ok, Danke :)
hab's erledigt und folgendes ist rausgekommen: Code:
ComboFix 13-07-09.01 - Vladimir 09.07.2013 20:08:25.1.8 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.49.1031.18.4055.2047 [GMT 2:00]
ausgeführt von:: c:\users\Vladimir\Desktop\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files (x86)\Common Files\Acer GameZone online.ico
c:\users\Vladimir\4.0
c:\users\Vladimir\AppData\Local\assembly\tmp
c:\windows\SysWow64\html
c:\windows\SysWow64\html\calendar.html
c:\windows\SysWow64\html\calendarbottom.html
c:\windows\SysWow64\html\calendartop.html
c:\windows\SysWow64\html\crystalexportdialog.htm
c:\windows\SysWow64\html\crystalprinthost.html
c:\windows\SysWow64\images
c:\windows\SysWow64\images\toolbar\calendar.gif
c:\windows\SysWow64\images\toolbar\crlogo.gif
c:\windows\SysWow64\images\toolbar\export.gif
c:\windows\SysWow64\images\toolbar\export_over.gif
c:\windows\SysWow64\images\toolbar\exportd.gif
c:\windows\SysWow64\images\toolbar\First.gif
c:\windows\SysWow64\images\toolbar\first_over.gif
c:\windows\SysWow64\images\toolbar\Firstd.gif
c:\windows\SysWow64\images\toolbar\gotopage.gif
c:\windows\SysWow64\images\toolbar\gotopage_over.gif
c:\windows\SysWow64\images\toolbar\gotopaged.gif
c:\windows\SysWow64\images\toolbar\grouptree.gif
c:\windows\SysWow64\images\toolbar\grouptree_over.gif
c:\windows\SysWow64\images\toolbar\grouptreed.gif
c:\windows\SysWow64\images\toolbar\grouptreepressed.gif
c:\windows\SysWow64\images\toolbar\Last.gif
c:\windows\SysWow64\images\toolbar\last_over.gif
c:\windows\SysWow64\images\toolbar\Lastd.gif
c:\windows\SysWow64\images\toolbar\Next.gif
c:\windows\SysWow64\images\toolbar\next_over.gif
c:\windows\SysWow64\images\toolbar\Nextd.gif
c:\windows\SysWow64\images\toolbar\Prev.gif
c:\windows\SysWow64\images\toolbar\prev_over.gif
c:\windows\SysWow64\images\toolbar\Prevd.gif
c:\windows\SysWow64\images\toolbar\print.gif
c:\windows\SysWow64\images\toolbar\print_over.gif
c:\windows\SysWow64\images\toolbar\printd.gif
c:\windows\SysWow64\images\toolbar\Refresh.gif
c:\windows\SysWow64\images\toolbar\refresh_over.gif
c:\windows\SysWow64\images\toolbar\refreshd.gif
c:\windows\SysWow64\images\toolbar\Search.gif
c:\windows\SysWow64\images\toolbar\search_over.gif
c:\windows\SysWow64\images\toolbar\searchd.gif
c:\windows\SysWow64\images\toolbar\up.gif
c:\windows\SysWow64\images\toolbar\up_over.gif
c:\windows\SysWow64\images\toolbar\upd.gif
c:\windows\SysWow64\images\tree\begindots.gif
c:\windows\SysWow64\images\tree\beginminus.gif
c:\windows\SysWow64\images\tree\beginplus.gif
c:\windows\SysWow64\images\tree\blank.gif
c:\windows\SysWow64\images\tree\blankdots.gif
c:\windows\SysWow64\images\tree\dots.gif
c:\windows\SysWow64\images\tree\lastdots.gif
c:\windows\SysWow64\images\tree\lastminus.gif
c:\windows\SysWow64\images\tree\lastplus.gif
c:\windows\SysWow64\images\tree\Magnify.gif
c:\windows\SysWow64\images\tree\minus.gif
c:\windows\SysWow64\images\tree\minusbox.gif
c:\windows\SysWow64\images\tree\plus.gif
c:\windows\SysWow64\images\tree\plusbox.gif
c:\windows\SysWow64\images\tree\singleminus.gif
c:\windows\SysWow64\images\tree\singleplus.gif
.
.
((((((((((((((((((((((( Dateien erstellt von 2013-06-09 bis 2013-07-09 ))))))))))))))))))))))))))))))
.
.
2013-07-09 18:15 . 2013-07-09 18:15 -------- d-----w- c:\users\Default\AppData\Local\temp
2013-07-09 17:47 . 2013-07-09 17:47 -------- d-----w- C:\FRST
2013-07-09 16:57 . 2013-07-09 16:57 76232 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{ED5190FA-8174-41CE-8541-2E6848CAD1CE}\offreg.dll
2013-07-09 16:47 . 2013-07-09 16:47 -------- d-----w- c:\windows\ERUNT
2013-07-09 16:27 . 2013-06-12 03:08 9552976 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{ED5190FA-8174-41CE-8541-2E6848CAD1CE}\mpengine.dll
2013-07-06 08:32 . 2013-07-06 08:32 -------- d-----w- c:\programdata\Steam
2013-07-04 19:50 . 2013-07-04 19:56 -------- d-----w- c:\program files\Solid Edge ST5
2013-07-03 21:58 . 2013-07-03 21:58 -------- d-----w- c:\program files\CCleaner
2013-06-29 08:21 . 2013-06-29 08:21 -------- d-----w- c:\users\Vladimir\AppData\Local\Mathsoft
2013-06-29 00:35 . 2013-06-29 00:35 -------- d-----w- c:\users\Vladimir\AppData\Local\Parametric_Technology_Cor
2013-06-29 00:24 . 2013-06-29 00:24 -------- d-----w- c:\users\Vladimir\AppData\Roaming\Mathsoft
2013-06-29 00:23 . 2013-06-29 00:23 -------- d-----w- c:\program files (x86)\Mathcad
2013-06-22 22:27 . 2013-06-22 22:27 -------- d-----w- C:\found.001
2013-06-18 21:22 . 2013-06-18 21:21 8192 ----a-w- c:\windows\SysWow64\srvany.exe
2013-06-12 01:01 . 2013-05-17 01:25 257536 ----a-w- c:\program files (x86)\Internet Explorer\ieproxy.dll
2013-06-11 21:09 . 2013-05-08 06:39 1910632 ----a-w- c:\windows\system32\drivers\tcpip.sys
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-06-11 22:04 . 2012-04-04 10:16 692104 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2013-06-11 22:04 . 2011-05-19 16:11 71048 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-06-02 20:32 . 2013-05-25 12:36 282104 ----a-w- c:\windows\SysWow64\PnkBstrB.xtr
2013-06-02 20:32 . 2010-08-01 19:40 282104 ----a-w- c:\windows\SysWow64\PnkBstrB.exe
2013-06-02 20:32 . 2010-08-01 19:40 234768 ----a-w- c:\windows\SysWow64\PnkBstrB.ex0
2013-05-25 12:48 . 2010-08-01 19:40 76888 ----a-w- c:\windows\SysWow64\PnkBstrA.exe
2013-05-21 20:33 . 2011-12-14 19:23 466456 ----a-w- c:\windows\system32\wrap_oal.dll
2013-05-21 20:33 . 2011-12-14 19:23 444952 ----a-w- c:\windows\SysWow64\wrap_oal.dll
2013-05-21 20:33 . 2011-12-14 19:23 122904 ----a-w- c:\windows\system32\OpenAL32.dll
2013-05-21 20:33 . 2011-12-14 19:23 109080 ----a-w- c:\windows\SysWow64\OpenAL32.dll
2013-05-21 01:03 . 2013-05-21 01:03 719360 ----a-w- c:\windows\SysWow64\mshtmlmedia.dll
2013-05-21 01:03 . 2013-05-21 01:03 523264 ----a-w- c:\windows\SysWow64\vbscript.dll
2013-05-21 01:03 . 2013-05-21 01:03 226304 ----a-w- c:\windows\system32\elshyph.dll
2013-05-21 01:03 . 2013-05-21 01:03 185344 ----a-w- c:\windows\SysWow64\elshyph.dll
2013-05-21 01:03 . 2013-05-21 01:03 158720 ----a-w- c:\windows\SysWow64\msls31.dll
2013-05-21 01:03 . 2013-05-21 01:03 150528 ----a-w- c:\windows\SysWow64\iexpress.exe
2013-05-21 01:03 . 2013-05-21 01:03 138752 ----a-w- c:\windows\SysWow64\wextract.exe
2013-05-21 01:03 . 2013-05-21 01:03 137216 ----a-w- c:\windows\SysWow64\ieUnatt.exe
2013-05-21 01:03 . 2013-05-21 01:03 1054720 ----a-w- c:\windows\system32\MsSpellCheckingFacility.exe
2013-05-21 01:03 . 2013-05-21 01:03 97280 ----a-w- c:\windows\system32\mshtmled.dll
2013-05-21 01:03 . 2013-05-21 01:03 92160 ----a-w- c:\windows\system32\SetIEInstalledDate.exe
2013-05-21 01:03 . 2013-05-21 01:03 905728 ----a-w- c:\windows\system32\mshtmlmedia.dll
2013-05-21 01:03 . 2013-05-21 01:03 81408 ----a-w- c:\windows\system32\icardie.dll
2013-05-21 01:03 . 2013-05-21 01:03 77312 ----a-w- c:\windows\system32\tdc.ocx
2013-05-21 01:03 . 2013-05-21 01:03 762368 ----a-w- c:\windows\system32\ieapfltr.dll
2013-05-21 01:03 . 2013-05-21 01:03 73728 ----a-w- c:\windows\SysWow64\SetIEInstalledDate.exe
2013-05-21 01:03 . 2013-05-21 01:03 62976 ----a-w- c:\windows\system32\pngfilt.dll
2013-05-21 01:03 . 2013-05-21 01:03 61952 ----a-w- c:\windows\SysWow64\tdc.ocx
2013-05-21 01:03 . 2013-05-21 01:03 599552 ----a-w- c:\windows\system32\vbscript.dll
2013-05-21 01:03 . 2013-05-21 01:03 52224 ----a-w- c:\windows\system32\msfeedsbs.dll
2013-05-21 01:03 . 2013-05-21 01:03 51200 ----a-w- c:\windows\system32\imgutil.dll
2013-05-21 01:03 . 2013-05-21 01:03 48640 ----a-w- c:\windows\SysWow64\mshtmler.dll
2013-05-21 01:03 . 2013-05-21 01:03 48640 ----a-w- c:\windows\system32\mshtmler.dll
2013-05-21 01:03 . 2013-05-21 01:03 452096 ----a-w- c:\windows\system32\dxtmsft.dll
2013-05-21 01:03 . 2013-05-21 01:03 441856 ----a-w- c:\windows\system32\html.iec
2013-05-21 01:03 . 2013-05-21 01:03 38400 ----a-w- c:\windows\SysWow64\imgutil.dll
2013-05-21 01:03 . 2013-05-21 01:03 361984 ----a-w- c:\windows\SysWow64\html.iec
2013-05-21 01:03 . 2013-05-21 01:03 281600 ----a-w- c:\windows\system32\dxtrans.dll
2013-05-21 01:03 . 2013-05-21 01:03 27648 ----a-w- c:\windows\system32\licmgr10.dll
2013-05-21 01:03 . 2013-05-21 01:03 270848 ----a-w- c:\windows\system32\iedkcs32.dll
2013-05-21 01:03 . 2013-05-21 01:03 247296 ----a-w- c:\windows\system32\webcheck.dll
2013-05-21 01:03 . 2013-05-21 01:03 235008 ----a-w- c:\windows\system32\url.dll
2013-05-21 01:03 . 2013-05-21 01:03 23040 ----a-w- c:\windows\SysWow64\licmgr10.dll
2013-05-21 01:03 . 2013-05-21 01:03 216064 ----a-w- c:\windows\system32\msls31.dll
2013-05-21 01:03 . 2013-05-21 01:03 197120 ----a-w- c:\windows\system32\msrating.dll
2013-05-21 01:03 . 2013-05-21 01:03 173568 ----a-w- c:\windows\system32\ieUnatt.exe
2013-05-21 01:03 . 2013-05-21 01:03 167424 ----a-w- c:\windows\system32\iexpress.exe
2013-05-21 01:03 . 2013-05-21 01:03 1509376 ----a-w- c:\windows\system32\inetcpl.cpl
2013-05-21 01:03 . 2013-05-21 01:03 149504 ----a-w- c:\windows\system32\occache.dll
2013-05-21 01:03 . 2013-05-21 01:03 144896 ----a-w- c:\windows\system32\wextract.exe
2013-05-21 01:03 . 2013-05-21 01:03 1441280 ----a-w- c:\windows\SysWow64\inetcpl.cpl
2013-05-21 01:03 . 2013-05-21 01:03 1400416 ----a-w- c:\windows\system32\ieapfltr.dat
2013-05-21 01:03 . 2013-05-21 01:03 13824 ----a-w- c:\windows\system32\mshta.exe
2013-05-21 01:03 . 2013-05-21 01:03 136192 ----a-w- c:\windows\system32\iepeers.dll
2013-05-21 01:03 . 2013-05-21 01:03 135680 ----a-w- c:\windows\system32\IEAdvpack.dll
2013-05-21 01:03 . 2013-05-21 01:03 12800 ----a-w- c:\windows\SysWow64\mshta.exe
2013-05-21 01:03 . 2013-05-21 01:03 12800 ----a-w- c:\windows\system32\msfeedssync.exe
2013-05-21 01:03 . 2013-05-21 01:03 110592 ----a-w- c:\windows\SysWow64\IEAdvpack.dll
2013-05-21 01:03 . 2013-05-21 01:03 102912 ----a-w- c:\windows\system32\inseng.dll
2013-05-02 00:06 . 2010-04-11 21:29 278800 ------w- c:\windows\system32\MpSigStub.exe
2013-05-01 23:51 . 2013-05-01 23:51 866720 ----a-w- c:\windows\SysWow64\npDeployJava1.dll
2013-05-01 23:51 . 2013-05-01 23:51 95648 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll
2013-05-01 23:51 . 2010-05-18 07:27 788896 ----a-w- c:\windows\SysWow64\deployJava1.dll
2013-04-13 05:49 . 2013-05-14 17:10 135168 ----a-w- c:\windows\apppatch\AppPatch64\AcXtrnal.dll
2013-04-13 05:49 . 2013-05-14 17:10 350208 ----a-w- c:\windows\apppatch\AppPatch64\AcLayers.dll
2013-04-13 05:49 . 2013-05-14 17:10 308736 ----a-w- c:\windows\apppatch\AppPatch64\AcGenral.dll
2013-04-13 05:49 . 2013-05-14 17:10 111104 ----a-w- c:\windows\apppatch\AppPatch64\acspecfc.dll
2013-04-13 04:45 . 2013-05-14 17:10 474624 ----a-w- c:\windows\apppatch\AcSpecfc.dll
2013-04-13 04:45 . 2013-05-14 17:10 2176512 ----a-w- c:\windows\apppatch\AcGenral.dll
2013-04-12 14:45 . 2013-04-23 17:12 1656680 ----a-w- c:\windows\system32\drivers\ntfs.sys
2011-11-07 16:02 . 2011-11-07 16:02 543000 ----a-w- c:\program files\TunaticSetup.exe
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP]
@="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}"
[HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}]
2009-09-10 13:41 120104 ----a-w- c:\program files (x86)\EgisTec\MyWinLocker 3\x86\PSDProtect.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-11-18 39408]
"DAEMON Tools Lite"="c:\program files (x86)\DAEMON Tools Lite\daemon.exe" [2009-04-23 691656]
"Logitech Vid"="c:\program files (x86)\Logitech\Vid HD\Vid.exe" [2011-01-13 6129496]
"Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2013-06-03 19603048]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"JMB36X IDE Setup"="c:\windows\RaidTool\xInsIDE.exe" [2007-03-20 36864]
"BackupManagerTray"="c:\program files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe" [2009-08-12 261888]
"Hotkey Utility"="c:\program files (x86)\Acer\Hotkey Utility\HotkeyUtility.exe" [2009-08-18 629280]
"EgisTecLiveUpdate"="c:\program files (x86)\EgisTec Egis Software Update\EgisUpdate.exe" [2009-08-04 199464]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-09-25 98304]
"amd_dc_opt"="c:\program files (x86)\AMD\Dual-Core Optimizer\amd_dc_opt.exe" [2008-07-22 77824]
"LogMeIn Hamachi Ui"="c:\program files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe" [2011-08-04 1955208]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2012-08-09 348664]
"BigDogPath"="c:\windows\ZSSnp211.exe" [2007-04-06 57344]
"LWS"="c:\program files (x86)\Logitech\LWS\Webcam Software\LWS.exe" [2011-11-11 205336]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-02-20 59240]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2012-04-18 421888]
"PDFPrint"="c:\program files (x86)\PDF24\pdf24.exe" [2013-02-19 162856]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-04-04 958576]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2013-03-12 253816]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
cv act sc interface RegisterTool.lnk - c:\program files (x86)\cv cryptovision\cv act sc interface\RegisterTool.exe [2012-8-14 8224256]
SmartCopy.lnk - c:\program files (x86)\Northstar\SmartCopy\SmartCopy.exe [2010-2-19 319488]
SmartLauncher.lnk - c:\program files (x86)\Northstar\SmartLauncher\SmartLauncher.exe [2010-2-19 53760]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
R1 SBRE;SBRE;c:\windows\system32\drivers\SBREdrv.sys;c:\windows\SYSNATIVE\drivers\SBREdrv.sys [x]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 IOPort;IOPort;c:\windows\system32\DRIVERS\IOPORT.SYS;c:\windows\SYSNATIVE\DRIVERS\IOPORT.SYS [x]
R2 ir16_32;Intel Indeo(N) service;c:\windows\System32\svchost.exe;c:\windows\SYSNATIVE\svchost.exe [x]
R2 KBDMAI;Virtual keyboard 32-bit service;c:\windows\System32\svchost.exe;c:\windows\SYSNATIVE\svchost.exe [x]
R2 KMService;KMService;c:\windows\system32\srvany.exe;c:\windows\SYSNATIVE\srvany.exe [x]
R2 Skype C2C Service;Skype C2C Service;c:\programdata\Skype\Toolbars\Skype C2C Service\c2c_service.exe;c:\programdata\Skype\Toolbars\Skype C2C Service\c2c_service.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R2 Updater Service;Updater Service;c:\program files\Acer\Acer Updater\UpdaterService.exe;c:\program files\Acer\Acer Updater\UpdaterService.exe [x]
R3 libusb0;LibUsb-Win32 - Kernel Driver 03/20/2007, 0.1.12.1;c:\windows\system32\DRIVERS\libusb0.sys;c:\windows\SYSNATIVE\DRIVERS\libusb0.sys [x]
R3 LVRS64;Logitech RightSound Filter Driver;c:\windows\system32\DRIVERS\lvrs64.sys;c:\windows\SYSNATIVE\DRIVERS\lvrs64.sys [x]
R3 LVUVC64;Logitech HD Webcam C270(UVC);c:\windows\system32\DRIVERS\lvuvc64.sys;c:\windows\SYSNATIVE\DRIVERS\lvuvc64.sys [x]
R3 MWLService;MyWinLocker Service;c:\program files (x86)\EgisTec\MyWinLocker 3\x86\\MWLService.exe;c:\program files (x86)\EgisTec\MyWinLocker 3\x86\\MWLService.exe [x]
R3 S3XXx64;SCR3xx USB SmartCardReader64;c:\windows\system32\DRIVERS\S3XXx64.sys;c:\windows\SYSNATIVE\DRIVERS\S3XXx64.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TurboBoost;TurboBoost;c:\program files\Intel\TurboBoost\TurboBoost.exe;c:\program files\Intel\TurboBoost\TurboBoost.exe [x]
R3 VSPerfDrv100;Performance Tools Driver 10.0;c:\program files (x86)\Microsoft Visual Studio 10.0\Team Tools\Performance Tools\x64\VSPerfDrv100.sys;c:\program files (x86)\Microsoft Visual Studio 10.0\Team Tools\Performance Tools\x64\VSPerfDrv100.sys [x]
R3 vvftav211;vvftav211;c:\windows\system32\drivers\vvftav211.sys;c:\windows\SYSNATIVE\drivers\vvftav211.sys [x]
R3 ZSMC30x;USB PC Camera Service ZSMC30x;c:\windows\system32\Drivers\ZS211.sys;c:\windows\SYSNATIVE\Drivers\ZS211.sys [x]
S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys;c:\windows\SYSNATIVE\Drivers\sptd.sys [x]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys;c:\windows\SYSNATIVE\DRIVERS\avkmgr.sys [x]
S1 mwlPSDFilter;mwlPSDFilter;c:\windows\system32\DRIVERS\mwlPSDFilter.sys;c:\windows\SYSNATIVE\DRIVERS\mwlPSDFilter.sys [x]
S1 mwlPSDNServ;mwlPSDNServ;c:\windows\system32\DRIVERS\mwlPSDNServ.sys;c:\windows\SYSNATIVE\DRIVERS\mwlPSDNServ.sys [x]
S1 mwlPSDVDisk;mwlPSDVDisk;c:\windows\system32\DRIVERS\mwlPSDVDisk.sys;c:\windows\SYSNATIVE\DRIVERS\mwlPSDVDisk.sys [x]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe;c:\windows\SYSNATIVE\atiesrxx.exe [x]
S2 AntiVirSchedulerService;Avira Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [x]
S2 Greg_Service;GRegService;c:\program files (x86)\Acer\Registration\GregHSRW.exe;c:\program files (x86)\Acer\Registration\GregHSRW.exe [x]
S2 Hamachi2Svc;LogMeIn Hamachi Tunneling Engine;c:\program files (x86)\LogMeIn Hamachi\hamachi-2.exe;c:\program files (x86)\LogMeIn Hamachi\hamachi-2.exe [x]
S2 NTI IScheduleSvc;NTI IScheduleSvc;c:\program files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe;c:\program files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe [x]
S2 PDF Architect Helper Service;PDF Architect Helper Service;c:\program files (x86)\PDF Architect\HelperService.exe;c:\program files (x86)\PDF Architect\HelperService.exe [x]
S2 PDF Architect Service;PDF Architect Service;c:\program files (x86)\PDF Architect\ConversionService.exe;c:\program files (x86)\PDF Architect\ConversionService.exe [x]
S2 TurboB;Turbo Boost UI Monitor driver;c:\windows\system32\DRIVERS\TurboB.sys;c:\windows\SYSNATIVE\DRIVERS\TurboB.sys [x]
S2 UMVPFSrv;UMVPFSrv;c:\program files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exe;c:\program files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exe [x]
S2 UNS;Intel(R) Management & Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [x]
S2 USBS3S4Detection;USBS3S4Detection;c:\oem\USBDECTION\USBS3S4Detection.exe;c:\oem\USBDECTION\USBS3S4Detection.exe [x]
S3 e1kexpress;Intel(R) PRO/1000 PCI Express Network Connection Driver K;c:\windows\system32\DRIVERS\e1k62x64.sys;c:\windows\SYSNATIVE\DRIVERS\e1k62x64.sys [x]
S3 HECIx64;Intel(R) Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys;c:\windows\SYSNATIVE\DRIVERS\HECIx64.sys [x]
.
.
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
KBDMAI
ir16_32
.
Inhalt des "geplante Tasks" Ordners
.
2013-07-09 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-04 22:04]
.
2013-07-09 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-03-17 20:19]
.
2013-07-09 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-03-17 20:19]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP]
@="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}"
[HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}]
2009-09-10 13:44 137512 ----a-w- c:\program files (x86)\EgisTec\MyWinLocker 3\x64\PSDProtect.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"mwlDaemon"="c:\program files (x86)\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe" [2009-09-10 349480]
"IAAnotif"="c:\program files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2009-10-13 186904]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2009-10-28 8312352]
"AdobeAAMUpdater-1.0"="c:\program files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2010-03-06 500208]
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.yandex.ru/?win=49&clid=48577
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: &??????? ? Microsoft Excel - c:\progra~2\MICROS~1\OFFICE11\EXCEL.EXE/3000
IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~1\Office14\EXCEL.EXE/3000
IE: Se&nd to OneNote - c:\progra~2\MICROS~1\Office14\ONBttnIE.dll/105
TCP: Interfaces\{10fe83d3-bb31-414d-82d3-68ddfb66bf40}: NameServer = 193.189.250.101 193.189.250.100
FF - ProfilePath - c:\users\Vladimir\AppData\Roaming\Mozilla\Firefox\Profiles\mvbfgt6t.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.google.de/firefox?client=firefox-a&rls=org.mozilla:de:official
FF - prefs.js: network.proxy.ftp - 109.207.61.182
FF - prefs.js: network.proxy.ftp_port - 8090
FF - prefs.js: network.proxy.http - 109.207.61.182
FF - prefs.js: network.proxy.http_port - 8090
FF - prefs.js: network.proxy.socks - 109.207.61.182
FF - prefs.js: network.proxy.socks_port - 8090
FF - prefs.js: network.proxy.ssl - 109.207.61.182
FF - prefs.js: network.proxy.ssl_port - 8090
FF - prefs.js: network.proxy.type - 0
FF - ExtSQL: 2013-05-25 14:03; battlefieldplay4free@ea.com; c:\users\Vladimir\AppData\Roaming\Mozilla\Firefox\Profiles\mvbfgt6t.default\extensions\battlefieldplay4free@ea.com
FF - ExtSQL: 2013-07-03 19:20; {2A4702A6-63E6-46E4-BEF3-E2769B6774A0}; c:\users\Vladimir\AppData\Roaming\Mozilla\Firefox\Profiles\mvbfgt6t.default\extensions\{2A4702A6-63E6-46E4-BEF3-E2769B6774A0}
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Toolbar-Locked - (no file)
SafeBoot-mcmscsvc
SafeBoot-MCODS
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
Toolbar-Locked - (no file)
WebBrowser-{51A86BB3-6602-4C85-92A5-130EE4864F13} - (no file)
AddRemove-Grand Theft Auto - Vice City - d:\games\Grand Theft Auto - Vice City\UNWISE.EXE
AddRemove-QipGuard - c:\users\Vladimir\AppData\Roaming\QipGuard\QipGuard.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\S-1-5-21-2921061897-715250580-3416074679-1000\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
@Allowed: (Read) (RestrictedCode)
"??"=hex:0d,93,4e,66,33,db,27,79,3e,ba,e6,16,c5,75,2c,d1,b6,c1,6a,2d,6d,9a,e8,
ab,9f,a2,7a,33,98,b3,22,41,bb,e6,4b,6d,14,a0,aa,5e,31,69,5b,1c,74,69,ba,6c,\
"??"=hex:56,1b,0f,dc,29,18,f7,c7,b9,ae,a1,c8,ff,45,e4,24
.
[HKEY_USERS\S-1-5-21-2921061897-715250580-3416074679-1000\Software\SecuROM\License information*]
"datasecu"=hex:31,9a,ed,d4,77,33,a9,0d,51,b5,7f,d3,a2,26,4a,84,1f,7a,9d,2b,19,
14,a6,b7,be,33,1e,ee,f3,f0,89,a6,c1,1e,62,24,fb,76,13,24,c5,84,6e,98,67,45,\
"rkeysecu"=hex:9d,24,be,4d,b7,a6,04,58,43,3d,d1,7d,6e,2e,e4,d3
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_7_700_224_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_7_700_224_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_7_700_224_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_7_700_224_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
@Denied: (A) (Everyone)
"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B9A09F18-45AB-4F09-A117-A4ADDA8FA8C8}]
@Denied: (A) (Everyone)
"Solution"="{36eb6792-3a29-43b3-8cd0-f67d266fb426}"
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane\0]
"Key"="ActionsPane"
"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\8.0\\ActionsPane.xsd"
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
"Key"="ActionsPane3"
"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2013-07-09 20:20:10
ComboFix-quarantined-files.txt 2013-07-09 18:20
.
Vor Suchlauf: 22 Verzeichnis(se), 370.592.706.560 Bytes frei
Nach Suchlauf: 28 Verzeichnis(se), 369.632.833.536 Bytes frei
.
- - End Of File - - 3BB796C3E55A1CE4239C2DC345FCFA15
A36C5E4F47E84449FF07ED3517B43A31 übrigens, so wie es aussieht hat Combofix auch einiges gelöscht, oder?
Unter "Weitere Löschungen" sind so einige Toolbar-dateien aufgelistet. Waren die möglicherweise für mein Problem zuständig? EDIT: hmm, wie ich sehe eher nicht. Das Problem ist immer noch da :) |