Hallo und entschuldigung das es so lange gedauert hat,
hier die combofix.txt Code:
ComboFix 14-04-20.01 - Elethor 25.04.2014 14:20:19.1.2 - x64
Microsoft Windows 7 Enterprise 6.1.7601.1.1252.49.1031.18.4096.2668 [GMT 2:00]
ausgeführt von:: c:\users\Elethor\Desktop\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {4D041356-F94D-285F-8768-AAE50FA36859}
FW: COMODO Firewall *Disabled* {8F7746F7-FE68-E084-3B6C-7404A51E8FB3}
SP: Avira Desktop *Disabled/Updated* {F665F2B2-DF77-27D1-BDD8-9197742422E4}
SP: COMODO Antivirus *Disabled/Outdated* {0C2D2636-923D-EE52-2A83-E643204A8275}
SP: Spybot - Search and Destroy *Enabled/Updated* {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}
SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
D:\install.exe
.
.
((((((((((((((((((((((((((((((((((((((( Treiber/Dienste )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_NPF
.
.
((((((((((((((((((((((( Dateien erstellt von 2014-03-25 bis 2014-04-25 ))))))))))))))))))))))))))))))
.
.
2014-04-25 12:31 . 2014-04-25 12:31 -------- d-----w- c:\users\Default\AppData\Local\temp
2014-04-19 17:50 . 2014-04-20 01:25 -------- d-----w- c:\users\Elethor\AppData\Local\CrashDumps
2014-04-18 15:31 . 2014-04-14 18:13 96168 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll
2014-04-17 17:23 . 2014-04-17 17:23 -------- d-sh--w- c:\users\Elethor\AppData\Local\EmieUserList
2014-04-17 17:23 . 2014-04-17 17:23 -------- d-sh--w- c:\users\Elethor\AppData\Local\EmieSiteList
2014-04-17 17:03 . 2014-04-21 13:06 -------- d-----w- C:\FRST
2014-04-17 16:36 . 2014-04-17 16:36 -------- d-----w- c:\program files (x86)\ESET
2014-04-12 13:19 . 2014-04-12 13:19 -------- d-----w- c:\windows\ERUNT
2014-04-12 11:29 . 2014-04-12 11:29 -------- d-----w- c:\program files\SiSoftware
2014-04-11 22:45 . 2014-04-11 22:47 -------- d-----w- C:\AdwCleaner
2014-04-11 22:12 . 2014-04-11 22:12 -------- d-----w- c:\program files (x86)\NirSoft
2014-04-11 12:49 . 2012-01-10 12:28 750488 ----a-w- c:\windows\system32\npDeployJava1.dll
2014-04-11 12:49 . 2012-01-10 12:28 660368 ----a-w- c:\windows\system32\deployJava1.dll
2014-04-10 17:52 . 2014-04-24 21:57 119512 ----a-w- c:\windows\system32\drivers\MBAMSwissArmy.sys
2014-04-10 17:51 . 2014-04-03 07:51 63192 ----a-w- c:\windows\system32\drivers\mwac.sys
2014-04-10 17:51 . 2014-04-03 07:51 88280 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys
2014-04-10 17:51 . 2014-04-10 17:51 -------- d-----w- c:\program files (x86)\Malwarebytes Anti-Malware
2014-04-10 17:16 . 2014-03-06 06:00 359936 ----a-w- c:\program files\Internet Explorer\IEShims.dll
2014-04-10 17:16 . 2014-03-06 05:50 257536 ----a-w- c:\program files (x86)\Internet Explorer\IEShims.dll
2014-04-10 17:16 . 2014-03-06 08:32 574976 ----a-w- c:\windows\system32\ieui.dll
2014-04-10 17:07 . 2014-03-04 09:44 243712 ----a-w- c:\windows\system32\wow64.dll
2014-04-10 17:07 . 2014-03-04 09:44 1163264 ----a-w- c:\windows\system32\kernel32.dll
2014-04-10 17:07 . 2014-03-04 09:44 362496 ----a-w- c:\windows\system32\wow64win.dll
2014-04-10 17:07 . 2014-03-04 09:44 13312 ----a-w- c:\windows\system32\wow64cpu.dll
2014-04-10 17:07 . 2014-03-04 09:44 16384 ----a-w- c:\windows\system32\ntvdm64.dll
2014-04-10 17:07 . 2014-03-04 09:17 14336 ----a-w- c:\windows\SysWow64\ntvdm64.dll
2014-04-10 17:07 . 2014-03-04 09:16 25600 ----a-w- c:\windows\SysWow64\setup16.exe
2014-04-10 17:07 . 2014-03-04 09:16 5120 ----a-w- c:\windows\SysWow64\wow32.dll
2014-04-10 17:07 . 2014-03-04 08:09 7680 ----a-w- c:\windows\SysWow64\instnm.exe
2014-04-10 17:07 . 2014-03-04 08:09 2048 ----a-w- c:\windows\SysWow64\user.exe
2014-04-06 21:38 . 2014-04-06 21:38 -------- d-----w- c:\users\Elethor\AppData\Roaming\Trine2
2014-04-06 19:38 . 2014-04-06 19:38 -------- d-----w- c:\program files (x86)\Trend Micro
2014-04-04 22:42 . 2014-04-06 21:36 -------- d-----w- c:\users\Elethor\AppData\Roaming\Comodo
2014-04-04 22:41 . 2014-04-04 22:41 -------- d-----w- c:\programdata\Shared Space
2014-04-04 22:40 . 2014-03-25 19:22 45784 ----a-w- c:\windows\system32\cmdkbd64.dll
2014-04-04 22:40 . 2014-03-25 19:22 40664 ----a-w- c:\windows\SysWow64\cmdkbd32.dll
2014-04-04 22:40 . 2014-03-25 19:22 352984 ----a-w- c:\windows\system32\cmdvrt64.dll
2014-04-04 22:40 . 2014-03-25 19:22 284888 ----a-w- c:\windows\SysWow64\cmdvrt32.dll
2014-03-29 18:40 . 2014-03-29 18:40 -------- d-----w- c:\program files (x86)\Common Files\Skype
2014-03-29 18:40 . 2014-03-29 18:40 -------- d-----r- c:\program files (x86)\Skype
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-04-16 21:12 . 2011-10-07 17:48 105552 ----a-w- c:\windows\system32\drivers\inspect.sys
2014-04-16 21:12 . 2011-10-07 17:47 48360 ----a-w- c:\windows\system32\drivers\cmdhlp.sys
2014-04-16 21:12 . 2011-10-07 17:47 738472 ----a-w- c:\windows\system32\drivers\cmdGuard.sys
2014-04-16 21:12 . 2011-10-07 17:47 23168 ----a-w- c:\windows\system32\drivers\cmderd.sys
2014-04-11 11:25 . 2014-02-07 19:28 70832 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2014-04-11 11:25 . 2014-02-07 19:28 692400 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2014-04-10 17:09 . 2011-03-08 19:49 90655440 ----a-w- c:\windows\system32\MRT.exe
2014-04-03 07:50 . 2012-12-09 18:38 25816 ----a-w- c:\windows\system32\drivers\mbam.sys
2014-03-30 22:40 . 2011-11-06 07:23 290184 ----a-w- c:\windows\SysWow64\PnkBstrB.xtr
2014-03-30 22:40 . 2011-11-06 05:59 290184 ----a-w- c:\windows\SysWow64\PnkBstrB.exe
2014-03-30 22:40 . 2011-11-06 05:59 280904 ----a-w- c:\windows\SysWow64\PnkBstrB.ex0
2014-03-28 00:52 . 2011-11-06 05:59 76888 ----a-w- c:\windows\SysWow64\PnkBstrA.exe
2014-03-25 19:22 . 2011-10-07 17:47 43216 ----a-w- c:\windows\system32\cmdcsr.dll
2014-03-25 19:22 . 2011-10-07 17:47 363504 ----a-w- c:\windows\SysWow64\guard32.dll
2014-03-25 19:22 . 2011-10-07 17:47 453680 ----a-w- c:\windows\system32\guard64.dll
2014-03-04 09:17 . 2014-04-10 17:07 44032 ----a-w- c:\windows\apppatch\acwow64.dll
2014-02-07 01:23 . 2014-03-12 23:39 3156480 ----a-w- c:\windows\system32\win32k.sys
2014-02-04 02:32 . 2014-03-12 23:38 624128 ----a-w- c:\windows\system32\qedit.dll
2014-02-04 02:04 . 2014-03-12 23:38 509440 ----a-w- c:\windows\SysWow64\qedit.dll
2014-01-29 02:32 . 2014-03-12 23:39 484864 ----a-w- c:\windows\system32\wer.dll
2014-01-29 02:06 . 2014-03-12 23:39 381440 ----a-w- c:\windows\SysWow64\wer.dll
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\0_AeroFSShellExtension]
@="{882108B6-26E6-4926-BC70-EA1D738D5DEB}"
[HKEY_CLASSES_ROOT\CLSID\{882108B6-26E6-4926-BC70-EA1D738D5DEB}]
2014-03-26 20:25 623104 ----a-w- c:\users\Elethor\AppData\Roaming\AeroFSExec\v_0.8.22\AeroFSShellExt32.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\1_AeroFSShellExtension]
@="{882108B1-26E6-4926-BC70-EA1D738D5DEB}"
[HKEY_CLASSES_ROOT\CLSID\{882108B1-26E6-4926-BC70-EA1D738D5DEB}]
2014-03-26 20:25 623104 ----a-w- c:\users\Elethor\AppData\Roaming\AeroFSExec\v_0.8.22\AeroFSShellExt32.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\2_AeroFSShellExtension]
@="{882108B2-26E6-4926-BC70-EA1D738D5DEB}"
[HKEY_CLASSES_ROOT\CLSID\{882108B2-26E6-4926-BC70-EA1D738D5DEB}]
2014-03-26 20:25 623104 ----a-w- c:\users\Elethor\AppData\Roaming\AeroFSExec\v_0.8.22\AeroFSShellExt32.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\3_AeroFSShellExtension]
@="{882108B3-26E6-4926-BC70-EA1D738D5DEB}"
[HKEY_CLASSES_ROOT\CLSID\{882108B3-26E6-4926-BC70-EA1D738D5DEB}]
2014-03-26 20:25 623104 ----a-w- c:\users\Elethor\AppData\Roaming\AeroFSExec\v_0.8.22\AeroFSShellExt32.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\5_AeroFSShellExtension]
@="{882108B5-26E6-4926-BC70-EA1D738D5DEB}"
[HKEY_CLASSES_ROOT\CLSID\{882108B5-26E6-4926-BC70-EA1D738D5DEB}]
2014-03-26 20:25 623104 ----a-w- c:\users\Elethor\AppData\Roaming\AeroFSExec\v_0.8.22\AeroFSShellExt32.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-21 1475584]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"AMD AVT"="start AMD Accelerated Video Transcoding device initialization" [X]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2014-02-20 689744]
"SDTray"="c:\program files (x86)\Spybot - Search & Destroy 2\SDTray.exe" [2013-07-25 5624784]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2013-04-29 642304]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2013-07-02 254336]
.
c:\users\Elethor\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Mozilla Thunderbird.lnk - c:\program files (x86)\Mozilla Thunderbird\thunderbird.exe [2014-3-19 390256]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0\0sdnclean64.exe
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\hitmanpro37]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\hitmanpro37.sys]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\HitmanPro37Crusader]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\HitmanPro37CrusaderBoot]
@=""
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\run-]
"RUSB3MON"="c:\program files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\rusb3mon.exe"
"BlueStacks Agent"=c:\program files (x86)\BlueStacks\HD-Agent.exe
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes Anti-Malware\mbamservice.exe;c:\program files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys;c:\windows\SYSNATIVE\drivers\AtihdW76.sys [x]
R3 BEService;BattlEye Service;c:\program files (x86)\Common Files\BattlEye\BEService.exe;c:\program files (x86)\Common Files\BattlEye\BEService.exe [x]
R3 cmdvirth;COMODO Virtual Service Manager;c:\program files\COMODO\COMODO Internet Security\cmdvirth.exe;c:\program files\COMODO\COMODO Internet Security\cmdvirth.exe [x]
R3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys;c:\windows\SYSNATIVE\drivers\dmvsc.sys [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 MBAMWebAccessControl;MBAMWebAccessControl;c:\windows\system32\drivers\mwac.sys;c:\windows\SYSNATIVE\drivers\mwac.sys [x]
R3 MotioninJoyXFilter;MotioninJoy Virtual Xinput device Filter Driver;c:\windows\system32\DRIVERS\MijXfilt.sys;c:\windows\SYSNATIVE\DRIVERS\MijXfilt.sys [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]
R3 SandraAgentSrv;SiSoftware Deployment Agent Service;c:\program files\SiSoftware\SiSoftware Sandra Lite 2014.SP1c\RpcAgentSrv.exe;c:\program files\SiSoftware\SiSoftware Sandra Lite 2014.SP1c\RpcAgentSrv.exe [x]
R3 Synth3dVsc;Microsoft Virtual 3D Video Transport Driver;c:\windows\system32\drivers\Synth3dVsc.sys;c:\windows\SYSNATIVE\drivers\Synth3dVsc.sys [x]
R3 terminpt;Microsoft Remote Desktop Input Driver;c:\windows\system32\drivers\terminpt.sys;c:\windows\SYSNATIVE\drivers\terminpt.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
R3 tsusbhub;Remote Deskotop USB Hub;c:\windows\system32\drivers\tsusbhub.sys;c:\windows\SYSNATIVE\drivers\tsusbhub.sys [x]
R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys;c:\windows\SYSNATIVE\drivers\rdvgkmd.sys [x]
R4 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe;c:\windows\SYSNATIVE\atiesrxx.exe [x]
R4 sptd;sptd;c:\windows\\SystemRoot\System32\Drivers\sptd.sys;c:\windows\\SystemRoot\System32\Drivers\sptd.sys [x]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys;c:\windows\SYSNATIVE\DRIVERS\avkmgr.sys [x]
S1 cmdGuard;COMODO Internet Security Sandbox Driver;c:\windows\system32\DRIVERS\cmdguard.sys;c:\windows\SYSNATIVE\DRIVERS\cmdguard.sys [x]
S1 cmdHlp;COMODO Internet Security Helper Driver;c:\windows\system32\DRIVERS\cmdhlp.sys;c:\windows\SYSNATIVE\DRIVERS\cmdhlp.sys [x]
S2 AntiVirSchedulerService;Avira Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [x]
S2 DirMngr;DirMngr;c:\program files (x86)\GNU\GnuPG\dirmngr.exe;c:\program files (x86)\GNU\GnuPG\dirmngr.exe [x]
S2 Garmin Core Update Service;Garmin Core Update Service;c:\program files (x86)\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe;c:\program files (x86)\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe [x]
S2 mbamchameleon;mbamchameleon;c:\windows\system32\drivers\mbamchameleon.sys;c:\windows\SYSNATIVE\drivers\mbamchameleon.sys [x]
S2 MBAMScheduler;MBAMScheduler;c:\program files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe;c:\program files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [x]
S2 SDScannerService;Spybot-S&D 2 Scanner Service;c:\program files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe;c:\program files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [x]
S2 SDUpdateService;Spybot-S&D 2 Updating Service;c:\program files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe;c:\program files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [x]
S2 SDWSCService;Spybot-S&D 2 Security Center Service;c:\program files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe;c:\program files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [x]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys;c:\windows\SYSNATIVE\drivers\mbam.sys [x]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - WS2IFSL
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\0_AeroFSShellExtension]
@="{882108B6-26E6-4926-BC70-EA1D738D5DEB}"
[HKEY_CLASSES_ROOT\CLSID\{882108B6-26E6-4926-BC70-EA1D738D5DEB}]
2014-03-26 20:25 648192 ----a-w- c:\users\Elethor\AppData\Roaming\AeroFSExec\v_0.8.22\x64\AeroFSShellExt64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\1_AeroFSShellExtension]
@="{882108B1-26E6-4926-BC70-EA1D738D5DEB}"
[HKEY_CLASSES_ROOT\CLSID\{882108B1-26E6-4926-BC70-EA1D738D5DEB}]
2014-03-26 20:25 648192 ----a-w- c:\users\Elethor\AppData\Roaming\AeroFSExec\v_0.8.22\x64\AeroFSShellExt64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\2_AeroFSShellExtension]
@="{882108B2-26E6-4926-BC70-EA1D738D5DEB}"
[HKEY_CLASSES_ROOT\CLSID\{882108B2-26E6-4926-BC70-EA1D738D5DEB}]
2014-03-26 20:25 648192 ----a-w- c:\users\Elethor\AppData\Roaming\AeroFSExec\v_0.8.22\x64\AeroFSShellExt64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\3_AeroFSShellExtension]
@="{882108B3-26E6-4926-BC70-EA1D738D5DEB}"
[HKEY_CLASSES_ROOT\CLSID\{882108B3-26E6-4926-BC70-EA1D738D5DEB}]
2014-03-26 20:25 648192 ----a-w- c:\users\Elethor\AppData\Roaming\AeroFSExec\v_0.8.22\x64\AeroFSShellExt64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\5_AeroFSShellExtension]
@="{882108B5-26E6-4926-BC70-EA1D738D5DEB}"
[HKEY_CLASSES_ROOT\CLSID\{882108B5-26E6-4926-BC70-EA1D738D5DEB}]
2014-03-26 20:25 648192 ----a-w- c:\users\Elethor\AppData\Roaming\AeroFSExec\v_0.8.22\x64\AeroFSShellExt64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"COMODO Internet Security"="c:\program files\COMODO\COMODO Internet Security\cistray.exe" [2014-03-25 1275608]
"EvtMgr6"="c:\program files\Logitech\SetPointP\SetPoint.exe" [2011-10-07 1744152]
"RTHDVCPL"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2013-03-29 13513288]
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://de.yahoo.com?fr=fp-comodo
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyServer = localhost:21320
Trusted Zone: soe.com
Trusted Zone: sony.com
TCP: DhcpNameServer = 192.168.2.1
FF - ProfilePath - c:\users\Elethor\AppData\Roaming\Mozilla\Firefox\Profiles\6ao4ehfq.default\
FF - prefs.js: browser.startup.homepage - about:home
FF - prefs.js: keyword.URL - www.google.de/search?q=
FF - prefs.js: network.proxy.ftp - 95.211.156.222
FF - prefs.js: network.proxy.ftp_port - 7777
FF - prefs.js: network.proxy.gopher - 127.0.0.1
FF - prefs.js: network.proxy.gopher_port - 4001
FF - prefs.js: network.proxy.http - 95.211.156.222
FF - prefs.js: network.proxy.http_port - 7777
FF - prefs.js: network.proxy.socks - 95.211.156.222
FF - prefs.js: network.proxy.socks_port - 7777
FF - prefs.js: network.proxy.ssl - 95.211.156.222
FF - prefs.js: network.proxy.ssl_port - 7777
FF - prefs.js: network.proxy.type - 0
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
ShellIconOverlayIdentifiers-{882108B4-26E6-4926-BC70-EA1D738D5DEB} - (no file)
Notify-LBTWlgn - (no file)
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
ShellIconOverlayIdentifiers-{882108B4-26E6-4926-BC70-EA1D738D5DEB} - (no file)
AddRemove-BattlEye for OA - j:\steamlibrary\steamapps\common\Arma 2 Operation Arrowhead\Expansion\BattlEye\UnInstallBE.exe
AddRemove-{7353BAE6-5E49-46C4-A9B5-8A269A313789} - c:\users\Elethor\AppData\Local\{0691F710-1ECA-4B5A-9727-25554F1BFDC6}\setup.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\S-1-5-21-3937361682-188343742-509953620-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*"29]
@Class="Shell"
.
[HKEY_USERS\S-1-5-21-3937361682-188343742-509953620-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*"29\OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"
.
[HKEY_USERS\S-1-5-21-3937361682-188343742-509953620-1001\Software\SecuROM\License information*]
"datasecu"=hex:ac,b1,aa,c3,c2,b4,dd,2e,da,b3,b0,81,a1,86,41,ec,29,ad,a6,1e,a1,
74,96,0f,d5,a7,79,06,e1,7d,ea,84,d9,d0,77,19,a5,b6,bc,e4,cd,28,78,07,dc,92,\
"rkeysecu"=hex:7d,01,5d,c3,90,da,d8,7d,20,33,f3,f4,a2,3c,74,e9
.
[HKEY_LOCAL_MACHINE\SOFTWARE\COMODO\CIS\Installer\Sym_Cam\CIS]
"SymbolicLinkValue"=hex(6):5c,00,52,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,4f,00,46,00,\
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\cmdAgent\Mode\Configurations]
"SymbolicLinkValue"=hex(6):5c,00,52,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,59,00,53,00,\
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\cmdAgent\Mode\Data]
"SymbolicLinkValue"=hex(6):5c,00,52,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,4f,00,46,00,\
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\cmdAgent\Mode\Options]
"SymbolicLinkValue"=hex(6):5c,00,52,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,4f,00,46,00,\
.
[HKEY_LOCAL_MACHINE\SYSTEM\Software\COMODO\Cam]
"SymbolicLinkValue"=hex(6):5c,00,52,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,4f,00,46,00,\
.
[HKEY_LOCAL_MACHINE\SYSTEM\Software\COMODO\Firewall Pro]
"SymbolicLinkValue"=hex(6):5c,00,52,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,59,00,53,00,\
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
c:\program files (x86)\Avira\AntiVir Desktop\avguard.exe
c:\windows\SysWOW64\PnkBstrA.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2014-04-25 14:41:33 - PC wurde neu gestartet
ComboFix-quarantined-files.txt 2014-04-25 12:41
.
Vor Suchlauf: 14 Verzeichnis(se), 27.251.896.320 Bytes frei
Nach Suchlauf: 17 Verzeichnis(se), 26.657.349.632 Bytes frei
.
- - End Of File - - B09AE0F82F66DF25B3F3D22759DA642C
A36C5E4F47E84449FF07ED3517B43A31
Das programm wurde erst nicht richtig entpackt weil comodo anscheinend trotz beendigung weiterhin zugriffe blockiert hat.
Nachdem ich es dann zum starten bekommen habe waren avira und Spybot noch aktiv die hab ich abgeschaltet, combofix hat sich dann noch über die updateprozesse von spybot beschwert die nicht mit dem programm geschlossen wurden, welche ich dann aber per taskmanager geschlossen habe.
Nach dem neustart wurde in der Combofix konsole kurz "Zugriff verweigert" angezeigt es gab danach aber keinerlei fehlermeldung.
Mfg,
Seleyon |
Malwarebytes Anti-Malware 
AdwCleaner auf deinen Desktop.
SecurityCheck und:
WARNUNG an die MITLESER: 
