| BurneyGumble | 21.10.2014 15:36 |
Hier das Log von Combofix: Code:
ComboFix 14-10-20.01 - ****** ****** 21.10.2014 10:21:02.1.4 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.49.1031.18.8086.5744 [GMT 2:00]
ausgeführt von:: c:\users\****** ******\Desktop\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {4D041356-F94D-285F-8768-AAE50FA36859}
FW: Online Armor Firewall *Disabled* {BD3F5FCA-866B-1E2E-0A68-58900A751EA1}
SP: Avira Desktop *Disabled/Updated* {F665F2B2-DF77-27D1-BDD8-9197742422E4}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Neuer Wiederherstellungspunkt wurde erstellt
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\.ico
c:\programdata\1408009490.bdinstall.bin
c:\programdata\1408013264.bdinstall.bin
c:\programdata\1408015951.bdinstall.bin
c:\programdata\1408038884.bdinstall.bin
c:\users\****** ******\AppData\Local\Temp\_MEI44122\_ctypes.pyd
c:\users\****** ******\AppData\Local\Temp\_MEI44122\_elementtree.pyd
c:\users\****** ******\AppData\Local\Temp\_MEI44122\_hashlib.pyd
c:\users\****** ******\AppData\Local\Temp\_MEI44122\_multiprocessing.pyd
c:\users\****** ******\AppData\Local\Temp\_MEI44122\_socket.pyd
c:\users\****** ******\AppData\Local\Temp\_MEI44122\_ssl.pyd
c:\users\****** ******\AppData\Local\Temp\_MEI44122\hashobjs_ext.pyd
c:\users\****** ******\AppData\Local\Temp\_MEI44122\pyexpat.pyd
c:\users\****** ******\AppData\Local\Temp\_MEI44122\pysqlite2._sqlite.pyd
c:\users\****** ******\AppData\Local\Temp\_MEI44122\python27.dll
c:\users\****** ******\AppData\Local\Temp\_MEI44122\pythoncom27.dll
c:\users\****** ******\AppData\Local\Temp\_MEI44122\PyWinTypes27.dll
c:\users\****** ******\AppData\Local\Temp\_MEI44122\select.pyd
c:\users\****** ******\AppData\Local\Temp\_MEI44122\unicodedata.pyd
c:\users\****** ******\AppData\Local\Temp\_MEI44122\win32api.pyd
c:\users\****** ******\AppData\Local\Temp\_MEI44122\win32com.shell.shell.pyd
c:\users\****** ******\AppData\Local\Temp\_MEI44122\win32crypt.pyd
c:\users\****** ******\AppData\Local\Temp\_MEI44122\win32event.pyd
c:\users\****** ******\AppData\Local\Temp\_MEI44122\win32file.pyd
c:\users\****** ******\AppData\Local\Temp\_MEI44122\win32gui.pyd
c:\users\****** ******\AppData\Local\Temp\_MEI44122\win32inet.pyd
c:\users\****** ******\AppData\Local\Temp\_MEI44122\win32pdh.pyd
c:\users\****** ******\AppData\Local\Temp\_MEI44122\win32pipe.pyd
c:\users\****** ******\AppData\Local\Temp\_MEI44122\win32process.pyd
c:\users\****** ******\AppData\Local\Temp\_MEI44122\win32profile.pyd
c:\users\****** ******\AppData\Local\Temp\_MEI44122\win32security.pyd
c:\users\****** ******\AppData\Local\Temp\_MEI44122\win32ts.pyd
c:\users\****** ******\AppData\Local\Temp\_MEI44122\windows._lib_cacheinvalidation.pyd
c:\users\****** ******\AppData\Local\Temp\_MEI44122\wx._animate.pyd
c:\users\****** ******\AppData\Local\Temp\_MEI44122\wx._controls_.pyd
c:\users\****** ******\AppData\Local\Temp\_MEI44122\wx._core_.pyd
c:\users\****** ******\AppData\Local\Temp\_MEI44122\wx._gdi_.pyd
c:\users\****** ******\AppData\Local\Temp\_MEI44122\wx._html2.pyd
c:\users\****** ******\AppData\Local\Temp\_MEI44122\wx._misc_.pyd
c:\users\****** ******\AppData\Local\Temp\_MEI44122\wx._windows_.pyd
c:\users\****** ******\AppData\Local\Temp\_MEI44122\wx._wizard.pyd
c:\users\****** ******\AppData\Local\Temp\_MEI44122\wxbase294u_net_vc90.dll
c:\users\****** ******\AppData\Local\Temp\_MEI44122\wxbase294u_vc90.dll
c:\users\****** ******\AppData\Local\Temp\_MEI44122\wxmsw294u_adv_vc90.dll
c:\users\****** ******\AppData\Local\Temp\_MEI44122\wxmsw294u_core_vc90.dll
c:\users\****** ******\AppData\Local\Temp\_MEI44122\wxmsw294u_html_vc90.dll
c:\users\****** ******\AppData\Local\Temp\_MEI44122\wxmsw294u_webview_vc90.dll
c:\users\****** ******\AppData\Local\Temp\avgnt.exe\Avira.OE.ExtApi.dll
c:\users\******~1\AppData\Local\Temp\_MEI44122\_ctypes.pyd
c:\users\******~1\AppData\Local\Temp\_MEI44122\_elementtree.pyd
c:\users\******~1\AppData\Local\Temp\_MEI44122\_hashlib.pyd
c:\users\******~1\AppData\Local\Temp\_MEI44122\_multiprocessing.pyd
c:\users\******~1\AppData\Local\Temp\_MEI44122\_socket.pyd
c:\users\******~1\AppData\Local\Temp\_MEI44122\_ssl.pyd
c:\users\******~1\AppData\Local\Temp\_MEI44122\hashobjs_ext.pyd
c:\users\******~1\AppData\Local\Temp\_MEI44122\pyexpat.pyd
c:\users\******~1\AppData\Local\Temp\_MEI44122\pysqlite2._sqlite.pyd
c:\users\******~1\AppData\Local\Temp\_MEI44122\python27.dll
c:\users\******~1\AppData\Local\Temp\_MEI44122\pythoncom27.dll
c:\users\******~1\AppData\Local\Temp\_MEI44122\PyWinTypes27.dll
c:\users\******~1\AppData\Local\Temp\_MEI44122\select.pyd
c:\users\******~1\AppData\Local\Temp\_MEI44122\unicodedata.pyd
c:\users\******~1\AppData\Local\Temp\_MEI44122\win32api.pyd
c:\users\******~1\AppData\Local\Temp\_MEI44122\win32com.shell.shell.pyd
c:\users\******~1\AppData\Local\Temp\_MEI44122\win32crypt.pyd
c:\users\******~1\AppData\Local\Temp\_MEI44122\win32event.pyd
c:\users\******~1\AppData\Local\Temp\_MEI44122\win32file.pyd
c:\users\******~1\AppData\Local\Temp\_MEI44122\win32gui.pyd
c:\users\******~1\AppData\Local\Temp\_MEI44122\win32inet.pyd
c:\users\******~1\AppData\Local\Temp\_MEI44122\win32pdh.pyd
c:\users\******~1\AppData\Local\Temp\_MEI44122\win32pipe.pyd
c:\users\******~1\AppData\Local\Temp\_MEI44122\win32process.pyd
c:\users\******~1\AppData\Local\Temp\_MEI44122\win32profile.pyd
c:\users\******~1\AppData\Local\Temp\_MEI44122\win32security.pyd
c:\users\******~1\AppData\Local\Temp\_MEI44122\win32ts.pyd
c:\users\******~1\AppData\Local\Temp\_MEI44122\windows._lib_cacheinvalidation.pyd
c:\users\******~1\AppData\Local\Temp\_MEI44122\wx._animate.pyd
c:\users\******~1\AppData\Local\Temp\_MEI44122\wx._controls_.pyd
c:\users\******~1\AppData\Local\Temp\_MEI44122\wx._core_.pyd
c:\users\******~1\AppData\Local\Temp\_MEI44122\wx._gdi_.pyd
c:\users\******~1\AppData\Local\Temp\_MEI44122\wx._html2.pyd
c:\users\******~1\AppData\Local\Temp\_MEI44122\wx._misc_.pyd
c:\users\******~1\AppData\Local\Temp\_MEI44122\wx._windows_.pyd
c:\users\******~1\AppData\Local\Temp\_MEI44122\wx._wizard.pyd
c:\users\******~1\AppData\Local\Temp\_MEI44122\wxbase294u_net_vc90.dll
c:\users\******~1\AppData\Local\Temp\_MEI44122\wxbase294u_vc90.dll
c:\users\******~1\AppData\Local\Temp\_MEI44122\wxmsw294u_adv_vc90.dll
c:\users\******~1\AppData\Local\Temp\_MEI44122\wxmsw294u_core_vc90.dll
c:\users\******~1\AppData\Local\Temp\_MEI44122\wxmsw294u_html_vc90.dll
c:\users\******~1\AppData\Local\Temp\_MEI44122\wxmsw294u_webview_vc90.dll
c:\users\******~1\AppData\Local\Temp\avgnt.exe\Avira.OE.ExtApi.dll
.
.
((((((((((((((((((((((( Dateien erstellt von 2014-09-21 bis 2014-10-21 ))))))))))))))))))))))))))))))
.
.
2014-10-21 08:43 . 2014-10-21 08:43 -------- d-----w- c:\users\Public\AppData\Local\temp
2014-10-21 08:43 . 2014-10-21 08:43 -------- d-----w- c:\users\postgres\AppData\Local\temp
2014-10-21 08:43 . 2014-10-21 08:43 -------- d-----w- c:\users\postgres.************\AppData\Local\temp
2014-10-21 08:43 . 2014-10-21 08:43 -------- d-----w- c:\users\****** - Admin\AppData\Local\temp
2014-10-21 08:43 . 2014-10-21 08:43 -------- d-----w- c:\users\Default\AppData\Local\temp
2014-10-21 07:28 . 2014-10-21 07:30 -------- d-----w- C:\FRST
2014-10-01 14:18 . 2014-09-25 02:08 371712 ----a-w- c:\windows\system32\qdvd.dll
2014-10-01 14:18 . 2014-09-25 01:40 519680 ----a-w- c:\windows\SysWow64\qdvd.dll
2014-09-30 15:20 . 2013-12-19 09:57 482424 ----a-w- c:\windows\prinst.exe
2014-09-30 15:20 . 2013-12-19 10:15 151856 ----a-w- c:\windows\system32\Spool\prtprocs\x64\NetFaxProc64.dll
2014-09-30 15:20 . 2013-12-19 10:15 284464 ----a-w- c:\windows\system32\NetFaxPort64.dll
2014-09-30 15:20 . 2013-12-19 10:15 222000 ----a-w- c:\windows\SysWow64\NetFaxPort.dll
2014-09-30 15:19 . 2014-09-30 15:19 -------- d-----w- c:\program files (x86)\Common Files\Scan Process Machine
2014-09-30 15:19 . 2014-09-30 15:19 -------- d-----w- c:\program files\Common Files\Common Desktop Agent
2014-09-30 15:19 . 2014-09-30 15:19 -------- d-----w- c:\program files (x86)\Common Files\Common Desktop Agent
2014-09-30 15:19 . 2014-09-30 15:19 -------- d-----w- c:\users\****** ******\AppData\Roaming\Samsung
2014-09-30 15:17 . 2014-09-30 15:20 -------- d-----w- c:\program files (x86)\Samsung
2014-09-30 15:17 . 2013-11-28 08:25 91136 ------w- c:\windows\system32\ssdevm64.dll
2014-09-30 15:17 . 2013-11-28 08:25 94208 ------w- c:\windows\SysWow64\ssdevm.dll
2014-09-28 15:58 . 2014-09-28 15:58 -------- d-----w- c:\users\****** ******\AppData\Roaming\TuneUp Software
2014-09-28 15:58 . 2014-09-28 15:58 -------- d-----w- c:\users\****** ******\AppData\Local\TuneUp Software
2014-09-28 15:58 . 2014-09-28 15:59 -------- d-----w- c:\programdata\TuneUp Software
2014-09-28 15:58 . 2014-09-28 15:58 -------- d-sh--w- c:\programdata\{FE8D473A-6F06-4F99-B5F4-BED72B2A038C}
2014-09-28 15:58 . 2014-09-28 15:58 -------- d--h--w- c:\programdata\Common Files
2014-09-28 15:58 . 2014-09-28 15:58 -------- d-----w- c:\users\****** ******\AppData\Roaming\RHEng
2014-09-28 15:56 . 2011-05-13 10:16 493056 ----a-w- c:\windows\SysWow64\dhRichClient3.dll
2014-09-28 15:56 . 2011-03-25 18:42 338432 ----a-w- c:\windows\SysWow64\sqlite36_engine.dll
2014-09-24 07:46 . 2014-09-09 22:11 2048 ----a-w- c:\windows\system32\tzres.dll
2014-09-24 07:46 . 2014-09-09 21:47 2048 ----a-w- c:\windows\SysWow64\tzres.dll
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-10-15 22:08 . 2012-12-02 15:16 103265616 ----a-w- c:\windows\system32\MRT.exe
2014-10-14 12:57 . 2014-08-15 21:13 43064 ----a-w- c:\windows\system32\drivers\avnetflt.sys
2014-10-14 12:57 . 2014-08-15 21:12 131608 ----a-w- c:\windows\system32\drivers\avipbb.sys
2014-10-14 12:57 . 2014-08-15 21:12 119272 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2014-10-11 13:44 . 2014-08-05 09:39 122584 ----a-w- c:\windows\system32\drivers\MBAMSwissArmy.sys
2014-09-25 22:16 . 2012-12-01 16:22 71344 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2014-09-25 22:16 . 2012-12-01 16:22 701104 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2014-09-09 07:31 . 2014-09-09 08:00 166384 ----a-w- c:\windows\system32\drivers\psmounterex.sys
2014-08-23 02:07 . 2014-08-28 07:14 404480 ----a-w- c:\windows\system32\gdi32.dll
2014-08-23 01:45 . 2014-08-28 07:14 311808 ----a-w- c:\windows\SysWow64\gdi32.dll
2014-08-14 09:45 . 2014-08-14 09:45 0 ----a-w- c:\windows\system32\BDSandBoxUISkin32.dll
2014-08-14 09:45 . 2014-08-14 09:45 0 ----a-w- c:\windows\system32\BDSandBoxUISkin.dll
2014-08-14 09:45 . 2014-08-14 09:45 0 ----a-w- c:\windows\system32\BDSandBoxUH.dll
2014-08-01 11:53 . 2014-09-10 07:20 1031168 ----a-w- c:\windows\system32\TSWorkspace.dll
2014-08-01 11:35 . 2014-09-10 07:20 793600 ----a-w- c:\windows\SysWow64\TSWorkspace.dll
2014-07-25 00:35 . 2014-07-25 00:35 875688 ----a-w- c:\windows\SysWow64\msvcr120_clr0400.dll
2014-07-24 21:47 . 2014-07-24 21:47 869544 ----a-w- c:\windows\system32\msvcr120_clr0400.dll
2014-07-23 11:29 . 2014-08-15 21:12 28600 ----a-w- c:\windows\system32\drivers\avkmgr.sys
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WinPatrol"="c:\program files (x86)\BillP Studios\WinPatrol\winpatrol.exe" [2013-12-10 455744]
"f.lux"="c:\users\****** ******\AppData\Local\FluxSoftware\Flux\flux.exe" [2013-10-23 1017224]
"GoogleDriveSync"="c:\program files (x86)\Google\Drive\googledrivesync.exe" [2014-06-27 24477056]
"GoogleChromeAutoLaunch_406E507BFF9DCF3BCF12E8B02057CAA5"="c:\program files (x86)\Google\Chrome\Application\chrome.exe" [2014-06-05 860488]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"IAStorIcon"="c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe" [2011-11-29 284440]
"USB3MON"="c:\program files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe" [2012-01-27 291608]
"AVMWlanClient"="c:\program files (x86)\avmwlanstick\wlangui.exe" [2010-10-22 2105344]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2014-08-21 959176]
"KeyScrambler"="c:\program files (x86)\KeyScrambler\keyscrambler.exe" [2013-02-10 534160]
"KeePass 2 PreLoad"="c:\program files (x86)\KeePass Password Safe 2\KeePass.exe" [2014-02-03 2092032]
"hpqSRMon"="c:\program files (x86)\HP\Digital Imaging\bin\hpqSRMon.exe" [2008-07-22 150528]
"LifeCam"="c:\program files (x86)\Microsoft LifeCam\LifeExp.exe" [2010-05-20 119152]
"HP Software Update"="c:\program files (x86)\HP\HP Software Update\HPWuSchd2.exe" [2011-10-28 49208]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2014-10-14 703736]
"Avira Systray"="c:\program files (x86)\Avira\My Avira\Avira.OE.Systray.exe" [2014-09-23 165168]
.
c:\users\****** ******\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
CloudStation.lnk - c:\users\****** ******\AppData\Local\CloudStation\bin\cloud.exe [2014-6-11 3774880]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files (x86)\HP\Digital Imaging\bin\hpqtra08.exe [2009-9-23 270336]
Samsung Network PC Fax.lnk - c:\windows\System32\spool\drivers\x64\3\NetFaxTray64.exe [2014-9-30 378160]
Secunia PSI Tray.lnk - c:\program files (x86)\Secunia\PSI\psi_tray.exe [2013-2-7 575000]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"EnableSecureUIAPath"= 1 (0x1)
"EnableLinkedConnections"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"mixer2"=wdmaud.drv
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [x]
R2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [x]
R3 AppleChargerSrv;AppleChargerSrv;c:\windows\system32\AppleChargerSrv.exe;c:\windows\SYSNATIVE\AppleChargerSrv.exe [x]
R3 avmeject;AVM Eject;c:\windows\system32\drivers\avmeject.sys;c:\windows\SYSNATIVE\drivers\avmeject.sys [x]
R3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudbus.sys;c:\windows\SYSNATIVE\DRIVERS\ssudbus.sys [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\L1C62x64.sys;c:\windows\SYSNATIVE\DRIVERS\L1C62x64.sys [x]
R3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;c:\windows\system32\drivers\nusb3hub.sys;c:\windows\SYSNATIVE\drivers\nusb3hub.sys [x]
R3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;c:\windows\system32\drivers\nusb3xhc.sys;c:\windows\SYSNATIVE\drivers\nusb3xhc.sys [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]
R3 ssudmdm;SAMSUNG Mobile USB Modem Drivers (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudmdm.sys;c:\windows\SYSNATIVE\DRIVERS\ssudmdm.sys [x]
R3 SvcOnlineArmor;Online Armor;c:\program files (x86)\Online Armor\oasrv.exe;c:\program files (x86)\Online Armor\oasrv.exe [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
S0 iusb3hcs;Intel(R) USB 3.0 Hostcontroller-Switchtreiber;c:\windows\system32\DRIVERS\iusb3hcs.sys;c:\windows\SYSNATIVE\DRIVERS\iusb3hcs.sys [x]
S1 AppleCharger;AppleCharger;c:\windows\system32\DRIVERS\AppleCharger.sys;c:\windows\SYSNATIVE\DRIVERS\AppleCharger.sys [x]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys;c:\windows\SYSNATIVE\DRIVERS\avkmgr.sys [x]
S1 OADevice;OADriver;c:\windows\SysWow64\Drivers\OADriver.sys;c:\windows\SysWow64\Drivers\OADriver.sys [x]
S1 oahlpXX;Online Armor helper driver;c:\windows\syswow64\drivers\oahlp64.sys;c:\windows\syswow64\drivers\oahlp64.sys [x]
S1 OAmon;OAmon;c:\windows\SysWOW64\Drivers\OAmon.sys;c:\windows\SysWOW64\Drivers\OAmon.sys [x]
S2 AntiVirSchedulerService;Avira Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [x]
S2 Avira.OE.ServiceHost;Avira Service Host;c:\program files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe;c:\program files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [x]
S2 Intel(R) Capability Licensing Service Interface;Intel(R) Capability Licensing Service Interface;c:\program files\Intel\iCLS Client\HeciServer.exe;c:\program files\Intel\iCLS Client\HeciServer.exe [x]
S2 jhi_service;Intel(R) Dynamic Application Loader Host Interface Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [x]
S2 OAcat;Online Armor Helper Service;c:\program files (x86)\Online Armor\OAcat.exe;c:\program files (x86)\Online Armor\OAcat.exe [x]
S2 postgresql-8.4;postgresql-8.4 - PostgreSQL Server 8.4;C:/Program Files (x86)/PostgreSQL/8.4/bin/pg_ctl.exe runservice -N postgresql-8.4 -D C:/Program Files (x86)/PostgreSQL/8.4/data -w;C:/Program Files (x86)/PostgreSQL/8.4/bin/pg_ctl.exe runservice -N postgresql-8.4 -D C:/Program Files (x86)/PostgreSQL/8.4/data -w [x]
S2 ReflectService.exe;Macrium Reflect Image Mounting Service;c:\program files\Macrium\Reflect\ReflectService.exe;c:\program files\Macrium\Reflect\ReflectService.exe [x]
S2 Samsung Network Fax Server;Samsung Network Fax Server;c:\windows\system32\spool\drivers\x64\3\NetFaxServer64.exe;c:\windows\SYSNATIVE\spool\drivers\x64\3\NetFaxServer64.exe [x]
S2 Secunia PSI Agent;Secunia PSI Agent;c:\program files (x86)\Secunia\PSI\PSIA.exe;c:\program files (x86)\Secunia\PSI\PSIA.exe [x]
S2 Secunia Update Agent;Secunia Update Agent;c:\program files (x86)\Secunia\PSI\sua.exe;c:\program files (x86)\Secunia\PSI\sua.exe [x]
S2 SSPORT;SSPORT;c:\windows\system32\Drivers\SSPORT.sys;c:\windows\SYSNATIVE\Drivers\SSPORT.sys [x]
S2 TeamViewer9;TeamViewer 9;c:\program files (x86)\TeamViewer\Version9\TeamViewer_Service.exe;c:\program files (x86)\TeamViewer\Version9\TeamViewer_Service.exe [x]
S2 UsbClientService;UsbClientService;c:\program files (x86)\Synology\Assistant\UsbClientService.exe;c:\program files (x86)\Synology\Assistant\UsbClientService.exe [x]
S3 busenum;Synology Virtual USB Hub;c:\windows\system32\DRIVERS\busenum.sys;c:\windows\SYSNATIVE\DRIVERS\busenum.sys [x]
S3 dc3d;MS Hardware Device Detection Driver (USB);c:\windows\system32\DRIVERS\dc3d.sys;c:\windows\SYSNATIVE\DRIVERS\dc3d.sys [x]
S3 fwlanusbn;FRITZ!WLAN N;c:\windows\system32\DRIVERS\fwlanusbn.sys;c:\windows\SYSNATIVE\DRIVERS\fwlanusbn.sys [x]
S3 IntcDAud;Intel(R) Display-Audio;c:\windows\system32\DRIVERS\IntcDAud.sys;c:\windows\SYSNATIVE\DRIVERS\IntcDAud.sys [x]
S3 iusb3hub;Intel(R) USB 3.0-Hubtreiber;c:\windows\system32\DRIVERS\iusb3hub.sys;c:\windows\SYSNATIVE\DRIVERS\iusb3hub.sys [x]
S3 iusb3xhc;Intel(R) USB 3.0 eXtensible-Hostcontrollertreiber;c:\windows\system32\DRIVERS\iusb3xhc.sys;c:\windows\SYSNATIVE\DRIVERS\iusb3xhc.sys [x]
S3 KeyScrambler;KeyScrambler;c:\windows\system32\drivers\keyscrambler.sys;c:\windows\SYSNATIVE\drivers\keyscrambler.sys [x]
S3 LEqdUsb;Logitech SetPoint Unifying KMDF USB Filter;c:\windows\system32\DRIVERS\LEqdUsb.Sys;c:\windows\SYSNATIVE\DRIVERS\LEqdUsb.Sys [x]
S3 LHidEqd;Logitech SetPoint Unifying KMDF HID Filter;c:\windows\system32\DRIVERS\LHidEqd.Sys;c:\windows\SYSNATIVE\DRIVERS\LHidEqd.Sys [x]
S3 MSHUSBVideo;NX6000/NX3000/VX2000/VX5000/VX5500/VX7000/Cinema Filter Driver;c:\windows\system32\Drivers\nx6000.sys;c:\windows\SYSNATIVE\Drivers\nx6000.sys [x]
S3 OAnet;OnlineArmor Service;c:\windows\system32\DRIVERS\oanet.sys;c:\windows\SYSNATIVE\DRIVERS\oanet.sys [x]
S3 Point64;Microsoft Mouse and Keyboard Center Filter Driver;c:\windows\system32\DRIVERS\point64.sys;c:\windows\SYSNATIVE\DRIVERS\point64.sys [x]
S3 PSI;PSI;c:\windows\system32\DRIVERS\psi_mf_amd64.sys;c:\windows\SYSNATIVE\DRIVERS\psi_mf_amd64.sys [x]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2014-07-11 08:11 1091912 ----a-w- c:\program files (x86)\Google\Chrome\Application\35.0.1916.153\Installer\chrmstp.exe
.
Inhalt des "geplante Tasks" Ordners
.
2014-10-21 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-09-17 22:16]
.
2014-10-21 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2014-02-07 08:20]
.
2014-10-21 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2014-02-07 08:20]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\01UnsuppModule]
@="{AEB16659-2125-4ADA-A4AB-45EE21E86469}"
[HKEY_CLASSES_ROOT\CLSID\{AEB16659-2125-4ADA-A4AB-45EE21E86469}]
2014-06-11 14:08 2765312 ----a-w- c:\users\****** ******\AppData\Local\CloudStation\iconoverlay_v7\IconOverlayDLLs_x64\iconOverlay.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\02SyncingModule]
@="{48AB5ADA-36B1-4137-99C9-2BD97F8788AB}"
[HKEY_CLASSES_ROOT\CLSID\{48AB5ADA-36B1-4137-99C9-2BD97F8788AB}]
2014-06-11 14:08 2765312 ----a-w- c:\users\****** ******\AppData\Local\CloudStation\iconoverlay_v7\IconOverlayDLLs_x64\iconOverlay.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\03SyncedModule]
@="{472CE1AD-5D53-4BCF-A1FB-3982A5F55138}"
[HKEY_CLASSES_ROOT\CLSID\{472CE1AD-5D53-4BCF-A1FB-3982A5F55138}]
2014-06-11 14:08 2765312 ----a-w- c:\users\****** ******\AppData\Local\CloudStation\iconoverlay_v7\IconOverlayDLLs_x64\iconOverlay.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\04ReadOnlyModule]
@="{A433C3E0-8B24-40EB-93C3-4B10D9959F58}"
[HKEY_CLASSES_ROOT\CLSID\{A433C3E0-8B24-40EB-93C3-4B10D9959F58}]
2014-06-11 14:08 2765312 ----a-w- c:\users\****** ******\AppData\Local\CloudStation\iconoverlay_v7\IconOverlayDLLs_x64\iconOverlay.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveBlacklistedOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42}]
2014-06-27 12:20 777032 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedEditOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}]
2014-06-27 12:20 777032 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedViewOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43}]
2014-06-27 12:20 777032 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSyncedOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}]
2014-06-27 12:20 777032 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSyncingOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41}]
2014-06-27 12:20 777032 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2012-01-16 12445288]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2012-12-14 172144]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2012-12-14 399984]
"Persistence"="c:\windows\system32\igfxpers.exe" [2012-12-14 441968]
"EvtMgr6"="c:\program files\Logitech\SetPointP\SetPoint.exe" [2012-11-04 2419512]
"LicenseProxy"="c:\program files\LicenseProxy\LicenseProxy.exe" [2013-06-28 298496]
"CDAServer"="c:\program files\Common Files\Common Desktop Agent\CDASrv.exe" [2012-03-09 462712]
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.trovi.com/?gd=&ctid=CT3322288&octid=EB_ORIGINAL_CTID&ISID=M2D398160-C05C-4BC3-B4B1-BFDC7CBFC713&SearchSource=55&CUI=&UM=6&UP=SP13B83FA7-1281-4C6E-A136-1FB75D1C1340&SSPV=
mLocal Page = c:\windows\SysWOW64\blank.htm
TCP: DhcpNameServer = 192.168.1.1
FF - ProfilePath - c:\users\****** ******\AppData\Roaming\Mozilla\Firefox\Profiles\mftpap7j.default-1413543929839\
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Wow6432Node-HKLM-Run-<NO NAME> - (no file)
SafeBoot-CleanHlp
SafeBoot-CleanHlp.sys
AddRemove-{29AE3F9F-7158-4ca7-B1ED-28A73ECDB215}_is1 - c:\program files (x86)\Samsung SSD Magician\unins000.exe
AddRemove-{5A0C0737-6AFE-4DC6-A8B4-6DFE509ACD75}_is1 - c:\users\****** ******\AppData\Roaming\Mozilla\Firefox\Profiles\vpqitd8x.default\extensions\cliqz@cliqz.com\unins000.exe
.
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\postgresql-8.4]
"ImagePath"="C:/Program Files (x86)/PostgreSQL/8.4/bin/pg_ctl.exe runservice -N \"postgresql-8.4\" -D \"C:/Program Files (x86)/PostgreSQL/8.4/data\" -w"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\postgresql-8.4]
"ImagePath"="C:/Program Files (x86)/PostgreSQL/8.4/bin/pg_ctl.exe runservice -N \"postgresql-8.4\" -D \"C:/Program Files (x86)/PostgreSQL/8.4/data\" -w"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_15_0_0_167_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_15_0_0_167_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
@Denied: (A 2) (Everyone)
@="IFlashBroker6"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_15_0_0_167_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_15_0_0_167_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_15_0_0_167.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.15"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_15_0_0_167.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_15_0_0_167.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_15_0_0_167.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
@Denied: (A 2) (Everyone)
@="IFlashBroker6"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\RNG*]
"Seed"=hex:49,31,f4,88,04,28,01,14,c5,ca,fa,5f,f5,cf,66,6e,1f,6c,42,48,3b,1d,
bb,84,6e,c3,98,a3,07,68,b8,a1,8e,3f,71,ca,a8,53,6d,af,a8,e5,29,51,a3,e5,99,\
"Seed"=hex:49,31,f4,88,04,28,01,14,c5,ca,fa,5f,f5,cf,66,6e,1f,6c,42,48,3b,1d,
bb,84,6e,c3,98,a3,07,68,b8,a1,8e,3f,71,ca,a8,53,6d,af,a8,e5,29,51,a3,e5,99,\
"Seed"=hex:49,31,f4,88,04,28,01,14,c5,ca,fa,5f,f5,cf,66,6e,1f,6c,42,48,3b,1d,
bb,84,6e,c3,98,a3,07,68,b8,a1,8e,3f,71,ca,a8,53,6d,af,a8,e5,29,51,a3,e5,99,\
"Seed"=hex:49,31,f4,88,04,28,01,14,c5,ca,fa,5f,f5,cf,66,6e,1f,6c,42,48,3b,1d,
bb,84,6e,c3,98,a3,07,68,b8,a1,8e,3f,71,ca,a8,53,6d,af,a8,e5,29,51,a3,e5,99,\
"Seed"=hex:49,31,f4,88,04,28,01,14,c5,ca,fa,5f,f5,cf,66,6e,1f,6c,42,48,3b,1d,
bb,84,6e,c3,98,a3,07,68,b8,a1,8e,3f,71,ca,a8,53,6d,af,a8,e5,29,51,a3,e5,99,\
"Seed"=hex:49,31,f4,88,04,28,01,14,c5,ca,fa,5f,f5,cf,66,6e,1f,6c,42,48,3b,1d,
bb,84,6e,c3,98,a3,07,68,b8,a1,8e,3f,71,ca,a8,53,6d,af,a8,e5,29,51,a3,e5,99,\
"Seed"=hex:49,31,f4,88,04,28,01,14,c5,ca,fa,5f,f5,cf,66,6e,1f,6c,42,48,3b,1d,
bb,84,6e,c3,98,a3,07,68,b8,a1,8e,3f,71,ca,a8,53,6d,af,a8,e5,29,51,a3,e5,99,\
"Seed"=hex:49,31,f4,88,04,28,01,14,c5,ca,fa,5f,f5,cf,66,6e,1f,6c,42,48,3b,1d,
bb,84,6e,c3,98,a3,07,68,b8,a1,8e,3f,71,ca,a8,53,6d,af,a8,e5,29,51,a3,e5,99,\
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Environment*]
"v5Setup"="07-ENKJ-TXR9-J6WB-M4RB-XFPE-F9N6TP1"
"v5Licence0"="15-AF92-SFPV-GMN5-SJE2-N5UF-KR1PQ7S"
"Activated"="N"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
c:\program files (x86)\Avira\AntiVir Desktop\avguard.exe
c:\program files (x86)\avmwlanstick\WlanNetService.exe
c:\program files (x86)\PostgreSQL\8.4\bin\pg_ctl.exe
c:\program files (x86)\PostgreSQL\8.4\bin\postgres.exe
c:\program files (x86)\PostgreSQL\8.4\bin\postgres.exe
c:\program files (x86)\PostgreSQL\8.4\bin\postgres.exe
c:\program files (x86)\PostgreSQL\8.4\bin\postgres.exe
c:\program files (x86)\PostgreSQL\8.4\bin\postgres.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2014-10-21 10:46:31 - PC wurde neu gestartet
ComboFix-quarantined-files.txt 2014-10-21 08:46
.
Vor Suchlauf: 7.869.235.200 Bytes frei
Nach Suchlauf: 7.662.374.912 Bytes frei
.
- - End Of File - - EF0C653B116B5A7C8FD905434F742A70
Ich habe danach noch einen eigenständigen Neustart gemacht. Dabei verzögerte sich auch wieder der Start bei den Kacheln. Diese stoppen kurz bevor sie sich zusammenfügen und das Bild war noch verschwommen. Nach 5 Sekunden ging es dann zum Benutzer Log-In Screen.
Muss ich sonst noch etwas machen?
Nachdem ich den PC jetzt doch nochmal ausgeschaltet hatte, habe ich beim erneuten Start wieder das Eingangsproblem gehabt.
WinPatrol hat mir gerade dann noch diese Meldung angezeit.
Diese habe ich mit Yes angeklickt: http://abload.de/img/unbenanntwgqbw.jpg
Nach erneutem Start besteht das Problem weiterhin, ich habe hier mal die Fehlermeldung notiert:
Status: 0xc000000f
Info: Fehler bei Startauswahl. Zugriff auf ein erforderliches Gerät nicht möglich. |
Malwarebytes Anti-Malware 
AdwCleaner auf deinen Desktop.
SecurityCheck und:
WARNUNG an die MITLESER: 
