ERLEDIGT!
unten der inhalt der logfile-datei.
den rechner habe ich erst mal nicht weiter angefasst.
Combofix Logfile: Code:
ComboFix 12-07-04.04 - ich 04.07.2012 20:16:05.1.4 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.49.1031.18.3069.1385 [GMT 2:00]
ausgeführt von:: c:\users\ich\Desktop\ComboFix.exe
AV: Panda Internet Security 2012 *Disabled/Updated* {86971480-9989-6750-B122-681A86518D59}
FW: Panda Personal Firewall 2012 *Disabled* {BEAC95A5-D3E6-6608-9A7D-C12F7882CA22}
SP: Panda Internet Security 2012 *Disabled/Updated* {3DF6F564-BFB3-68DE-8B92-5368FDD6C7E4}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
ADS - Windows: deleted 48 bytes in 1 streams.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\8364DA1918.sys
c:\users\ich\AppData\Local\assembly\tmp
c:\users\ich\AppData\Local\Temp\pdk-ich-4968\14d02158d1dc4c498d1acd9638684120\Name.dll
c:\users\ich\AppData\Local\Temp\pdk-ich-4968\1760917c94a6dfc5d7404399c61fafee\mysql.dll
c:\users\ich\AppData\Local\Temp\pdk-ich-4968\20252d6e001ae3774b425e81ba09b666\Fcntl.dll
c:\users\ich\AppData\Local\Temp\pdk-ich-4968\2076671ee5d0a5323570c92c74abac6f\Process.dll
c:\users\ich\AppData\Local\Temp\pdk-ich-4968\23ae7fb85999872530b5a5d4d67a4f44\Registry.dll
c:\users\ich\AppData\Local\Temp\pdk-ich-4968\23fe5d76b9491fa255db2281ac7687d5\Service.dll
c:\users\ich\AppData\Local\Temp\pdk-ich-4968\2909a292fcdc7512c1a68e25e2c8a70a\Array.dll
c:\users\ich\AppData\Local\Temp\pdk-ich-4968\2d2847f7dd2a1fddd0fdb79d9d64ba93\List.dll
c:\users\ich\AppData\Local\Temp\pdk-ich-4968\2f0807b0946b0fe6a4923ffadf1218fc\vxs.dll
c:\users\ich\AppData\Local\Temp\pdk-ich-4968\461090bfc26706cc26ffa02662c1592c\Syck.dll
c:\users\ich\AppData\Local\Temp\pdk-ich-4968\48a4e6ef370984d8d9ce53660d66a7a5\Unicode.dll
c:\users\ich\AppData\Local\Temp\pdk-ich-4968\4e3813a1edb6903dcc223941e51f7e18\Parser.dll
c:\users\ich\AppData\Local\Temp\pdk-ich-4968\52831fecbfbbfee1a05b91977e499808\File.dll
c:\users\ich\AppData\Local\Temp\pdk-ich-4968\52ade7602469b51858072e874c345e37\ReadKey.dll
c:\users\ich\AppData\Local\Temp\pdk-ich-4968\5f6960e0234e0b14396e4c82a1f56c8f\HiRes.dll
c:\users\ich\AppData\Local\Temp\pdk-ich-4968\5ff67c77560df778223e3ec495b98f1e\Hebrew.dll
c:\users\ich\AppData\Local\Temp\pdk-ich-4968\62aa3b09ac39e34fd76505142c94e975\Storable.dll
c:\users\ich\AppData\Local\Temp\pdk-ich-4968\6a834a555edd63cb8706466e7c1666f2\Hostname.dll
c:\users\ich\AppData\Local\Temp\pdk-ich-4968\6c1da131f436ce35edb0690f338bdad8\File.dll
c:\users\ich\AppData\Local\Temp\pdk-ich-4968\6c25de79371a4db1d7e8eff0d11d5337\Base64.dll
c:\users\ich\AppData\Local\Temp\pdk-ich-4968\6eca2cf2961ac400050de852a1cbef9b\Byte.dll
c:\users\ich\AppData\Local\Temp\pdk-ich-4968\7020d50af327e3fc94b98242c307fc81\Cwd.dll
c:\users\ich\AppData\Local\Temp\pdk-ich-4968\76c0175b78e6f49c7544e19221d4457d\IO.dll
c:\users\ich\AppData\Local\Temp\pdk-ich-4968\7dd16cc839f33995d1a58e2773aa29b8\WinError.dll
c:\users\ich\AppData\Local\Temp\pdk-ich-4968\81368e51ca54d10b955b02b2e5382e48\Peek.dll
c:\users\ich\AppData\Local\Temp\pdk-ich-4968\855297e7b4b860331fdbdd53426f5e15\Dumper.dll
c:\users\ich\AppData\Local\Temp\pdk-ich-4968\86351894c58e4804ca004825fea78bbb\Encode.dll
c:\users\ich\AppData\Local\Temp\pdk-ich-4968\880556fb31088a703b58d0705c4f2b53\DBI.dll
c:\users\ich\AppData\Local\Temp\pdk-ich-4968\89c552b9aa641030773cbce7545c6143\XS.dll
c:\users\ich\AppData\Local\Temp\pdk-ich-4968\90198bd2c008178752393a8740fa6369\XS.dll
c:\users\ich\AppData\Local\Temp\pdk-ich-4968\9076f6dacaea506ecfb169822b132706\MD5.dll
c:\users\ich\AppData\Local\Temp\pdk-ich-4968\952d7675581ad6751c38c1bc1610a553\EV.dll
c:\users\ich\AppData\Local\Temp\pdk-ich-4968\a25a24e2bf313aac977c088e9fc2ef8d\XSAccessor.dll
c:\users\ich\AppData\Local\Temp\pdk-ich-4968\a7c0cce4e1ac2c1f6d3e71bbe3c9bdd3\Socket.dll
c:\users\ich\AppData\Local\Temp\pdk-ich-4968\b7b4505cb0a127c242f14d779e410e03\POSIX.dll
c:\users\ich\AppData\Local\Temp\pdk-ich-4968\bb8ac2d2050e30577927a7ac95d99cd9\GD.dll
c:\users\ich\AppData\Local\Temp\pdk-ich-4968\bbd47973ed5d8e788aba7a048104ad0e\Scan.dll
c:\users\ich\AppData\Local\Temp\pdk-ich-4968\c06adade199b7f380d57181669fb22c1\Util.dll
c:\users\ich\AppData\Local\Temp\pdk-ich-4968\c3da4aa4c02db51c7f94d5eaf2438023\OLE.dll
c:\users\ich\AppData\Local\Temp\pdk-ich-4968\c82dfc62685be5146500ea5ff0f05368\SHA1.dll
c:\users\ich\AppData\Local\Temp\pdk-ich-4968\c8b0e39733c3e73e232a64a5c305ca76\API.dll
c:\users\ich\AppData\Local\Temp\pdk-ich-4968\e1ea0dbaf8a3ac5d1f0be83f219f8571\FastCalc.dll
c:\users\ich\AppData\Local\Temp\pdk-ich-4968\e775fca35641b4340ecf5cdba1fc6f62\Expat.dll
c:\users\ich\AppData\Local\Temp\pdk-ich-4968\f48694173221cfa9bad4275e2389b498\Win32.dll
c:\users\ich\AppData\Local\Temp\pdk-ich-4968\fc8b9fd242032de837413f14e26ce21c\Zlib.dll
c:\users\ich\AppData\Local\Temp\pdk-ich-4968\perl510.dll
c:\users\ich\AppData\Local\Temp\pdk-ich-744\20252d6e001ae3774b425e81ba09b666\Fcntl.dll
c:\users\ich\AppData\Local\Temp\pdk-ich-744\2076671ee5d0a5323570c92c74abac6f\Process.dll
c:\users\ich\AppData\Local\Temp\pdk-ich-744\23ae7fb85999872530b5a5d4d67a4f44\Registry.dll
c:\users\ich\AppData\Local\Temp\pdk-ich-744\23fe5d76b9491fa255db2281ac7687d5\Service.dll
c:\users\ich\AppData\Local\Temp\pdk-ich-744\2d2847f7dd2a1fddd0fdb79d9d64ba93\List.dll
c:\users\ich\AppData\Local\Temp\pdk-ich-744\6a834a555edd63cb8706466e7c1666f2\Hostname.dll
c:\users\ich\AppData\Local\Temp\pdk-ich-744\7020d50af327e3fc94b98242c307fc81\Cwd.dll
c:\users\ich\AppData\Local\Temp\pdk-ich-744\7dd16cc839f33995d1a58e2773aa29b8\WinError.dll
c:\users\ich\AppData\Local\Temp\pdk-ich-744\855297e7b4b860331fdbdd53426f5e15\Dumper.dll
c:\users\ich\AppData\Local\Temp\pdk-ich-744\86351894c58e4804ca004825fea78bbb\Encode.dll
c:\users\ich\AppData\Local\Temp\pdk-ich-744\a7c0cce4e1ac2c1f6d3e71bbe3c9bdd3\Socket.dll
c:\users\ich\AppData\Local\Temp\pdk-ich-744\b7b4505cb0a127c242f14d779e410e03\POSIX.dll
c:\users\ich\AppData\Local\Temp\pdk-ich-744\c3da4aa4c02db51c7f94d5eaf2438023\OLE.dll
c:\users\ich\AppData\Local\Temp\pdk-ich-744\f48694173221cfa9bad4275e2389b498\Win32.dll
c:\users\ich\AppData\Local\Temp\pdk-ich-744\perl510.dll
c:\users\ich\AppData\Roaming\Desktopicon
c:\users\ich\AppData\Roaming\inst.exe
c:\users\ich\GoToAssistDownloadHelper.exe
c:\windows\IsUn0407.exe
c:\windows\pkunzip.pif
c:\windows\pkzip.pif
c:\windows\system32\~GLH0045.TMP
c:\windows\system32\~GLH0054.TMP
c:\windows\system32\suf575B.tmp
c:\windows\system32\tmp5574.tmp
c:\windows\system32\tmpEBE8.tmp
c:\windows\system32\tmpEBF9.tmp
c:\windows\unin0407.exe
N:\Autorun.inf
.
.
((((((((((((((((((((((( Dateien erstellt von 2012-06-04 bis 2012-07-04 ))))))))))))))))))))))))))))))
.
.
2012-07-02 17:23 . 2012-07-02 17:33 -------- d-----w- C:\_OTL
2012-07-01 23:24 . 2012-07-01 23:24 40776 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2012-07-01 22:17 . 2012-07-01 22:17 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2012-07-01 21:50 . 2012-07-01 21:50 -------- d-----w- c:\users\ich\AppData\Roaming\Malwarebytes
2012-07-01 21:50 . 2012-07-01 21:50 -------- d-----w- c:\programdata\Malwarebytes
2012-07-01 21:50 . 2012-04-04 13:56 22344 ----a-w- c:\windows\system32\drivers\mbam.sys
2012-06-21 23:10 . 2012-06-02 22:19 53784 ----a-w- c:\windows\system32\wuauclt.exe
2012-06-21 23:10 . 2012-06-02 22:19 45080 ----a-w- c:\windows\system32\wups2.dll
2012-06-21 23:10 . 2012-06-02 22:19 1933848 ----a-w- c:\windows\system32\wuaueng.dll
2012-06-21 23:10 . 2012-06-02 22:12 2422272 ----a-w- c:\windows\system32\wucltux.dll
2012-06-21 23:09 . 2012-06-02 22:19 35864 ----a-w- c:\windows\system32\wups.dll
2012-06-21 23:09 . 2012-06-02 22:19 577048 ----a-w- c:\windows\system32\wuapi.dll
2012-06-21 23:09 . 2012-06-02 22:12 88576 ----a-w- c:\windows\system32\wudriver.dll
2012-06-21 23:09 . 2012-06-02 13:19 171904 ----a-w- c:\windows\system32\wuwebv.dll
2012-06-21 23:09 . 2012-06-02 13:12 33792 ----a-w- c:\windows\system32\wuapp.exe
2012-06-21 19:52 . 2012-06-21 20:14 -------- d-----w- c:\users\ich\AppData\Roaming\redsn0w
2012-06-21 19:18 . 2012-06-21 19:18 -------- d-----w- c:\program files\iPod
2012-06-21 19:11 . 2012-06-21 19:11 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin7.dll
2012-06-21 19:11 . 2012-06-21 19:11 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin6.dll
2012-06-21 19:11 . 2012-06-21 19:11 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin5.dll
2012-06-21 19:11 . 2012-06-21 19:11 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin4.dll
2012-06-21 19:11 . 2012-06-21 19:11 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin3.dll
2012-06-21 19:11 . 2012-06-21 19:11 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin2.dll
2012-06-21 19:11 . 2012-06-21 19:11 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin.dll
2012-06-21 19:08 . 2012-06-21 19:08 -------- d-----w- c:\program files\Bonjour
2012-06-12 20:22 . 2012-05-01 14:03 180736 ----a-w- c:\windows\system32\drivers\rdpwd.sys
2012-06-12 20:22 . 2012-05-15 19:51 2045440 ----a-w- c:\windows\system32\win32k.sys
2012-06-07 22:31 . 2004-07-13 23:05 356431 ----a-w- c:\windows\system32\GDS32.DLL
2012-06-07 22:29 . 2000-08-20 21:00 1388544 ----a-w- c:\windows\system32\temp.014
2012-06-07 22:29 . 1999-05-05 19:22 282896 ----a-w- c:\windows\system32\temp.013
2012-06-07 22:29 . 1999-05-05 19:22 16384 ----a-w- c:\windows\system32\temp.012
2012-06-05 22:49 . 2012-06-05 22:49 -------- d-----w- c:\users\ich\AppData\Local\Kuvva
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-05-02 00:46 . 2012-05-02 00:46 4472832 ----a-w- c:\windows\system32\GPhotos.scr
2012-04-25 10:11 . 2012-04-25 10:11 4547944 ----a-w- c:\windows\system32\usbaaplrc.dll
2012-04-25 10:11 . 2012-04-25 10:11 43520 ----a-w- c:\windows\system32\drivers\usbaapl.sys
2012-04-24 19:46 . 2012-04-07 12:51 418464 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2012-04-24 19:46 . 2011-06-16 08:53 70304 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-04-18 18:56 . 2012-04-18 18:56 94208 ----a-w- c:\windows\system32\QuickTimeVR.qtx
2012-04-18 18:56 . 2012-04-18 18:56 69632 ----a-w- c:\windows\system32\QuickTime.qts
2012-04-09 14:43 . 2010-06-10 23:10 16400 ----a-w- c:\windows\system32\drivers\LNonPnP.sys
2010-07-08 08:37 . 2010-07-08 08:37 101544 ----a-w- c:\program files\Common Files\LinkInstaller.exe
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2011-12-05 19:17 94208 ----a-w- c:\users\ich\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2011-12-05 19:17 94208 ----a-w- c:\users\ich\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2011-12-05 19:17 94208 ----a-w- c:\users\ich\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2011-12-05 19:17 94208 ----a-w- c:\users\ich\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ISUSPM Startup"="c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2005-08-11 249856]
"PicPick Start"="c:\program files\- Computereinrichtung -\PicPick\picpick.exe" [2010-07-30 4972032]
"Ditto"="c:\program files\- Computereinrichtung -\Ditto\Ditto.exe" [2009-08-16 716800]
"SyncMyCal"="c:\program files\- Sonstige Programme -\SyncMyCal\SyncMyCal.exe" [2009-12-29 213584]
"TrueCrypt"="c:\program files\- Computereinrichtung -\TrueCrypt\TrueCrypt.exe" [2012-04-02 1516496]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-10-07 13584928]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-10-07 92704]
"Bluetooth HCI Monitor"="HCIMNTR.DLL" [2006-12-07 9728]
"Clean Desktop"="c:\program files\- Computereinrichtung -\Clean Desktop\Clean Desktop 3\clean_desktop.exe" [2007-02-27 80384]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2011-04-20 58656]
"EvtMgr6"="c:\program files\Logitech\SetPointP\SetPoint.exe" [2010-10-28 1352272]
"APVXDWIN"="c:\program files\- Wartung & Sicherheit -\Panda IS 12\APVXDWIN.EXE" [2011-04-13 1000768]
"SCANINICIO"="c:\program files\- Wartung & Sicherheit -\Panda IS 12\Inicio.exe" [2011-02-02 70464]
"AdobeAAMUpdater-1.0"="c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2010-07-28 497648]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-04-08 254696]
"SMART Board Service"="c:\program files\SMART Technologies\Education Software\SMARTBoardService.exe" [2011-07-13 1761136]
"SMART Board Tools"="c:\program files\SMART Technologies\Education Software\SMARTBoardTools.exe" [2011-06-23 9800560]
"PMBVolumeWatcher"="c:\program files\- Foto -\Sony Image Data Suite\PMB\PMBVolumeWatcher.exe" [2010-11-26 648032]
"LWS"="c:\program files\- Foto -\Logitech WebCam\LWS\Webcam Software\LWS.exe" [2010-05-07 165208]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-05-30 59280]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2012-04-18 421888]
"iTunesHelper"="c:\program files\- Player & Brennen -\iTunes\iTunesHelper.exe" [2012-06-07 421776]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
BTTray.lnk - c:\program files\- Computereinrichtung -\Bluetooth Software\BTTray.exe [2007-2-13 715568]
Squeezebox Server-Taskleisten-Tool.lnk - c:\program files\- Player & Brennen -\Squeezebox\SqueezeTray.exe [2010-2-27 2351191]
Twonky Tray Control.lnk - c:\program files\TwonkyMedia\twonkymediaserverconfig.exe [2011-6-23 612104]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avldr]
2010-03-24 10:55 55552 ----a-w- c:\windows\System32\avldr.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PskSvcRetail]
@="Service"
.
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^SMART-Board-Werkzeuge.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\SMART-Board-Werkzeuge.lnk
backup=c:\windows\pss\SMART-Board-Werkzeuge.lnk.CommonStartup
backupExtension=.CommonStartup
.
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^t@x aktuell.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\t@x aktuell.lnk
backup=c:\windows\pss\t@x aktuell.lnk.CommonStartup
backupExtension=.CommonStartup
.
[HKLM\~\startupfolder\C:^Users^ich^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Clean Desktop.lnk]
path=c:\users\ich\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Clean Desktop.lnk
backup=c:\windows\pss\Clean Desktop.lnk.Startup
backupExtension=.Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acronis Scheduler2 Service]
2009-11-12 04:42 362032 ----a-w- c:\program files\Common Files\Acronis\Schedule2\schedhlp.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CloneCDTray]
2006-09-28 19:21 57344 ----a-w- c:\program files\- Player & Brennen -\Clone CD_DVD\CloneCD\CloneCDTray.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Eraser]
2010-11-04 21:09 980368 ----a-w- c:\progra~1\-COMPU~1\Eraser\Eraser.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
2010-06-16 18:52 136176 ----atw- c:\users\ich\AppData\Local\Google\Update\GoogleUpdate.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2012-04-18 18:56 421888 ----a-w- c:\program files\QuickTime\QTTask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SigmatelSysTrayApp]
2007-05-06 15:10 405504 ----a-w- c:\program files\SigmaTel\C-Major Audio\WDM\sttray.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SSS2007 File Redirection Starter]
2007-05-15 14:18 53248 ----a-w- c:\program files\- Wartung & Sicherheit -\Steganos Security Suite 2007\fredirstarter.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SSS2007 HotKeys]
2007-05-21 09:11 25088 ----a-w- c:\program files\- Wartung & Sicherheit -\Steganos Security Suite 2007\SteganosHotKeyService.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SSS2007 PasswordManagerFFAutoFill]
2007-05-21 09:11 21504 ----a-w- c:\program files\- Wartung & Sicherheit -\Steganos Security Suite 2007\PasswordManagerFFAutoFill.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SSS2008 File Redirection Starter]
2007-10-11 15:40 57344 ----a-w- c:\users\ich\Desktop\Wartung & Sicherheit\Steganos Privacy Suite\fredirstarter.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SSS2008 HotKeys]
2007-10-12 14:29 25088 ----a-w- c:\users\ich\Desktop\Wartung & Sicherheit\Steganos Privacy Suite\SteganosHotKeyService.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SSS2008 PasswordManagerFFAutoFill]
2007-10-12 14:29 21504 ----a-w- c:\users\ich\Desktop\Wartung & Sicherheit\Steganos Privacy Suite\PasswordManagerFFAutoFill.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2011-04-08 10:59 254696 ----a-w- c:\program files\Common Files\Java\Java Update\jusched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TrueImageMonitor.exe]
2009-11-12 04:42 5140960 ----a-w- c:\program files\- Wartung & Sicherheit -\Acronis True Image\TrueImageMonitor.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\USBToolTip]
2007-02-20 09:07 199752 ----a-w- c:\progra~1\Pinnacle\SHARED~1\Programs\USBTip\USBTip.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WMPNSCFG]
2008-01-19 07:33 202240 ----a-w- c:\program files\Windows Media Player\wmpnscfg.exe
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"ISUSPM Startup"="c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" -start
"iTunesHelper"="c:\program files\- Player & Brennen -\iTunes\iTunesHelper.exe"
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-2038763042-2180243786-335070420-1000]
"EnableNotifications"=dword:00000001
"EnableNotificationsRef"=dword:00000001
.
R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [x]
S2 acedrv10;acedrv10;c:\windows\system32\drivers\acedrv10.sys [x]
S2 acehlp10;acehlp10;c:\windows\system32\drivers\acehlp10.sys [x]
S2 AdobeActiveFileMonitor9.0;Adobe Active File Monitor V9;c:\program files\- Foto -\Photoshop Elements\Elements 9 Organizer\PhotoshopElementsFileAgent.exe [x]
S2 afcdpsrv;Acronis Nonstop Backup service;c:\program files\Common Files\Acronis\CDP\afcdpsrv.exe [x]
S3 afcdp;afcdp;c:\windows\system32\DRIVERS\afcdp.sys [x]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - WS2IFSL
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs REG_MULTI_SZ BthServ
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{A8D647C8-65AC-409F-B7B2-3C0FEE1A32F2}]
2010-02-16 17:02 114688 ----a-w- c:\program files\PixiePack Codec Pack\InstallerHelper.exe
.
Inhalt des "geplante Tasks" Ordners
.
2012-06-23 c:\windows\Tasks\1-Klick-Wartung.job
- c:\program files\- Wartung & Sicherheit -\TuneUp Utilities 2009\OneClickStarter.exe [2008-12-11 18:07]
.
2012-07-04 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-07 19:46]
.
2012-07-01 c:\windows\Tasks\At1.job
- c:\program files\- Wartung & Sicherheit -\Panda IS 12\PAVJOBS.EXE [2011-07-29 18:18]
.
2012-07-04 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-03 18:52]
.
2012-07-04 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-03 18:52]
.
2012-07-04 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2038763042-2180243786-335070420-1000Core.job
- c:\users\ich\AppData\Local\Google\Update\GoogleUpdate.exe [2010-09-06 18:52]
.
2012-07-04 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2038763042-2180243786-335070420-1000UA.job
- c:\users\ich\AppData\Local\Google\Update\GoogleUpdate.exe [2010-09-06 18:52]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = about:blank
mStart Page = about:blank
uInternet Settings,ProxyServer = 190.102.206.48:8080
uInternet Settings,ProxyOverride = *.local
IE: &Download by Orbit - c:\program files\- Internet -\Orbit Downloader\orbitmxt.dll/201
IE: &Grab video by Orbit - c:\program files\- Internet -\Orbit Downloader\orbitmxt.dll/204
IE: add to &BOM - d:\\-COPY-~1\\BIET-O~1\\\\AddToBOM.hta
IE: Add to &Evernote - c:\program files\Evernote\enbar.dll/2000
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: Bild an &Bluetooth-Gerät senden... - c:\program files\- Computereinrichtung -\Bluetooth Software\btsendto_ie_ctx.htm
IE: Do&wnload selected by Orbit - c:\program files\- Internet -\Orbit Downloader\orbitmxt.dll/203
IE: Down&load all by Orbit - c:\program files\- Internet -\Orbit Downloader\orbitmxt.dll/202
IE: Mit GetRight downloaden - c:\program files\- Internet -\GetRight\GRdownload.htm
IE: Mit Getright-Browser öffnen - c:\program files\- Internet -\GetRight\GRbrowse.htm
IE: Nach Microsoft &Excel exportieren - c:\progra~1\-OFFIC~1\MICROS~1\2003\OFFICE11\EXCEL.EXE/3000
IE: Nach Microsoft E&xcel exportieren - c:\progra~1\-OFFIC~1\MICROS~1\2010\Office14\EXCEL.EXE/3000
IE: Nach Microsoft E&xel exportieren - c:\progra~1\-OFFIC~1\MICROS~1\2007\Office12\EXCEL.EXE/3000
IE: Seite an &Bluetooth-Gerät senden... - c:\program files\- Computereinrichtung -\Bluetooth Software\btsendto_ie.htm
IE: {{1CE4DE72-7FCC-4eb8-8F66-AE6A56A0A54D} - {0854DA01-5BF8-4E9D-A0E9-3CD5500AFB8C} - c:\program files\Common Files\WebSpeech.4.0\LgxIEBar.dll
TCP: Interfaces\{383897AC-0679-41D9-9BFE-EE35629B3D56}: NameServer = 10.95.80.1
DPF: {41602003-2956-11D0-BA24-080009D9611D} - hxxp://www.simpletoon.com/SimpleToon.cab
FF - ProfilePath - c:\users\ich\AppData\Roaming\Mozilla\Firefox\Profiles\6x0uvplz.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2319825&SearchSource=3&q={searchTerms}
FF - prefs.js: browser.search.selectedEngine - Google.de Bildersuche
FF - prefs.js: browser.startup.homepage - hxxp://www.google.de/ig
FF - prefs.js: keyword.URL - chrome://browser-region/locale/region.properties
FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: nglayout.initialpaint.delay - 600
FF - user.js: content.notify.interval - 600000
FF - user.js: content.max.tokenizing.time - 1800000
FF - user.js: content.switch.threshold - 600000
.
.
------- Dateityp-Verknüpfung -------
.
JSEFile=c:\progra~1\-WARTU~1\PANDAI~2\PAVSCRIP.EXE "%1" %*
VBEFile=c:\progra~1\-WARTU~1\PANDAI~2\PAVSCRIP.EXE "%1" %*
VBSFile=c:\progra~1\-WARTU~1\PANDAI~2\PAVSCRIP.EXE "%1" %*
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
URLSearchHooks-{40c3cc16-7269-4b32-9531-17f2950fb06f} - (no file)
URLSearchHooks-{872b5b88-9db5-4310-bdd0-ac189557e5f5} - (no file)
MSConfigStartUp-ALDI Foto Service - c:\program files\- Foto -\ALDI Bestellsoftware\FotoSuite.exe
MSConfigStartUp-ALDI_NORD_FotoSuite_Download - c:\program files\- Foto -\ALDI Bestellsoftware\FotoSuite.exe
MSConfigStartUp-NBKeyScan - c:\program files\- Player & Brennen -\Nero\Nero 8\Nero BackItUp\NBKeyScan.exe
MSConfigStartUp-NeroFilterCheck - c:\program files\Common Files\Nero\Lib\NeroCheck.exe
MSConfigStartUp-PC Suite Tray - c:\program files\- Handy -\Nokia PC Suite\Nokia PC Suite 7\PCSuite.exe
MSConfigStartUp-TrayServer - c:\program files\- Player & Brennen -Video Deluxe 15 Plus\TrayServer.exe
MSConfigStartUp-UpdatePDRShortCut - c:\program files\- Player & Brennen -\CyberLink PowerDirector 7\PowerDirector\MUITransfer\MUIStartMenu.exe
AddRemove-Kuck mal Kunst - c:\windows\IsUn0407.exe
AddRemove-Photo-Objects 25 000 Premium Image Collection - c:\windows\IsUn0407.exe
AddRemove-Take ONE 4 - c:\windows\IsUn0407.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2012-07-04 20:34
Windows 6.0.6002 Service Pack 2 NTFS
.
Scanne versteckte Prozesse...
.
Scanne versteckte Autostarteinträge...
.
Scanne versteckte Dateien...
.
Scan erfolgreich abgeschlossen
versteckte Dateien: 0
.
**************************************************************************
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\Approved Extensions]
@Denied: (2) (LocalSystem)
"{F053C368-5458-45B2-9B4D-D8914BDDDBFF}"=hex:51,66,7a,6c,4c,1d,38,12,06,c0,40,
f4,6a,1a,dc,00,e4,5b,9b,d1,4e,83,9f,eb
"{D4027C7F-154A-4066-A1AD-4243D8127440}"=hex:51,66,7a,6c,4c,1d,38,12,11,7f,11,
d0,78,5b,08,05,de,bb,01,03,dd,4c,30,54
"{10945114-B19F-4614-8450-B25E444A1020}"=hex:51,66,7a,6c,4c,1d,38,12,7a,52,87,
14,ad,ff,7a,03,fb,46,f1,1e,41,14,54,34
"{1427A821-7B93-4F08-9A34-9FA03A3D93DB}"=hex:51,66,7a,6c,4c,1d,38,12,4f,ab,34,
10,a1,35,66,0a,e5,22,dc,e0,3f,63,d7,cf
"{18DF081C-E8AD-4283-A596-FA578C2EBDC3}"=hex:51,66,7a,6c,4c,1d,38,12,72,0b,cc,
1c,9f,a6,ed,07,da,80,b9,17,89,70,f9,d7
"{83A30C59-3A50-49E6-9DAF-4923C4EA3C23}"=hex:51,66,7a,6c,4c,1d,38,12,37,0f,b0,
87,62,74,88,0c,e2,b9,0a,63,c1,b4,78,37
"{DBC80044-A445-435B-BC74-9C25C1C588A9}"=hex:51,66,7a,6c,4c,1d,38,12,2a,03,db,
df,77,ea,35,06,c3,62,df,65,c4,9b,cc,bd
"{00000000-5736-4205-0009-69923075AC16}"=hex:51,66,7a,6c,4c,1d,38,12,6e,03,13,
04,04,19,6b,07,7f,1f,2a,d2,35,2b,e8,02
"{00000000-5736-4205-0009-C3C68D1BC971}"=hex:51,66,7a,6c,4c,1d,38,12,6e,03,13,
04,04,19,6b,07,7f,1f,80,86,88,45,8d,65
"{FF059E31-CC5A-4E2E-BF3B-96E929D65503}"=hex:51,66,7a,6c,4c,1d,38,12,5f,9d,16,
fb,68,82,40,0b,c0,2d,d5,a9,2c,88,11,17
"{2D9700CB-A777-4DB0-96E1-1EBEBB7D1510}"=hex:51,66,7a,6c,4c,1d,38,12,a5,03,84,
29,45,e9,de,08,e9,f7,5d,fe,be,23,51,04
"{BDEADE7F-C265-11D0-BCED-00A0C90AB50F}"=hex:51,66,7a,6c,4c,1d,38,12,11,dd,f9,
b9,57,8c,be,54,c3,fb,43,e0,cc,54,f1,1b
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration]
@Denied: (2) (LocalSystem)
"Timestamp"=hex:3c,d1,6f,a2,eb,4d,cc,01
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (LocalSystem)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,b4,aa,d5,2f,a4,bf,32,49,8b,df,48,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,b4,aa,d5,2f,a4,bf,32,49,8b,df,48,\
.
[HKEY_USERS\S-1-5-21-2038763042-2180243786-335070420-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.032\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.032"
.
[HKEY_USERS\S-1-5-21-2038763042-2180243786-335070420-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.apd\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.apd"
.
[HKEY_USERS\S-1-5-21-2038763042-2180243786-335070420-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.arw\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.arw"
.
[HKEY_USERS\S-1-5-21-2038763042-2180243786-335070420-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bw\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.bw"
.
[HKEY_USERS\S-1-5-21-2038763042-2180243786-335070420-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bwf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.bwf"
.
[HKEY_USERS\S-1-5-21-2038763042-2180243786-335070420-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.caf\UserChoice]
@Denied: (2) (S-1-5-21-2038763042-2180243786-335070420-1000)
@Denied: (2) (LocalSystem)
"Progid"="caf_auto_file"
.
[HKEY_USERS\S-1-5-21-2038763042-2180243786-335070420-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cdda\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.cdda"
.
[HKEY_USERS\S-1-5-21-2038763042-2180243786-335070420-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cel\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.cel"
.
[HKEY_USERS\S-1-5-21-2038763042-2180243786-335070420-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.djv\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.djv"
.
[HKEY_USERS\S-1-5-21-2038763042-2180243786-335070420-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.fff\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.fff"
.
[HKEY_USERS\S-1-5-21-2038763042-2180243786-335070420-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.hdr\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.hdr"
.
[HKEY_USERS\S-1-5-21-2038763042-2180243786-335070420-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.icn\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.icn"
.
[HKEY_USERS\S-1-5-21-2038763042-2180243786-335070420-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ilbm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.ilbm"
.
[HKEY_USERS\S-1-5-21-2038763042-2180243786-335070420-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.int\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.int"
.
[HKEY_USERS\S-1-5-21-2038763042-2180243786-335070420-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.inta\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.inta"
.
[HKEY_USERS\S-1-5-21-2038763042-2180243786-335070420-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.iw4\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.iw4"
.
[HKEY_USERS\S-1-5-21-2038763042-2180243786-335070420-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.j2c\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.j2c"
.
[HKEY_USERS\S-1-5-21-2038763042-2180243786-335070420-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jbr\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.jbr"
.
[HKEY_USERS\S-1-5-21-2038763042-2180243786-335070420-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jif\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.jif"
.
[HKEY_USERS\S-1-5-21-2038763042-2180243786-335070420-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpk\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.jpk"
.
[HKEY_USERS\S-1-5-21-2038763042-2180243786-335070420-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m15\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.m15"
.
[HKEY_USERS\S-1-5-21-2038763042-2180243786-335070420-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1a\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.m1a"
.
[HKEY_USERS\S-1-5-21-2038763042-2180243786-335070420-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m2a\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.m2a"
.
[HKEY_USERS\S-1-5-21-2038763042-2180243786-335070420-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m75\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.m75"
.
[HKEY_USERS\S-1-5-21-2038763042-2180243786-335070420-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mef\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.mef"
.
[HKEY_USERS\S-1-5-21-2038763042-2180243786-335070420-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mos\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.mos"
.
[HKEY_USERS\S-1-5-21-2038763042-2180243786-335070420-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pbr\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.pbr"
.
[HKEY_USERS\S-1-5-21-2038763042-2180243786-335070420-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pics\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.pics"
.
[HKEY_USERS\S-1-5-21-2038763042-2180243786-335070420-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pix\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.pix"
.
[HKEY_USERS\S-1-5-21-2038763042-2180243786-335070420-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pspbrush\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.pspbrush"
.
[HKEY_USERS\S-1-5-21-2038763042-2180243786-335070420-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pspimage\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.pspimage"
.
[HKEY_USERS\S-1-5-21-2038763042-2180243786-335070420-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.qcp\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.qcp"
.
[HKEY_USERS\S-1-5-21-2038763042-2180243786-335070420-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.qtpf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.qtpf"
.
[HKEY_USERS\S-1-5-21-2038763042-2180243786-335070420-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rgba\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.rgba"
.
[HKEY_USERS\S-1-5-21-2038763042-2180243786-335070420-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rsb\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.rsb"
.
[HKEY_USERS\S-1-5-21-2038763042-2180243786-335070420-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rw2\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.rw2"
.
[HKEY_USERS\S-1-5-21-2038763042-2180243786-335070420-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rwl\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.rwl"
.
[HKEY_USERS\S-1-5-21-2038763042-2180243786-335070420-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.sdv\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.sdv"
.
[HKEY_USERS\S-1-5-21-2038763042-2180243786-335070420-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.sfil\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.sfil"
.
[HKEY_USERS\S-1-5-21-2038763042-2180243786-335070420-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.smf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.smf"
.
[HKEY_USERS\S-1-5-21-2038763042-2180243786-335070420-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.sml\UserChoice]
@Denied: (2) (S-1-5-21-2038763042-2180243786-335070420-1000)
@Denied: (2) (LocalSystem)
"Progid"="Applications\\notepad.exe"
.
[HKEY_USERS\S-1-5-21-2038763042-2180243786-335070420-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.swa\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.swa"
.
[HKEY_USERS\S-1-5-21-2038763042-2180243786-335070420-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ulw\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.ulw"
.
[HKEY_USERS\S-1-5-21-2038763042-2180243786-335070420-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.v11o\UserChoice]
@Denied: (2) (S-1-5-21-2038763042-2180243786-335070420-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Foto-Manager 2009.v11o"
.
[HKEY_USERS\S-1-5-21-2038763042-2180243786-335070420-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.v11p\UserChoice]
@Denied: (2) (S-1-5-21-2038763042-2180243786-335070420-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Foto-Manager 2009.v11p"
.
[HKEY_USERS\S-1-5-21-2038763042-2180243786-335070420-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.v11pf\UserChoice]
@Denied: (2) (S-1-5-21-2038763042-2180243786-335070420-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Foto-Manager 2009.v11pf"
.
[HKEY_USERS\S-1-5-21-2038763042-2180243786-335070420-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.v30po\UserChoice]
@Denied: (2) (S-1-5-21-2038763042-2180243786-335070420-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.v30po"
.
[HKEY_USERS\S-1-5-21-2038763042-2180243786-335070420-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.v30pp\UserChoice]
@Denied: (2) (S-1-5-21-2038763042-2180243786-335070420-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.v30pp"
.
[HKEY_USERS\S-1-5-21-2038763042-2180243786-335070420-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.v30ppf\UserChoice]
@Denied: (2) (S-1-5-21-2038763042-2180243786-335070420-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.v30ppf"
.
[HKEY_USERS\S-1-5-21-2038763042-2180243786-335070420-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vfw\UserChoice]
@Denied: (2) (LocalSystem)
@Denied: (2) (S-1-5-21-2038763042-2180243786-335070420-1000)
"Progid"="ACDSee Pro 3.vfw"
.
[HKEY_USERS\S-1-5-21-2038763042-2180243786-335070420-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wbm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.wbm"
.
[HKEY_USERS\S-1-5-21-2038763042-2180243786-335070420-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xif\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.xif"
.
[HKEY_USERS\S-1-5-21-2038763042-2180243786-335070420-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xmp\UserChoice]
@Denied: (2) (S-1-5-21-2038763042-2180243786-335070420-1000)
@Denied: (2) (LocalSystem)
"Progid"="ACDSee Pro 3.xmp"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------
.
- - - - - - - > 'Explorer.exe'(9424)
c:\program files\- Wartung & Sicherheit -\Panda IS 12\pavoepl.dll
c:\program files\- Computereinrichtung -\Ditto\focus.dll
c:\users\ich\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
c:\windows\system32\btmmhook.dll
c:\windows\system32\btncopy.dll
c:\program files\- iPhone -\WinSCP\DragExt.dll
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\windows\system32\nvvsvc.exe
c:\program files\- Wartung & Sicherheit -\Panda IS 12\PskSvc.exe
c:\program files\- Wartung & Sicherheit -\Panda IS 12\TPSrv.exe
c:\program files\- WARTUNG & SICHERHEIT -\PANDA IS 12\WebProxy.exe
c:\windows\system32\rundll32.exe
c:\program files\Common Files\LogiShrd\Bluetooth\lbtserv.exe
c:\windows\SYSTEM32\WISPTIS.EXE
c:\program files\Common Files\microsoft shared\ink\TabTip.exe
c:\windows\system32\WUDFHost.exe
c:\windows\SYSTEM32\WISPTIS.EXE
c:\program files\Common Files\microsoft shared\ink\TabTip.exe
c:\windows\system32\conime.exe
c:\windows\System32\rundll32.exe
c:\program files\Common Files\Acronis\Schedule2\schedul2.exe
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Common Files\MAGIX Services\Database\bin\FABS.exe
c:\program files\- Wartung & Sicherheit -\Hotspot Shield\bin\openvpnas.exe
c:\program files\- Wartung & Sicherheit -\Hotspot Shield\HssWPR\hsssrv.exe
c:\program files\Common Files\Logishrd\LVMVFM\LVPrcSrv.exe
c:\program files\- Wartung & Sicherheit -\Panda IS 12\PsCtrls.exe
c:\program files\- Wartung & Sicherheit -\Panda IS 12\PavFnSvr.exe
c:\program files\Common Files\Panda Security\PavShld\pavprsrv.exe
c:\program files\- Wartung & Sicherheit -\Panda IS 12\pavsrvx86.exe
c:\program files\- Wartung & Sicherheit -\Panda IS 12\AVENGINE.EXE
c:\program files\- Foto -\Sony Image Data Suite\PMB\PMBDeviceInfoProvider.exe
c:\program files\- wartung & sicherheit -\panda is 12\firewall\PSHOST.EXE
c:\program files\- Wartung & Sicherheit -\Panda IS 12\PsImSvc.exe
c:\program files\Common Files\Protexis\License Service\PsiService_2.exe
c:\windows\system32\SatSrv.exe
c:\progra~1\-PLAYE~1\SQUEEZ~1\server\Bin\MSWIN3~1\mysqld.exe
c:\windows\system32\STacSV.exe
c:\program files\- Player & Brennen -\Alcohol 120\StarWind\StarWindServiceAE.exe
c:\windows\System32\TUProgSt.exe
c:\program files\TwonkyMedia\twonkymediaserverwatchdog.exe
c:\program files\TwonkyMedia\TwonkyMediaServer.exe
c:\windows\system32\WUDFHost.exe
c:\program files\iPod\bin\iPodService.exe
c:\progra~1\-PLAYE~1\SQUEEZ~1\server\SQUEEZ~3.EXE
c:\program files\- Wartung & Sicherheit -\Hotspot Shield\bin\openvpntray.exe
c:\program files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe
c:\program files\- Wartung & Sicherheit -\Panda IS 12\SRVLOAD.EXE
c:\program files\- Wartung & Sicherheit -\Panda IS 12\PavBckPT.exe
c:\windows\system32\wbem\unsecapp.exe
c:\\?\c:\windows\system32\wbem\WMIADAP.EXE
.
**************************************************************************
.
Zeit der Fertigstellung: 2012-07-04 20:38:45 - PC wurde neu gestartet
ComboFix-quarantined-files.txt 2012-07-04 18:38
.
Vor Suchlauf: 8.460.374.016 Bytes frei
Nach Suchlauf: 8.114.823.168 Bytes frei
.
- - End Of File - - CC185F5C54C1E7CBA56BAB7C1464B277
--- --- --- |
