cheesy94 | 11.02.2014 16:32 | Hab das mal sogemacht wie angewiesen.
Hier die Log-Datei: Code:
ComboFix 14-02-11.01 - Cheesy 11.02.2014 16:21:46.1.4 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.43.1031.18.3886.2120 [GMT 1:00]
ausgeführt von:: c:\users\Cheesy\Desktop\ComboFix.exe
AV: Microsoft Security Essentials *Disabled/Updated* {641105E6-77ED-3F35-A304-765193BCB75F}
SP: Microsoft Security Essentials *Disabled/Updated* {DF70E402-51D7-30BB-99B4-4D23E83BFDE2}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\install.exe
c:\programdata\0tbpw.pad
c:\programdata\lsass.exe
c:\users\Cheesy\AppData\Roaming\Mozilla\Firefox\Profiles\rw3ktp7a.default\extensions\36lkzmaoi@wxazmgh.org
c:\users\Cheesy\AppData\Roaming\Mozilla\Firefox\Profiles\rw3ktp7a.default\extensions\36lkzmaoi@wxazmgh.org\bootstrap.js
c:\users\Cheesy\AppData\Roaming\Mozilla\Firefox\Profiles\rw3ktp7a.default\extensions\36lkzmaoi@wxazmgh.org\chrome.manifest
c:\users\Cheesy\AppData\Roaming\Mozilla\Firefox\Profiles\rw3ktp7a.default\extensions\36lkzmaoi@wxazmgh.org\content\bg.js
c:\users\Cheesy\AppData\Roaming\Mozilla\Firefox\Profiles\rw3ktp7a.default\extensions\36lkzmaoi@wxazmgh.org\install.rdf
c:\users\Cheesy\AppData\Roaming\Mozilla\Firefox\Profiles\rw3ktp7a.default\extensions\4h2_y@gne-oxo.com
c:\users\Cheesy\AppData\Roaming\Mozilla\Firefox\Profiles\rw3ktp7a.default\extensions\4h2_y@gne-oxo.com\bootstrap.js
c:\users\Cheesy\AppData\Roaming\Mozilla\Firefox\Profiles\rw3ktp7a.default\extensions\4h2_y@gne-oxo.com\chrome.manifest
c:\users\Cheesy\AppData\Roaming\Mozilla\Firefox\Profiles\rw3ktp7a.default\extensions\4h2_y@gne-oxo.com\content\bg.js
c:\users\Cheesy\AppData\Roaming\Mozilla\Firefox\Profiles\rw3ktp7a.default\extensions\4h2_y@gne-oxo.com\install.rdf
c:\users\Cheesy\AppData\Roaming\Mozilla\Firefox\Profiles\rw3ktp7a.default\extensions\fr3.ryuye@krgogojdoy.co.uk
c:\users\Cheesy\AppData\Roaming\Mozilla\Firefox\Profiles\rw3ktp7a.default\extensions\fr3.ryuye@krgogojdoy.co.uk\bootstrap.js
c:\users\Cheesy\AppData\Roaming\Mozilla\Firefox\Profiles\rw3ktp7a.default\extensions\fr3.ryuye@krgogojdoy.co.uk\chrome.manifest
c:\users\Cheesy\AppData\Roaming\Mozilla\Firefox\Profiles\rw3ktp7a.default\extensions\fr3.ryuye@krgogojdoy.co.uk\content\bg.js
c:\users\Cheesy\AppData\Roaming\Mozilla\Firefox\Profiles\rw3ktp7a.default\extensions\fr3.ryuye@krgogojdoy.co.uk\install.rdf
c:\users\Julia\AppData\Local\Google\Chrome\User Data\Default\Extensions\hicbbkbehoadobmcabelfffdmjcdcmoa
c:\users\Julia\AppData\Local\Google\Chrome\User Data\Default\Extensions\hicbbkbehoadobmcabelfffdmjcdcmoa\2.3\background.html
c:\users\Julia\AppData\Local\Google\Chrome\User Data\Default\Extensions\hicbbkbehoadobmcabelfffdmjcdcmoa\2.3\content.js
c:\users\Julia\AppData\Local\Google\Chrome\User Data\Default\Extensions\hicbbkbehoadobmcabelfffdmjcdcmoa\2.3\FixNMQjdQpQb.js
c:\users\Julia\AppData\Local\Google\Chrome\User Data\Default\Extensions\hicbbkbehoadobmcabelfffdmjcdcmoa\2.3\lsdb.js
c:\users\Julia\AppData\Local\Google\Chrome\User Data\Default\Extensions\hicbbkbehoadobmcabelfffdmjcdcmoa\2.3\manifest.json
c:\users\Julia\AppData\Local\Google\Chrome\User Data\Default\Preferences
c:\users\Julia\AppData\Roaming\Mozilla\Firefox\Profiles\i74teu7f.default\extensions\36lkzmaoi@wxazmgh.org
c:\users\Julia\AppData\Roaming\Mozilla\Firefox\Profiles\i74teu7f.default\extensions\36lkzmaoi@wxazmgh.org\bootstrap.js
c:\users\Julia\AppData\Roaming\Mozilla\Firefox\Profiles\i74teu7f.default\extensions\36lkzmaoi@wxazmgh.org\chrome.manifest
c:\users\Julia\AppData\Roaming\Mozilla\Firefox\Profiles\i74teu7f.default\extensions\36lkzmaoi@wxazmgh.org\content\bg.js
c:\users\Julia\AppData\Roaming\Mozilla\Firefox\Profiles\i74teu7f.default\extensions\36lkzmaoi@wxazmgh.org\install.rdf
c:\users\Julia\AppData\Roaming\Mozilla\Firefox\Profiles\i74teu7f.default\extensions\4h2_y@gne-oxo.com
c:\users\Julia\AppData\Roaming\Mozilla\Firefox\Profiles\i74teu7f.default\extensions\4h2_y@gne-oxo.com\bootstrap.js
c:\users\Julia\AppData\Roaming\Mozilla\Firefox\Profiles\i74teu7f.default\extensions\4h2_y@gne-oxo.com\chrome.manifest
c:\users\Julia\AppData\Roaming\Mozilla\Firefox\Profiles\i74teu7f.default\extensions\4h2_y@gne-oxo.com\content\bg.js
c:\users\Julia\AppData\Roaming\Mozilla\Firefox\Profiles\i74teu7f.default\extensions\4h2_y@gne-oxo.com\install.rdf
c:\users\Julia\AppData\Roaming\Mozilla\Firefox\Profiles\i74teu7f.default\extensions\staged\fr3.ryuye@krgogojdoy.co.uk
c:\users\Julia\AppData\Roaming\Mozilla\Firefox\Profiles\i74teu7f.default\extensions\staged\fr3.ryuye@krgogojdoy.co.uk\bootstrap.js
c:\users\Julia\AppData\Roaming\Mozilla\Firefox\Profiles\i74teu7f.default\extensions\staged\fr3.ryuye@krgogojdoy.co.uk\chrome.manifest
c:\users\Julia\AppData\Roaming\Mozilla\Firefox\Profiles\i74teu7f.default\extensions\staged\fr3.ryuye@krgogojdoy.co.uk\content\bg.js
c:\users\Julia\AppData\Roaming\Mozilla\Firefox\Profiles\i74teu7f.default\extensions\staged\fr3.ryuye@krgogojdoy.co.uk\install.rdf
c:\users\Julia\googleupdatesetup.exe
c:\users\Julia\OnlineVideoSetup.exe
c:\windows\IsUn0407.exe
.
.
((((((((((((((((((((((( Dateien erstellt von 2014-01-11 bis 2014-02-11 ))))))))))))))))))))))))))))))
.
.
2014-02-11 15:27 . 2014-02-11 15:27 -------- d-----w- c:\users\Default\AppData\Local\temp
2014-02-11 12:48 . 2013-12-03 18:28 10315576 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{350641C3-0BAD-4DDE-92A3-72915F1070D3}\mpengine.dll
2014-02-11 10:59 . 2014-02-11 12:51 -------- d-----w- C:\FRST
2014-02-11 10:38 . 2014-02-11 11:12 -------- d-----w- c:\program files (x86)\Age of Empires II HD The Forgotten
2014-02-11 10:33 . 2014-02-11 10:33 -------- d-----w- c:\program files (x86)\UTuberAdBloCkeer
2014-02-11 10:32 . 2014-02-11 10:32 -------- d-----w- c:\program files (x86)\SeavveNeewaApppz
2014-02-11 10:31 . 2014-02-11 10:31 -------- d-----w- c:\program files (x86)\GariEatSaevee4U
2014-02-10 17:18 . 2014-02-10 17:21 -------- d-----w- c:\program files (x86)\Age of Empire 2 HD Edition
2014-02-10 13:50 . 2014-02-10 17:47 -------- d-----w- c:\programdata\Steam
2014-02-10 13:48 . 2014-02-10 13:49 -------- d-----w- c:\programdata\Package Cache
2014-02-10 13:43 . 2009-09-04 16:29 235344 ----a-w- c:\windows\SysWow64\d3dx11_42.dll
2014-02-08 10:59 . 2014-02-08 10:59 965000 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{E89083AB-681E-4F0A-B3E5-30C6FD02B87A}\gapaengine.dll
2014-02-08 10:59 . 2013-12-03 18:28 10315576 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2014-02-08 10:58 . 2014-02-08 10:58 -------- d-----w- c:\program files (x86)\Microsoft Security Client
2014-02-08 10:58 . 2014-02-08 10:58 -------- d-----w- c:\program files\Microsoft Security Client
2014-02-07 19:06 . 2014-02-07 19:06 -------- d-----w- c:\users\Cheesy\AppData\Local\FlatOut Ultimate Carnage
2014-02-07 19:03 . 2007-10-22 02:37 17928 ----a-w- c:\windows\SysWow64\X3DAudio1_2.dll
2014-02-07 19:02 . 2005-05-26 14:34 3767504 ----a-w- c:\windows\system32\d3dx9_26.dll
2014-02-07 19:02 . 2005-05-26 14:34 2297552 ----a-w- c:\windows\SysWow64\d3dx9_26.dll
2014-02-07 19:02 . 2005-03-18 16:19 3823312 ----a-w- c:\windows\system32\d3dx9_25.dll
2014-02-07 19:02 . 2005-02-05 18:45 3544272 ----a-w- c:\windows\system32\d3dx9_24.dll
2014-02-07 18:57 . 2014-02-07 18:57 -------- d--h--r- c:\users\Cheesy\AppData\Roaming\SecuROM
2014-02-07 18:57 . 2014-02-07 18:57 -------- d-----w- c:\program files (x86)\Empire Interactive
2014-02-07 18:57 . 2014-02-07 18:57 178800 ----a-w- c:\windows\SysWow64\CmdLineExt_x64.dll
2014-02-07 18:40 . 2010-05-26 10:41 2106216 ----a-w- c:\windows\SysWow64\D3DCompiler_43.dll
2014-02-07 18:36 . 2014-02-07 18:51 -------- d-----w- c:\users\Cheesy\ManiaPlanet
2014-02-07 18:22 . 2014-02-07 18:32 -------- d-----w- c:\programdata\TmForever
2014-02-07 18:17 . 2014-02-07 18:19 -------- d-----w- c:\program files (x86)\TmNationsForever
2014-02-07 09:49 . 2013-12-04 03:28 10315576 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{818F9560-DA7A-4270-BCD9-79E605B87A48}\mpengine.dll
2014-02-06 20:13 . 2014-02-06 20:13 -------- d-----w- c:\program files\Microsoft Xbox 360 Accessories
2014-02-06 19:24 . 2000-01-04 05:39 212992 ----a-w- c:\program files (x86)\Common Files\InstallShield\Engine\6\Intel 32\ILog.dll
2014-02-06 13:53 . 2014-02-06 13:53 -------- d-----w- c:\users\Cheesy\AppData\Local\Google
2014-02-06 10:31 . 2014-02-06 10:39 -------- d-----w- c:\users\Cheesy\AppData\Roaming\HP
2014-02-02 11:32 . 2014-02-02 11:32 -------- d-----w- c:\program files\iPod
2014-02-02 11:32 . 2014-02-02 11:32 -------- d-----w- c:\programdata\34BE82C4-E596-4e99-A191-52C6199EBF69
2014-02-02 11:32 . 2014-02-02 11:32 -------- d-----w- c:\program files\iTunes
2014-02-02 11:32 . 2014-02-02 11:32 -------- d-----w- c:\program files (x86)\iTunes
2014-02-02 11:18 . 2014-02-11 12:20 -------- d-----w- c:\programdata\UTuberAdBloCkeer
2014-02-02 11:18 . 2014-02-02 11:18 -------- d-----w- c:\programdata\aeepcfhhiiainojhhfjfmdmehaigkhdb
2014-01-17 14:01 . 2014-01-17 14:01 -------- d-----w- c:\users\Cheesy\AppData\Local\Diagnostics
2014-01-17 13:30 . 2014-01-17 13:30 12400 ----a-w- c:\windows\SysWow64\drivers\SECDRV.SYS
2014-01-17 13:23 . 2013-12-18 20:09 96168 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll
2014-01-17 13:19 . 2014-02-11 10:30 -------- d-----w- c:\program files (x86)\EA SPORTS
2014-01-15 11:22 . 2013-11-27 01:41 53248 ----a-w- c:\windows\system32\drivers\usbehci.sys
2014-01-15 11:22 . 2013-11-27 01:41 325120 ----a-w- c:\windows\system32\drivers\usbport.sys
2014-01-15 11:22 . 2013-11-27 01:41 343040 ----a-w- c:\windows\system32\drivers\usbhub.sys
2014-01-15 11:22 . 2013-11-27 01:41 99840 ----a-w- c:\windows\system32\drivers\usbccgp.sys
2014-01-15 11:22 . 2013-11-27 01:41 25600 ----a-w- c:\windows\system32\drivers\usbohci.sys
2014-01-15 11:22 . 2013-11-27 01:41 30720 ----a-w- c:\windows\system32\drivers\usbuhci.sys
2014-01-15 11:22 . 2013-11-27 01:41 7808 ----a-w- c:\windows\system32\drivers\usbd.sys
2014-01-15 11:22 . 2013-11-26 10:32 3156480 ----a-w- c:\windows\system32\win32k.sys
2014-01-15 11:22 . 2013-11-26 11:40 376768 ----a-w- c:\windows\system32\drivers\netio.sys
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-02-06 10:45 . 2012-04-21 17:07 692616 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2014-02-06 10:45 . 2011-06-09 19:50 71048 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2014-01-19 07:33 . 2010-10-25 15:05 270496 ------w- c:\windows\system32\MpSigStub.exe
2014-01-16 12:23 . 2013-09-10 17:04 566480 ----a-w- c:\programdata\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe
2014-01-15 12:17 . 2012-08-26 08:15 86054176 ----a-w- c:\windows\system32\MRT.exe
2013-11-23 18:26 . 2013-12-20 17:54 417792 ----a-w- c:\windows\SysWow64\WMPhoto.dll
2013-11-23 17:47 . 2013-12-20 17:54 465920 ----a-w- c:\windows\system32\WMPhoto.dll
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive1]
@="{F241C880-6982-4CE5-8CF7-7085BA96DA5A}"
[HKEY_CLASSES_ROOT\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}]
2014-01-02 09:52 222832 ----a-w- c:\users\Cheesy\AppData\Local\Microsoft\SkyDrive\17.0.2015.0811\SkyDriveShell.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive2]
@="{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}"
[HKEY_CLASSES_ROOT\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}]
2014-01-02 09:52 222832 ----a-w- c:\users\Cheesy\AppData\Local\Microsoft\SkyDrive\17.0.2015.0811\SkyDriveShell.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive3]
@="{BBACC218-34EA-4666-9D7A-C78F2274A524}"
[HKEY_CLASSES_ROOT\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}]
2014-01-02 09:52 222832 ----a-w- c:\users\Cheesy\AppData\Local\Microsoft\SkyDrive\17.0.2015.0811\SkyDriveShell.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2010-01-09 98304]
"IAStorIcon"="c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe" [2010-03-04 284696]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2014-01-20 43848]
"HP Software Update"="c:\program files (x86)\HP\HP Software Update\HPWuSchd2.exe" [2009-11-18 54576]
"VirtualCloneDrive"="c:\program files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" [2013-03-10 88984]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2013-07-02 254336]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2014-01-20 152392]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files (x86)\HP\Digital Imaging\bin\hpqtra08.exe [2009-11-18 275072]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux3"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\run-]
"ArcSoft Connection Service"=c:\program files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
"HP Software Update"=c:\program files (x86)\HP\HP Software Update\HPWuSchd2.exe
"TkBellExe"="c:\program files (x86)\Common Files\Real\Update_OB\realsched.exe" -osboot
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe"
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe"
.
--- Andere Dienste/Treiber im Speicher ---
.
*Deregistered* - uwlyruob
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2014-02-06 13:53 1211720 ----a-w- c:\program files (x86)\Google\Chrome\Application\32.0.1700.107\Installer\chrmstp.exe
.
Inhalt des "geplante Tasks" Ordners
.
2014-02-11 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-21 10:45]
.
2014-02-11 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-11-03 18:43]
.
2014-02-11 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-11-03 18:43]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro1 (ErrorConflict)]
@="{8BA85C75-763B-4103-94EB-9470F12FE0F7}"
[HKEY_CLASSES_ROOT\CLSID\{8BA85C75-763B-4103-94EB-9470F12FE0F7}]
2014-01-16 12:24 2331336 ----a-w- c:\program files\Microsoft Office 15\root\vfs\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro2 (SyncInProgress)]
@="{CD55129A-B1A1-438E-A425-CEBC7DC684EE}"
[HKEY_CLASSES_ROOT\CLSID\{CD55129A-B1A1-438E-A425-CEBC7DC684EE}]
2014-01-16 12:24 2331336 ----a-w- c:\program files\Microsoft Office 15\root\vfs\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro3 (InSync)]
@="{E768CD3B-BDDC-436D-9C13-E1B39CA257B1}"
[HKEY_CLASSES_ROOT\CLSID\{E768CD3B-BDDC-436D-9C13-E1B39CA257B1}]
2014-01-16 12:24 2331336 ----a-w- c:\program files\Microsoft Office 15\root\vfs\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2010-01-08 166424]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2010-01-08 390680]
"Persistence"="c:\windows\system32\igfxpers.exe" [2010-01-08 410136]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2010-02-08 10060832]
"XboxStat"="c:\program files\Microsoft Xbox 360 Accessories\XboxStat.exe" [2009-09-30 825184]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2013-10-23 1266912]
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: E&xport to Microsoft Excel - c:\program files\Microsoft Office 15\Root\Office15\EXCEL.EXE/3000
IE: Se&nd to OneNote - c:\program files\Microsoft Office 15\Root\Office15\ONBttnIE.dll/105
TCP: DhcpNameServer = 10.0.0.138
FF - ProfilePath - c:\users\Cheesy\AppData\Roaming\Mozilla\Firefox\Profiles\rw3ktp7a.default\
FF - prefs.js: browser.search.defaulturl -
FF - prefs.js: browser.search.selectedEngine -
FF - prefs.js: browser.startup.homepage - google.at
FF - prefs.js: keyword.URL -
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Wow6432Node-HKLM-Run-<NO NAME> - (no file)
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
ShellIconOverlayIdentifiers-{F241C880-6982-4CE5-8CF7-7085BA96DA5A} - (no file)
ShellIconOverlayIdentifiers-{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} - (no file)
ShellIconOverlayIdentifiers-{BBACC218-34EA-4666-9D7A-C78F2274A524} - (no file)
ShellIconOverlayIdentifiers-{FB314ED9-A251-47B7-93E1-CDD82E34AF8B} - (no file)
ShellIconOverlayIdentifiers-{FB314EDA-A251-47B7-93E1-CDD82E34AF8B} - (no file)
ShellIconOverlayIdentifiers-{FB314EDB-A251-47B7-93E1-CDD82E34AF8B} - (no file)
ShellIconOverlayIdentifiers-{FB314EDC-A251-47B7-93E1-CDD82E34AF8B} - (no file)
HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\S-1-5-21-191219003-3295231329-2360569858-1004\Software\SecuROM\License information*]
"datasecu"=hex:eb,d8,9b,cc,a9,f2,48,34,e7,22,6a,50,21,36,85,36,c8,ae,c4,72,47,
8b,0a,c4,ae,2d,ad,b5,f7,c5,0a,46,a9,41,61,28,33,ce,ab,0f,08,b1,6c,f0,70,85,\
"rkeysecu"=hex:29,23,be,84,e1,6c,d6,ae,52,90,49,f1,f1,bb,e9,eb
.
[HKEY_USERS\S-1-5-21-191219003-3295231329-2360569858-1004_Classes\CLSID]
@DACL=(02 0000)
.
[HKEY_USERS\S-1-5-21-191219003-3295231329-2360569858-1004_Classes\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}]
@DACL=(02 0000)
@="SyncingOverlayHandler Class"
.
[HKEY_USERS\S-1-5-21-191219003-3295231329-2360569858-1004_Classes\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}]
@DACL=(02 0000)
@="ErrorOverlayHandler Class"
.
[HKEY_USERS\S-1-5-21-191219003-3295231329-2360569858-1004_Classes\CLSID\{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}]
@DACL=(02 0000)
@="SkyDriveEx"
.
[HKEY_USERS\S-1-5-21-191219003-3295231329-2360569858-1004_Classes\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}]
@DACL=(02 0000)
@="UpToDateOverlayHandler Class"
.
[HKEY_USERS\S-1-5-21-191219003-3295231329-2360569858-1004_Classes\CLSID\{F8071786-1FD0-4A66-81A1-3CBE29274458}]
@DACL=(02 0000)
@="SyncFileInformationProvider Class"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\windows\\system32\\Macromed\\Flash\\FlashUtil64_12_0_0_44_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\windows\\system32\\Macromed\\Flash\\FlashUtil64_12_0_0_44_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_12_0_0_44_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_12_0_0_44_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_12_0_0_44.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_12_0_0_44.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_12_0_0_44.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_12_0_0_44.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
@Denied: (A) (Everyone)
"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
"Key"="ActionsPane3"
"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2014-02-11 16:29:41
ComboFix-quarantined-files.txt 2014-02-11 15:29
.
Vor Suchlauf: 12 Verzeichnis(se), 218.504.798.208 Bytes frei
Nach Suchlauf: 16 Verzeichnis(se), 218.449.387.520 Bytes frei
.
- - End Of File - - 9F4E4E77463C83957851F6691A3BD6A5 |