| Firewolf_08 | 25.11.2013 21:30 |
Hallo schrauber,
vielen Dank für Deine Hilfe! :dankeschoen:
Combofix brachte mir folgendes Ergebnis: Code:
ComboFix 13-11-23.02 - Evi 25.11.2013 20:48:35.1.2 - x86
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.49.1031.18.3033.1927 [GMT 1:00]
ausgeführt von:: c:\users\Evi\Desktop\ComboFix.exe
AV: Microsoft Security Essentials *Disabled/Updated* {641105E6-77ED-3F35-A304-765193BCB75F}
AV: Norton Internet Security Online *Disabled/Updated* {63DF5164-9100-186D-2187-8DC619EFD8BF}
FW: Norton Internet Security Online *Disabled* {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}
SP: Microsoft Security Essentials *Disabled/Updated* {DF70E402-51D7-30BB-99B4-4D23E83BFDE2}
SP: Norton Internet Security Online *Disabled/Updated* {D8BEB080-B73A-17E3-1B37-B6B462689202}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Evi\Desktop\Search.lnk
c:\users\Evi\Desktop\Setup.exe
c:\windows\system32\FlashPlayerApp.exe
.
Infizierte Kopie von c:\windows\system32\userinit.exe wurde gefunden und desinfiziert
Kopie von - c:\windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe wurde wiederhergestellt
.
.
((((((((((((((((((((((( Dateien erstellt von 2013-10-25 bis 2013-11-25 ))))))))))))))))))))))))))))))
.
.
2013-11-25 19:54 . 2013-11-25 19:57 -------- d-----w- c:\users\Evi\AppData\Local\temp
2013-11-25 19:54 . 2013-11-25 19:54 -------- d-----w- c:\users\Default\AppData\Local\temp
2013-11-25 19:54 . 2013-11-25 19:54 -------- d-----w- c:\users\Admin\AppData\Local\temp
2013-11-25 18:17 . 2013-11-08 01:15 7772552 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{24519DFD-E715-4A19-AB22-9075368BC441}\mpengine.dll
2013-11-24 23:46 . 2013-11-24 23:46 -------- d-----w- C:\FRST
2013-11-24 23:45 . 2013-11-24 23:45 -------- d-----w- c:\users\Evi\AppData\Roaming\0C1I1L1R1J0M1P0I1G
2013-11-24 23:41 . 2013-11-25 08:27 -------- d-----w- c:\program files\VuuPC
2013-11-24 23:41 . 2013-11-24 23:41 -------- d-----w- c:\users\Evi\AppData\Roaming\aartemis
2013-11-24 23:20 . 2013-10-08 06:51 873384 ----a-w- c:\windows\system32\npdeployJava1.dll
2013-11-24 23:20 . 2013-10-08 06:51 796072 ----a-w- c:\windows\system32\deployJava1.dll
2013-11-24 21:03 . 2013-11-24 21:03 -------- d-----w- c:\program files\HitmanPro
2013-11-24 20:51 . 2013-11-24 21:19 -------- d-----w- c:\programdata\HitmanPro
2013-11-24 20:22 . 2013-11-08 01:15 7772552 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2013-11-24 20:18 . 2013-11-24 20:18 999936 ----a-w- c:\program files\Internet Explorer\networkinspection.dll
2013-11-24 19:39 . 2013-11-24 19:39 -------- d-----w- c:\users\Evi\AppData\Roaming\ScanSpyware
2013-11-24 19:39 . 2008-09-07 16:22 8704 ----a-w- c:\windows\system32\ssbtsr.exe
2013-11-24 19:39 . 2013-11-24 19:39 -------- d-----w- c:\program files\ScanSpyware
2013-11-24 15:54 . 2013-11-24 15:54 -------- d-----w- c:\users\Evi\AppData\Roaming\Malwarebytes
2013-11-24 15:54 . 2013-11-24 15:54 -------- d-----w- c:\programdata\Malwarebytes
2013-11-24 15:54 . 2013-11-24 15:54 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2013-11-24 15:54 . 2013-04-04 13:50 22856 ----a-w- c:\windows\system32\drivers\mbam.sys
2013-11-24 15:53 . 2013-11-24 15:53 -------- d-----w- c:\users\Evi\AppData\Local\Programs
2013-11-24 15:37 . 2013-11-24 15:37 -------- d-----w- c:\programdata\Oracle
2013-11-24 15:36 . 2013-11-24 15:36 -------- d-----w- c:\program files\Common Files\Java
2013-11-24 15:36 . 2013-10-08 06:50 94632 ----a-w- c:\windows\system32\WindowsAccessBridge.dll
2013-11-13 18:46 . 2013-11-13 18:46 -------- d-----w- C:\dec971f0e103bc8b257a941e970667
2013-11-13 16:42 . 2013-10-05 19:57 1168384 ----a-w- c:\windows\system32\crypt32.dll
2013-11-06 17:39 . 2013-10-18 14:40 719224 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{4FE15F2F-C78C-4689-BB71-36F1D228706E}\gapaengine.dll
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-11-19 10:21 . 2010-10-27 20:50 230048 ------w- c:\windows\system32\MpSigStub.exe
2013-10-18 14:40 . 2012-10-04 04:29 719224 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\NISBackup\gapaengine.dll
2013-09-27 08:53 . 2013-09-27 08:53 214696 ----a-w- c:\windows\system32\drivers\MpFilter.sys
2013-09-27 08:53 . 2012-03-20 18:44 104768 ----a-w- c:\windows\system32\drivers\NisDrvWFP.sys
2013-09-14 00:48 . 2013-10-11 08:28 338944 ----a-w- c:\windows\system32\drivers\afd.sys
2013-09-08 02:07 . 2013-10-11 08:28 1294272 ----a-w- c:\windows\system32\drivers\tcpip.sys
2013-09-08 02:03 . 2013-10-11 08:28 231424 ----a-w- c:\windows\system32\mswsock.dll
2013-09-04 01:15 . 2013-10-26 09:11 258560 ----a-w- c:\windows\system32\drivers\usbhub.sys
2013-09-04 01:14 . 2013-10-26 09:11 76288 ----a-w- c:\windows\system32\drivers\usbccgp.sys
2013-09-04 01:14 . 2013-10-26 09:11 284672 ----a-w- c:\windows\system32\drivers\usbport.sys
2013-09-04 01:14 . 2013-10-26 09:11 43008 ----a-w- c:\windows\system32\drivers\usbehci.sys
2013-09-04 01:14 . 2013-10-26 09:11 20480 ----a-w- c:\windows\system32\drivers\usbohci.sys
2013-09-04 01:14 . 2013-10-26 09:11 24064 ----a-w- c:\windows\system32\drivers\usbuhci.sys
2013-09-04 01:14 . 2013-10-26 09:11 6016 ----a-w- c:\windows\system32\drivers\usbd.sys
2013-08-29 01:51 . 2013-10-11 08:28 3969472 ----a-w- c:\windows\system32\ntkrnlpa.exe
2013-08-29 01:51 . 2013-10-11 08:28 3914176 ----a-w- c:\windows\system32\ntoskrnl.exe
2013-08-29 01:50 . 2013-10-11 08:28 1289096 ----a-w- c:\windows\system32\ntdll.dll
2013-08-29 01:50 . 2013-10-11 08:28 619520 ----a-w- c:\windows\system32\tdh.dll
2013-08-29 01:48 . 2013-10-11 08:28 640512 ----a-w- c:\windows\system32\advapi32.dll
2013-08-28 01:04 . 2013-10-11 08:22 2348544 ----a-w- c:\windows\system32\win32k.sys
2013-08-28 00:57 . 2013-10-11 08:27 434688 ----a-w- c:\windows\system32\scavengeui.dll
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\~\Browser Helper Objects\{0027da2d-c9f2-4b0b-ae05-e2cd1bdb6cff}]
2012-09-20 09:34 508744 ----a-w- c:\users\Evi\AppData\LocalLow\CT2625848\ldrtbDVDV.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{0027da2d-c9f2-4b0b-ae05-e2cd1bdb6cff}"= "c:\users\Evi\AppData\LocalLow\CT2625848\ldrtbDVDV.dll" [2012-09-20 508744]
.
[HKEY_CLASSES_ROOT\clsid\{0027da2d-c9f2-4b0b-ae05-e2cd1bdb6cff}]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\VeriFace Enc]
@="{771C7324-DA80-49D3-8017-753B0AF60951}"
[HKEY_CLASSES_ROOT\CLSID\{771C7324-DA80-49D3-8017-753B0AF60951}]
2010-02-22 08:39 1410312 ----a-w- c:\windows\System32\IcnOvrly.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2009-06-04 186904]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-12-03 35184]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-09-18 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-09-18 174104]
"Persistence"="c:\windows\system32\igfxpers.exe" [2009-09-18 150552]
"SmartAudio"="c:\program files\CONEXANT\SAII\SAIICpl.exe" [2009-07-16 307768]
"VeriFaceManager"="c:\program files\Lenovo\VeriFace\PManage.exe" [2010-02-22 3122440]
"UpdateP2GShortCut"="c:\program files\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe" [2008-12-03 218408]
"EnergyUtility"="c:\program files\Lenovo\Energy Management\utility.exe" [2009-09-29 4114288]
"Energy Management"="c:\program files\Lenovo\Energy Management\Energy Management.exe" [2009-09-29 5064560]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2013-10-23 948440]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"WLStart"="c:\program files\Windows Live\Installer\wlstart.exe" [2009-07-26 786760]
.
c:\users\Evi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OpenOffice.org 3.2.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2010-5-20 1195008]
.
c:\users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
DSL-Manager.lnk - c:\program files\DSL-Manager\DslMgr.exe [2010-10-26 1085440]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\hitmanpro37]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\hitmanpro37.sys]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\HitmanPro37Crusader]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\HitmanPro37CrusaderBoot]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
R1 BHDrvx86;BHDrvx86;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\BASHDefs\20120302.001\BHDrvx86.sys [2012-03-02 820856]
R3 Bridge0;Bridge0;c:\windows\system32\drivers\WDBridge.sys [2009-07-28 63240]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2012-02-05 106104]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe [2013-11-24 108032]
R3 k57nd60x;Broadcom NetLink (TM) Gigabit Ethernet - NDIS 6.0;c:\windows\system32\DRIVERS\k57nd60x.sys [2009-07-13 229888]
R3 Lenovo ReadyComm AppSvc;Lenovo ReadyComm AppSvc;c:\program files\Lenovo\ReadyComm\AppSvc.exe [2009-08-14 509192]
R3 Lenovo ReadyComm ConnSvc;Lenovo ReadyComm ConnSvc;c:\program files\Lenovo\ReadyComm\ConnSvc.exe [2009-09-22 579400]
R3 netw5v32;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;c:\windows\system32\DRIVERS\netw5v32.sys [2009-07-13 4231168]
R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [2013-09-27 104768]
R3 NisSrv;Microsoft-Netzwerkinspektion;c:\program files\Microsoft Security Client\NisSrv.exe [2013-10-23 280288]
R3 PS_MDP;ReadyComm Presentation Space Helper Service;c:\windows\System32\IgrsSvcs.exe [2009-07-14 20992]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2012-08-23 14848]
R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys [x]
R3 RtsUIR;Realtek IR Driver;c:\windows\system32\DRIVERS\Rts516xIR.sys [x]
R3 TDslMgrService;DSL-Manager;c:\program files\DSL-Manager\DslMgrSvc.exe [2008-10-23 307200]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2012-08-23 49664]
R3 WinRing0_1_2_0;WinRing0_1_2_0;d:\test\ECECECEC\WinRing0.sys [x]
R3 wsvd;wsvd;c:\windows\system32\DRIVERS\wsvd.sys [2009-07-21 81704]
S0 SymDS;Symantec Data Store;c:\windows\system32\drivers\NIS\1207000.00D\SYMDS.SYS [2011-01-27 340088]
S0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\NIS\1207000.00D\SYMEFA.SYS [2011-03-15 744568]
S1 DslMNLwf;DSL-Manager NDIS LightWeight Filter;c:\windows\system32\DRIVERS\dslmnlwf.sys [2007-08-01 16448]
S1 funfrm;funfrm; [x]
S1 IDSVix86;IDSVix86;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\IPSDefs\20120308.001\IDSvix86.sys [2012-03-06 368248]
S1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\NIS\1207000.00D\Ironx86.SYS [2011-01-27 136312]
S1 SymNetS;Symantec Network Security WFP Driver;c:\windows\System32\Drivers\NIS\1207000.00D\SYMNETS.SYS [2011-04-21 299640]
S2 BBSvc;Bing Bar Update Service;c:\program files\Microsoft\BingBar\BBSvc.EXE [2011-10-21 196176]
S2 BBUpdate;BBUpdate;c:\program files\Microsoft\BingBar\SeaPort.EXE [2011-10-13 249648]
S2 HitmanProScheduler;HitmanPro Scheduler;c:\program files\HitmanPro\hmpsched.exe [2013-11-24 106280]
S2 IGRS;IGRS;c:\program files\Lenovo\ReadyComm\common\IGRS.exe [2009-07-14 38152]
S2 NIS;Norton Internet Security;c:\program files\Norton Internet Security\Engine\18.7.0.13\ccSvcHst.exe [2011-04-17 130008]
S2 ReadyComm.DirectRouter;ReadyComm.DirectRouter;c:\windows\System32\IgrsSvcs.exe [2009-07-14 20992]
S2 RemoteEngineService;VuuPC RemoteEngine Service;c:\program files\VuuPC\remoteengine.exe [2013-11-19 2967568]
S2 TeamViewer5;TeamViewer 5;c:\program files\TeamViewer\Version5\TeamViewer_Service.exe [2010-10-19 2011944]
S2 VuuPCConnectivity;VuuPC Connectivity;c:\program files\VuuPC\Connectivity.exe [2013-11-19 4747280]
S3 ACPIVPC;Lenovo Virtual Power Controller Driver;c:\windows\system32\DRIVERS\AcpiVpc.sys [2010-01-20 23136]
S3 teamviewervpn;TeamViewer VPN Adapter;c:\windows\system32\DRIVERS\teamviewervpn.sys [2010-10-15 25088]
S3 usbsmi;Lenovo EasyCamera;c:\windows\system32\DRIVERS\SMIksdrv.sys [2009-06-19 168704]
S3 wdmirror;wdmirror;c:\windows\system32\DRIVERS\WDMirror.sys [2009-07-16 11792]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - WS2IFSL
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation REG_MULTI_SZ SSDPSRV upnphost SCardSvr TBS fdrespub AppIDSvc QWAVE wcncsvc SensrSvc Mcx2Svc
IgrsSvcs REG_MULTI_SZ ReadyComm.DirectRouter PS_MDP
.
Inhalt des "geplante Tasks" Ordners
.
2013-11-25 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-12-24 19:58]
.
2013-11-25 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-12-24 19:58]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://aartemis.com/?type=hp&ts=1385336493&from=cor&uid=WDCXWD5000BEVT-22ZAT0_WD-WX80AB90615306153
uDefault_Search_URL = hxxp://www.aartemis.com/web/?type=ds&ts=1385336493&from=cor&uid=WDCXWD5000BEVT-22ZAT0_WD-WX80AB90615306153&q={searchTerms}
mStart Page = hxxp://aartemis.com/?type=hp&ts=1385336493&from=cor&uid=WDCXWD5000BEVT-22ZAT0_WD-WX80AB90615306153
uSearchAssistant = hxxp://www.google.com
IE: Free YouTube to MP3 Converter - c:\users\Evi\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm
TCP: DhcpNameServer = 10.22.11.1
FF - ProfilePath - c:\users\Evi\AppData\Roaming\Mozilla\Firefox\Profiles\7giu4rtz.default\
FF - prefs.js: browser.search.selectedEngine - aartemis
FF - prefs.js: browser.startup.homepage - hxxp://aartemis.com/?type=hp&ts=1385336493&from=cor&uid=WDCXWD5000BEVT-22ZAT0_WD-WX80AB90615306153
FF - prefs.js: keyword.URL - hxxp://feed.snapdo.com/?publisher=SnapdoSoftonicYB&dpid=SnapdoSoftonicYB&co=DE&userid=227b4f00-a25f-86d6-324f-95d8bbfd1700&searchtype=ds&installDate=18/10/2013&q=
FF - prefs.js: network.proxy.type - 0
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Toolbar-Locked - (no file)
HKCU-Run-Rxncnt - c:\users\Evi\AppData\Roaming\Rxncnt.exe
c:\users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DSL-Manager.lnk - (no file)
c:\users\Evi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DSL-Manager.lnk - (no file)
SafeBoot-mcmscsvc
SafeBoot-MCODS
AddRemove-CT2625848 - c:\users\Evi\AppData\Local\Conduit\CT2625848\uninstall.exe
.
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\NIS]
"ImagePath"="\"c:\program files\Norton Internet Security\Engine\18.7.0.13\ccSvcHst.exe\" /s \"NIS\" /m \"c:\program files\Norton Internet Security\Engine\18.7.0.13\diMaster.dll\" /prefetch:1"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\S-1-5-21-3050001101-202350276-4080494179-1003\Software\Microsoft\Internet Explorer\Approved Extensions]
@DACL=(02 0000)
"{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA}"=hex:51,66,7a,6c,4c,1d,3b,1b,f3,f2,f9,
63,2e,38,26,0f,85,d9,bc,f0,9f,08,0e,d5
"{18DF081C-E8AD-4283-A596-FA578C2EBDC3}"=hex:51,66,7a,6c,4c,1d,3b,1b,0c,15,cd,
04,9a,bb,ec,0e,b8,9d,b9,17,8e,6d,fa,dc
"{602ADB0E-4AFF-4217-8AA1-95DAC4DFA408}"=hex:51,66,7a,6c,4c,1d,3b,1b,1e,c6,38,
7c,c8,19,78,0e,97,aa,d6,9a,c6,9c,e3,17
"{6D53EC84-6AAE-4787-AEEE-F4628F01010C}"=hex:51,66,7a,6c,4c,1d,3b,1b,94,f1,41,
71,99,39,e8,0b,b3,e5,b7,22,8d,42,46,13
"{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}"=hex:51,66,7a,6c,4c,1d,3b,1b,ab,8a,06,
6a,c7,85,43,0a,ab,e0,97,9a,f3,9a,6a,5c
"{9030D464-4C02-4ABF-8ECC-5164760863C6}"=hex:51,66,7a,6c,4c,1d,3b,1b,74,c9,22,
8c,35,1f,d0,06,93,c7,12,24,74,4b,24,d9
"{DBC80044-A445-435B-BC74-9C25C1C588A9}"=hex:51,66,7a,6c,4c,1d,3b,1b,54,1d,da,
c7,72,f7,34,0f,a1,7f,df,65,c3,86,cf,b6
"{0027da2d-c9f2-4b0b-ae05-e2cd1bdb6cff}"=hex:51,66,7a,6c,4c,1d,3b,1b,3d,c7,35,
1c,c5,9a,64,07,b3,0e,a1,8d,19,98,2b,e0
"{8DCB7100-DF86-4384-8842-8FA844297B3F}"=hex:51,66,7a,6c,4c,1d,3b,1b,10,6c,d9,
91,b1,8c,eb,0f,95,49,cc,e8,46,6a,3c,20
"{D2CE3E00-F94A-4740-988E-03DC2F38C34F}"=hex:51,66,7a,6c,4c,1d,3b,1b,10,23,dc,
ce,7d,aa,2f,0b,85,85,40,9c,2d,7b,84,50
"{4D2D3B0F-69BE-477A-90F5-FDDB05357975}"=hex:51,66,7a,6c,4c,1d,3b,1b,1f,26,3f,
51,89,3a,15,0b,8d,fe,be,9b,07,76,3e,6a
"{98889811-442D-49DD-99D7-DC866BE87DBC}"=hex:51,66,7a,6c,4c,1d,3b,1b,01,85,9a,
84,1a,17,b2,05,84,dc,9f,c6,69,ab,3a,a3
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\windows\\system32\\Macromed\\Flash\\FlashUtil32_11_7_700_202_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\windows\\system32\\Macromed\\Flash\\FlashUtil32_11_7_700_202_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------
.
- - - - - - - > 'Explorer.exe'(1324)
c:\program files\TeamViewer\Version5\tv.dll
c:\windows\system32\IcnOvrly.dll
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\program files\Microsoft Security Client\MsMpEng.exe
c:\windows\system32\WLANExt.exe
c:\windows\system32\conhost.exe
c:\program files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
c:\program files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
c:\program files\Microsoft SQL Server\90\Shared\sqlwriter.exe
c:\program files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
c:\windows\servicing\TrustedInstaller.exe
c:\program files\TeamViewer\Version5\TeamViewer_Desktop.exe
c:\windows\system32\taskhost.exe
c:\program files\teamviewer\version5\TeamViewer.exe
c:\windows\system32\conhost.exe
c:\program files\VuuPC\RemoteEngineHelper.exe
c:\program files\VuuPC\RemoteEngineHelper.exe
c:\windows\system32\sppsvc.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\\?\c:\windows\system32\wbem\WMIADAP.EXE
c:\windows\system32\taskhost.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2013-11-25 21:02:43 - PC wurde neu gestartet
ComboFix-quarantined-files.txt 2013-11-25 20:02
.
Vor Suchlauf: 20 Verzeichnis(se), 374.182.801.408 Bytes frei
Nach Suchlauf: 24 Verzeichnis(se), 374.970.339.328 Bytes frei
.
- - End Of File - - 265CCF0DABAE34F4AC4D1732E3D93764
A36C5E4F47E84449FF07ED3517B43A31
P.S. Nicht wundern über die aktiven Prozesse von TeamViewer. Den verwende ich, da der betroffene Rechner aktuell nicht direkt bei mir steht. |
Malwarebytes Anti-Malware 
AdwCleaner auf deinen Desktop.
SecurityCheck und:
