| microdns | 25.03.2013 11:56 |
Code:
ComboFix 13-03-24.03 - xxxxx 25.03.2013 9:50.3.4 - x64
Microsoft Windows 7 Professional 6.1.7601.1.1252.43.1031.18.4079.2695 [GMT 1:00]
ausgeführt von:: c:\users\xxxxx\Desktop\ComboFix.exe
Benutzte Befehlsschalter :: c:\users\xxxxx\Desktop\CFScript.txt
AV: Trend Micro Security Agent *Enabled/Updated* {7193B549-236F-55EE-9AEC-F65279E59A92}
FW: Trend Micro Personal Firewall *Disabled* {49A8346C-6900-54B6-B1B3-5F678736DDE9}
SP: Trend Micro Security Agent *Enabled/Updated* {CAF254AD-0555-5A60-A05C-CD200262D02F}
SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
FILE ::
"c:\windows\System32\ojswjz.ouu"
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\xxxxx\AppData\Local\Temp\_MEI18482\_ctypes.pyd
c:\users\xxxxx\AppData\Local\Temp\_MEI18482\_elementtree.pyd
c:\users\xxxxx\AppData\Local\Temp\_MEI18482\_hashlib.pyd
c:\users\xxxxx\AppData\Local\Temp\_MEI18482\_socket.pyd
c:\users\xxxxx\AppData\Local\Temp\_MEI18482\_ssl.pyd
c:\users\xxxxx\AppData\Local\Temp\_MEI18482\pyexpat.pyd
c:\users\xxxxx\AppData\Local\Temp\_MEI18482\pysqlite2._sqlite.pyd
c:\users\xxxxx\AppData\Local\Temp\_MEI18482\python27.dll
c:\users\xxxxx\AppData\Local\Temp\_MEI18482\pythoncom27.dll
c:\users\xxxxx\AppData\Local\Temp\_MEI18482\PyWinTypes27.dll
c:\users\xxxxx\AppData\Local\Temp\_MEI18482\select.pyd
c:\users\xxxxx\AppData\Local\Temp\_MEI18482\unicodedata.pyd
c:\users\xxxxx\AppData\Local\Temp\_MEI18482\win32api.pyd
c:\users\xxxxx\AppData\Local\Temp\_MEI18482\win32com.shell.shell.pyd
c:\users\xxxxx\AppData\Local\Temp\_MEI18482\win32crypt.pyd
c:\users\xxxxx\AppData\Local\Temp\_MEI18482\win32event.pyd
c:\users\xxxxx\AppData\Local\Temp\_MEI18482\win32file.pyd
c:\users\xxxxx\AppData\Local\Temp\_MEI18482\win32inet.pyd
c:\users\xxxxx\AppData\Local\Temp\_MEI18482\win32pdh.pyd
c:\users\xxxxx\AppData\Local\Temp\_MEI18482\win32process.pyd
c:\users\xxxxx\AppData\Local\Temp\_MEI18482\win32profile.pyd
c:\users\xxxxx\AppData\Local\Temp\_MEI18482\win32security.pyd
c:\users\xxxxx\AppData\Local\Temp\_MEI18482\win32ts.pyd
c:\users\xxxxx\AppData\Local\Temp\_MEI18482\windows._cacheinvalidation.pyd
c:\users\xxxxx\AppData\Local\Temp\_MEI18482\wx._controls_.pyd
c:\users\xxxxx\AppData\Local\Temp\_MEI18482\wx._core_.pyd
c:\users\xxxxx\AppData\Local\Temp\_MEI18482\wx._gdi_.pyd
c:\users\xxxxx\AppData\Local\Temp\_MEI18482\wx._html2.pyd
c:\users\xxxxx\AppData\Local\Temp\_MEI18482\wx._misc_.pyd
c:\users\xxxxx\AppData\Local\Temp\_MEI18482\wx._windows_.pyd
c:\users\xxxxx\AppData\Local\Temp\_MEI18482\wx._wizard.pyd
c:\users\xxxxx\AppData\Local\Temp\_MEI18482\wxbase294u_net_vc90.dll
c:\users\xxxxx\AppData\Local\Temp\_MEI18482\wxbase294u_vc90.dll
c:\users\xxxxx\AppData\Local\Temp\_MEI18482\wxmsw294u_adv_vc90.dll
c:\users\xxxxx\AppData\Local\Temp\_MEI18482\wxmsw294u_core_vc90.dll
c:\users\xxxxx\AppData\Local\Temp\_MEI18482\wxmsw294u_html_vc90.dll
c:\users\xxxxx\AppData\Local\Temp\_MEI18482\wxmsw294u_webview_vc90.dll
.
.
((((((((((((((((((((((( Dateien erstellt von 2013-02-25 bis 2013-03-25 ))))))))))))))))))))))))))))))
.
.
2013-03-25 09:03 . 2013-03-25 09:03 -------- d-----w- c:\users\Default\AppData\Local\temp
2013-03-25 09:03 . 2013-03-25 09:03 -------- d-----w- c:\users\AMAInst\AppData\Local\temp
2013-03-25 09:03 . 2013-03-25 09:03 -------- d-----w- c:\users\AMAInst.ADAMATIC\AppData\Local\temp
2013-03-25 09:03 . 2013-03-25 09:03 -------- d-----w- c:\users\AMAINS~1~ADA\AppData\Local\temp
2013-03-25 09:03 . 2013-03-25 09:03 -------- d-----w- c:\users\administrator\AppData\Local\temp
2013-03-21 16:03 . 2013-03-21 16:03 -------- d-----w- c:\windows\ERUNT
2013-03-21 16:03 . 2013-03-21 16:03 -------- d-----w- C:\JRT
2013-03-21 08:55 . 2013-03-21 08:55 -------- d-----w- c:\program files (x86)\ESET
2013-03-21 08:43 . 2013-03-21 08:43 -------- d-----w- c:\users\xxxxx\AppData\Roaming\Malwarebytes
2013-03-21 08:43 . 2013-03-21 08:43 -------- d-----w- c:\programdata\Malwarebytes
2013-03-21 08:43 . 2013-03-21 08:43 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
2013-03-21 08:43 . 2012-12-14 15:49 24176 ----a-w- c:\windows\system32\drivers\mbam.sys
2013-03-20 12:13 . 2013-03-20 12:13 -------- d-----w- c:\program files (x86)\Mozilla Maintenance Service
2013-03-19 15:38 . 2013-03-19 15:38 388096 ----a-r- c:\users\xxxxx\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2013-03-19 15:38 . 2013-03-19 15:38 -------- d-----w- c:\program files (x86)\Trend Micro
2013-03-18 17:23 . 2013-03-22 08:12 22064 ----a-w- c:\windows\DCEBoot64.exe
2013-03-14 11:48 . 2013-03-14 11:48 -------- d-----w- C:\MoTemp
2013-03-13 17:25 . 2013-03-19 09:04 -------- d-----w- c:\users\xxxxx\AdobeLicensingFilesBackup
2013-03-13 16:59 . 2013-03-20 11:37 -------- d-----w- c:\users\xxxxx\AppData\Local\Adobe
2013-03-07 13:29 . 2012-03-23 18:58 11137024 ----a-w- c:\windows\SysWow64\libmfxsw32.dll
2013-03-06 16:21 . 2013-03-06 16:51 -------- d-----w- c:\program files\unicode
2013-03-06 14:47 . 2013-03-06 14:57 -------- d-----w- c:\program files (x86)\DDSV2
2013-03-06 09:19 . 2013-03-06 09:19 -------- d-----w- c:\users\xxxxx\AppData\Roaming\OfficeRecovery
2013-03-01 17:41 . 2013-03-01 17:41 -------- d-----w- c:\users\xxxxx\AppData\Local\BorisFX
2013-03-01 17:37 . 2012-01-17 23:54 29476864 ----a-w- c:\windows\system32\BCC8_AE_Float.dll
2013-03-01 17:37 . 2012-01-18 01:12 29330432 ----a-w- c:\windows\system32\BCC8_AE_16Bit.dll
2013-03-01 17:37 . 2012-01-18 01:31 9286144 ----a-w- c:\windows\system32\BCC8_3DObjects_AE.dll
2013-03-01 17:37 . 2012-01-18 01:24 29283328 ----a-w- c:\windows\system32\BCC8_AE_8Bit.dll
2013-03-01 15:34 . 2013-03-01 15:34 -------- d-----w- c:\users\xxxxx\AppData\Roaming\com.amazon.music.uploader
2013-03-01 15:33 . 2013-03-01 15:33 -------- d-----w- c:\program files (x86)\Amazon
2013-02-26 10:19 . 2013-02-26 10:19 -------- d-----w- c:\users\xxxxx\AppData\Roaming\simplitec
2013-02-26 10:01 . 2013-02-26 10:01 -------- d-----w- c:\programdata\simplitec
2013-02-26 10:01 . 2013-02-26 10:01 -------- d-----w- c:\program files (x86)\MSXML 4.0
2013-02-25 18:05 . 2013-02-25 18:05 -------- d-----w- c:\users\xxxxx\AppData\Roaming\SorensonMedia
2013-02-25 10:18 . 2013-02-25 10:18 -------- d-----w- c:\users\xxxxx\AppData\Roaming\JGoodies
2013-02-25 10:14 . 2013-02-25 10:14 -------- d-----w- c:\program files (x86)\JGoodies
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-03-19 10:58 . 2012-10-12 12:00 693976 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2013-03-19 10:58 . 2012-10-12 12:00 73432 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-02-14 09:40 . 2012-11-14 18:15 4047024 ----a-w- c:\windows\SysWow64\SpoonUninstall.exe
2013-02-05 11:22 . 2013-02-05 11:22 36868 ----a-w- c:\program files (x86)\uninst-Particular.exe
2013-02-04 08:55 . 2013-02-04 08:56 95648 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll
2013-02-04 08:55 . 2012-10-12 12:04 782240 ----a-w- c:\windows\SysWow64\deployJava1.dll
2013-02-04 08:55 . 2012-10-12 12:04 861088 ----a-w- c:\windows\SysWow64\npDeployJava1.dll
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\1TortoiseNormal]
@="{C5994560-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994560-53D9-4125-87C9-F193FC689CB2}]
2011-06-13 09:20 64792 ----a-w- c:\program files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\2TortoiseModified]
@="{C5994561-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994561-53D9-4125-87C9-F193FC689CB2}]
2011-06-13 09:20 64792 ----a-w- c:\program files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\3TortoiseConflict]
@="{C5994562-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994562-53D9-4125-87C9-F193FC689CB2}]
2011-06-13 09:20 64792 ----a-w- c:\program files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\4TortoiseLocked]
@="{C5994563-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994563-53D9-4125-87C9-F193FC689CB2}]
2011-06-13 09:20 64792 ----a-w- c:\program files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\5TortoiseReadOnly]
@="{C5994564-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994564-53D9-4125-87C9-F193FC689CB2}]
2011-06-13 09:20 64792 ----a-w- c:\program files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\6TortoiseDeleted]
@="{C5994565-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994565-53D9-4125-87C9-F193FC689CB2}]
2011-06-13 09:20 64792 ----a-w- c:\program files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\7TortoiseAdded]
@="{C5994566-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994566-53D9-4125-87C9-F193FC689CB2}]
2011-06-13 09:20 64792 ----a-w- c:\program files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\8TortoiseIgnored]
@="{C5994567-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994567-53D9-4125-87C9-F193FC689CB2}]
2011-06-13 09:20 64792 ----a-w- c:\program files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\9TortoiseUnversioned]
@="{C5994568-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994568-53D9-4125-87C9-F193FC689CB2}]
2011-06-13 09:20 64792 ----a-w- c:\program files (x86)\Common Files\TortoiseOverlays\TortoiseOverlays.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2012-11-13 23:32 129272 ----a-w- c:\users\xxxxx\AppData\Roaming\Dropbox\bin\DropboxExt.17.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2012-11-13 23:32 129272 ----a-w- c:\users\xxxxx\AppData\Roaming\Dropbox\bin\DropboxExt.17.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2012-11-13 23:32 129272 ----a-w- c:\users\xxxxx\AppData\Roaming\Dropbox\bin\DropboxExt.17.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2012-11-13 23:32 129272 ----a-w- c:\users\xxxxx\AppData\Roaming\Dropbox\bin\DropboxExt.17.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"GoogleDriveSync"="c:\program files (x86)\Google\Drive\googledrivesync.exe" [2013-03-07 19357112]
"Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2013-01-08 18705664]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"ECtiClient"="c:\program files (x86)\ESTOS\ProCall 4\eCtiClient.exe" [2012-06-01 20119936]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-07-03 252848]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-10-11 59280]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2012-10-25 421888]
"AdobeCS4ServiceManager"="c:\program files (x86)\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" [2008-08-14 611712]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-12-18 946352]
.
c:\users\xxxxx\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dropbox.lnk - c:\users\xxxxx\AppData\Roaming\Dropbox\bin\Dropbox.exe [2013-1-20 28539272]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
"disablecad"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoWelcomeScreen"= 1 (0x1)
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2013-01-08 161536]
R3 Adobe Version Cue CS4;Adobe Version Cue CS4;c:\program files (x86)\Common Files\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4.exe [2008-08-15 284016]
R3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys [2010-11-21 71168]
R3 edsservice;ESTOS Desktop Sharing Services;c:\program files (x86)\ESTOS\ProCall 4\EDeskShareService.exe [2012-06-01 647064]
R3 FLEXnet Licensing Service 64;FLEXnet Licensing Service 64;c:\program files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe [2013-02-05 1038088]
R3 hidkmdf;KMDF Driver;c:\windows\system32\DRIVERS\hidkmdf.sys [2012-10-12 13728]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-21 59392]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [2010-11-21 31232]
R3 WacHidRouter;Wacom Hid Router;c:\windows\system32\DRIVERS\wachidrouter.sys [2012-10-12 81312]
R3 wacomrouterfilter;Wacom Router Filter Driver;c:\windows\system32\DRIVERS\wacomrouterfilter.sys [2012-10-12 15776]
R4 sptd;sptd;c:\windows\\SystemRoot\System32\Drivers\sptd.sys [x]
S0 NCFilter;Novell UNC Filter - Filter;c:\windows\system32\DRIVERS\NCFilter.sys [2012-07-13 112256]
S0 NCRecognizer;Novell UNC Filter - Recognizer;c:\windows\system32\DRIVERS\NCRecognizer.sys [2012-07-13 119936]
S0 NCUncFilter;Novell UNC Filter - UNC Filter;c:\windows\system32\DRIVERS\NCUncFilter.sys [2012-07-13 26240]
S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys [2011-11-03 56208]
S2 Amsp;Trend Micro Solution Platform;c:\program files\Trend Micro\AMSP\coreServiceShell.exe coreFrameworkHost.exe [x]
S2 EACUSrv;ESTOS Automatic Client Update;c:\windows\system32\EACUSrv.exe [2012-06-01 6758312]
S2 fexservice;FontExplorer X Pro.FontManagementService;c:\program files (x86)\FontExplorer X\FontExplorer X Pro\FontManagementServices.exe [2012-09-13 44408]
S2 NCFSD;Novell Client File System Redirector;c:\program files\Novell\Client\XTier\Drivers\ncfsd.sys [2012-07-13 108672]
S2 NCIOCTL;Novell Xplat IoCtl Driver;c:\program files\Novell\Client\XTier\Drivers\ncioctl.sys [2012-07-13 90240]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2012-10-02 382824]
S2 TeamViewer8;TeamViewer 8;c:\program files (x86)\TeamViewer\Version8\TeamViewer_Service.exe [2013-03-06 3560288]
S2 tmevtmgr;tmevtmgr;c:\windows\system32\DRIVERS\tmevtmgr.sys [2011-06-23 69904]
S2 WTabletServicePro;Wacom Professional Service;c:\program files\Tablet\Wacom\WTabletServicePro.exe [2012-10-29 613760]
S2 XTSvcMgr;Novell XTier Service Manager;c:\program files\Novell\Client\XTier\Services\XTSvcMgr.exe [2012-07-13 20096]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*Deregistered* - nccache
*Deregistered* - nciom
*Deregistered* - ncp
*Deregistered* - ncpfsp
*Deregistered* - ncpl
*Deregistered* - ndm
*Deregistered* - ndmndap
*Deregistered* - niam
*Deregistered* - nipctl
*Deregistered* - nscm
*Deregistered* - nsns
*Deregistered* - nsvccost
*Deregistered* - xtxplat
.
Inhalt des "geplante Tasks" Ordners
.
2013-03-25 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-10-23 09:51]
.
2013-03-25 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-10-23 09:51]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\1TortoiseNormal]
@="{C5994560-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994560-53D9-4125-87C9-F193FC689CB2}]
2011-06-13 09:20 75544 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\2TortoiseModified]
@="{C5994561-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994561-53D9-4125-87C9-F193FC689CB2}]
2011-06-13 09:20 75544 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\3TortoiseConflict]
@="{C5994562-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994562-53D9-4125-87C9-F193FC689CB2}]
2011-06-13 09:20 75544 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\4TortoiseLocked]
@="{C5994563-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994563-53D9-4125-87C9-F193FC689CB2}]
2011-06-13 09:20 75544 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\5TortoiseReadOnly]
@="{C5994564-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994564-53D9-4125-87C9-F193FC689CB2}]
2011-06-13 09:20 75544 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\6TortoiseDeleted]
@="{C5994565-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994565-53D9-4125-87C9-F193FC689CB2}]
2011-06-13 09:20 75544 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\7TortoiseAdded]
@="{C5994566-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994566-53D9-4125-87C9-F193FC689CB2}]
2011-06-13 09:20 75544 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\8TortoiseIgnored]
@="{C5994567-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994567-53D9-4125-87C9-F193FC689CB2}]
2011-06-13 09:20 75544 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\9TortoiseUnversioned]
@="{C5994568-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994568-53D9-4125-87C9-F193FC689CB2}]
2011-06-13 09:20 75544 ----a-w- c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2012-11-13 23:32 162552 ----a-w- c:\users\xxxxx\AppData\Roaming\Dropbox\bin\DropboxExt64.17.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2012-11-13 23:32 162552 ----a-w- c:\users\xxxxx\AppData\Roaming\Dropbox\bin\DropboxExt64.17.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2012-11-13 23:32 162552 ----a-w- c:\users\xxxxx\AppData\Roaming\Dropbox\bin\DropboxExt64.17.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2012-11-13 23:32 162552 ----a-w- c:\users\xxxxx\AppData\Roaming\Dropbox\bin\DropboxExt64.17.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveBlacklistedOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42}]
2013-03-07 15:31 776144 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}]
2013-03-07 15:31 776144 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSyncedOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}]
2013-03-07 15:31 776144 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSyncingOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41}]
2013-03-07 15:31 776144 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Trend Micro Client Framework"="c:\program files\Trend Micro\UniClient\UiFrmWrk\UIWatchDog.exe" [2011-12-13 219480]
"ETapiNotify3"="c:\windows\SysWOW64\eclientn3.exe" [2012-10-12 1961472]
"NWTRAY"="NWTRAY.EXE" [2012-07-13 38016]
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyServer = 192.168.20.2:8080
uInternet Settings,ProxyOverride = 192.168.*.*;172.*.*.*;10.11.5.*;10.11.6.*;*.amatic1.com;*.amatic.com;amatic-at.local;<local>
IE: An OneNote s&enden - c:\progra~2\MICROS~1\Office14\ONBttnIE.dll/105
IE: An vorhandene PDF-Datei anfügen - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
IE: In Adobe PDF konvertieren - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
IE: Linkziel an vorhandene PDF-Datei anhängen - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Linkziel in Adobe PDF konvertieren - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Nach Microsoft E&xcel exportieren - c:\progra~2\MICROS~1\Office14\EXCEL.EXE/3000
TCP: DhcpNameServer = 172.16.0.11 172.16.0.12
FF - ProfilePath - c:\users\xxxxx\AppData\Roaming\Mozilla\Firefox\Profiles\6gtj4wa0.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.google.at
FF - prefs.js: network.proxy.ftp - 89.174.39.102
FF - prefs.js: network.proxy.ftp_port - 80
FF - prefs.js: network.proxy.gopher - 89.174.39.102
FF - prefs.js: network.proxy.gopher_port - 80
FF - prefs.js: network.proxy.http_port - 80
FF - prefs.js: network.proxy.socks - 89.174.39.102
FF - prefs.js: network.proxy.socks_port - 80
FF - prefs.js: network.proxy.ssl - 89.174.39.102
FF - prefs.js: network.proxy.ssl_port - 80
FF - prefs.js: network.proxy.type - 0
FF - ExtSQL: 2013-03-15 17:59; 5nc3QHFgcb@r06Ws9gvNNVRfH.com; c:\users\xxxxx\AppData\Roaming\Mozilla\Firefox\Profiles\6gtj4wa0.default\extensions\5nc3QHFgcb@r06Ws9gvNNVRfH.com.xpi
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
AddRemove-dBpoweramp DSP Effects - c:\windows\system32\SpoonUninstall.exe
AddRemove-dBpoweramp m4a Codec - c:\windows\system32\SpoonUninstall.exe
AddRemove-dBpoweramp Music Converter - c:\windows\system32\SpoonUninstall.exe
AddRemove-dBpoweramp Ogg Vorbis Codec - c:\windows\system32\SpoonUninstall.exe
AddRemove-dBPowerAMP Real Audio (Helix) Encoder - c:\windows\system32\SpoonUninstall.exe
AddRemove-dBpoweramp Windows Media Audio 10 Codec - c:\windows\system32\SpoonUninstall.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BEB3C0C7-B648-4257-96D9-B5D024816E27}\Version*Version]
"Version"=hex:b2,07,16,91,8d,ad,de,03,1c,05,5e,4e,cb,20,16,6d,9e,c9,63,91,3c,
40,5b,8a,20,91,b1,2f,c7,4c,62,7c,a9,95,57,d7,be,25,81,e3,73,48,31,0d,97,16,\
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin.*1*]
@="?????????????????? v1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin.*1*\CLSID]
@="{E23FE9C6-778E-49D4-B537-38FCDE4887D8}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin.*2*]
@="?????????????????? v2"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin.*2*\CLSID]
@="{9BE31822-FDAD-461B-AD51-BE1D1C159921}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
@Denied: (A) (Everyone)
"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
"Key"="ActionsPane3"
"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Minnetonka Audio Software\SurCode Dolby Digital Premiere\Version*Version]
"Version"=hex:b2,07,16,91,8d,ad,de,03,1c,05,5e,4e,cb,20,16,6d,9e,c9,63,91,3c,
40,5b,8a,20,91,b1,2f,c7,4c,62,7c,a9,95,57,d7,be,25,81,e3,73,48,31,0d,97,16,\
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
c:\program files (x86)\TeamViewer\Version8\TeamViewer.exe
c:\program files (x86)\Google\Update\1.3.21.135\GoogleCrashHandler.exe
c:\program files (x86)\TeamViewer\Version8\tv_w32.exe
c:\program files\Tablet\Wacom\WacomHost.exe
c:\program files (x86)\ESTOS\ProCall 4\Communicator.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2013-03-25 10:10:34 - PC wurde neu gestartet
ComboFix-quarantined-files.txt 2013-03-25 09:10
ComboFix2.txt 2013-03-20 22:55
.
Vor Suchlauf: 19 Verzeichnis(se), 440.162.840.576 Bytes frei
Nach Suchlauf: 20 Verzeichnis(se), 439.777.890.304 Bytes frei
.
- - End Of File - - D47CFB2C20DF6B0099D3E165F47BDEC7
|
WARNUNG für die MITLESER: 