-29 02:59 . 2012-02-29 02:59 -------- d-----w- c:\program files (x86)\Serif
2012-02-27 02:30 . 2012-03-01 20:05 -------- d-----w- c:\users\Manuel\VirtualBox VMs
2012-02-27 02:16 . 2012-03-06 23:01 -------- d-----w- c:\users\Manuel\.VirtualBox
2012-02-27 02:15 . 2011-12-19 12:45 224048 ----a-w- c:\windows\system32\drivers\VBoxDrv.sys
2012-02-27 02:14 . 2011-12-19 12:45 130864 ----a-w- c:\windows\system32\drivers\VBoxUSBMon.sys
2012-02-27 02:14 . 2012-02-27 02:14 -------- d-----w- c:\program files\Oracle
2012-02-27 01:11 . 2012-02-27 01:11 -------- d-----w- c:\program files (x86)\WinSCP
2012-02-26 20:19 . 2001-08-12 13:38 -------- d-----w- c:\windows\system32\software.lc
2012-02-26 20:19 . 2001-07-13 10:59 32768 ----a-w- c:\windows\system32\UUDECODE.EXE
2012-02-26 20:19 . 1998-12-08 15:28 24576 ----a-w- c:\windows\system32\UUENCODE.EXE
2012-02-26 14:42 . 2012-02-26 14:42 -------- d-----w- c:\users\Manuel\AppData\Roaming\Canneverbe Limited
2012-02-26 14:42 . 2012-02-26 14:42 -------- d-----w- c:\programdata\Canneverbe Limited
2012-02-26 14:42 . 2012-02-26 14:42 -------- d-----w- c:\program files (x86)\CDBurnerXP
2012-02-24 21:42 . 2012-02-24 21:42 60 ----a-w- c:\users\Manuel\update.bat
2012-02-24 20:38 . 2012-02-25 00:49 -------- d-----w- c:\program files (x86)\Valve
2012-02-24 08:38 . 2012-02-24 08:38 -------- d-----w- c:\programdata\ATI
2012-02-24 08:21 . 2012-02-24 08:21 -------- d-----w- C:\AMD
2012-02-24 08:16 . 2012-02-24 08:16 -------- d-----w- c:\programdata\EA Core
2012-02-24 08:16 . 2012-02-24 10:04 -------- d-----w- c:\programdata\EA Logs
2012-02-24 08:15 . 2012-02-24 08:15 -------- d--h--w- c:\program files (x86)\Common Files\EAInstaller
2012-02-24 08:13 . 2012-02-24 08:13 -------- d-----w- c:\programdata\NVIDIA
2012-02-24 06:51 . 2012-03-02 01:11 -------- d-----w- c:\program files (x86)\Battlelog Web Plugins
2012-02-24 01:27 . 2012-02-24 01:27 -------- d-----w- c:\users\Manuel\AppData\Roaming\Thunderbird
2012-02-24 01:27 . 2012-02-24 01:27 -------- d-----w- c:\users\Manuel\AppData\Local\Thunderbird
2012-02-24 01:26 . 2012-02-24 01:26 -------- d-----w- c:\program files (x86)\Mozilla Thunderbird
2012-02-23 22:41 . 2012-03-07 15:04 -------- d-----w- c:\users\Manuel\AppData\Roaming\UseNeXT
2012-02-23 22:41 . 2012-02-23 22:41 -------- d-----w- c:\program files (x86)\UseNeXT
2012-02-23 15:40 . 2012-02-23 15:40 -------- d-----w- c:\programdata\Blizzard Entertainment
2012-02-23 04:42 . 2012-02-23 04:42 -------- d-----w- c:\users\Manuel\AppData\Local\Apps
2012-02-23 04:42 . 2012-02-29 20:53 -------- d-----w- c:\users\Manuel\AppData\Local\Deployment
2012-02-23 02:28 . 2012-02-24 10:30 -------- d-----w- c:\users\Manuel\AppData\Roaming\FileZilla
2012-02-23 02:27 . 2012-02-23 02:28 -------- d-----w- c:\program files (x86)\FileZilla FTP Client
2012-02-22 22:05 . 2012-02-22 22:05 -------- d-----w- c:\program files (x86)\Intelore
2012-02-22 21:00 . 2012-02-22 21:00 -------- d-----w- c:\program files (x86)\OpenVPN
2012-02-22 02:32 . 2012-02-22 03:12 -------- d-----w- c:\program files (x86)\Common Files\Blizzard Entertainment
2012-02-21 23:32 . 2012-02-21 23:32 254528 ----a-w- c:\windows\system32\drivers\dtsoftbus01.sys
2012-02-21 23:32 . 2012-03-02 01:10 -------- d-----w- c:\program files (x86)\DAEMON Tools Toolbar
2012-02-21 23:32 . 2012-02-21 23:33 -------- d-----w- c:\program files (x86)\DAEMON Tools Lite
2012-02-21 20:25 . 2012-03-04 17:48 -------- d-----w- c:\programdata\boost_interprocess
2012-02-21 20:10 . 2012-03-05 00:58 -------- d-----w- c:\users\Manuel\AppData\Roaming\Screaming Bee
2012-02-21 20:10 . 2012-02-21 20:11 -------- d-----w- c:\programdata\Screaming Bee
2012-02-21 20:08 . 2012-02-21 20:08 -------- d-----w- c:\users\Manuel\AppData\Local\Windows Live
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-03-07 05:39 . 2012-01-28 16:12 414368 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2012-03-07 05:27 . 2012-01-31 17:43 472808 ----a-w- c:\windows\SysWow64\deployJava1.dll
2012-02-28 15:39 . 2012-01-31 19:32 282864 ----a-w- c:\windows\SysWow64\PnkBstrB.xtr
2012-02-28 15:39 . 2012-01-31 19:28 282864 ----a-w- c:\windows\SysWow64\PnkBstrB.exe
2012-02-28 15:38 . 2012-01-31 19:28 280904 ----a-w- c:\windows\SysWow64\PnkBstrB.ex0
2012-02-24 09:52 . 2012-01-31 19:28 76888 ----a-w- c:\windows\SysWow64\PnkBstrA.exe
2012-01-29 04:10 . 2012-01-28 15:29 279656 ------w- c:\windows\system32\MpSigStub.exe
2012-01-28 16:56 . 2012-01-28 16:56 53248 ----a-r- c:\users\Manuel\AppData\Roaming\Microsoft\Installer\{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}\ARPPRODUCTICON.exe
2012-01-18 05:44 . 2012-01-18 05:44 540960 ----a-w- c:\windows\SysWow64\LVUI2RC.dll
2012-01-18 05:44 . 2012-01-18 05:44 545056 ----a-w- c:\windows\SysWow64\LVUI2.dll
2012-01-18 05:44 . 2012-01-18 05:44 561440 ----a-w- c:\windows\system32\LVUIRC64.dll
2012-01-18 05:44 . 2012-01-18 05:44 4865568 ----a-w- c:\windows\system32\drivers\lvuvc64.sys
2012-01-18 05:44 . 2012-01-18 05:44 769312 ----a-w- c:\windows\system32\LVUI64.dll
2012-01-18 05:44 . 2012-01-18 05:44 351136 ----a-w- c:\windows\system32\drivers\lvrs64.sys
2012-01-18 05:44 . 2012-01-18 05:44 307488 ----a-w- c:\windows\SysWow64\lvcodec2.dll
2012-01-18 05:44 . 2012-01-18 05:44 263456 ----a-w- c:\windows\system32\lvco13311044.dll
2012-01-18 05:44 . 2012-01-18 05:44 176416 ----a-w- c:\windows\system32\lvcod64.dll
2012-01-18 05:44 . 2012-01-18 05:44 25632 ----a-w- c:\windows\system32\drivers\lvbflt64.sys
2012-01-18 05:44 . 2012-01-18 05:44 336408 ----a-w- c:\windows\SysWow64\DevManagerCore.dll
2012-01-18 05:44 . 2012-01-18 05:44 336408 ----a-w- c:\windows\system32\DevManagerCore.dll
2012-01-18 05:44 . 2012-01-18 05:44 10920984 ----a-w- c:\windows\SysWow64\LogiDPP.dll
2012-01-18 05:44 . 2012-01-18 05:44 10920984 ----a-w- c:\windows\system32\LogiDPP.dll
2012-01-18 05:44 . 2012-01-18 05:44 104472 ----a-w- c:\windows\SysWow64\LogiDPPApp.exe
2012-01-18 05:44 . 2012-01-18 05:44 104472 ----a-w- c:\windows\system32\LogiDPPApp.exe
2011-12-19 12:45 . 2011-12-19 12:45 146736 ----a-w- c:\windows\system32\drivers\VBoxNetAdp.sys
2011-12-19 12:43 . 2011-12-19 12:43 320816 ----a-w- c:\windows\system32\VBoxNetFltNobj.dll
2011-12-19 12:43 . 2011-12-19 12:43 165680 ----a-w- c:\windows\system32\drivers\VBoxNetFlt.sys
2011-12-15 17:29 . 2011-12-15 17:29 31232 ----a-w- c:\windows\system32\drivers\tap0901.sys
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files (x86)\Windows Sidebar\sidebar.exe" [2009-07-14 1173504]
"DAEMON Tools Lite"="c:\program files (x86)\DAEMON Tools Lite\DTLite.exe" [2011-01-20 1305408]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2012-01-20 5487488]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"AVP"="c:\program files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe" [2011-04-24 202296]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2011-12-05 343168]
"Malwarebytes' Anti-Malware"="c:\program files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-01-13 460872]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-01-18 254696]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Secunia PSI Tray.lnk - c:\program files (x86)\Secunia\PSI\psi_tray.exe [2011-7-29 291896]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]
@=""
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2012-02-15 158856]
R3 AODDriver4.0;AODDriver4.0;c:\program files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [2011-06-24 55424]
R3 EagleX64;EagleX64;c:\windows\system32\drivers\EagleX64.sys [x]
R3 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance;c:\program files (x86)\Common Files\MAGIX Services\Database\bin\fbserver.exe [2008-08-07 3276800]
R3 MEMSWEEP2;MEMSWEEP2;c:\windows\system32\84B.tmp [x]
R3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [x]
R3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [x]
R3 SwitchBoard;SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
R3 tap0801;TAP-Win32 Adapter V8;c:\windows\system32\DRIVERS\tap0801.sys [x]
R3 tap0901t;TAP-Win32 Adapter V9 (Tunngle);c:\windows\system32\DRIVERS\tap0901t.sys [x]
R3 tapoas;TAP-Win32 Adapter OAS;c:\windows\system32\DRIVERS\tapoas.sys [x]
R3 TunngleService;TunngleService;c:\program files (x86)\Tunngle\TnglCtrl.exe [2012-02-14 736104]
R3 VBoxNetAdp;VirtualBox Host-Only Ethernet Adapter;c:\windows\system32\DRIVERS\VBoxNetAdp.sys [x]
S0 johci;JMicron 1394 Filter Driver;c:\windows\system32\DRIVERS\johci.sys [x]
S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [x]
S1 kl2;kl2;c:\windows\system32\DRIVERS\kl2.sys [x]
S1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter;c:\windows\system32\DRIVERS\klim6.sys [x]
S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV64.SYS [2011-07-22 14928]
S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL64.SYS [2011-07-12 12368]
S1 VBoxDrv;VirtualBox Service;c:\windows\system32\DRIVERS\VBoxDrv.sys [x]
S1 VBoxUSBMon;VirtualBox USB Monitor Driver;c:\windows\system32\DRIVERS\VBoxUSBMon.sys [x]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]
S2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCORE64.EXE [2011-08-11 140672]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-01-03 63928]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x]
S2 AMD FUEL Service;AMD FUEL Service;c:\program files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [2011-12-05 361984]
S2 AODDriver4.01;AODDriver4.01;c:\program files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [2011-06-24 55424]
S2 ArchiCrypt Sichere Loeschzonen;ArchiCrypt Shredder - Sichere Löschzonen Hilfsservice;c:\program files (x86)\ArchiCrypt\ArchiCrypt Shredder 5\ArchiCryptInjector64.exe [2010-05-04 312032]
S2 Fabs;FABS - Helping agent for MAGIX media database;c:\program files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe [2009-08-27 1253376]
S2 Hamachi2Svc;LogMeIn Hamachi Tunneling Engine;c:\program files (x86)\LogMeIn Hamachi\hamachi-2.exe [2012-02-28 2343816]
S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-01-13 652360]
S2 SBSDWSCService;SBSD Security Center Service;c:\program files (x86)\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368]
S2 Secunia PSI Agent;Secunia PSI Agent;c:\program files (x86)\Secunia\PSI\PSIA.exe [2011-07-29 994360]
S2 Secunia Update Agent;Secunia Update Agent;c:\program files (x86)\Secunia\PSI\sua.exe [2011-07-29 399416]
S2 TeamViewer6;TeamViewer 6;c:\program files (x86)\TeamViewer\Version6\TeamViewer_Service.exe [2011-08-30 2358656]
S2 TeamViewer7;TeamViewer 7;c:\program files (x86)\TeamViewer\Version7\TeamViewer_Service.exe [2012-01-19 3027840]
S2 UMVPFSrv;UMVPFSrv;c:\program files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exe [2012-01-18 450848]
S3 amdiox64;AMD IO Driver;c:\windows\system32\DRIVERS\amdiox64.sys [x]
S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [x]
S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [x]
S3 AtiHDAudioService;ATI Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys [x]
S3 CompFilter64;UVCCompositeFilter;c:\windows\system32\DRIVERS\lvbflt64.sys [x]
S3 EuMusDesignVirtualAudioCableWdm;Virtual Audio Cable (WDM);c:\windows\system32\DRIVERS\vrtaucbl.sys [x]
S3 klmouflt;Kaspersky Lab KLMOUFLT;c:\windows\system32\DRIVERS\klmouflt.sys [x]
S3 LVRS64;Logitech RightSound Filter Driver;c:\windows\system32\DRIVERS\lvrs64.sys [x]
S3 LVUVC64;Logitech HD Webcam C510(UVC);c:\windows\system32\DRIVERS\lvuvc64.sys [x]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [x]
S3 netr28ux;RT2870 USB Extensible Wireless LAN Card Driver;c:\windows\system32\DRIVERS\netr28ux.sys [x]
S3 PSI;PSI;c:\windows\system32\DRIVERS\psi_mf.sys [x]
S3 ScreamBAudioSvc;ScreamBee Audio;c:\windows\system32\drivers\ScreamingBAudio64.sys [x]
S3 VBoxNetFlt;VirtualBox Bridged Networking Service;c:\windows\system32\DRIVERS\VBoxNetFlt.sys [x]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - SASDIFSV
*Deregistered* - ArchiCryptInjector
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2012-02-14 10806816]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x0
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page =
mStart Page =
mLocal Page =
uInternet Settings,ProxyOverride = *.local
IE: Free YouTube Download - c:\users\Manuel\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm
IE: Free YouTube to MP3 Converter - c:\users\Manuel\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm
IE: {{7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - c:\program files (x86)\ICQ7.5\ICQ.exe
LSP: %SystemRoot%\system32\PrxerDrv.dll
TCP: DhcpNameServer = 192.168.1.1
FF - ProfilePath - c:\users\Manuel\AppData\Roaming\Mozilla\Firefox\Profiles\34nask8m.default\
FF - prefs.js: browser.startup.homepage - www.google.de
FF - user.js: extensions.BabylonToolbar_i.babTrack - affID=108298
FF - user.js: extensions.BabylonToolbar_i.babExt -
FF - user.js: extensions.BabylonToolbar_i.srcExt - ss
FF - user.js: extensions.BabylonToolbar_i.id - 14823d1c00000000000000ffd3fc8b8d
FF - user.js: extensions.BabylonToolbar_i.hardId - 14823d1c00000000000000ffd3fc8b8d
FF - user.js: extensions.BabylonToolbar_i.instlDay - 15400
FF - user.js: extensions.BabylonToolbar_i.vrsn - 1.5.3.17
FF - user.js: extensions.BabylonToolbar_i.vrsni - 1.5.3.17
FF - user.js: extensions.BabylonToolbar_i.vrsnTs - 1.5.3.170:51
FF - user.js: extensions.BabylonToolbar_i.prtnrId - babylon
FF - user.js: extensions.BabylonToolbar_i.prdct - BabylonToolbar
FF - user.js: extensions.BabylonToolbar_i.aflt - babsst
FF - user.js: extensions.BabylonToolbar_i.smplGrp - none
FF - user.js: extensions.BabylonToolbar_i.tlbrId - base
FF - user.js: extensions.BabylonToolbar_i.instlRef - sst
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
AddRemove-Adobe Shockwave Player - c:\windows\system32\Adobe\Shockwave 11\uninstaller.exe
AddRemove-Half-Life Dedicated Server Update Tool - c:\server\UNWISE.EXE
.
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\MEMSWEEP2]
"ImagePath"="\??\c:\windows\system32\84B.tmp"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\npggsvc]
"ImagePath"="c:\windows\system32\GameMon.des -service"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\Approved Extensions]
@Denied: (2) (LocalSystem)
"{18DF081C-E8AD-4283-A596-FA578C2EBDC3}"=hex:51,66,7a,6c,4c,1d,38,12,72,0b,cc,
1c,9f,a6,ed,07,da,80,b9,17,89,70,f9,d7
"{53707962-6F74-2D53-2644-206D7942484F}"=hex:51,66,7a,6c,4c,1d,38,12,0c,7a,63,
57,46,21,3d,68,59,52,63,2d,7c,1c,0c,5b
"{59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C}"=hex:51,66,7a,6c,4c,1d,38,12,da,39,34,
5d,e1,a9,97,05,de,be,2c,e9,c9,ff,c2,38
"{DBC80044-A445-435B-BC74-9C25C1C588A9}"=hex:51,66,7a,6c,4c,1d,38,12,2a,03,db,
df,77,ea,35,06,c3,62,df,65,c4,9b,cc,bd
"{E33CF602-D945-461A-83F0-819F76A199F8}"=hex:51,66,7a,6c,4c,1d,38,12,6c,f5,2f,
e7,77,97,74,03,fc,e6,c2,df,73,ff,dd,ec
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration]
@Denied: (2) (LocalSystem)
"Timestamp"=hex:7b,8a,a4,41,66,fa,cc,01
.
[HKEY_USERS\S-1-5-21-129560445-3818396582-2292848211-1001\Software\SecuROM\License information*]
"datasecu"=hex:61,3b,44,e9,3b,02,14,c3,02,f9,33,8d,06,9f,a0,44,04,ac,ea,91,f1,
91,26,2f,95,50,95,34,ea,71,02,0e,a1,2c,52,4e,75,b3,cf,48,fa,25,3c,81,64,d1,\
"rkeysecu"=hex:f4,2d,bc,4e,07,00,56,80,ae,94,46,f3,cf,01,cc,35
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11e_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11e_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}]
@Denied: (A 2) (Everyone)
@="IFlashBroker3"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib]
@="{6EF568F4-D437-4466-AA63-A3645136D93E}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2E4BB6BE-A75F-4DC0-9500-68203655A2C4}]
@Denied: (A 2) (Everyone)
@="IFlashBroker"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2E4BB6BE-A75F-4DC0-9500-68203655A2C4}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2E4BB6BE-A75F-4DC0-9500-68203655A2C4}\TypeLib]
@="{6EF568F4-D437-4466-AA63-A3645136D93E}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{DDF4CE26-4BDA-42BC-B0F0-0E75243AD285}]
@Denied: (A 2) (Everyone)
@="IFlashBroker2"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{DDF4CE26-4BDA-42BC-B0F0-0E75243AD285}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{DDF4CE26-4BDA-42BC-B0F0-0E75243AD285}\TypeLib]
@="{6EF568F4-D437-4466-AA63-A3645136D93E}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2012-03-07 16:20:49
ComboFix-quarantined-files.txt 2012-03-07 15:20
.
Vor Suchlauf: 11 Verzeichnis(se), 24.830.599.168 Bytes frei
Nach Suchlauf: 16 Verzeichnis(se), 24.446.562.304 Bytes frei
.
- - End Of File - - 888849A5728AB6FC01524D307880250D
--- --- --- |
