Trojaner-Board - Ava Soft Virus

Hier nun der Combofix file. Combofix ist sauber durchgelaufen - nur Avira hat gemeldet das die regestry blockiert wurde.

Combofix Logfile:
Code:
ComboFix 13-05-18.04 - Lemke 20.05.2013  17:00:21.1.4 - x64

Microsoft Windows 7 Home Premium   6.1.7601.1.1252.49.1031.18.3576.1924 [GMT 2:00]

ausgeführt von:: c:\users\Lemke\Desktop\ComboFix.exe

AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}

SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}

.

.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

c:\windows\Installer\{AA4D1C5E-116A-4FF4-AA91-28F526868203}\SHCT_TRAY_PROGRAMG_A10D8603999C4E9488776EF2533C58C9.exe

.

.

(((((((((((((((((((((((   Dateien erstellt von 2013-04-20 bis 2013-05-20  ))))))))))))))))))))))))))))))

.

.

2013-05-20 15:11 . 2013-05-20 15:11        --------        d-----w-        c:\users\Default\AppData\Local\temp

2013-05-19 23:30 . 2013-05-19 23:30        --------        d-----w-        c:\windows\Replay Music 5

2013-05-19 23:30 . 2013-05-19 23:30        --------        d-----w-        c:\program files (x86)\Replay Music 5

2013-05-19 22:48 . 2013-05-19 22:48        --------        d-----w-        C:\_OTL

2013-05-18 14:48 . 2013-04-05 06:50        19231232        ----a-w-        c:\windows\system32\mshtml.dll

2013-05-18 14:48 . 2013-04-05 06:50        15404032        ----a-w-        c:\windows\system32\ieframe.dll

2013-05-18 11:05 . 2013-04-10 06:01        265064        ----a-w-        c:\windows\system32\drivers\dxgmms1.sys

2013-05-18 11:05 . 2013-04-10 06:01        983400        ----a-w-        c:\windows\system32\drivers\dxgkrnl.sys

2013-05-18 11:05 . 2011-02-03 11:25        144384        ----a-w-        c:\windows\system32\cdd.dll

2013-05-18 11:05 . 2013-02-27 05:52        14172672        ----a-w-        c:\windows\system32\shell32.dll

2013-05-18 11:05 . 2013-02-27 05:48        1930752        ----a-w-        c:\windows\system32\authui.dll

2013-05-18 11:05 . 2013-02-27 06:02        111448        ----a-w-        c:\windows\system32\consent.exe

2013-05-18 11:05 . 2013-02-27 05:52        197120        ----a-w-        c:\windows\system32\shdocvw.dll

2013-05-18 11:05 . 2013-02-27 05:47        70144        ----a-w-        c:\windows\system32\appinfo.dll

2013-05-18 11:05 . 2013-02-27 04:49        1796096        ----a-w-        c:\windows\SysWow64\authui.dll

2013-05-18 11:04 . 2013-04-10 03:30        3153920        ----a-w-        c:\windows\system32\win32k.sys

2013-05-18 11:04 . 2013-03-19 05:53        48640        ----a-w-        c:\windows\system32\wwanprotdim.dll

2013-05-18 11:04 . 2013-03-19 05:53        230400        ----a-w-        c:\windows\system32\wwansvc.dll

2013-05-13 19:50 . 2013-05-20 15:08        --------        d-----w-        c:\users\Lemke\AppData\Roaming\Skype

2013-05-13 19:50 . 2013-05-13 19:50        --------        d-----w-        c:\program files (x86)\Common Files\Skype

2013-05-13 19:50 . 2013-05-13 19:50        --------        d-----r-        c:\program files (x86)\Skype

2013-05-13 19:50 . 2013-05-13 19:50        --------        d-----w-        c:\programdata\Skype

2013-05-07 12:45 . 2013-05-07 12:45        83160        ----a-w-        c:\windows\system32\drivers\avnetflt.sys

2013-04-26 04:24 . 2013-04-12 14:45        1656680        ----a-w-        c:\windows\system32\drivers\ntfs.sys

.

.

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2013-05-18 14:52 . 2011-02-10 20:56        75016696        ----a-w-        c:\windows\system32\MRT.exe

2013-05-18 12:12 . 2012-10-01 16:16        692104        ----a-w-        c:\windows\SysWow64\FlashPlayerApp.exe

2013-05-18 12:12 . 2011-06-27 23:24        71048        ----a-w-        c:\windows\SysWow64\FlashPlayerCPLApp.cpl

2013-05-15 18:37 . 2010-06-24 19:33        22240        ----a-w-        c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll

2013-04-13 05:49 . 2013-05-18 11:05        135168        ----a-w-        c:\windows\apppatch\AppPatch64\AcXtrnal.dll

2013-04-13 05:49 . 2013-05-18 11:05        350208        ----a-w-        c:\windows\apppatch\AppPatch64\AcLayers.dll

2013-04-13 05:49 . 2013-05-18 11:05        308736        ----a-w-        c:\windows\apppatch\AppPatch64\AcGenral.dll

2013-04-13 05:49 . 2013-05-18 11:05        111104        ----a-w-        c:\windows\apppatch\AppPatch64\acspecfc.dll

2013-04-13 04:45 . 2013-05-18 11:05        474624        ----a-w-        c:\windows\apppatch\AcSpecfc.dll

2013-04-13 04:45 . 2013-05-18 11:05        2176512        ----a-w-        c:\windows\apppatch\AcGenral.dll

2013-04-07 16:32 . 2013-04-07 16:32        51496        ----a-w-        c:\windows\system32\drivers\stflt.sys

2013-04-06 11:47 . 2013-04-06 11:47        1054720        ----a-w-        c:\windows\system32\MsSpellCheckingFacility.exe

2013-04-06 11:47 . 2013-04-06 11:47        719360        ----a-w-        c:\windows\SysWow64\mshtmlmedia.dll

2013-04-06 11:47 . 2013-04-06 11:47        523264        ----a-w-        c:\windows\SysWow64\vbscript.dll

2013-04-06 11:47 . 2013-04-06 11:47        226304        ----a-w-        c:\windows\system32\elshyph.dll

2013-04-06 11:47 . 2013-04-06 11:47        185344        ----a-w-        c:\windows\SysWow64\elshyph.dll

2013-04-06 11:47 . 2013-04-06 11:47        158720        ----a-w-        c:\windows\SysWow64\msls31.dll

2013-04-06 11:47 . 2013-04-06 11:47        150528        ----a-w-        c:\windows\SysWow64\iexpress.exe

2013-04-06 11:47 . 2013-04-06 11:47        138752        ----a-w-        c:\windows\SysWow64\wextract.exe

2013-04-06 11:47 . 2013-04-06 11:47        73728        ----a-w-        c:\windows\SysWow64\SetIEInstalledDate.exe

2013-04-06 11:47 . 2013-04-06 11:47        61952        ----a-w-        c:\windows\SysWow64\tdc.ocx

2013-04-06 11:47 . 2013-04-06 11:47        48640        ----a-w-        c:\windows\SysWow64\mshtmler.dll

2013-04-06 11:47 . 2013-04-06 11:47        38400        ----a-w-        c:\windows\SysWow64\imgutil.dll

2013-04-06 11:47 . 2013-04-06 11:47        361984        ----a-w-        c:\windows\SysWow64\html.iec

2013-04-06 11:47 . 2013-04-06 11:47        137216        ----a-w-        c:\windows\SysWow64\ieUnatt.exe

2013-04-06 11:47 . 2013-04-06 11:47        12800        ----a-w-        c:\windows\SysWow64\mshta.exe

2013-04-06 11:47 . 2013-04-06 11:47        110592        ----a-w-        c:\windows\SysWow64\IEAdvpack.dll

2013-04-06 11:47 . 2013-04-06 11:47        23040        ----a-w-        c:\windows\SysWow64\licmgr10.dll

2013-04-06 11:47 . 2013-04-06 11:47        1441280        ----a-w-        c:\windows\SysWow64\inetcpl.cpl

2013-04-06 11:47 . 2013-04-06 11:47        97280        ----a-w-        c:\windows\system32\mshtmled.dll

2013-04-06 11:47 . 2013-04-06 11:47        905728        ----a-w-        c:\windows\system32\mshtmlmedia.dll

2013-04-06 11:47 . 2013-04-06 11:47        81408        ----a-w-        c:\windows\system32\icardie.dll

2013-04-06 11:47 . 2013-04-06 11:47        762368        ----a-w-        c:\windows\system32\ieapfltr.dll

2013-04-06 11:47 . 2013-04-06 11:47        599552        ----a-w-        c:\windows\system32\vbscript.dll

2013-04-06 11:47 . 2013-04-06 11:47        452096        ----a-w-        c:\windows\system32\dxtmsft.dll

2013-04-06 11:47 . 2013-04-06 11:47        441856        ----a-w-        c:\windows\system32\html.iec

2013-04-06 11:47 . 2013-04-06 11:47        281600        ----a-w-        c:\windows\system32\dxtrans.dll

2013-04-06 11:47 . 2013-04-06 11:47        27648        ----a-w-        c:\windows\system32\licmgr10.dll

2013-04-06 11:47 . 2013-04-06 11:47        270848        ----a-w-        c:\windows\system32\iedkcs32.dll

2013-04-06 11:47 . 2013-04-06 11:47        247296        ----a-w-        c:\windows\system32\webcheck.dll

2013-04-06 11:47 . 2013-04-06 11:47        235008        ----a-w-        c:\windows\system32\url.dll

2013-04-06 11:47 . 2013-04-06 11:47        216064        ----a-w-        c:\windows\system32\msls31.dll

2013-04-06 11:47 . 2013-04-06 11:47        197120        ----a-w-        c:\windows\system32\msrating.dll

2013-04-06 11:47 . 2013-04-06 11:47        167424        ----a-w-        c:\windows\system32\iexpress.exe

2013-04-06 11:47 . 2013-04-06 11:47        1509376        ----a-w-        c:\windows\system32\inetcpl.cpl

2013-04-06 11:47 . 2013-04-06 11:47        144896        ----a-w-        c:\windows\system32\wextract.exe

2013-04-06 11:47 . 2013-04-06 11:47        1400416        ----a-w-        c:\windows\system32\ieapfltr.dat

2013-04-06 11:47 . 2013-04-06 11:47        102912        ----a-w-        c:\windows\system32\inseng.dll

2013-04-06 11:47 . 2013-04-06 11:47        92160        ----a-w-        c:\windows\system32\SetIEInstalledDate.exe

2013-04-06 11:47 . 2013-04-06 11:47        77312        ----a-w-        c:\windows\system32\tdc.ocx

2013-04-06 11:47 . 2013-04-06 11:47        62976        ----a-w-        c:\windows\system32\pngfilt.dll

2013-04-06 11:47 . 2013-04-06 11:47        52224        ----a-w-        c:\windows\system32\msfeedsbs.dll

2013-04-06 11:47 . 2013-04-06 11:47        51200        ----a-w-        c:\windows\system32\imgutil.dll

2013-04-06 11:47 . 2013-04-06 11:47        48640        ----a-w-        c:\windows\system32\mshtmler.dll

2013-04-06 11:47 . 2013-04-06 11:47        173568        ----a-w-        c:\windows\system32\ieUnatt.exe

2013-04-06 11:47 . 2013-04-06 11:47        149504        ----a-w-        c:\windows\system32\occache.dll

2013-04-06 11:47 . 2013-04-06 11:47        13824        ----a-w-        c:\windows\system32\mshta.exe

2013-04-06 11:47 . 2013-04-06 11:47        136192        ----a-w-        c:\windows\system32\iepeers.dll

2013-04-06 11:47 . 2013-04-06 11:47        135680        ----a-w-        c:\windows\system32\IEAdvpack.dll

2013-04-06 11:47 . 2013-04-06 11:47        12800        ----a-w-        c:\windows\system32\msfeedssync.exe

2013-04-06 11:45 . 2013-04-06 11:45        9728        ---ha-w-        c:\windows\SysWow64\api-ms-win-downlevel-shlwapi-l1-1-0.dll

2013-04-06 11:45 . 2013-04-06 11:45        9728        ---ha-w-        c:\windows\system32\api-ms-win-downlevel-shlwapi-l1-1-0.dll

2013-04-06 11:45 . 2013-04-06 11:45        648192        ----a-w-        c:\windows\system32\d3d10level9.dll

2013-04-06 11:45 . 2013-04-06 11:45        604160        ----a-w-        c:\windows\SysWow64\d3d10level9.dll

2013-04-06 11:45 . 2013-04-06 11:45        5632        ---ha-w-        c:\windows\SysWow64\api-ms-win-downlevel-shlwapi-l2-1-0.dll

2013-04-06 11:45 . 2013-04-06 11:45        5632        ---ha-w-        c:\windows\SysWow64\api-ms-win-downlevel-ole32-l1-1-0.dll

2013-04-06 11:45 . 2013-04-06 11:45        5632        ---ha-w-        c:\windows\system32\api-ms-win-downlevel-shlwapi-l2-1-0.dll

2013-04-06 11:45 . 2013-04-06 11:45        5632        ---ha-w-        c:\windows\system32\api-ms-win-downlevel-ole32-l1-1-0.dll

2013-04-06 11:45 . 2013-04-06 11:45        522752        ----a-w-        c:\windows\system32\XpsGdiConverter.dll

2013-04-06 11:45 . 2013-04-06 11:45        465920        ----a-w-        c:\windows\system32\WMPhoto.dll

2013-04-06 11:45 . 2013-04-06 11:45        417792        ----a-w-        c:\windows\SysWow64\WMPhoto.dll

2013-04-06 11:45 . 2013-04-06 11:45        4096        ---ha-w-        c:\windows\SysWow64\api-ms-win-downlevel-user32-l1-1-0.dll

2013-04-06 11:45 . 2013-04-06 11:45        4096        ---ha-w-        c:\windows\system32\api-ms-win-downlevel-user32-l1-1-0.dll

2013-04-06 11:45 . 2013-04-06 11:45        3928064        ----a-w-        c:\windows\system32\d2d1.dll

2013-04-06 11:45 . 2013-04-06 11:45        364544        ----a-w-        c:\windows\SysWow64\XpsGdiConverter.dll

2013-04-06 11:45 . 2013-04-06 11:45        363008        ----a-w-        c:\windows\system32\dxgi.dll

2013-04-06 11:45 . 2013-04-06 11:45        3584        ---ha-w-        c:\windows\SysWow64\api-ms-win-downlevel-advapi32-l2-1-0.dll

2013-04-06 11:45 . 2013-04-06 11:45        3584        ---ha-w-        c:\windows\system32\api-ms-win-downlevel-advapi32-l2-1-0.dll

2013-04-06 11:45 . 2013-04-06 11:45        3419136        ----a-w-        c:\windows\SysWow64\d2d1.dll

2013-04-06 11:45 . 2013-04-06 11:45        333312        ----a-w-        c:\windows\system32\d3d10_1core.dll

2013-04-06 11:45 . 2013-04-06 11:45        3072        ---ha-w-        c:\windows\SysWow64\api-ms-win-downlevel-version-l1-1-0.dll

2013-04-06 11:45 . 2013-04-06 11:45        3072        ---ha-w-        c:\windows\SysWow64\api-ms-win-downlevel-shell32-l1-1-0.dll

2013-04-06 11:45 . 2013-04-06 11:45        3072        ---ha-w-        c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll

2013-04-06 11:45 . 2013-04-06 11:45        3072        ---ha-w-        c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll

2013-04-06 11:45 . 2013-04-06 11:45        296960        ----a-w-        c:\windows\system32\d3d10core.dll

2013-04-06 11:45 . 2013-04-06 11:45        293376        ----a-w-        c:\windows\SysWow64\dxgi.dll

2013-04-06 11:45 . 2013-04-06 11:45        2776576        ----a-w-        c:\windows\system32\msmpeg2vdec.dll

2013-04-06 11:45 . 2013-04-06 11:45        2565120        ----a-w-        c:\windows\system32\d3d10warp.dll

2013-04-06 11:45 . 2013-04-06 11:45        2560        ---ha-w-        c:\windows\SysWow64\api-ms-win-downlevel-normaliz-l1-1-0.dll

2013-04-06 11:45 . 2013-04-06 11:45        2560        ---ha-w-        c:\windows\system32\api-ms-win-downlevel-normaliz-l1-1-0.dll

2013-04-06 11:45 . 2013-04-06 11:45        249856        ----a-w-        c:\windows\SysWow64\d3d10_1core.dll

2013-04-06 11:45 . 2013-04-06 11:45        245248        ----a-w-        c:\windows\system32\WindowsCodecsExt.dll

2013-04-06 11:45 . 2013-04-06 11:45        2284544        ----a-w-        c:\windows\SysWow64\msmpeg2vdec.dll

2013-04-06 11:45 . 2013-04-06 11:45        221184        ----a-w-        c:\windows\system32\UIAnimation.dll

2013-04-06 11:45 . 2013-04-06 11:45        220160        ----a-w-        c:\windows\SysWow64\d3d10core.dll

2013-04-06 11:45 . 2013-04-06 11:45        207872        ----a-w-        c:\windows\SysWow64\WindowsCodecsExt.dll

2013-04-06 11:45 . 2013-04-06 11:45        1988096        ----a-w-        c:\windows\SysWow64\d3d10warp.dll

2013-04-06 11:45 . 2013-04-06 11:45        194560        ----a-w-        c:\windows\system32\d3d10_1.dll

2013-04-06 11:45 . 2013-04-06 11:45        1887232        ----a-w-        c:\windows\system32\d3d11.dll

2013-04-06 11:45 . 2013-04-06 11:45        187392        ----a-w-        c:\windows\SysWow64\UIAnimation.dll

.

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"EADM"="c:\program files (x86)\Origin\Origin.exe" [2013-03-29 3497552]

"swg"="c:\program files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2012-08-11 39408]

"Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2013-04-19 18678376]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2011-07-08 336384]

"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2013-05-07 345312]

.

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

watchmi tray.lnk - c:\windows\Installer\{AA4D1C5E-116A-4FF4-AA91-28F526868203}\SHCT_TRAY_PROGRAMG_A10D8603999C4E9488776EF2533C58C9.exe [N/A]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 5 (0x5)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]

"Userinit"="userinit.exe"

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]

"LoadAppInit_DLLs"=1 (0x1)

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]

"mixer4"=wdmaud.drv

.

R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]

R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2013-04-19 161384]

R3 RRNetCap;RRNetCap Service;c:\windows\system32\DRIVERS\rrnetcap.sys [2012-07-19 37480]

R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-21 59392]

R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [2010-11-21 31232]

R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [2012-12-13 54784]

R3 WatAdminSvc;Windows-Aktivierungstechnologieservice;c:\windows\system32\Wat\WatAdminSvc.exe [2011-07-04 1255736]

R3 wsvd;wsvd;c:\windows\system32\DRIVERS\wsvd.sys [2010-09-23 129008]

R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-23 57184]

S0 amd_sata;amd_sata;c:\windows\system32\drivers\amd_sata.sys [2011-04-16 79488]

S0 amd_xata;amd_xata;c:\windows\system32\drivers\amd_xata.sys [2011-04-16 40064]

S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys [2013-03-30 28600]

S1 ctxusbm;Citrix USB Monitor Driver;c:\windows\system32\DRIVERS\ctxusbm.sys [2012-04-25 93272]

S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2011-07-08 204288]

S2 AMD FUEL Service;AMD FUEL Service;c:\program files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [2011-07-08 365568]

S2 AntiVirSchedulerService;Avira Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [2013-03-30 86752]

S2 cag;Citrix cag plugin for Access Gateway;c:\program files\Common Files\Deterministic Networks\Common Files\cag.sys [2009-08-10 90136]

S2 cvhsvc;Client Virtualization Handler;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [2012-01-04 822624]

S2 lxdu_device;lxdu_device;c:\windows\system32\lxducoms.exe [2009-10-16 1039360]

S2 sftlist;Application Virtualization Client;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe [2011-10-01 508776]

S2 watchmi;watchmi service;c:\program files (x86)\watchmi\TvdService.exe [2010-12-06 62464]

S3 amdhub30;AMD USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\amdhub30.sys [2011-03-18 87168]

S3 amdiox64;AMD IO Driver;c:\windows\system32\drivers\amdiox64.sys [2010-02-18 46136]

S3 amdxhc;AMD USB 3.0 Host Controller Driver;c:\windows\system32\drivers\amdxhc.sys [2011-03-18 188544]

S3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys [2011-06-07 231440]

S3 RRNetCapMP;RRNetCapMP;c:\windows\system32\DRIVERS\rrnetcap.sys [2012-07-19 37480]

S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2011-05-16 533096]

S3 RTL8192su;Realtek RTL8192SU Wireless LAN 802.11n USB 2.0 Network Adapter;c:\windows\system32\DRIVERS\RTL8192su.sys [2010-11-25 694888]

S3 Sftfs;Sftfs;c:\windows\system32\DRIVERS\Sftfslh.sys [2011-10-01 764264]

S3 Sftplay;Sftplay;c:\windows\system32\DRIVERS\Sftplaylh.sys [2011-10-01 268648]

S3 Sftredir;Sftredir;c:\windows\system32\DRIVERS\Sftredirlh.sys [2011-10-01 25960]

S3 Sftvol;Sftvol;c:\windows\system32\DRIVERS\Sftvollh.sys [2011-10-01 22376]

S3 sftvsa;Application Virtualization Service Agent;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [2011-10-01 219496]

S3 usbfilter;AMD USB Filter Driver;c:\windows\system32\DRIVERS\usbfilter.sys [2010-12-16 47232]

.

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]

2013-04-10 04:58        1642448        ----a-w-        c:\program files (x86)\Google\Chrome\Application\26.0.1410.64\Installer\chrmstp.exe

.

Inhalt des "geplante Tasks" Ordners

.

2013-05-20 c:\windows\Tasks\Adobe Flash Player Updater.job

- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-10-01 12:12]

.

2013-05-20 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-08-11 13:37]

.

2013-05-20 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-08-11 13:37]

.

.

--------- X64 Entries -----------

.

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"MedionReminder"="c:\program files (x86)\CyberLink\PowerRecover\Reminder.exe" [2011-05-25 443688]

"lxdumon.exe"="c:\program files (x86)\Lexmark 5600-6600 Series\lxdumon.exe" [2010-02-04 676520]

"EzPrint"="c:\program files (x86)\Lexmark 5600-6600 Series\ezprint.exe" [2010-02-04 131752]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]

"MedionReminder"="c:\program files (x86)\CyberLink\PowerRecover\Reminder.exe" [2011-05-25 443688]

.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost  - LocalService

FontCache

.

------- Zusätzlicher Suchlauf -------

.

uLocal Page = c:\windows\system32\blank.htm

uStart Page = hxxp://www.google.de/

mLocal Page = c:\windows\SysWOW64\blank.htm

uInternet Settings,ProxyOverride = *.local

IE: {{0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - eBay - eine der größten deutschen Shopping-Websites

TCP: DhcpNameServer = 192.168.1.1

.

- - - - Entfernte verwaiste Registrierungseinträge - - - -

.

URLSearchHooks-{0027da2d-c9f2-4b0b-ae05-e2cd1bdb6cff} - (no file)

BHO-{0027da2d-c9f2-4b0b-ae05-e2cd1bdb6cff} - (no file)

Toolbar-{0027da2d-c9f2-4b0b-ae05-e2cd1bdb6cff} - (no file)

HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start

WebBrowser-{0027DA2D-C9F2-4B0B-AE05-E2CD1BDB6CFF} - (no file)

HKLM-Run-SpywareTerminatorShield - c:\program files (x86)\Spyware Terminator\SpywareTerminatorShield.exe

HKLM-Run-SpywareTerminatorUpdater - c:\program files (x86)\Spyware Terminator\SpywareTerminatorUpdate.exe

AddRemove-Adobe Shockwave Player - c:\windows\system32\Adobe\Shockwave 11\uninstaller.exe

AddRemove-DVD Shrink DE_is1 - c:\program files (x86)\DVD Shrink DE\unins000.exe

AddRemove-CT2625848 - c:\users\Lemke\AppData\Local\Conduit\CT2625848\uninstall.exe

.

.

.

--------------------- Gesperrte Registrierungsschluessel ---------------------

.

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ChromeHTML"

.

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ChromeHTML"

.

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ChromeHTML"

.

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ChromeHTML"

.

[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ChromeHTML"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_7_700_202_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]

@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_7_700_202_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="IFlashBroker5"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_7_700_202_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_7_700_202_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Shockwave Flash Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_202.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]

@="0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]

@="ShockwaveFlash.ShockwaveFlash.11"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_202.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="ShockwaveFlash.ShockwaveFlash"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Macromedia Flash Factory Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_202.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]

@="FlashFactory.FlashFactory.1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_202.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="FlashFactory.FlashFactory"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="IFlashBroker5"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

Zeit der Fertigstellung: 2013-05-20  17:28:16

ComboFix-quarantined-files.txt  2013-05-20 15:28

.

Vor Suchlauf: 7 Verzeichnis(se), 871.168.516.096 Bytes frei

Nach Suchlauf: 11 Verzeichnis(se), 870.781.759.488 Bytes frei

.

- - End Of File - - BD2E2EF4A9F7688A4C92988F48BBDB28
--- --- ---