Robin0308 | 20.02.2014 16:14 | hi, hab hier die Logfile bzw. die Combofix.txt: Code:
ComboFix 14-02-19.01 - Robin 20.02.2014 16:05:53.2.6 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.49.1031.18.8149.6689 [GMT 1:00]
ausgeführt von:: c:\users\Robin\Desktop\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {17AD7D40-BA12-9C46-7131-94903A54AD8B}
SP: avast! Antivirus *Disabled/Updated* {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Neuer Wiederherstellungspunkt wurde erstellt
.
.
((((((((((((((((((((((( Dateien erstellt von 2014-01-20 bis 2014-02-20 ))))))))))))))))))))))))))))))
.
.
2014-02-20 15:09 . 2014-02-20 15:09 -------- d-----w- c:\users\Default\AppData\Local\temp
2014-02-19 16:41 . 2014-02-19 16:42 -------- d-----w- C:\FRST
2014-02-18 21:40 . 2014-02-18 21:40 -------- d-----w- c:\users\Robin\AppData\Local\My Games
2014-02-16 16:01 . 2014-02-16 16:01 -------- d-----w- c:\users\Robin\.MCTranscodingSDK
2014-02-16 16:00 . 2014-02-16 16:00 -------- d-----w- c:\programdata\Geevs
2014-02-15 21:44 . 2014-02-15 21:44 -------- d-----w- c:\users\Robin\AppData\Local\Smartbar
2014-02-15 21:44 . 2014-02-15 21:46 -------- d-----w- c:\users\Robin\AppData\Roaming\Systweak
2014-02-15 21:44 . 2013-08-22 17:36 20312 ----a-w- c:\windows\system32\roboot64.exe
2014-02-15 21:19 . 2014-02-15 21:29 -------- d-----w- c:\program files\Common Files\Adobe
2014-02-15 20:59 . 2014-02-15 20:59 -------- d-----w- c:\program files\Zapp
2014-02-15 20:59 . 2014-02-15 20:59 -------- d-----w- c:\users\Robin\AppData\Roaming\SimplyTech
2014-02-15 20:59 . 2014-02-15 20:59 -------- d-----w- c:\program files (x86)\Zapp
2014-02-15 20:59 . 2014-02-04 05:36 33864 ----a-w- c:\windows\Launcher.exe
2014-02-13 14:28 . 2014-02-13 14:28 -------- d-----w- c:\windows\SysWow64\SearchProtect
2014-02-12 21:45 . 2014-02-12 21:45 312744 ----a-w- c:\windows\system32\javaws.exe
2014-02-12 21:45 . 2014-02-12 21:45 108968 ----a-w- c:\windows\system32\WindowsAccessBridge-64.dll
2014-02-12 21:45 . 2014-02-12 21:45 189352 ----a-w- c:\windows\system32\javaw.exe
2014-02-12 21:45 . 2014-02-12 21:45 189352 ----a-w- c:\windows\system32\java.exe
2014-02-10 16:26 . 2014-02-10 16:26 -------- d-----w- c:\users\Robin\AppData\Local\EdgeOfReality
2014-02-09 21:33 . 2014-02-14 22:32 -------- d-----w- c:\users\Robin\AppData\Roaming\vlc
2014-02-05 17:57 . 2014-02-17 21:31 -------- d-----w- c:\users\Robin\AppData\Roaming\.minecraft
2014-02-03 17:44 . 2014-02-03 17:44 -------- d-----w- C:\2-click run
2014-02-03 17:40 . 2014-02-03 17:40 -------- d-----w- c:\users\Robin\AppData\Local\SearchProtect
2014-01-29 19:02 . 2014-01-29 19:02 38960 ----a-w- c:\windows\SysWow64\RGBAcodec.dll
2014-01-26 20:26 . 2013-12-27 18:42 39200 ----a-w- c:\windows\system32\drivers\nvvad64v.sys
2014-01-26 20:26 . 2013-12-27 18:42 33056 ----a-w- c:\windows\SysWow64\nvaudcap32v.dll
2014-01-25 16:52 . 2014-01-25 16:52 -------- d-----w- c:\users\Robin\.fontconfig
2014-01-25 16:52 . 2014-01-25 16:52 -------- d-----w- c:\users\Robin\.cache
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-02-04 21:51 . 2013-08-04 22:29 71048 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2014-02-04 21:51 . 2013-08-04 22:29 692616 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2014-02-03 18:02 . 2014-01-16 20:19 80184 ----a-w- c:\windows\system32\drivers\aswstm.sys
2014-02-03 18:02 . 2013-08-27 16:24 421704 ----a-w- c:\windows\system32\drivers\aswSP.sys
2014-02-03 18:02 . 2013-08-27 16:24 78648 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2014-02-03 18:02 . 2013-08-27 16:24 334136 ----a-w- c:\windows\system32\aswBoot.exe
2014-02-03 18:02 . 2013-08-27 16:24 1038072 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2014-02-03 18:02 . 2013-08-27 16:24 43152 ----a-w- c:\windows\avastSS.scr
2014-01-21 02:53 . 2013-11-02 09:54 1048152 ----a-w- c:\windows\SysWow64\nvspcap.dll
2014-01-21 02:53 . 2013-11-02 09:54 1179576 ----a-w- c:\windows\system32\nvspcap64.dll
2014-01-16 20:19 . 2013-08-27 16:24 207904 ----a-w- c:\windows\system32\drivers\aswVmm.sys
2013-12-27 18:42 . 2013-08-04 22:12 35104 ----a-w- c:\windows\system32\nvaudcap64v.dll
2013-12-19 20:33 . 2013-08-04 22:19 18310112 ----a-w- c:\windows\system32\nvwgf2umx.dll
2013-12-19 20:33 . 2013-08-04 22:19 15877216 ----a-w- c:\windows\SysWow64\nvwgf2um.dll
2013-12-19 20:33 . 2013-08-04 21:49 61216 ----a-w- c:\windows\system32\OpenCL.dll
2013-12-19 20:33 . 2013-08-04 21:49 53024 ----a-w- c:\windows\SysWow64\OpenCL.dll
2013-12-19 20:33 . 2013-08-04 21:48 1436528 ----a-w- c:\windows\system32\nvumdshimx.dll
2013-12-19 20:33 . 2013-08-04 21:48 15230352 ----a-w- c:\windows\SysWow64\nvd3dum.dll
2013-12-19 20:33 . 2013-08-04 21:48 3071656 ----a-w- c:\windows\system32\nvapi64.dll
2013-12-19 20:33 . 2013-08-04 21:48 2698272 ----a-w- c:\windows\SysWow64\nvapi.dll
2013-12-19 18:53 . 2013-08-04 21:49 6671648 ----a-w- c:\windows\system32\nvcpl.dll
2013-12-19 18:53 . 2013-08-04 21:49 3490080 ----a-w- c:\windows\system32\nvsvc64.dll
2013-12-19 18:53 . 2013-08-04 21:49 922912 ----a-w- c:\windows\system32\nvvsvc.exe
2013-12-19 18:53 . 2013-08-04 21:49 63776 ----a-w- c:\windows\system32\nvshext.dll
2013-12-19 18:53 . 2013-08-04 21:49 386336 ----a-w- c:\windows\system32\nvmctray.dll
2013-12-19 18:53 . 2013-08-04 21:49 2559776 ----a-w- c:\windows\system32\nvsvcr.dll
2013-12-19 11:20 . 2013-12-19 11:20 590112 ----a-w- c:\windows\SysWow64\nvStreaming.exe
2013-12-19 05:01 . 2013-08-04 21:49 3539040 ----a-w- c:\windows\system32\nvcoproc.bin
2013-12-04 19:32 . 2013-10-09 22:15 282296 ----a-w- c:\windows\SysWow64\PnkBstrB.xtr
2013-12-04 19:32 . 2013-10-09 22:12 282296 ----a-w- c:\windows\SysWow64\PnkBstrB.exe
2013-12-04 19:31 . 2013-10-09 22:12 270240 ----a-w- c:\windows\SysWow64\PnkBstrB.ex0
2013-11-24 14:58 . 2013-11-24 14:58 10240 ----a-r- c:\users\Robin\AppData\Roaming\Microsoft\Installer\{BAC3B914-9A96-4097-A5C7-7BF0CAD679D3}\IconBAC3B9141.exe
2013-11-24 14:58 . 2013-11-24 14:58 10240 ----a-r- c:\users\Robin\AppData\Roaming\Microsoft\Installer\{BAC3B914-9A96-4097-A5C7-7BF0CAD679D3}\IconBAC3B914.exe
2013-11-23 12:20 . 2013-08-27 16:24 92544 ----a-w- c:\windows\system32\drivers\aswRdr2.sys
2013-11-23 12:20 . 2013-08-27 16:24 65776 ----a-w- c:\windows\system32\drivers\aswRvrt.sys
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{14264a21-01fa-455f-a9c4-7c8b3d82b6f6}]
2014-02-05 06:38 1103432 ----a-w- c:\program files (x86)\Zapp\IE\Zapp.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{31ad400d-1b06-4e33-a59a-90c2c140cba0}]
2010-11-05 01:58 297808 ----a-w- c:\windows\System32\mscoree.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]
"{14264a21-01fa-455f-a9c4-7c8b3d82b6f6}"= "c:\program files (x86)\Zapp\IE\Zapp.dll" [2014-02-05 1103432]
.
[HKEY_CLASSES_ROOT\clsid\{14264a21-01fa-455f-a9c4-7c8b3d82b6f6}]
[HKEY_CLASSES_ROOT\wtb.Band.1]
[HKEY_CLASSES_ROOT\TypeLib\{8ff7f225-ef13-4714-a630-951a331d8189}]
[HKEY_CLASSES_ROOT\wtb.Band]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools Lite"="d:\program files (x86)\DAEMON Tools Lite\DTLite.exe" [2013-03-14 3672640]
"icq"="c:\users\Robin\AppData\Roaming\ICQM\icq.exe" [2013-08-06 28698984]
"Steam"="d:\program files (x86)\Steam\steam.exe" [2014-02-18 1822400]
"EPLTarget\P0000000000000000"="c:\windows\system32\spool\DRIVERS\x64\3\E_IATIHAE.EXE" [2012-02-29 283232]
"Skype"="d:\program files (x86)\Skype\Phone\Skype.exe" [2013-11-14 20584608]
"EPLTarget\P0000000000000001"="c:\windows\system32\spool\DRIVERS\x64\3\E_IATIHAE.EXE" [2012-02-29 283232]
"Browser Infrastructure Helper"="c:\users\Robin\AppData\Local\Smartbar\Application\Shopop.exe" [2013-12-31 21040]
"NextLive"="c:\users\Robin\AppData\Roaming\newnext.me\nengine.dll" [2013-11-14 1283584]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-05-11 958576]
"BCSSync"="d:\program files (x86)\Microsoft Office\Office14\BCSSync.exe" [2010-03-13 91520]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2013-04-21 59720]
"iTunesHelper"="d:\program files (x86)\iTunes\iTunesHelper.exe" [2013-08-16 152392]
"QuickTime Task"="d:\program files (x86)\QuickTime\QTTask.exe" [2013-05-01 421888]
"Adobe Creative Cloud"="c:\program files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe" [2014-02-11 2239376]
"AvastUI.exe"="d:\program files\AVAST Software\Avast\AvastUI.exe" [2014-02-03 3767096]
"LogMeIn Hamachi Ui"="d:\program files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe" [2014-02-04 3813712]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
GIGABYTE OC_GURU.lnk - c:\program files (x86)\GIGABYTE\GIGABYTE OC_GURU II\OC_GURU.exe [2013-3-1 21946368]
Hear.lnk - d:\program files\Hear\Hear.exe [2014-1-16 3174024]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"mixer1"=wdmaud.drv
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 CltMngSvc;Search Protect by Conduit Service;c:\progra~2\SearchProtect\Main\bin\CltMngSvc.exe;c:\progra~2\SearchProtect\Main\bin\CltMngSvc.exe [x]
R2 SkypeUpdate;Skype Updater;d:\program files (x86)\Skype\Updater\Updater.exe;d:\program files (x86)\Skype\Updater\Updater.exe [x]
R2 WinkHandler;WinkHandler;c:\program files (x86)\Iminent\WinkHandler.exe;c:\program files (x86)\Iminent\WinkHandler.exe [x]
R3 aswStm;aswStm;c:\windows\system32\drivers\aswStm.sys;c:\windows\SYSNATIVE\drivers\aswStm.sys [x]
R3 GPCIDrv;GPCIDrv;c:\program files (x86)\GIGABYTE\GIGABYTE OC_GURU II\GPCIDrv64.sys;c:\program files (x86)\GIGABYTE\GIGABYTE OC_GURU II\GPCIDrv64.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 WSDScan;WSD-Scanunterstützung durch UMB;c:\windows\system32\DRIVERS\WSDScan.sys;c:\windows\SYSNATIVE\DRIVERS\WSDScan.sys [x]
S0 amd_sata;amd_sata;c:\windows\system32\DRIVERS\amd_sata.sys;c:\windows\SYSNATIVE\DRIVERS\amd_sata.sys [x]
S0 amd_xata;amd_xata;c:\windows\system32\DRIVERS\amd_xata.sys;c:\windows\SYSNATIVE\DRIVERS\amd_xata.sys [x]
S0 aswRvrt;avast! Revert; [x]
S0 aswVmm;avast! VM Monitor; [x]
S1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys;c:\windows\SYSNATIVE\drivers\aswSnx.sys [x]
S1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys;c:\windows\SYSNATIVE\drivers\aswSP.sys [x]
S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys;c:\windows\SYSNATIVE\DRIVERS\dtsoftbus01.sys [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys;c:\windows\SYSNATIVE\drivers\aswMonFlt.sys [x]
S2 Hamachi2Svc;LogMeIn Hamachi Tunneling Engine;d:\program files (x86)\LogMeIn Hamachi\hamachi-2.exe;d:\program files (x86)\LogMeIn Hamachi\hamachi-2.exe [x]
S2 NvNetworkService;NVIDIA Network Service;c:\program files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe;c:\program files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [x]
S2 NvStreamSvc;NVIDIA Streamer Service;c:\program files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe;c:\program files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [x]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [x]
S2 TeamViewer8;TeamViewer 8;d:\program files (x86)\TeamViewer\Version8\TeamViewer_Service.exe;d:\program files (x86)\TeamViewer\Version8\TeamViewer_Service.exe [x]
S3 EtronHub3;Etron USB 3.0 Extensible Hub Driver;c:\windows\system32\Drivers\EtronHub3.sys;c:\windows\SYSNATIVE\Drivers\EtronHub3.sys [x]
S3 EtronXHCI;Etron USB 3.0 Extensible Host Controller Driver;c:\windows\system32\Drivers\EtronXHCI.sys;c:\windows\SYSNATIVE\Drivers\EtronXHCI.sys [x]
S3 MBfilt;MBfilt;c:\windows\system32\drivers\MBfilt64.sys;c:\windows\SYSNATIVE\drivers\MBfilt64.sys [x]
S3 nvvad_WaveExtensible;NVIDIA Virtual Audio Device (Wave Extensible) (WDM);c:\windows\system32\drivers\nvvad64v.sys;c:\windows\SYSNATIVE\drivers\nvvad64v.sys [x]
S3 REN2CAP_DRIVER;Hear;c:\windows\system32\drivers\ren2cap.sys;c:\windows\SYSNATIVE\drivers\ren2cap.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
S3 usbfilter;AMD USB Filter Driver;c:\windows\system32\DRIVERS\usbfilter.sys;c:\windows\SYSNATIVE\DRIVERS\usbfilter.sys [x]
.
.
Inhalt des "geplante Tasks" Ordners
.
2014-02-20 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-08-04 21:51]
.
2014-02-19 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3062181239-1702867323-3627005284-1000Core.job
- c:\users\Robin\AppData\Local\Facebook\Update\FacebookUpdate.exe [2014-01-19 19:20]
.
2014-02-19 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3062181239-1702867323-3627005284-1000UA.job
- c:\users\Robin\AppData\Local\Facebook\Update\FacebookUpdate.exe [2014-01-19 19:20]
.
2014-02-20 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-12-05 13:50]
.
2014-02-20 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-12-05 13:50]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2014-02-03 18:02 287280 ----a-w- d:\program files\AVAST Software\Avast\ashShA64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Nvtmru"="c:\program files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe" [BU]
"RTHDVCPL"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2013-03-29 13513288]
"ShadowPlay"="c:\windows\system32\nvspcap64.dll" [2014-01-21 1179576]
"NvBackend"="c:\program files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe" [2014-01-21 2234144]
"AdobeAAMUpdater-1.0"="c:\program files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2013-12-10 472984]
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://search.conduit.com/?ctid=CT3314958&octid=EB_ORIGINAL_CTID&SearchSource=55&CUI=&UM=4&UP=SP32A90F07-5575-4C79-96E3-CFDB19C3D552&SSPV=
uDefault_Search_URL = hxxp://search.certified-toolbar.com?si=66807&tid=6724&ver=5.7&ts=1392497969847&tguid=66817-8086-1392497969847-8DC38F95248515358FD0C9B6699636A2&st=chrome&q=
mDefault_Search_URL = hxxp://search.certified-toolbar.com?si=66807&tid=6724&ver=5.7&ts=1392497969847&tguid=66817-8086-1392497969847-8DC38F95248515358FD0C9B6699636A2&st=chrome&q=
mStart Page = about:newtab
mLocal Page = c:\windows\SysWOW64\blank.htm
mSearch Page = hxxp://search.certified-toolbar.com?si=66807&tid=6724&ver=5.7&ts=1392497969847&tguid=66817-8086-1392497969847-8DC38F95248515358FD0C9B6699636A2&st=chrome&q=
mSearch Bar = hxxp://search.certified-toolbar.com?si=66807&tid=6724&ver=5.7&ts=1392497969847&tguid=66817-8086-1392497969847-8DC38F95248515358FD0C9B6699636A2&st=chrome&q=
uInternet Settings,ProxyOverride = *.local
IE: An OneNote s&enden - d:\progra~2\MICROS~2\Office14\ONBttnIE.dll/105
IE: Nach Microsoft E&xcel exportieren - d:\progra~2\MICROS~2\Office14\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.2.1
FF - ProfilePath - c:\users\Robin\AppData\Roaming\Mozilla\Firefox\Profiles\6stx20st.default-1387489683870\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://search.conduit.com/?ctid=CT3314958&octid=EB_ORIGINAL_CTID&SearchSource=55&CUI=&UM=4&UP=SP32A90F07-5575-4C79-96E3-CFDB19C3D552&SSPV=
FF - prefs.js: network.proxy.type - 2
FF - ExtSQL: 2014-02-15 22:59; {70ba6a57-dc09-4a3e-bbe1-dfb10af77244}; c:\users\Robin\AppData\Roaming\Mozilla\Firefox\Profiles\6stx20st.default-1387489683870\extensions\{70ba6a57-dc09-4a3e-bbe1-dfb10af77244}
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
AddRemove-SearchProtect - c:\progra~2\SearchProtect\Main\bin\uninstall.exe
AddRemove-{8D914DD2-F3CE-44E4-9498-E7EED093281C}_is1 - c:\program files (x86)\IndustrieGigant 2\unins000.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\S-1-5-21-3062181239-1702867323-3627005284-1000\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{14264a21-01fa-455f-a9c4-7c8b3d82b6f6}]
@Denied: (A 2) (Administrators)
@Denied: (A 2) (S-1-5-21-3062181239-1702867323-3627005284-1000)
"Flags"=dword:00000400
.
[HKEY_USERS\S-1-5-21-3062181239-1702867323-3627005284-1000\Software\SecuROM\License information*]
"datasecu"=hex:96,02,09,d0,90,fb,34,de,9d,dd,4d,cc,78,d8,15,aa,bb,da,c2,b2,92,
26,4f,a5,ee,85,c0,81,68,9d,00,2c,5b,eb,3a,cc,13,1c,35,39,c0,d4,39,ec,33,11,\
"rkeysecu"=hex:29,23,be,84,e1,6c,d6,ae,52,90,49,f1,f1,bb,e9,eb
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_12_0_0_44_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_12_0_0_44_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_12_0_0_44_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_12_0_0_44_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_12_0_0_44.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_12_0_0_44.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_12_0_0_44.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_12_0_0_44.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
@Denied: (A) (Everyone)
"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
"Key"="ActionsPane3"
"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2014-02-20 16:10:19
ComboFix-quarantined-files.txt 2014-02-20 15:10
ComboFix2.txt 2014-02-20 15:03
.
Vor Suchlauf: 8.345.473.024 Bytes frei
Nach Suchlauf: 8.282.427.392 Bytes frei
.
- - End Of File - - BE2E0874B2C0AC96ECAC8FD1B232322A
A36C5E4F47E84449FF07ED3517B43A31 |