VPN Client ist deinstalliert und das Log-File sieht wiefolgt aus: Code:
ComboFix 15-08-08.01 - Beldi 10.08.2015 14:03:23.1.8 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.49.1031.18.16347.11236 [GMT 2:00]
ausgeführt von:: c:\users\Beldi\Downloads\ComboFix.exe
AV: Ad-Aware Antivirus *Disabled/Outdated* {D87B6541-12A1-DAEA-0033-9B8057AAB996}
AV: Avira Antivirus *Disabled/Updated* {4D041356-F94D-285F-8768-AAE50FA36859}
FW: Ad-Aware Firewall *Disabled* {E040E464-58CE-DBB2-2B6C-32B5A979FEED}
SP: Ad-Aware Antivirus *Disabled/Outdated* {631A84A5-349B-D564-3A83-A0F22C2DF32B}
SP: Avira Antivirus *Disabled/Updated* {F665F2B2-DF77-27D1-BDD8-9197742422E4}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Neuer Wiederherstellungspunkt wurde erstellt
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Beldi\AppData\Local\Temp\_MEI40522\_ctypes.pyd
c:\users\Beldi\AppData\Local\Temp\_MEI40522\_elementtree.pyd
c:\users\Beldi\AppData\Local\Temp\_MEI40522\_hashlib.pyd
c:\users\Beldi\AppData\Local\Temp\_MEI40522\_multiprocessing.pyd
c:\users\Beldi\AppData\Local\Temp\_MEI40522\_psutil_windows.pyd
c:\users\Beldi\AppData\Local\Temp\_MEI40522\_socket.pyd
c:\users\Beldi\AppData\Local\Temp\_MEI40522\_ssl.pyd
c:\users\Beldi\AppData\Local\Temp\_MEI40522\_yappi.pyd
c:\users\Beldi\AppData\Local\Temp\_MEI40522\common.time34.pyd
c:\users\Beldi\AppData\Local\Temp\_MEI40522\hashobjs_ext.pyd
c:\users\Beldi\AppData\Local\Temp\_MEI40522\pyexpat.pyd
c:\users\Beldi\AppData\Local\Temp\_MEI40522\pysqlite2._sqlite.pyd
c:\users\Beldi\AppData\Local\Temp\_MEI40522\python27.dll
c:\users\Beldi\AppData\Local\Temp\_MEI40522\pythoncom27.dll
c:\users\Beldi\AppData\Local\Temp\_MEI40522\PyWinTypes27.dll
c:\users\Beldi\AppData\Local\Temp\_MEI40522\select.pyd
c:\users\Beldi\AppData\Local\Temp\_MEI40522\unicodedata.pyd
c:\users\Beldi\AppData\Local\Temp\_MEI40522\usb_ext.pyd
c:\users\Beldi\AppData\Local\Temp\_MEI40522\win32api.pyd
c:\users\Beldi\AppData\Local\Temp\_MEI40522\win32com.shell.shell.pyd
c:\users\Beldi\AppData\Local\Temp\_MEI40522\win32crypt.pyd
c:\users\Beldi\AppData\Local\Temp\_MEI40522\win32event.pyd
c:\users\Beldi\AppData\Local\Temp\_MEI40522\win32file.pyd
c:\users\Beldi\AppData\Local\Temp\_MEI40522\win32gui.pyd
c:\users\Beldi\AppData\Local\Temp\_MEI40522\win32inet.pyd
c:\users\Beldi\AppData\Local\Temp\_MEI40522\win32pdh.pyd
c:\users\Beldi\AppData\Local\Temp\_MEI40522\win32pipe.pyd
c:\users\Beldi\AppData\Local\Temp\_MEI40522\win32process.pyd
c:\users\Beldi\AppData\Local\Temp\_MEI40522\win32profile.pyd
c:\users\Beldi\AppData\Local\Temp\_MEI40522\win32security.pyd
c:\users\Beldi\AppData\Local\Temp\_MEI40522\win32ts.pyd
c:\users\Beldi\AppData\Local\Temp\_MEI40522\windows._lib_cacheinvalidation.pyd
c:\users\Beldi\AppData\Local\Temp\_MEI40522\wx._animate.pyd
c:\users\Beldi\AppData\Local\Temp\_MEI40522\wx._controls_.pyd
c:\users\Beldi\AppData\Local\Temp\_MEI40522\wx._core_.pyd
c:\users\Beldi\AppData\Local\Temp\_MEI40522\wx._gdi_.pyd
c:\users\Beldi\AppData\Local\Temp\_MEI40522\wx._html2.pyd
c:\users\Beldi\AppData\Local\Temp\_MEI40522\wx._misc_.pyd
c:\users\Beldi\AppData\Local\Temp\_MEI40522\wx._windows_.pyd
c:\users\Beldi\AppData\Local\Temp\_MEI40522\wx._wizard.pyd
c:\users\Beldi\AppData\Local\Temp\_MEI40522\wxbase294u_net_vc90.dll
c:\users\Beldi\AppData\Local\Temp\_MEI40522\wxbase294u_vc90.dll
c:\users\Beldi\AppData\Local\Temp\_MEI40522\wxmsw294u_adv_vc90.dll
c:\users\Beldi\AppData\Local\Temp\_MEI40522\wxmsw294u_core_vc90.dll
c:\users\Beldi\AppData\Local\Temp\_MEI40522\wxmsw294u_html_vc90.dll
c:\users\Beldi\AppData\Local\Temp\_MEI40522\wxmsw294u_webview_vc90.dll
c:\users\Beldi\AppData\Local\Temp\avgnt.exe\Avira.OE.ExtApi.dll
D:\install.exe
.
.
((((((((((((((((((((((((((((((((((((((( Treiber/Dienste )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_NEWDRIVER
-------\Service_NEWDRIVER
.
.
((((((((((((((((((((((( Dateien erstellt von 2015-07-10 bis 2015-08-10 ))))))))))))))))))))))))))))))
.
.
2015-08-10 12:36 . 2015-08-10 12:36 -------- d-----w- c:\users\Default\AppData\Local\temp
2015-08-10 10:44 . 2015-08-10 10:46 -------- d-----w- C:\FRST
2015-08-06 17:03 . 2015-08-06 17:03 -------- d-----w- c:\users\Beldi\AppData\Roaming\Smooth and Flat
2015-08-06 17:03 . 2015-08-06 17:03 -------- d-----w- c:\users\Beldi\AppData\Local\grabacr.net
2015-08-06 15:44 . 2015-08-06 15:44 40704 ----a-w- c:\windows\system32\drivers\Neo_0039.sys
2015-08-06 15:43 . 2015-08-06 15:43 49024 ----a-w- c:\windows\system32\drivers\see.sys
2015-08-06 15:42 . 2015-08-06 15:42 144104 ----a-w- c:\windows\system32\vpncmd.exe
2015-07-30 18:52 . 2015-07-30 18:52 92448 ----a-w- c:\windows\system32\drivers\ESLWireACD.sys
2015-07-30 18:07 . 2015-08-10 10:26 -------- d-----w- c:\users\Beldi\AppData\Local\ESL Wire Game Client
2015-07-30 18:07 . 2015-07-30 18:07 -------- d-----w- c:\programdata\ESL Wire
2015-07-29 13:22 . 2013-10-09 09:20 83160 ----a-w- c:\windows\system32\drivers\rtu30x64w7.sys
2015-07-29 13:22 . 2013-10-09 09:20 74456 ----a-w- c:\windows\system32\RtNicProp64.dll
2015-07-28 18:19 . 2015-07-28 18:19 -------- d-----w- c:\users\Beldi\AppData\Local\IdleMaster
2015-07-28 12:17 . 2015-06-15 21:45 3242496 ----a-w- c:\windows\system32\msi.dll
2015-07-28 12:17 . 2015-06-15 21:45 1941504 ----a-w- c:\windows\system32\authui.dll
2015-07-28 12:17 . 2015-06-15 21:43 2364416 ----a-w- c:\windows\SysWow64\msi.dll
2015-07-28 12:17 . 2015-06-15 21:50 112064 ----a-w- c:\windows\system32\consent.exe
2015-07-28 12:17 . 2015-06-15 21:45 504320 ----a-w- c:\windows\system32\msihnd.dll
2015-07-28 12:17 . 2015-06-15 21:45 70656 ----a-w- c:\windows\system32\appinfo.dll
2015-07-28 12:17 . 2015-06-15 21:44 128000 ----a-w- c:\windows\system32\msiexec.exe
2015-07-28 12:17 . 2015-06-15 21:43 337408 ----a-w- c:\windows\SysWow64\msihnd.dll
2015-07-28 12:17 . 2015-06-15 21:43 1805824 ----a-w- c:\windows\SysWow64\authui.dll
2015-07-28 12:17 . 2015-06-15 21:42 73216 ----a-w- c:\windows\SysWow64\msiexec.exe
2015-07-28 12:17 . 2015-06-15 21:42 25088 ----a-w- c:\windows\system32\msimsg.dll
2015-07-28 12:17 . 2015-06-15 21:37 25088 ----a-w- c:\windows\SysWow64\msimsg.dll
2015-07-28 12:07 . 2015-07-28 12:07 -------- d-----w- c:\program files (x86)\AGEIA Technologies
2015-07-28 11:44 . 2015-04-27 19:23 188416 ----a-w- c:\windows\system32\cryptsvc.dll
2015-07-28 11:44 . 2015-04-27 19:04 143872 ----a-w- c:\windows\SysWow64\cryptsvc.dll
2015-07-28 11:44 . 2015-04-27 19:04 1174528 ----a-w- c:\windows\SysWow64\crypt32.dll
2015-07-28 11:44 . 2015-04-27 19:23 229376 ----a-w- c:\windows\system32\wintrust.dll
2015-07-28 11:44 . 2015-04-27 19:23 1480192 ----a-w- c:\windows\system32\crypt32.dll
2015-07-28 11:44 . 2015-04-27 19:23 140288 ----a-w- c:\windows\system32\cryptnet.dll
2015-07-28 11:44 . 2015-04-27 19:05 179200 ----a-w- c:\windows\SysWow64\wintrust.dll
2015-07-28 11:44 . 2015-04-27 19:04 103936 ----a-w- c:\windows\SysWow64\cryptnet.dll
2015-07-27 14:46 . 2015-07-27 14:46 -------- d-----w- c:\program files (x86)\Realtek
2015-07-27 11:43 . 2015-07-15 03:19 41984 ----a-w- c:\windows\system32\lpk.dll
2015-07-27 11:43 . 2015-07-15 03:19 100864 ----a-w- c:\windows\system32\fontsub.dll
2015-07-27 11:43 . 2015-07-15 03:19 14336 ----a-w- c:\windows\system32\dciman32.dll
2015-07-27 11:43 . 2015-07-15 03:19 46080 ----a-w- c:\windows\system32\atmlib.dll
2015-07-27 11:43 . 2015-07-15 02:55 70656 ----a-w- c:\windows\SysWow64\fontsub.dll
2015-07-27 11:43 . 2015-07-15 02:55 10240 ----a-w- c:\windows\SysWow64\dciman32.dll
2015-07-27 11:43 . 2015-07-15 02:55 34304 ----a-w- c:\windows\SysWow64\atmlib.dll
2015-07-27 11:43 . 2015-07-15 02:54 25600 ----a-w- c:\windows\SysWow64\lpk.dll
2015-07-27 11:43 . 2015-07-15 01:59 372224 ----a-w- c:\windows\system32\atmfd.dll
2015-07-27 11:43 . 2015-07-15 01:52 299008 ----a-w- c:\windows\SysWow64\atmfd.dll
2015-07-26 23:54 . 2015-07-04 18:07 2087424 ----a-w- c:\windows\system32\ole32.dll
2015-07-26 23:54 . 2015-07-04 17:48 1414656 ----a-w- c:\windows\SysWow64\ole32.dll
2015-07-26 23:03 . 2015-06-02 00:07 254976 ----a-w- c:\windows\system32\cewmdm.dll
2015-07-26 23:03 . 2015-06-01 23:47 210432 ----a-w- c:\windows\SysWow64\cewmdm.dll
2015-07-26 22:44 . 2015-06-25 08:57 3207168 ----a-w- c:\windows\system32\win32k.sys
2015-07-26 17:22 . 2015-07-26 17:22 -------- d-----w- c:\users\Beldi\AppData\Local\CEF
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2015-07-30 17:42 . 2013-08-30 16:38 778416 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2015-07-30 17:42 . 2013-08-30 16:38 142512 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2015-07-28 10:27 . 2013-06-22 12:48 162528 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2015-07-28 10:27 . 2013-06-22 12:48 141416 ----a-w- c:\windows\system32\drivers\avipbb.sys
2015-07-03 06:43 . 2013-08-24 21:33 130333168 ----a-w- c:\windows\system32\MRT.exe
2015-06-17 09:10 . 2015-06-22 17:27 982672 ----a-w- c:\windows\SysWow64\NvIFR.dll
2015-06-17 09:10 . 2015-06-22 17:27 975176 ----a-w- c:\windows\SysWow64\NvFBC.dll
2015-06-17 09:10 . 2015-06-22 17:27 938752 ----a-w- c:\windows\SysWow64\nvumdshim.dll
2015-06-17 09:10 . 2015-06-22 17:27 503408 ----a-w- c:\windows\system32\nvEncodeAPI64.dll
2015-06-17 09:10 . 2015-06-22 17:27 42729104 ----a-w- c:\windows\system32\nvcompiler.dll
2015-06-17 09:10 . 2015-06-22 17:27 408392 ----a-w- c:\windows\system32\NvIFROpenGL.dll
2015-06-17 09:10 . 2015-06-22 17:27 407296 ----a-w- c:\windows\SysWow64\nvEncodeAPI.dll
2015-06-17 09:10 . 2015-06-22 17:27 37748880 ----a-w- c:\windows\SysWow64\nvcompiler.dll
2015-06-17 09:10 . 2015-06-22 17:27 364176 ----a-w- c:\windows\SysWow64\NvIFROpenGL.dll
2015-06-17 09:10 . 2015-06-22 17:27 30481552 ----a-w- c:\windows\system32\nvoglv64.dll
2015-06-17 09:10 . 2015-06-22 17:27 2932368 ----a-w- c:\windows\system32\nvcuvid.dll
2015-06-17 09:10 . 2015-06-22 17:27 2599752 ----a-w- c:\windows\SysWow64\nvcuvid.dll
2015-06-17 09:10 . 2015-06-22 17:27 22947144 ----a-w- c:\windows\SysWow64\nvoglv32.dll
2015-06-17 09:10 . 2015-06-22 17:27 1898128 ----a-w- c:\windows\system32\nvdispco6435330.dll
2015-06-17 09:10 . 2015-06-22 17:27 176904 ----a-w- c:\windows\system32\nvinitx.dll
2015-06-17 09:10 . 2015-06-22 17:27 16145200 ----a-w- c:\windows\system32\nvopencl.dll
2015-06-17 09:10 . 2015-06-22 17:27 1557832 ----a-w- c:\windows\system32\nvdispgenco6435330.dll
2015-06-17 09:10 . 2015-06-22 17:27 155280 ----a-w- c:\windows\SysWow64\nvinit.dll
2015-06-17 09:10 . 2015-06-22 17:27 150832 ----a-w- c:\windows\system32\nvoglshim64.dll
2015-06-17 09:10 . 2015-06-22 17:27 14497520 ----a-w- c:\windows\system32\nvcuda.dll
2015-06-17 09:10 . 2015-06-22 17:27 13263056 ----a-w- c:\windows\SysWow64\nvopencl.dll
2015-06-17 09:10 . 2015-06-22 17:27 128696 ----a-w- c:\windows\SysWow64\nvoglshim32.dll
2015-06-17 09:10 . 2015-06-22 17:27 11831856 ----a-w- c:\windows\SysWow64\nvcuda.dll
2015-06-17 09:10 . 2015-06-22 17:27 11011216 ----a-w- c:\windows\system32\drivers\nvlddmkm.sys
2015-06-17 09:10 . 2015-06-22 17:27 1099992 ----a-w- c:\windows\system32\nvumdshimx.dll
2015-06-17 09:10 . 2015-06-22 17:27 1060168 ----a-w- c:\windows\system32\NvIFR64.dll
2015-06-17 09:10 . 2015-06-22 17:27 1050768 ----a-w- c:\windows\system32\NvFBC64.dll
2015-06-17 09:10 . 2015-03-28 22:38 15866992 ----a-w- c:\windows\system32\nvd3dumx.dll
2015-06-17 09:10 . 2014-01-28 15:15 15224784 ----a-w- c:\windows\SysWow64\nvwgf2um.dll
2015-06-17 09:10 . 2013-06-19 03:00 112784 ----a-w- c:\windows\system32\OpenCL.dll
2015-06-17 09:10 . 2013-06-19 03:00 105288 ----a-w- c:\windows\SysWow64\OpenCL.dll
2015-06-17 09:10 . 2013-05-24 04:23 17724600 ----a-w- c:\windows\system32\nvwgf2umx.dll
2015-06-17 09:10 . 2013-05-24 04:23 12855416 ----a-w- c:\windows\SysWow64\nvd3dum.dll
2015-06-17 09:10 . 2013-05-24 04:22 3395648 ----a-w- c:\windows\system32\nvapi64.dll
2015-06-17 09:10 . 2013-05-24 04:22 2997544 ----a-w- c:\windows\SysWow64\nvapi.dll
2015-06-17 06:48 . 2013-06-19 03:00 937616 ----a-w- c:\windows\system32\nvvsvc.exe
2015-06-17 06:48 . 2013-06-19 03:00 62792 ----a-w- c:\windows\system32\nvshext.dll
2015-06-17 06:48 . 2013-06-19 03:00 385168 ----a-w- c:\windows\system32\nvmctray.dll
2015-06-17 06:48 . 2013-06-19 03:00 2558792 ----a-w- c:\windows\system32\nvsvcr.dll
2015-06-17 06:48 . 2013-06-19 03:00 6873232 ----a-w- c:\windows\system32\nvcpl.dll
2015-06-17 06:48 . 2013-06-19 03:00 3492168 ----a-w- c:\windows\system32\nvsvc64.dll
2015-06-17 06:03 . 2015-06-22 17:28 571024 ----a-w- c:\windows\SysWow64\nvStreaming.exe
2015-06-16 23:01 . 2015-06-16 23:01 1202856 ----a-w- c:\windows\SysWow64\FM20.DLL
2015-06-03 21:04 . 2015-03-28 22:41 1316000 ----a-w- c:\windows\SysWow64\nvspbridge.dll
2015-06-03 21:04 . 2013-12-02 20:45 1320304 ----a-w- c:\windows\SysWow64\nvspcap.dll
2015-06-03 21:04 . 2015-03-28 22:41 1756424 ----a-w- c:\windows\system32\nvspbridge64.dll
2015-06-03 21:04 . 2013-12-02 20:45 1571696 ----a-w- c:\windows\system32\nvspcap64.dll
2015-06-02 14:11 . 2013-06-19 03:00 4421614 ----a-w- c:\windows\system32\nvcoproc.bin
2015-05-25 18:24 . 2015-06-10 10:12 5569984 ----a-w- c:\windows\system32\ntoskrnl.exe
2015-05-25 18:21 . 2015-06-10 10:12 1728960 ----a-w- c:\windows\system32\ntdll.dll
2015-05-25 18:19 . 2015-06-10 10:12 243712 ----a-w- c:\windows\system32\wow64.dll
2015-05-25 18:19 . 2015-06-10 10:12 362496 ----a-w- c:\windows\system32\wow64win.dll
2015-05-25 18:19 . 2015-06-10 10:12 13312 ----a-w- c:\windows\system32\wow64cpu.dll
2015-05-25 18:19 . 2015-06-10 10:12 215040 ----a-w- c:\windows\system32\winsrv.dll
2015-05-25 18:19 . 2015-06-10 10:12 1255424 ----a-w- c:\windows\system32\diagtrack.dll
2015-05-25 18:19 . 2015-06-10 10:12 879104 ----a-w- c:\windows\system32\tdh.dll
2015-05-25 18:19 . 2015-06-10 10:12 503808 ----a-w- c:\windows\system32\srcore.dll
2015-05-25 18:19 . 2015-06-10 10:12 113664 ----a-w- c:\windows\system32\sechost.dll
2015-05-25 18:19 . 2015-06-10 10:12 50176 ----a-w- c:\windows\system32\srclient.dll
2015-05-25 18:19 . 2015-06-10 10:12 16384 ----a-w- c:\windows\system32\ntvdm64.dll
2015-05-25 18:19 . 2015-06-10 10:12 424960 ----a-w- c:\windows\system32\KernelBase.dll
2015-05-25 18:19 . 2015-06-10 10:12 1162752 ----a-w- c:\windows\system32\kernel32.dll
2015-05-25 18:18 . 2015-06-10 10:12 43520 ----a-w- c:\windows\system32\csrsrv.dll
2015-05-25 18:18 . 2015-06-10 10:12 879104 ----a-w- c:\windows\system32\advapi32.dll
2015-05-25 18:18 . 2015-06-10 10:12 404992 ----a-w- c:\windows\system32\tracerpt.exe
2015-05-25 18:18 . 2015-06-10 10:12 47104 ----a-w- c:\windows\system32\typeperf.exe
2015-05-25 18:18 . 2015-06-10 10:12 112640 ----a-w- c:\windows\system32\smss.exe
2015-05-25 18:18 . 2015-06-10 10:12 296960 ----a-w- c:\windows\system32\rstrui.exe
2015-05-25 18:18 . 2015-06-10 10:12 43008 ----a-w- c:\windows\system32\relog.exe
2015-05-25 18:18 . 2015-06-10 10:12 104448 ----a-w- c:\windows\system32\logman.exe
2015-05-25 18:18 . 2015-06-10 10:12 19456 ----a-w- c:\windows\system32\diskperf.exe
2015-05-25 18:18 . 2015-06-10 10:12 338432 ----a-w- c:\windows\system32\conhost.exe
2015-05-25 18:11 . 2015-06-10 10:12 4608 ---ha-w- c:\windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2015-05-25 18:11 . 2015-06-10 10:12 4608 ---ha-w- c:\windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2015-05-25 18:11 . 2015-06-10 10:12 4096 ---ha-w- c:\windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2015-05-25 18:11 . 2015-06-10 10:12 4096 ---ha-w- c:\windows\system32\api-ms-win-core-synch-l1-1-0.dll
2015-05-25 18:11 . 2015-06-10 10:12 4096 ---ha-w- c:\windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2015-05-25 18:11 . 2015-06-10 10:12 3584 ---ha-w- c:\windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-05-25 18:11 . 2015-06-10 10:12 3584 ---ha-w- c:\windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2015-05-25 18:11 . 2015-06-10 10:12 3584 ---ha-w- c:\windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2015-05-25 18:11 . 2015-06-10 10:12 3584 ---ha-w- c:\windows\system32\api-ms-win-core-misc-l1-1-0.dll
2015-05-25 18:11 . 2015-06-10 10:12 3584 ---ha-w- c:\windows\system32\api-ms-win-core-memory-l1-1-0.dll
2015-05-25 18:11 . 2015-06-10 10:12 3584 ---ha-w- c:\windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2015-05-25 18:11 . 2015-06-10 10:12 3072 ---ha-w- c:\windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2015-05-25 18:11 . 2015-06-10 10:12 3072 ---ha-w- c:\windows\system32\api-ms-win-core-util-l1-1-0.dll
2015-05-25 18:11 . 2015-06-10 10:12 3072 ---ha-w- c:\windows\system32\api-ms-win-core-string-l1-1-0.dll
2015-05-25 18:11 . 2015-06-10 10:12 3072 ---ha-w- c:\windows\system32\api-ms-win-core-profile-l1-1-0.dll
2015-05-25 18:11 . 2015-06-10 10:12 3072 ---ha-w- c:\windows\system32\api-ms-win-core-io-l1-1-0.dll
2015-05-25 18:11 . 2015-06-10 10:12 6656 ----a-w- c:\windows\system32\apisetschema.dll
2015-05-25 18:11 . 2015-06-10 10:12 6144 ---ha-w- c:\windows\system32\api-ms-win-security-base-l1-1-0.dll
2015-05-25 18:11 . 2015-06-10 10:12 4096 ---ha-w- c:\windows\system32\api-ms-win-core-localization-l1-1-0.dll
2015-05-25 18:11 . 2015-06-10 10:12 5120 ---ha-w- c:\windows\system32\api-ms-win-core-file-l1-1-0.dll
2015-05-25 18:11 . 2015-06-10 10:12 3584 ---ha-w- c:\windows\system32\api-ms-win-core-heap-l1-1-0.dll
2015-05-25 18:11 . 2015-06-10 10:12 3072 ---ha-w- c:\windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2015-05-25 18:11 . 2015-06-10 10:12 3072 ---ha-w- c:\windows\system32\api-ms-win-core-handle-l1-1-0.dll
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{41564952-412D-5637-4300-7A786E7484D7}]
2015-04-22 22:13 11144 ----a-w- c:\program files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7C\Passport.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]
"{41564952-412D-5637-4300-7A786E7484D7}"= "c:\program files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7C\Passport.dll" [2015-04-22 11144]
.
[HKEY_CLASSES_ROOT\clsid\{41564952-412d-5637-4300-7a786e7484d7}]
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2015-07-24 01:44 189464 ----a-w- c:\users\Beldi\AppData\Roaming\Dropbox\bin\DropboxExt.27.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2015-07-24 01:44 189464 ----a-w- c:\users\Beldi\AppData\Roaming\Dropbox\bin\DropboxExt.27.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2015-07-24 01:44 189464 ----a-w- c:\users\Beldi\AppData\Roaming\Dropbox\bin\DropboxExt.27.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Steam"="d:\programs\Steam\steam.exe" [2015-07-23 2895552]
"iCloudServices"="c:\program files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe" [2013-11-20 59720]
"ApplePhotoStreams"="c:\program files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe" [2013-11-20 59720]
"WinFLTray"="c:\windows\SysWow64\WinFLTray.exe" [2013-11-15 321736]
"FLBackup"="d:\programs\NewSoftware's\Folder Lock\FLComServCtrl.exe" [2013-11-15 276168]
"GoogleDriveSync"="c:\program files (x86)\Google\Drive\googledrivesync.exe" [2015-06-20 22012688]
"KeePass Password Safe"="d:\programs\KeePass Password Safe\KeePass.exe" [2014-04-06 2117632]
"EPLTarget\P0000000000000000"="c:\windows\system32\spool\DRIVERS\x64\3\E_IATIHLE.EXE" [2012-02-29 283232]
"CCleaner Monitoring"="c:\program files\CCleaner\CCleaner64.exe" [2015-02-19 7416088]
"Akamai NetSession Interface"="c:\users\Beldi\AppData\Local\Akamai\netsession_win.exe" [2014-10-29 4673432]
"GoogleChromeAutoLaunch_66A7697DF7D4D15F6FB804059ECC35A7"="c:\program files (x86)\Google\Chrome\Application\chrome.exe" [2015-07-31 813896]
"Dropbox Update"="c:\users\Beldi\AppData\Local\Dropbox\Update\DropboxUpdate.exe" [2015-06-13 134512]
"ESL Wire"="d:\programs\EslWire\wire.exe" [2014-12-09 3771904]
"Zoner Photo Studio Autoupdate"="c:\program files\ZONER\PHOTO STUDIO 16\Program32\ZPSTRAY.EXE" [2013-10-18 801816]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2015-07-28 782008]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2014-02-05 43848]
"VirtualCloneDrive"="d:\programs\VirtualCloneDrive\VCDDaemon.exe" [2013-03-10 88984]
"iTunesHelper"="d:\programs\iTunes\iTunesHelper.exe" [2014-05-26 152392]
"ApnTBMon"="c:\program files (x86)\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe" [2015-04-27 1684360]
"Razer Synapse"="c:\program files (x86)\Razer\Synapse\RzSynapse.exe" [2015-03-12 590144]
"Aeria Ignite"="c:\program files (x86)\Aeria Games\Ignite\aeriaignite.exe" [2013-06-06 1925656]
"EaseUS EPM tray"="d:\programs\EaseUS Partition Master 10.5\bin\EpmNews.exe" [2015-04-14 2089056]
"EaseUS EPM Tray Agent"="d:\programs\EaseUS Partition Master 10.5\bin\TrayPopupE\TrayTipAgentE.exe" [2014-11-18 255072]
"Avira Systray"="c:\program files (x86)\Avira\Launcher\Avira.Systray.exe" [2015-07-02 134368]
.
c:\users\Beldi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dropbox.lnk - c:\users\Beldi\AppData\Roaming\Dropbox\bin\Dropbox.exe /systemstartup [2015-5-5 39179912]
Rainmeter.lnk - d:\programs\Rainmeter\Rainmeter.exe [2013-11-10 36536]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"SoftwareSASGeneration"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Userinit"="userinit.exe"
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R2 VBoxAswDrv;VBoxAsw Support Driver;d:\programs\avast\ng\vbox\VBoxAswDrv.sys;d:\programs\avast\ng\vbox\VBoxAswDrv.sys [x]
R3 ArcService;Arc Service;d:\programs\Arc games\Arc\ArcService.exe;d:\programs\Arc games\Arc\ArcService.exe [x]
R3 BEService;BattlEye Service;c:\program files (x86)\Common Files\BattlEye\BEService.exe;c:\program files (x86)\Common Files\BattlEye\BEService.exe [x]
R3 celavimushost;Celavimus Client Host;d:\programs\CSGO Client Beta\CelavimusClientHelper.exe;d:\programs\CSGO Client Beta\CelavimusClientHelper.exe [x]
R3 cpuz138;cpuz138;c:\windows\TEMP\cpuz138\cpuz138_x64.sys;c:\windows\TEMP\cpuz138\cpuz138_x64.sys [x]
R3 Creative Audio Engine Licensing Service;Creative Audio Engine Licensing Service;c:\program files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe;c:\program files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [x]
R3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudbus.sys;c:\windows\SYSNATIVE\DRIVERS\ssudbus.sys [x]
R3 EagleX64;EagleX64;c:\windows\system32\drivers\EagleX64.sys;c:\windows\SYSNATIVE\drivers\EagleX64.sys [x]
R3 epmntdrv;epmntdrv;c:\windows\system32\epmntdrv.sys;c:\windows\SYSNATIVE\epmntdrv.sys [x]
R3 EtronHub3;Etron USB 3.0 Extensible Hub Driver;c:\windows\system32\Drivers\EtronHub3.sys;c:\windows\SYSNATIVE\Drivers\EtronHub3.sys [x]
R3 EtronXHCI;Etron USB 3.0 Extensible Host Controller Driver;c:\windows\System32\Drivers\EtronXHCI.sys;c:\windows\SYSNATIVE\Drivers\EtronXHCI.sys [x]
R3 EuGdiDrv;EuGdiDrv;c:\windows\system32\EuGdiDrv.sys;c:\windows\SYSNATIVE\EuGdiDrv.sys [x]
R3 Futuremark SystemInfo Service;Futuremark SystemInfo Service;c:\program files (x86)\Futuremark\SystemInfo\FMSISvc.exe;c:\program files (x86)\Futuremark\SystemInfo\FMSISvc.exe [x]
R3 GPUZ;GPUZ;c:\windows\TEMP\GPUZ.sys;c:\windows\TEMP\GPUZ.sys [x]
R3 hidkmdf;KMDF Driver;c:\windows\system32\DRIVERS\hidkmdf.sys;c:\windows\SYSNATIVE\DRIVERS\hidkmdf.sys [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 MHIKEY10;MHIKEY10;c:\windows\system32\Drivers\MHIKEY10x64.sys;c:\windows\SYSNATIVE\Drivers\MHIKEY10x64.sys [x]
R3 netr7364;RT73 USB-Drahtlos-LAN-Kartentreiber für Vista;c:\windows\system32\DRIVERS\netr7364.sys;c:\windows\SYSNATIVE\DRIVERS\netr7364.sys [x]
R3 NLNdisMP;NLNdisMP;c:\windows\system32\DRIVERS\nlndis.sys;c:\windows\SYSNATIVE\DRIVERS\nlndis.sys [x]
R3 NLNdisPT;NetLimiter Ndis Protocol Service;c:\windows\system32\DRIVERS\nlndis.sys;c:\windows\SYSNATIVE\DRIVERS\nlndis.sys [x]
R3 NvStUSB;NVIDIA Stereoscopic 3D USB driver;c:\windows\system32\drivers\nvstusb.sys;c:\windows\SYSNATIVE\drivers\nvstusb.sys [x]
R3 Origin Client Service;Origin Client Service;d:\programs\Origin\OriginClientService.exe;d:\programs\Origin\OriginClientService.exe [x]
R3 PVUSB;CESG502 64bit USB Driver;c:\windows\system32\DRIVERS\CESG64.sys;c:\windows\SYSNATIVE\DRIVERS\CESG64.sys [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]
R3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
R3 SaiK0CC3;SaiK0CC3;c:\windows\system32\DRIVERS\SaiK0CC3.sys;c:\windows\SYSNATIVE\DRIVERS\SaiK0CC3.sys [x]
R3 SaiU0CC3;SaiU0CC3;c:\windows\system32\DRIVERS\SaiU0CC3.sys;c:\windows\SYSNATIVE\DRIVERS\SaiU0CC3.sys [x]
R3 SEE;SoftEther Ethernet Layer Driver;c:\windows\system32\drivers\see.sys;c:\windows\SYSNATIVE\drivers\see.sys [x]
R3 skfiltv;skfiltv;c:\windows\system32\drivers\skfiltv.sys;c:\windows\SYSNATIVE\drivers\skfiltv.sys [x]
R3 ssudmdm;SAMSUNG Mobile USB Modem Drivers (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudmdm.sys;c:\windows\SYSNATIVE\DRIVERS\ssudmdm.sys [x]
R3 terminpt;Microsoft Remote Desktop Input Driver;c:\windows\system32\drivers\terminpt.sys;c:\windows\SYSNATIVE\drivers\terminpt.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys;c:\windows\SYSNATIVE\Drivers\usbaapl64.sys [x]
R3 WacHidRouter;Wacom Hid Router;c:\windows\system32\DRIVERS\wachidrouter.sys;c:\windows\SYSNATIVE\DRIVERS\wachidrouter.sys [x]
R3 wacomrouterfilter;Wacom Router Filter Driver;c:\windows\system32\DRIVERS\wacomrouterfilter.sys;c:\windows\SYSNATIVE\DRIVERS\wacomrouterfilter.sys [x]
S0 amd_sata;amd_sata;c:\windows\system32\drivers\amd_sata.sys;c:\windows\SYSNATIVE\drivers\amd_sata.sys [x]
S0 amd_xata;amd_xata;c:\windows\system32\drivers\amd_xata.sys;c:\windows\SYSNATIVE\drivers\amd_xata.sys [x]
S0 ESLWireAC;ESLWireAC;c:\windows\system32\drivers\ESLWireACD.sys;c:\windows\SYSNATIVE\drivers\ESLWireACD.sys [x]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys;c:\windows\SYSNATIVE\DRIVERS\avkmgr.sys [x]
S1 WinFLAdrv;WinFLAdrv;SysWOW64\WinFLAdrv.sys;SysWOW64\WinFLAdrv.sys [x]
S2 AntiVirMailService;Avira Mail Protection;c:\program files (x86)\Avira\AntiVir Desktop\avmailc7.exe;c:\program files (x86)\Avira\AntiVir Desktop\avmailc7.exe [x]
S2 AntiVirSchedulerService;Avira Scheduler;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [x]
S2 AntiVirWebService;Avira Web Protection;c:\program files (x86)\Avira\AntiVir Desktop\avwebg7.exe;c:\program files (x86)\Avira\AntiVir Desktop\avwebg7.exe [x]
S2 APNMCP;Ask Aktualisierungsdienst;c:\program files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe;c:\program files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe [x]
S2 aswHwid;avast! HardwareID;c:\windows\system32\drivers\aswHwid.sys;c:\windows\SYSNATIVE\drivers\aswHwid.sys [x]
S2 aswStm;aswStm;c:\windows\system32\drivers\aswStm.sys;c:\windows\SYSNATIVE\drivers\aswStm.sys [x]
S2 Avira.ServiceHost;Avira Service Host;c:\program files (x86)\Avira\Launcher\Avira.ServiceHost.exe;c:\program files (x86)\Avira\Launcher\Avira.ServiceHost.exe [x]
S2 avnetflt;avnetflt;c:\windows\system32\DRIVERS\avnetflt.sys;c:\windows\SYSNATIVE\DRIVERS\avnetflt.sys [x]
S2 DiagTrack;Diagnostics Tracking Service;c:\windows\System32\svchost.exe;c:\windows\SYSNATIVE\svchost.exe [x]
S2 EPSON_PM_RPCV4_04;EPSON V3 Service4(04);c:\program files\Common Files\EPSON\EPW!3 SSRP\E_S50RPB.EXE;c:\program files\Common Files\EPSON\EPW!3 SSRP\E_S50RPB.EXE [x]
S2 EslWireHelper;ESL Wire Helper Service;d:\programs\EslWire\service\WireHelperSvc.exe;d:\programs\EslWire\service\WireHelperSvc.exe [x]
S2 FLService;FLService;c:\windows\SysWow64\WinFLService.exe;c:\windows\SysWow64\WinFLService.exe [x]
S2 GfExperienceService;NVIDIA GeForce Experience Service;c:\program files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe;c:\program files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [x]
S2 LavasoftAdAwareService11;Ad-Aware Service 11;d:\programs\Ad-Aware Antivirus\11.7.485.8398\AdAwareService.exe;d:\programs\Ad-Aware Antivirus\11.7.485.8398\AdAwareService.exe [x]
S2 NAUpdate;Nero Update;c:\program files (x86)\Nero\Update\NASvc.exe;c:\program files (x86)\Nero\Update\NASvc.exe [x]
S2 NvNetworkService;NVIDIA Network Service;c:\program files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe;c:\program files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [x]
S2 NvStreamSvc;NVIDIA Streamer Service;c:\program files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe;c:\program files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [x]
S2 Razer Game Scanner Service;Razer Game Scanner;c:\program files (x86)\Razer\Razer Services\GSS\GameScannerService.exe;c:\program files (x86)\Razer\Razer Services\GSS\GameScannerService.exe [x]
S2 rzpmgrk;rzpmgrk;c:\windows\system32\drivers\rzpmgrk.sys;c:\windows\SYSNATIVE\drivers\rzpmgrk.sys [x]
S2 rzpnk;rzpnk;c:\windows\system32\drivers\rzpnk.sys;c:\windows\SYSNATIVE\drivers\rzpnk.sys [x]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [x]
S2 TeamViewer8;TeamViewer 8;c:\program files (x86)\TeamViewer\Version8\TeamViewer_Service.exe;c:\program files (x86)\TeamViewer\Version8\TeamViewer_Service.exe [x]
S2 VIAKaraokeService;VIA Karaoke digital mixer Service;c:\windows\system32\viakaraokesrv.exe;c:\windows\SYSNATIVE\viakaraokesrv.exe [x]
S2 WinVDEDrv;WinVDEDrv;c:\windows\SysWow64\WinVDEdrv.sys;c:\windows\SysWow64\WinVDEdrv.sys [x]
S2 WTabletServiceCon;Wacom Consumer Service;c:\program files\Tablet\Pen\WTabletServiceCon.exe;c:\program files\Tablet\Pen\WTabletServiceCon.exe [x]
S3 Neo_VPN;VPN Client Device Driver - VPN;c:\windows\system32\DRIVERS\Neo_0039.sys;c:\windows\SYSNATIVE\DRIVERS\Neo_0039.sys [x]
S3 NvStreamKms;NvStreamKms;c:\program files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys;c:\program files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [x]
S3 nvvad_WaveExtensible;NVIDIA Virtual Audio Device (Wave Extensible) (WDM);c:\windows\system32\drivers\nvvad64v.sys;c:\windows\SYSNATIVE\drivers\nvvad64v.sys [x]
S3 RTLU3E8023-W7-64;Realtek USB GBE NIC Family Windows7 64bit Driver;c:\windows\system32\DRIVERS\rtu30x64w7.sys;c:\windows\SYSNATIVE\DRIVERS\rtu30x64w7.sys [x]
S3 rzendpt;rzendpt;c:\windows\system32\DRIVERS\rzendpt.sys;c:\windows\SYSNATIVE\DRIVERS\rzendpt.sys [x]
S3 rzudd;Razer Mouse Driver;c:\windows\system32\DRIVERS\rzudd.sys;c:\windows\SYSNATIVE\DRIVERS\rzudd.sys [x]
S3 usbfilter;AMD USB Filter Driver;c:\windows\system32\DRIVERS\usbfilter.sys;c:\windows\SYSNATIVE\DRIVERS\usbfilter.sys [x]
S3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:\windows\system32\drivers\viahduaa.sys;c:\windows\SYSNATIVE\drivers\viahduaa.sys [x]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2015-08-05 21:39 995144 ----a-w- c:\program files (x86)\Google\Chrome\Application\44.0.2403.130\Installer\chrmstp.exe
.
Inhalt des "geplante Tasks" Ordners
.
2015-08-10 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-08-30 17:42]
.
2015-08-09 c:\windows\Tasks\DropboxUpdateTaskUserS-1-5-21-1342784955-843073210-3021472217-1001Core.job
- c:\users\Beldi\AppData\Local\Dropbox\Update\DropboxUpdate.exe [2015-06-13 12:47]
.
2015-08-10 c:\windows\Tasks\DropboxUpdateTaskUserS-1-5-21-1342784955-843073210-3021472217-1001UA.job
- c:\users\Beldi\AppData\Local\Dropbox\Update\DropboxUpdate.exe [2015-06-13 12:47]
.
2015-08-10 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-09-04 17:52]
.
2015-08-10 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-09-04 17:52]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{41564952-412D-5637-4300-7A786E7484D7}]
2015-04-22 22:13 12680 ----a-w- c:\program files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7C\Passport_x64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{41564952-412D-5637-4300-7A786E7484D7}"= "c:\program files (x86)\AskPartnerNetwork\Toolbar\AVIRA-V7C\Passport_x64.dll" [2015-04-22 12680]
.
[HKEY_CLASSES_ROOT\CLSID\{41564952-412D-5637-4300-7A786E7484D7}]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2015-07-24 01:50 226328 ----a-w- c:\users\Beldi\AppData\Roaming\Dropbox\bin\DropboxExt64.27.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2015-07-24 01:50 226328 ----a-w- c:\users\Beldi\AppData\Roaming\Dropbox\bin\DropboxExt64.27.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2015-07-24 01:50 226328 ----a-w- c:\users\Beldi\AppData\Roaming\Dropbox\bin\DropboxExt64.27.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2015-07-24 01:50 226328 ----a-w- c:\users\Beldi\AppData\Roaming\Dropbox\bin\DropboxExt64.27.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveBlacklistedOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42}]
2015-06-20 11:48 774984 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedEditOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}]
2015-06-20 11:48 774984 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedViewOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43}]
2015-06-20 11:48 774984 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSyncedOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}]
2015-06-20 11:48 774984 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSyncingOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41}]
2015-06-20 11:48 774984 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvBackend"="c:\program files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe" [2015-06-03 2754704]
"ShadowPlay"="c:\windows\system32\nvspcap64.dll" [2015-06-03 1571696]
"ProfilerU"="c:\program files\SmartTechnology\Software\ProfilerU.exe" [2013-04-16 454144]
"SaiMfd"="c:\program files\SmartTechnology\Software\SaiMfd.exe" [2013-04-16 158208]
"AdAwareTray"="d:\programs\Ad-Aware Antivirus\11.7.485.8398\AdAwareTray.exe" [2015-06-24 9549808]
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = www.google.com
mDefault_Search_URL = about:blank
mDefault_Page_URL = about:blank
mStart Page = about:blank
mLocal Page = c:\windows\SysWOW64\blank.htm
mSearch Page = about:blank
uInternet Settings,ProxyOverride = *.local;<local>
uSearchAssistant = www.google.com
IE: Nach Microsoft E&xel exportieren - c:\program files (x86)\MICROS~1\Office12\EXCEL.EXE/3000
Trusted Zone: aeriagames.com
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Toolbar-Locked - (no file)
Wow6432Node-HKCU-Run-Zoner Photo Studio Service 16 - c:\program files\Zoner\Photo Studio 16\Program32\ZPSTRAY.EXEc:\program files\Zoner\Photo Studio 16\Program32\ZPSService.exe
Wow6432Node-HKCU-Run-JeysePehem - (no file)
Wow6432Node-HKLM-Run-<NO NAME> - (no file)
SafeBoot-WinFLAdrv.sys
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
Toolbar-Locked - (no file)
ShellIconOverlayIdentifiers-{472083B0-C522-11CF-8763-00608CC02F24} - (no file)
AddRemove-BattlEye for A2 - d:\programs\Steam\steamapps\common\Arma 2BattlEye\UnInstallBE.exe
AddRemove-SmartTools Publishing · AutoSave für Outlook - d:\programs\Outlook AutoSave\UNWISE.EXE
AddRemove-{FD9E03B5-AEEA-4D59-B512-6CE4AA0281D4} - c:\users\Beldi\AppData\Local\{5EB42881-1E29-48E3-9E86-E4B71E83A651}\BYKI4Installer.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\S-1-5-21-1342784955-843073210-3021472217-1001\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
@Allowed: (Read) (RestrictedCode)
"??"=hex:ea,36,df,e5,99,a5,ec,04,db,9c,3a,bd,f7,3c,7c,ec,02,39,0a,dc,00,b5,11,
d3,26,d8,52,c6,bd,a2,90,8d,1b,21,12,ed,5e,0c,ea,69,a3,e8,cb,ef,fb,65,33,80,\
"??"=hex:41,e0,42,8c,cf,55,c7,95,2b,14,4d,f8,66,7b,0c,1b
.
[HKEY_USERS\S-1-5-21-1342784955-843073210-3021472217-1001\Software\SecuROM\License information*]
"datasecu"=hex:0b,76,98,95,f1,be,df,04,f4,e0,86,ad,af,34,e8,df,43,66,85,c5,ee,
e0,b5,bb,72,bd,ae,98,7a,c5,33,b2,80,ee,be,01,39,98,24,01,db,14,93,d4,b0,6a,\
"rkeysecu"=hex:2f,0f,d5,3e,02,2b,06,63,b1,0b,dd,b6,71,e2,54,98
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_18_0_0_209_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_18_0_0_209_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
@Denied: (A 2) (Everyone)
@="IFlashBroker6"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_18_0_0_209_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_18_0_0_209_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_18_0_0_209.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.18"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_18_0_0_209.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_18_0_0_209.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_18_0_0_209.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
@Denied: (A 2) (Everyone)
@="IFlashBroker6"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\program files (x86)\Creative\Shared Files\CTAudSvc.exe
c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
c:\program files (x86)\Avira\AntiVir Desktop\avguard.exe
c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files (x86)\Common Files\Microsoft Shared\VS7Debug\mdm.exe
c:\program files\Tablet\Pen\WacomHost.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2015-08-10 14:59:36 - PC wurde neu gestartet
ComboFix-quarantined-files.txt 2015-08-10 12:59
.
Vor Suchlauf: 15 Verzeichnis(se), 128.420.433.920 Bytes frei
Nach Suchlauf: 21 Verzeichnis(se), 128.123.322.368 Bytes frei
.
- - End Of File - - 345B5461161425714BBF8E69FD284E7E
A36C5E4F47E84449FF07ED3517B43A31 |