Google Links auf Werbung, Windows-Sicherheitscenterdienst verschwunden

Nahtal · 14.12.2011, 15:54

Hallo!

Ich habe ein ganz ähnliches Problem wie hier: TB Google Verlinkungen auf falsche Websites (thema 106190, ich kann hier aus irgendeinem grund keinen link einfügen...). Sowohl Google als auch Bing Ergebnisse waren plötzlich auf Werbung verlinkt, im Firefox als auch IE. Im Autostart Ordner in der Registry war eine gewisse F35.exe eingetragen, die ich da noch nie gesehen hatte. Im Taskmanager lief die F35, also hab ich sie erst mal abgeschossen, und dann aus dem Ordner C:\Users\[Mein Name]\AppData\Roaming\Microsoft\ gelöscht. Nach einem Neustart war sie dann aber nach einer Weile wieder da. Virenscan mit den Microsoft Security Essentials hat nichts gebracht. Über Diverse Foren hab ich dann von den Malwarebytes Scanner erfahren. Der hat mehrere Sachen gefunden und gelöscht (hab leider keine Logfile mehr). Danach war das Problem mit den Umleitungen erst einmal weg.

Ich war da wohl ein bischen naiv mit "hier mal das Löschen und dann einen Scan, dann ist alles wieder gut" war es nicht getan: Jetzt lässt sich der Windows Defender nicht mehr starten, weil der Sicherheitscenterdienst komplett verschwunden ist (aus der Liste der Dienste)... Auch die beiden Browser haben Schubweise ungewöhnlich hohe CPU auslastung (sind die auch infiziert worden!?)... Ich weiss nicht mehr ganz weiter. Danke schonmal im Vorraus für eure Hilfe!

Falls es weiter hilft, ich hab mal OTL laufen lassen:

OTL Logfile:

Code:

ATTFilter

OTL logfile created on: 14.12.2011 15:46:43 - Run 1
OTL by OldTimer - Version 3.2.31.0     Folder = D:\
64bit- Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,86 Gb Total Physical Memory | 1,93 Gb Available Physical Memory | 49,86% Memory free
7,72 Gb Paging File | 5,37 Gb Available in Paging File | 69,55% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 148,95 Gb Total Space | 19,86 Gb Free Space | 13,33% Space Free | Partition Type: NTFS
Drive D: | 931,51 Gb Total Space | 108,11 Gb Free Space | 11,61% Space Free | Partition Type: NTFS
 
Computer Name: [**Mein Computername**] | User Name: [**Mein Username**] | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2011.11.09 22:56:59 | 000,924,632 | ---- | M] (Mozilla Corporation) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe
PRC - [2011.10.16 14:22:40 | 000,584,192 | ---- | M] (OldTimer Tools) -- D:\OTL.exe
PRC - [2011.09.05 18:04:56 | 001,489,304 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AcroRd32.exe
PRC - [2011.08.31 17:00:48 | 000,449,608 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
PRC - [2011.08.31 17:00:48 | 000,366,152 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
PRC - [2011.06.06 11:55:28 | 000,064,952 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2011.05.25 21:07:14 | 024,176,560 | ---- | M] (Dropbox, Inc.) -- C:\Users\[**Mein Username**]\AppData\Roaming\Dropbox\bin\Dropbox.exe
PRC - [2011.03.08 13:21:18 | 000,138,168 | ---- | M] (Lenovo Group Limited) -- C:\Programme\Lenovo\ZOOM\TpScrex.exe
PRC - [2011.03.08 13:20:58 | 000,267,624 | ---- | M] (Lenovo Group Limited) -- C:\Programme\Lenovo\HOTKEY\TPONSCR.exe
PRC - [2011.02.18 17:09:02 | 000,028,672 | ---- | M] (Lenovo Group Limited) -- C:\Program Files (x86)\Lenovo\System Update\SUService.exe
PRC - [2011.02.04 03:45:00 | 000,062,824 | ---- | M] (Lenovo Group Limited) -- C:\Program Files (x86)\ThinkPad\Utilities\SCHTASK.EXE
PRC - [2010.12.02 12:55:54 | 000,064,440 | ---- | M] (Lenovo Group Limited) -- C:\Programme\Lenovo\HOTKEY\TPHKSVC.exe
PRC - [2010.11.29 16:32:44 | 000,069,560 | ---- | M] (Lenovo Group Limited) -- C:\Programme\Lenovo\HOTKEY\TPOSDSVC.exe
PRC - [2010.11.24 16:34:24 | 000,045,496 | ---- | M] (Lenovo Group Limited) -- C:\Programme\Lenovo\HOTKEY\micmute.exe
PRC - [2010.09.16 21:04:06 | 001,164,584 | ---- | M] () -- C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe
PRC - [2010.04.23 12:21:00 | 000,154,112 | ---- | M] (troubadix) -- C:\Programme\TPFanControl\TPFanControl.exe
PRC - [2010.04.20 12:23:32 | 000,074,088 | ---- | M] (Lenovo Group Limited) -- C:\Programme\Lenovo\Communications Utility\TPKNRSVC.exe
PRC - [2010.04.20 12:23:28 | 000,062,312 | ---- | M] (Lenovo Group Limited) -- C:\Programme\Lenovo\Communications Utility\TPKNRRES.exe
PRC - [2010.04.20 12:23:18 | 000,050,536 | ---- | M] (Lenovo Group Limited) -- C:\Programme\Lenovo\Communications Utility\CamMute.exe
PRC - [2010.04.07 14:37:38 | 000,093,032 | ---- | M] (Lenovo Group Limited) -- C:\Programme\Lenovo\VIRTSCRL\lvvsst.exe
PRC - [2010.04.01 14:50:44 | 000,043,960 | ---- | M] (Lenovo Group Limited) -- C:\Programme\Lenovo\VIRTSCRL\virtscrl.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2011.11.14 13:11:27 | 008,527,008 | ---- | M] () -- C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll
MOD - [2011.11.09 22:56:58 | 001,989,592 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
MOD - [2011.09.23 15:04:22 | 009,364,480 | ---- | M] () -- C:\Users\[**Mein Username**]\AppData\Local\Adobe\Acrobat\10.0\Cache\RdLang_rdlang32.deu
MOD - [2011.09.05 18:04:58 | 000,056,832 | ---- | M] () -- C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Locale\de_DE\BRdlang32.DEU
MOD - [2011.09.05 18:04:56 | 000,249,232 | ---- | M] () -- C:\Program Files (x86)\Adobe\Reader 10.0\Reader\sqlite.dll
MOD - [2010.09.16 21:04:50 | 000,095,528 | ---- | M] () -- C:\Program Files (x86)\DivX\DivX Update\DivXUpdateCheck.dll
MOD - [2010.09.16 21:04:06 | 001,164,584 | ---- | M] () -- C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe
 
 
========== Win32 Services (SafeList) ==========
 
SRV:64bit: - [2011.08.05 11:53:12 | 000,467,680 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Zune\ZuneWlanCfgSvc.exe -- (ZuneWlanCfgSvc)
SRV:64bit: - [2011.08.05 11:53:12 | 000,306,400 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Zune\WMZuneComm.exe -- (WMZuneComm)
SRV:64bit: - [2011.08.05 11:53:06 | 008,277,728 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Zune\ZuneNss.exe -- (ZuneNetworkSvc)
SRV:64bit: - [2011.06.03 12:51:38 | 000,134,928 | ---- | M] (Intel(R) Corporation) [Auto | Running] -- C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe -- (BTHSSecurityMgr)
SRV:64bit: - [2011.06.01 11:09:42 | 000,131,072 | --S- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Microsoft Research KinectSDK\Service\KinectManagementService.exe -- (KinectManagement)
SRV:64bit: - [2011.04.27 16:21:18 | 000,288,272 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- c:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe -- (NisSrv)
SRV:64bit: - [2011.04.27 16:21:18 | 000,012,784 | ---- | M] (Microsoft Corporation) [Auto | Running] -- c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe -- (MsMpSvc)
SRV:64bit: - [2011.01.10 13:48:32 | 000,231,280 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Home Server\Microsoft.HomeServer.Archive.TransferService.exe -- (arXfrSvc)
SRV:64bit: - [2011.01.10 13:47:54 | 000,109,936 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Home Server\esClient.exe -- (esClient)
SRV:64bit: - [2011.01.10 13:47:42 | 000,489,840 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Program Files\Windows Home Server\WHSConnector.exe -- (WHSConnector)
SRV:64bit: - [2010.12.13 13:37:16 | 000,194,416 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Microsoft LifeCam\MSCamS64.exe -- (MSCamSvc)
SRV:64bit: - [2010.11.12 18:48:50 | 000,045,928 | ---- | M] (Lenovo.) [Auto | Running] -- C:\Windows\SysNative\ibmpmsvc.exe -- (IBMPMSVC)
SRV:64bit: - [2010.10.08 06:18:46 | 000,697,616 | ---- | M] () [Auto | Running] -- C:\Program Files\ShrewSoft\VPN Client\ipsecd.exe -- (ipsecd)
SRV:64bit: - [2010.10.08 06:18:46 | 000,056,592 | ---- | M] () [Auto | Running] -- C:\Program Files\ShrewSoft\VPN Client\dtpd.exe -- (dtpd)
SRV:64bit: - [2010.10.08 06:18:44 | 000,957,712 | ---- | M] () [Auto | Running] -- C:\Program Files\ShrewSoft\VPN Client\iked.exe -- (iked)
SRV:64bit: - [2009.07.14 02:40:01 | 000,193,536 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\appmgmts.dll -- (AppMgmt)
SRV - [2011.09.09 04:46:14 | 000,912,384 | ---- | M] () [Auto | Stopped] -- C:\Programme\Synergy\synergys.exe -- (Synergy Server)
SRV - [2011.08.31 18:08:08 | 001,166,848 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Programme\Intel\BluetoothHS\BTHSAmpPalService.exe -- (AMPPALR3)
SRV - [2011.08.31 17:00:48 | 000,366,152 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2011.07.27 21:04:48 | 001,517,328 | ---- | M] (Intel(R) Corporation) [Auto | Running] -- C:\Programme\Intel\WiFi\bin\EvtEng.exe -- (EvtEng) Intel(R)
SRV - [2011.07.27 20:44:18 | 000,844,560 | ---- | M] (Intel(R) Corporation) [Auto | Running] -- C:\Programme\Common Files\Intel\WirelessCommon\RegSrvc.exe -- (RegSrvc) Intel(R)
SRV - [2011.06.30 14:36:22 | 000,403,240 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe -- (Steam Client Service)
SRV - [2011.06.06 11:55:28 | 000,064,952 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2011.02.18 17:09:02 | 000,028,672 | ---- | M] (Lenovo Group Limited) [Auto | Running] -- C:\Program Files (x86)\Lenovo\System Update\SUService.exe -- (SUService)
SRV - [2011.02.04 03:45:00 | 000,155,496 | ---- | M] (Lenovo.) [On_Demand | Stopped] -- C:\Program Files (x86)\ThinkPad\Utilities\DZSVC64.EXE -- (DozeSvc)
SRV - [2011.02.04 03:45:00 | 000,079,208 | ---- | M] (Lenovo) [On_Demand | Stopped] -- C:\Program Files (x86)\ThinkPad\Utilities\PWMDBSVC.EXE -- (Power Manager DBC Service)
SRV - [2010.12.03 11:00:54 | 000,114,024 | ---- | M] (Lenovo Group Limited) [Auto | Running] -- C:\Programme\Lenovo\HOTKEY\tphkload.exe -- (TPHKLOAD)
SRV - [2010.12.02 12:55:54 | 000,064,440 | ---- | M] (Lenovo Group Limited) [Auto | Running] -- C:\Programme\Lenovo\HOTKEY\TPHKSVC.exe -- (TPHKSVC)
SRV - [2010.11.24 16:34:24 | 000,045,496 | ---- | M] (Lenovo Group Limited) [Auto | Running] -- C:\Programme\Lenovo\HOTKEY\micmute.exe -- (LENOVO.MICMUTE)
SRV - [2010.11.20 13:19:20 | 000,397,824 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\SysWOW64\inetsrv\iisw3adm.dll -- (WAS)
SRV - [2010.11.20 13:19:20 | 000,397,824 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysWOW64\inetsrv\iisw3adm.dll -- (W3SVC)
SRV - [2010.11.20 13:18:03 | 000,061,440 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysWOW64\inetsrv\apphostsvc.dll -- (AppHostSvc)
SRV - [2010.08.20 21:08:46 | 000,036,352 | ---- | M] () [On_Demand | Stopped] -- C:\Program Files (x86)\OpenVPN\bin\openvpnserv.exe -- (OpenVPNService)
SRV - [2010.04.20 12:23:32 | 000,074,088 | ---- | M] (Lenovo Group Limited) [Auto | Running] -- C:\Programme\Lenovo\Communications Utility\TPKNRSVC.exe -- (LENOVO.TPKNRSVC)
SRV - [2010.04.20 12:23:18 | 000,050,536 | ---- | M] (Lenovo Group Limited) [Auto | Running] -- C:\Programme\Lenovo\Communications Utility\CamMute.exe -- (LENOVO.CAMMUTE)
SRV - [2010.04.07 14:37:38 | 000,093,032 | ---- | M] (Lenovo Group Limited) [Auto | Running] -- C:\Programme\Lenovo\VIRTSCRL\lvvsst.exe -- (Lenovo.VIRTSCRLSVC)
SRV - [2010.03.18 12:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2009.12.14 23:43:20 | 000,515,560 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe -- (SwitchBoard)
SRV - [2009.06.10 22:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - [2011.08.31 17:00:50 | 000,025,416 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\mbam.sys -- (MBAMProtector)
DRV:64bit: - [2011.08.08 07:32:08 | 000,299,008 | ---- | M] (Windows (R) Win 7 DDK provider) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\AmpPal.sys -- (AMPPALP)
DRV:64bit: - [2011.08.08 07:32:08 | 000,299,008 | ---- | M] (Windows (R) Win 7 DDK provider) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\AmpPal.sys -- (AMPPAL)
DRV:64bit: - [2011.08.03 17:28:32 | 008,604,672 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\NETwNs64.sys -- (NETwNs64) ___ Intel(R)
DRV:64bit: - [2011.08.01 14:59:06 | 000,045,416 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\point64.sys -- (Point64)
DRV:64bit: - [2011.07.28 17:37:10 | 000,052,584 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\dc3d.sys -- (dc3d) MS Hardware Device Detection Driver (USB)
DRV:64bit: - [2011.06.09 10:14:26 | 000,295,272 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\VMM.sys -- (vmm)
DRV:64bit: - [2011.05.27 20:01:12 | 000,046,112 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\kinectcamera.sys -- (KinectCamera)
DRV:64bit: - [2011.05.02 15:29:49 | 000,023,816 | ---- | M] (Prime Sense Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\psdrv3.sys -- (psdrv3)
DRV:64bit: - [2011.04.27 14:25:24 | 000,084,864 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\NisDrvWFP.sys -- (NisDrv)
DRV:64bit: - [2011.03.11 07:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011.03.11 07:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2011.02.17 19:25:02 | 001,419,824 | ---- | M] (Synaptics Incorporated) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SynTP.sys -- (SynTP)
DRV:64bit: - [2011.02.14 18:43:46 | 000,043,456 | ---- | M] (hxxp://libusb-win32.sourceforge.net) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\libusb0.sys -- (libusb0)
DRV:64bit: - [2011.02.04 03:45:00 | 000,031,344 | ---- | M] (Lenovo.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\DZHDD64.SYS -- (DzHDD64)
DRV:64bit: - [2011.02.04 03:45:00 | 000,014,960 | ---- | M] (Lenovo Group Limited) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\TPPWR64V.SYS -- (TPPWRIF)
DRV:64bit: - [2011.01.19 11:20:46 | 007,886,848 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\NETwNv64.sys -- (NETwNv64) ___ Intel(R)
DRV:64bit: - [2011.01.13 11:21:28 | 000,166,656 | ---- | M] (Ricoh co.,Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\5U877.sys -- (5U877)
DRV:64bit: - [2010.11.20 14:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2010.11.20 12:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2010.11.20 10:37:42 | 000,109,056 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\sdbus.sys -- (sdbus)
DRV:64bit: - [2010.11.12 18:48:30 | 000,039,024 | ---- | M] (Lenovo.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ibmpmdrv.sys -- (IBMPMDRV)
DRV:64bit: - [2010.09.07 14:09:34 | 000,015,472 | ---- | M] (Lenovo Group Limited) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\smiifx64.sys -- (lenovo.smi)
DRV:64bit: - [2010.09.02 08:18:46 | 000,021,504 | ---- | M] (Shrew Soft Inc) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\vfilter.sys -- (vflt)
DRV:64bit: - [2010.09.02 08:18:46 | 000,017,408 | ---- | M] (Shrew Soft Inc) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\virtualnet.sys -- (vnet)
DRV:64bit: - [2010.08.20 21:08:46 | 000,030,720 | ---- | M] (The OpenVPN Project) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\tap0901.sys -- (tap0901)
DRV:64bit: - [2010.07.22 09:39:10 | 000,295,600 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\e1k62x64.sys -- (e1kexpress) Intel(R)
DRV:64bit: - [2010.07.08 11:14:04 | 000,154,344 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\iANSW60e.sys -- (IANSPROTOCOL) Intel(R)
DRV:64bit: - [2010.07.08 11:14:04 | 000,154,344 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\iANSW60e.sys -- (iANSMiniport) Intel(R)
DRV:64bit: - [2010.06.21 15:07:38 | 000,131,688 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nvhda64v.sys -- (NVHDA)
DRV:64bit: - [2010.06.09 16:10:16 | 000,046,392 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\nm3.sys -- (nm3)
DRV:64bit: - [2010.04.19 19:47:42 | 000,050,688 | ---- | M] (Apple, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbaapl64.sys -- (USBAAPL64)
DRV:64bit: - [2010.03.17 21:21:58 | 007,680,512 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\NETw5s64.sys -- (NETw5s64) Intel(R)
DRV:64bit: - [2010.01.20 13:14:06 | 000,682,040 | ---- | M] (Conexant Systems Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\CHDRT64.sys -- (CnxtHdAudService)
DRV:64bit: - [2009.12.17 23:25:17 | 000,034,472 | ---- | M] (Elaborate Bytes AG) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\ElbyCDIO.sys -- (ElbyCDIO)
DRV:64bit: - [2009.11.01 18:16:50 | 000,033,736 | ---- | M] (HTC, Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ANDROIDUSB.sys -- (HTCAND64)
DRV:64bit: - [2009.10.26 05:52:00 | 000,061,952 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\rimspe64.sys -- (rimspci)
DRV:64bit: - [2009.08.09 22:25:45 | 000,036,352 | ---- | M] (Elaborate Bytes AG) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\VClone.sys -- (VClone)
DRV:64bit: - [2009.07.14 02:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009.07.14 02:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009.07.14 02:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009.07.14 01:39:20 | 000,023,040 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\WSDPrint.sys -- (WSDPrintDevice)
DRV:64bit: - [2009.07.14 01:35:37 | 000,025,088 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\WSDScan.sys -- (WSDScan)
DRV:64bit: - [2009.07.14 01:09:50 | 000,019,968 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usb8023x.sys -- (usb_rndisx)
DRV:64bit: - [2009.07.14 00:21:48 | 000,038,400 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\tpm.sys -- (TPM)
DRV:64bit: - [2009.06.10 21:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009.06.10 21:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009.06.10 21:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009.06.10 21:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2009.05.18 12:17:08 | 000,034,152 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys -- (GEARAspiWDM)
DRV:64bit: - [2009.05.11 08:33:56 | 000,118,016 | ---- | M] (Lenovo) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LenovoRd.sys -- (LenovoRd)
DRV:64bit: - [2007.02.19 06:56:38 | 000,027,136 | ---- | M] (Lenovo (United States) Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\psadd.sys -- (psadd)
DRV:64bit: - [2006.10.13 03:21:00 | 000,016,080 | ---- | M] (EnTech Taiwan) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\TVicPort64.sys -- (TVicPort64)
DRV - [2009.07.14 02:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
DRV - [2009.03.13 13:47:34 | 000,013,840 | ---- | M] (UPEK Inc.) [Kernel | Auto | Running] -- C:\Programme\ThinkVantage Fingerprint Software\smihlp.sys -- (smihlp) SMI Helper Driver (smihlp)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = [Binary data over 100 bytes]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.heise.de
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 6B 83 4B F1 84 1C CB 01  [binary data]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "hxxp://www.heise.de"
FF - prefs.js..extensions.enabledItems: {DDC359D1-844A-42a7-9AA1-88A850A938A8}:2.0.1
FF - prefs.js..extensions.enabledItems: firebug@software.joehewitt.com:1.6.2
FF - prefs.js..extensions.enabledItems: {9c51bd27-6ed8-4000-a2bf-36cb95c0c947}:11.0.1
FF - prefs.js..extensions.enabledItems: {e968fc70-8f95-4ab9-9e79-304de2a71ee1}:0.7.3
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.3
FF - prefs.js..extensions.enabledItems: tineye@ideeinc.com:1.1
FF - prefs.js..extensions.enabledItems: {c0c9a2c7-2e5c-4447-bc53-97718bc91e1b}:4.0
FF - prefs.js..extensions.enabledItems: {B17C1C5A-04B1-11DB-9804-B622A1EF5492}:1.2.1
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24
FF - prefs.js..network.proxy.backup.ftp: "proxy.in.tum.de"
FF - prefs.js..network.proxy.backup.ftp_port: 8080
FF - prefs.js..network.proxy.backup.gopher: "proxy.in.tum.de"
FF - prefs.js..network.proxy.backup.gopher_port: 8080
FF - prefs.js..network.proxy.backup.socks: "proxy.in.tum.de"
FF - prefs.js..network.proxy.backup.socks_port: 8080
FF - prefs.js..network.proxy.backup.ssl: "proxy.in.tum.de"
FF - prefs.js..network.proxy.backup.ssl_port: 8080
FF - prefs.js..network.proxy.ftp: "proxy.in.tum.de"
FF - prefs.js..network.proxy.ftp_port: 8080
FF - prefs.js..network.proxy.gopher: "proxy.in.tum.de"
FF - prefs.js..network.proxy.gopher_port: 8080
FF - prefs.js..network.proxy.http: "proxy.in.tum.de"
FF - prefs.js..network.proxy.http_port: 8080
FF - prefs.js..network.proxy.share_proxy_settings: true
FF - prefs.js..network.proxy.socks: "proxy.in.tum.de"
FF - prefs.js..network.proxy.socks_port: 8080
FF - prefs.js..network.proxy.ssl: "proxy.in.tum.de"
FF - prefs.js..network.proxy.ssl_port: 8080
FF - prefs.js..network.proxy.type: 0
 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_1_102.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MIF5BA~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/wpi,version=1.4: C:\Program Files\Microsoft\Web Platform Installer\\npwpidetector.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX,Inc.)
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\4.0.60831.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~2\MICROS~4\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~4\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3538.0513: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/wpi,version=1.4: C:\Program Files\Microsoft\Web Platform Installer\\npwpidetector.dll ()
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.79\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2011.11.09 22:56:59 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2011.09.23 00:51:53 | 000,000,000 | ---D | M]
 
[2010.07.05 22:05:37 | 000,000,000 | ---D | M] (No name found) -- C:\Users\[**Mein Username**]\AppData\Roaming\mozilla\Extensions
[2011.12.09 18:21:46 | 000,000,000 | ---D | M] (No name found) -- C:\Users\[**Mein Username**]\AppData\Roaming\mozilla\Firefox\Profiles\o6vs55r2.default\extensions
[2010.07.05 22:29:12 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\[**Mein Username**]\AppData\Roaming\mozilla\Firefox\Profiles\o6vs55r2.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010.07.05 22:29:12 | 000,000,000 | ---D | M] (Tamper Data) -- C:\Users\[**Mein Username**]\AppData\Roaming\mozilla\Firefox\Profiles\o6vs55r2.default\extensions\{9c51bd27-6ed8-4000-a2bf-36cb95c0c947}
[2011.01.03 01:52:56 | 000,000,000 | ---D | M] (Password Exporter) -- C:\Users\[**Mein Username**]\AppData\Roaming\mozilla\Firefox\Profiles\o6vs55r2.default\extensions\{B17C1C5A-04B1-11DB-9804-B622A1EF5492}
[2011.11.14 13:12:27 | 000,000,000 | ---D | M] (Greasemonkey) -- C:\Users\[**Mein Username**]\AppData\Roaming\mozilla\Firefox\Profiles\o6vs55r2.default\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}
[2011.02.02 17:18:23 | 000,000,000 | ---D | M] (User Agent Switcher) -- C:\Users\[**Mein Username**]\AppData\Roaming\mozilla\Firefox\Profiles\o6vs55r2.default\extensions\{e968fc70-8f95-4ab9-9e79-304de2a71ee1}
[2011.06.29 15:57:49 | 000,000,000 | ---D | M] (Custom Buttons) -- C:\Users\[**Mein Username**]\AppData\Roaming\mozilla\Firefox\Profiles\o6vs55r2.default\extensions\custombuttons@xsms.org
[2011.03.09 11:33:10 | 000,000,000 | ---D | M] (TinEye Reverse Image Search) -- C:\Users\[**Mein Username**]\AppData\Roaming\mozilla\Firefox\Profiles\o6vs55r2.default\extensions\tineye@ideeinc.com
[2009.07.09 11:27:34 | 000,002,172 | ---- | M] () -- C:\Users\[**Mein Username**]\AppData\Roaming\Mozilla\Firefox\Profiles\o6vs55r2.default\searchplugins\bing.xml
[2011.02.07 12:40:48 | 000,002,321 | ---- | M] () -- C:\Users\[**Mein Username**]\AppData\Roaming\Mozilla\Firefox\Profiles\o6vs55r2.default\searchplugins\dictcc.xml
[2011.06.14 10:38:02 | 000,002,006 | ---- | M] () -- C:\Users\[**Mein Username**]\AppData\Roaming\Mozilla\Firefox\Profiles\o6vs55r2.default\searchplugins\urban-dictionary.xml
[2011.11.09 22:57:00 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\extensions
[2011.08.31 09:08:37 | 000,000,000 | ---D | M] (Click to call with Skype) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2011.10.29 01:14:00 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA}
() (No name found) -- C:\USERS\[**Mein Username**]\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\O6VS55R2.DEFAULT\EXTENSIONS\{C0C9A2C7-2E5C-4447-BC53-97718BC91E1B}.XPI
() (No name found) -- C:\USERS\[**Mein Username**]\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\O6VS55R2.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}.XPI
() (No name found) -- C:\USERS\[**Mein Username**]\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\O6VS55R2.DEFAULT\EXTENSIONS\{DDC359D1-844A-42A7-9AA1-88A850A938A8}.XPI
() (No name found) -- C:\USERS\[**Mein Username**]\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\O6VS55R2.DEFAULT\EXTENSIONS\FIREBUG@SOFTWARE.JOEHEWITT.COM.XPI
[2011.11.09 22:56:59 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2011.10.03 04:06:04 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll
[2010.01.01 09:00:00 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2010.01.01 09:00:00 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2010.01.01 09:00:00 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2010.01.01 09:00:00 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2010.01.01 09:00:00 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2010.01.01 09:00:00 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2011.12.13 14:52:17 | 000,000,856 | RH-- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 94.63.240.140	www.bing.com
O2:64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
O2:64bit: - BHO: (BrowserHelper Class) - {9A065C65-4EE7-4DDD-9918-F129089A894A} - C:\Programme\Windows Home Server\WHSDeskBands.dll (Microsoft Corporation)
O2:64bit: - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Programme\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O3:64bit: - HKLM\..\Toolbar: (Home Server Banner) - {D73E76A3-F902-45BD-8FC8-95AE8E014671} - C:\Programme\Windows Home Server\WHSDeskBands.dll (Microsoft Corporation)
O3:64bit: - HKCU\..\Toolbar\WebBrowser: (&Address) - {01E04581-4EEE-11D0-BFE9-00AA005B4383} - C:\Windows\SysNative\ExplorerFrame.dll (Microsoft Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (&Address) - {01E04581-4EEE-11D0-BFE9-00AA005B4383} - C:\Windows\SysWOW64\ExplorerFrame.dll (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [IntelliPoint] c:\Program Files\Microsoft IntelliPoint\ipoint.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [LENOVO.TPKNRRES] C:\Programme\Lenovo\Communications Utility\TPKNRRES.exe (Lenovo Group Limited)
O4:64bit: - HKLM..\Run: [MSC] c:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [TPFanControl] C:\Programme\TPFanControl\TPFanControl.exe (troubadix)
O4:64bit: - HKLM..\Run: [Zune Launcher] c:\Program Files\Zune\ZuneLauncher.exe (Microsoft Corporation)
O4 - HKLM..\Run: [DivXUpdate] C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe ()
O4 - HKLM..\Run: [KeePass 2 PreLoad] C:\Program Files (x86)\KeePass Password Safe 2\KeePass.exe (Dominik Reichl)
O4 - HKLM..\Run: [LifeCam] C:\Program Files (x86)\Microsoft LifeCam\LifeExp.exe (Microsoft Corporation)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [PWMTRV] C:\Program Files (x86)\ThinkPad\Utilities\PWMTR64V.DLL (Lenovo Group Limited)
O4 - HKLM..\Run: [RotateImage] C:\Program Files (x86)\Integrated Camera Driver\X64\RCIMGDIR.exe (Ricoh co.,Ltd.)
O4 - Startup: C:\Users\[**Mein Username**]\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk = C:\Users\[**Mein Username**]\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HideSCAHealth = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableCAD = 1
O8:64bit: - Extra context menu item: Sothink SWF Catcher - C:\Program Files (x86)\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm ()
O8 - Extra context menu item: Sothink SWF Catcher - C:\Program Files (x86)\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm ()
O9 - Extra Button: Click to call with Skype - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Click to call with Skype - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra Button: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Program Files (x86)\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm ()
O9 - Extra 'Tools' menuitem : Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Program Files (x86)\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm ()
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000005 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000008 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000009 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} hxxp://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 131.159.14.206 131.159.14.208
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{3B95F5B2-532F-4302-92FC-F1D0E1289524}: DhcpNameServer = 192.168.100.254
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{45A3E5B8-AAAB-47D8-A902-DF89920FA93E}: NameServer = 194.24.128.100 81.3.216.100
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{66903589-D907-47DE-94FE-52BF7291FFEF}: Domain = tu-muenchen.de
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{66903589-D907-47DE-94FE-52BF7291FFEF}: NameServer = 10.156.33.53,129.187.5.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{78A15479-FA38-4FEB-9567-0118E6097A68}: DhcpNameServer = 131.159.14.206 131.159.14.208
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{805AA013-3BFB-4689-B617-5C5805333934}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{FC002D33-B931-4996-A0EA-60763D9D5CFA}: DhcpNameServer = 213.133.100.100 213.133.98.98
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\mso-offdap11 - No CLSID value found
O18:64bit: - Protocol\Handler\skype-ie-addon-data - No CLSID value found
O18:64bit: - Protocol\Handler\wlpg - No CLSID value found
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O18:64bit: - Protocol\Filter\text/xml {807573E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) -C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) -C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - HKCU Winlogon: Shell - (explorer.exe) -C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20:64bit: - Winlogon\Notify\psfus: DllName - (C:\Program Files\ThinkVantage Fingerprint Software\psqlpwd.dll) - C:\Programme\ThinkVantage Fingerprint Software\psqlpwd.dll (UPEK Inc.)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{46bba8e4-39eb-11e0-b86b-f977e927b5e5}\Shell - "" = AutoRun
O33 - MountPoints2\{46bba8e4-39eb-11e0-b86b-f977e927b5e5}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{46bba8f7-39eb-11e0-b86b-f977e927b5e5}\Shell - "" = AutoRun
O33 - MountPoints2\{46bba8f7-39eb-11e0-b86b-f977e927b5e5}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{4ab8d773-b234-11e0-af05-5cff350991a1}\Shell - "" = AutoRun
O33 - MountPoints2\{4ab8d773-b234-11e0-af05-5cff350991a1}\Shell\AutoRun\command - "" = F:\LaunchU3.exe -a
O33 - MountPoints2\{af37d370-88f0-11df-8555-5cff350991a1}\Shell - "" = AutoRun
O33 - MountPoints2\{af37d370-88f0-11df-8555-5cff350991a1}\Shell\AutoRun\command - "" = E:\autorun.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2011.12.14 03:27:35 | 000,000,000 | ---D | C] -- C:\Users\[**Mein Username**]\AppData\Local\{458D3125-0D31-4F13-BCED-6491E36E5AA2}
[2011.12.14 03:27:25 | 000,000,000 | ---D | C] -- C:\Users\[**Mein Username**]\AppData\Local\{D41D5D4D-9A1B-4CE9-9CDC-0256600E6095}
[2011.12.14 03:15:19 | 000,096,256 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmled.dll
[2011.12.14 03:15:19 | 000,072,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmled.dll
[2011.12.14 03:15:18 | 000,237,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\url.dll
[2011.12.14 03:15:18 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\url.dll
[2011.12.14 03:15:18 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll
[2011.12.14 03:15:17 | 000,248,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll
[2011.12.14 03:15:16 | 002,309,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9.dll
[2011.12.14 03:15:16 | 001,493,504 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\inetcpl.cpl
[2011.12.14 03:15:16 | 001,427,456 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\inetcpl.cpl
[2011.12.14 03:15:16 | 000,716,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript.dll
[2011.12.14 03:15:15 | 000,818,688 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript.dll
[2011.12.14 03:06:19 | 000,723,456 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\EncDec.dll
[2011.12.14 03:06:19 | 000,534,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\EncDec.dll
[2011.12.14 03:06:15 | 000,043,520 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\csrsrv.dll
[2011.12.14 03:04:08 | 052,988,224 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\MRT.exe
[2011.12.14 01:59:58 | 000,000,000 | ---D | C] -- C:\Users\[**Mein Username**]\AppData\Roaming\Malwarebytes
[2011.12.14 01:59:48 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2011.12.14 01:59:47 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2011.12.14 01:59:44 | 000,025,416 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2011.12.14 01:59:44 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2011.12.14 01:26:42 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
[2011.12.14 01:26:41 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner
[2011.12.14 01:19:07 | 000,000,000 | ---D | C] -- C:\Users\[**Mein Username**]\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\HiJackThis
[2011.12.14 01:19:06 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Trend Micro
[2011.12.14 00:38:22 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ESET
[2011.12.13 17:33:07 | 000,000,000 | ---D | C] -- C:\Users\[**Mein Username**]\AppData\Roaming\48A74
[2011.12.13 16:59:48 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WebReaper
[2011.12.13 16:59:48 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\WebReaper
[2011.12.13 16:49:19 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\LP
[2011.12.13 16:19:33 | 000,000,000 | ---D | C] -- C:\Users\[**Mein Username**]\AppData\Roaming\74508
[2011.12.13 16:18:56 | 000,000,000 | -HSD | C] -- C:\Users\[**Mein Username**]\AppData\Local\5d87cf71
[2011.12.13 15:01:03 | 000,000,000 | ---D | C] -- C:\Users\[**Mein Username**]\AppData\Roaming\Inspyder Web2Disk
[2011.12.13 14:46:20 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Visual Web Spider
[2011.12.13 14:21:23 | 000,000,000 | ---D | C] -- C:\Users\[**Mein Username**]\AppData\Local\{58559085-C5DA-4FEA-A9CC-856BDA4F4BE0}
[2011.12.13 14:21:13 | 000,000,000 | ---D | C] -- C:\Users\[**Mein Username**]\AppData\Local\{B2B10D9D-8C25-4673-B682-C492E8C79E38}
[2011.12.12 14:40:58 | 000,000,000 | ---D | C] -- C:\Users\[**Mein Username**]\AppData\Local\{3844D27F-421D-42E7-A5D8-B334034730AE}
[2011.12.12 14:39:55 | 000,000,000 | ---D | C] -- C:\Users\[**Mein Username**]\AppData\Local\{B0F9D105-5B05-40A3-8F14-0261271D4D79}
[2011.12.12 14:32:25 | 000,053,248 | ---- | C] (EnTech Taiwan) -- C:\Windows\System\TVicPort.dll
[2011.12.12 14:32:25 | 000,016,080 | ---- | C] (EnTech Taiwan) -- C:\Windows\SysNative\drivers\TVicPort64.sys
[2011.12.12 14:32:25 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TPFanControl
[2011.12.12 14:32:25 | 000,000,000 | ---D | C] -- C:\Program Files\TPFanControl
[2011.12.12 13:47:13 | 000,000,000 | ---D | C] -- C:\Users\[**Mein Username**]\AppData\Local\{114D8A5D-178F-458A-B953-B5A03E3ADA20}
[2011.12.10 16:58:25 | 000,000,000 | ---D | C] -- C:\Users\[**Mein Username**]\AppData\Local\{F7A23DFB-68EF-4509-B5F5-097A67C397C7}
[2011.12.10 16:58:10 | 000,000,000 | ---D | C] -- C:\Users\[**Mein Username**]\AppData\Local\{51AD986D-6976-42AB-908E-06F8BDEC9B41}
[2011.12.06 16:42:20 | 000,000,000 | ---D | C] -- C:\Users\[**Mein Username**]\Desktop\chill
[2011.12.05 17:37:02 | 000,000,000 | ---D | C] -- C:\Users\[**Mein Username**]\AppData\Local\{EAE49450-42A4-4A82-8A26-B854E81C9C61}
[2011.12.05 17:36:41 | 000,000,000 | ---D | C] -- C:\Users\[**Mein Username**]\AppData\Local\{BB56FCA8-43A5-414C-9212-BA2C404E1B60}
[2011.12.03 12:56:12 | 000,000,000 | ---D | C] -- C:\Users\[**Mein Username**]\AppData\Local\{5854D1AC-C6D7-4F17-9A0D-314868229CAC}
[2011.12.03 12:56:03 | 000,000,000 | ---D | C] -- C:\Users\[**Mein Username**]\AppData\Local\{C94D2BAF-0C30-4C1D-B658-6121CD0FF8BE}
[2011.12.03 00:52:34 | 000,000,000 | ---D | C] -- C:\Users\[**Mein Username**]\AppData\Local\{B9598C30-623C-450D-BA85-E7BCE2C96498}
[2011.12.03 00:52:12 | 000,000,000 | ---D | C] -- C:\Users\[**Mein Username**]\AppData\Local\{7772624F-6CD8-4DC9-BF92-8FA7E2A81A13}
[2011.12.01 14:53:46 | 000,000,000 | ---D | C] -- C:\Users\[**Mein Username**]\AppData\Local\{35F0F095-3E02-4DC3-9B59-788593A1C87B}
[2011.11.29 10:44:14 | 000,000,000 | ---D | C] -- C:\Users\[**Mein Username**]\AppData\Local\{4B1CDF44-0663-42AA-8C7B-FFDDABE7E807}
[2011.11.29 10:43:53 | 000,000,000 | ---D | C] -- C:\Users\[**Mein Username**]\AppData\Local\{D6697C06-227F-47EA-BC70-23D1208531CD}
[2011.11.29 04:27:22 | 000,000,000 | ---D | C] -- C:\Users\[**Mein Username**]\Documents\Meine empfangenen Dateien
[2011.11.28 22:43:30 | 000,000,000 | ---D | C] -- C:\Users\[**Mein Username**]\AppData\Local\{F46CE415-DA9B-4B1E-BB97-33C78200AA08}
[2011.11.28 09:00:35 | 000,000,000 | ---D | C] -- C:\Users\[**Mein Username**]\AppData\Local\{D47E542C-55A0-4791-AF52-8B41AA87D7DE}
[2011.11.28 09:00:14 | 000,000,000 | ---D | C] -- C:\Users\[**Mein Username**]\AppData\Local\{62215CE6-7B9D-4DA0-9886-2ED3E3D11636}
[2011.11.28 04:10:12 | 000,000,000 | ---D | C] -- C:\Users\[**Mein Username**]\AppData\Roaming\com.adobe.bridge.PublishPanel
[2011.11.27 20:59:51 | 000,000,000 | ---D | C] -- C:\Users\[**Mein Username**]\AppData\Local\{C9DA4A17-8544-4D8F-B628-B7E436A7D64C}
[2011.11.27 20:59:30 | 000,000,000 | ---D | C] -- C:\Users\[**Mein Username**]\AppData\Local\{912693EA-CA1B-4A4B-BDC5-B6EB88B3393A}
[2011.11.27 08:59:19 | 000,000,000 | ---D | C] -- C:\Users\[**Mein Username**]\AppData\Local\{7E94746C-845D-4200-B340-382D39BC0791}
[2011.11.27 08:59:09 | 000,000,000 | ---D | C] -- C:\Users\[**Mein Username**]\AppData\Local\{74B7EA83-2E8F-4280-88D9-58B509F94F9B}
[2011.11.26 15:23:12 | 000,000,000 | ---D | C] -- C:\Users\[**Mein Username**]\Desktop\bilder
[2011.11.25 10:46:29 | 000,000,000 | ---D | C] -- C:\Users\[**Mein Username**]\AppData\Local\{123D6A73-2D7A-40D6-AAC0-166F9FF35AD4}
[2011.11.24 22:45:57 | 000,000,000 | ---D | C] -- C:\Users\[**Mein Username**]\AppData\Local\{FFB08158-15AB-413C-9363-3DA4359FEAFE}
[2011.11.24 22:45:36 | 000,000,000 | ---D | C] -- C:\Users\[**Mein Username**]\AppData\Local\{93325A73-B66C-4200-9D76-4A74D85C473D}
[2011.11.24 00:31:03 | 000,000,000 | ---D | C] -- C:\Users\[**Mein Username**]\AppData\Local\{3C30E7A4-DDDD-4989-B91A-62C5AB0228C5}
[2011.11.24 00:30:42 | 000,000,000 | ---D | C] -- C:\Users\[**Mein Username**]\AppData\Local\{AC81E3A6-589A-40AD-A92B-781815A08762}
[2011.11.23 19:11:21 | 000,000,000 | ---D | C] -- C:\ProgramData\Intel
[2011.11.23 19:10:46 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Intel
[2011.11.23 19:10:46 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Cisco
[2011.11.22 23:05:00 | 000,000,000 | ---D | C] -- C:\Users\[**Mein Username**]\AppData\Local\{D3B7EFBA-8F90-4DBC-9210-B39821794ECC}
[2011.11.22 23:04:39 | 000,000,000 | ---D | C] -- C:\Users\[**Mein Username**]\AppData\Local\{550550AF-E1E9-4C03-81EA-DEFA0D1646CA}
[2011.11.20 17:25:33 | 000,000,000 | ---D | C] -- C:\Users\[**Mein Username**]\AppData\Local\{A8B4BC9D-0EBB-4FB8-8778-CD2CE46E6B80}
[2011.11.20 17:25:10 | 000,000,000 | ---D | C] -- C:\Users\[**Mein Username**]\AppData\Local\{69741420-9C95-4147-A6B0-0D8709B02F6F}
[2011.11.20 05:24:59 | 000,000,000 | ---D | C] -- C:\Users\[**Mein Username**]\AppData\Local\{595BE7F4-83E3-462B-BD63-AA0797AB7832}
[2011.11.19 13:37:23 | 000,000,000 | ---D | C] -- C:\Users\[**Mein Username**]\AppData\Local\{848CD9C2-4E7E-4CF8-8144-1376B3D233C2}
[2011.11.19 01:36:51 | 000,000,000 | ---D | C] -- C:\Users\[**Mein Username**]\AppData\Local\{C27BA6F2-2E47-4590-B851-C3AC00CF3661}
[2011.11.19 01:36:41 | 000,000,000 | ---D | C] -- C:\Users\[**Mein Username**]\AppData\Local\{FFAB961C-1384-4540-92FD-4BDF07F41E8D}
[2011.11.18 13:36:18 | 000,000,000 | ---D | C] -- C:\Users\[**Mein Username**]\AppData\Local\{C0C86756-6564-48B9-B7C9-D841F65E8439}
[2011.11.18 13:35:53 | 000,000,000 | ---D | C] -- C:\Users\[**Mein Username**]\AppData\Local\{637949B0-9E60-4DA6-926D-CDDA734A24FE}
[2011.11.17 22:12:22 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Earth
[2011.11.17 18:22:11 | 000,000,000 | ---D | C] -- C:\Users\[**Mein Username**]\AppData\Local\{9DD5F022-DB6F-4C19-9FDA-4D2EF29EB724}
[2011.11.17 18:22:10 | 000,000,000 | ---D | C] -- C:\Users\[**Mein Username**]\AppData\Local\{9E02481D-8319-4859-B67B-D3BF36072FC9}
[2011.11.16 17:11:09 | 000,000,000 | ---D | C] -- C:\Users\[**Mein Username**]\AppData\Roaming\MvvmLight
[2011.11.16 17:11:09 | 000,000,000 | ---D | C] -- C:\Users\[**Mein Username**]\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\MvvmLight
[2011.11.16 17:11:08 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Laurent Bugnion (GalaSoft)
[2011.11.14 17:30:13 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mendeley Desktop
[2011.11.14 17:30:08 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mendeley Desktop
 
========== Files - Modified Within 30 Days ==========
 
[2011.12.14 15:20:00 | 000,001,106 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2011.12.14 14:57:25 | 000,018,320 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2011.12.14 14:57:25 | 000,018,320 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2011.12.14 14:56:48 | 002,131,116 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2011.12.14 14:56:48 | 000,901,142 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2011.12.14 14:56:48 | 000,820,576 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2011.12.14 14:56:48 | 000,226,982 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2011.12.14 14:56:48 | 000,181,330 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2011.12.14 14:50:29 | 000,001,102 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2011.12.14 14:50:14 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2011.12.14 14:50:08 | 3110,866,944 | -HS- | M] () -- C:\hiberfil.sys
[2011.12.14 03:26:55 | 005,948,616 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2011.12.14 02:12:03 | 000,089,088 | ---- | M] () -- C:\Windows\SysNative\mbr.exe
[2011.12.14 00:14:55 | 000,007,600 | ---- | M] () -- C:\Users\[**Mein Username**]\AppData\Local\Resmon.ResmonCfg
[2011.12.13 19:39:09 | 000,000,724 | ---- | M] () -- C:\Users\[**Mein Username**]\Desktop\arffexport.arff
[2011.12.13 14:52:17 | 000,000,856 | RH-- | M] () -- C:\Windows\SysNative\drivers\etc\hosts
[2011.12.07 11:44:28 | 052,988,224 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\MRT.exe
[2011.12.01 04:39:42 | 000,427,474 | ---- | M] () -- C:\Users\[**Mein Username**]\Desktop\panorama.jpg
[2011.11.29 19:14:00 | 000,053,083 | ---- | M] () -- C:\Users\[**Mein Username**]\Desktop\sensor processing chain.png
[2011.11.25 16:50:47 | 000,574,615 | ---- | M] () -- C:\Users\[**Mein Username**]\Desktop\sensorsavedata.ssd
[2011.11.25 16:50:47 | 000,574,615 | ---- | M] () -- C:\Users\[**Mein Username**]\Desktop\sensorsavedata - Compass Stability.ssd
[2011.11.23 19:11:23 | 000,000,000 | -H-- | M] () -- C:\Windows\SysNative\drivers\Msft_Kernel_AMPPAL_01009.Wdf
[2011.11.23 18:32:01 | 000,357,978 | ---- | M] () -- C:\Users\[**Mein Username**]\Desktop\arffexport_longertest.arff
[2011.11.23 17:39:44 | 000,406,469 | ---- | M] () -- C:\Users\[**Mein Username**]\Desktop\arffexport_firstclassified.arff
 
========== Files Created - No Company Name ==========
 
[2011.12.14 02:12:03 | 000,089,088 | ---- | C] () -- C:\Windows\SysNative\mbr.exe
[2011.12.01 04:39:27 | 000,427,474 | ---- | C] () -- C:\Users\[**Mein Username**]\Desktop\panorama.jpg
[2011.11.29 19:14:00 | 000,053,083 | ---- | C] () -- C:\Users\[**Mein Username**]\Desktop\sensor processing chain.png
[2011.11.25 16:59:11 | 000,574,615 | ---- | C] () -- C:\Users\[**Mein Username**]\Desktop\sensorsavedata - Compass Stability.ssd
[2011.11.24 19:32:35 | 000,574,615 | ---- | C] () -- C:\Users\[**Mein Username**]\Desktop\sensorsavedata.ssd
[2011.11.24 19:32:35 | 000,000,724 | ---- | C] () -- C:\Users\[**Mein Username**]\Desktop\arffexport.arff
[2011.11.23 19:11:23 | 000,000,000 | -H-- | C] () -- C:\Windows\SysNative\drivers\Msft_Kernel_AMPPAL_01009.Wdf
[2011.11.23 18:20:52 | 000,357,978 | ---- | C] () -- C:\Users\[**Mein Username**]\Desktop\arffexport_longertest.arff
[2011.11.14 23:03:11 | 015,922,019 | ---- | C] () -- C:\Users\[**Mein Username**]\Desktop\CVPR 2011 - Final Video.mp4
[2011.11.14 16:25:21 | 000,406,469 | ---- | C] () -- C:\Users\[**Mein Username**]\Desktop\arffexport_firstclassified.arff
[2011.10.24 16:43:23 | 000,000,000 | ---- | C] () -- C:\Users\[**Mein Username**]\AppData\Local\{B5ECF200-429F-43EE-9814-C15191ECCD26}
[2011.09.27 14:40:19 | 000,001,456 | ---- | C] () -- C:\Users\[**Mein Username**]\AppData\Local\Adobe Save for Web 12.0 Prefs
[2011.07.23 13:20:24 | 000,032,256 | ---- | C] () -- C:\Windows\SysWow64\AVSredirect.dll
[2011.07.23 13:12:56 | 000,107,520 | RHS- | C] () -- C:\Windows\SysWow64\TAKDSDecoder.dll
[2011.06.13 19:20:04 | 000,000,425 | ---- | C] () -- C:\Windows\BRWMARK.INI
[2011.06.13 19:20:04 | 000,000,027 | ---- | C] () -- C:\Windows\BRPP2KA.INI
[2011.04.09 17:55:28 | 000,179,261 | ---- | C] () -- C:\Windows\SysWow64\xlive.dll.cat
[2011.03.25 13:58:05 | 000,066,856 | ---- | C] () -- C:\Windows\SysWow64\SynTPEnhPS.dll
[2010.11.21 03:47:35 | 000,007,600 | ---- | C] () -- C:\Users\[**Mein Username**]\AppData\Local\Resmon.ResmonCfg
[2010.11.13 20:42:44 | 000,000,000 | ---- | C] () -- C:\Users\[**Mein Username**]\AppData\Roaming\gnuplot_history
[2010.11.04 01:58:46 | 000,038,425 | ---- | C] () -- C:\Users\[**Mein Username**]\AppData\Roaming\Kommagetrennte Werte (Windows).ADR
[2010.10.15 21:56:43 | 000,000,263 | ---- | C] () -- C:\Windows\SmartTRAK.INI
[2010.10.15 21:35:04 | 000,015,259 | ---- | C] () -- C:\Windows\SysWow64\compress.exe
[2010.09.03 15:52:51 | 000,000,600 | ---- | C] () -- C:\Users\[**Mein Username**]\AppData\Local\PUTTY.RND
[2010.08.31 00:31:21 | 000,001,442 | ---- | C] () -- C:\Windows\cxxd-n.ini
[2010.08.23 13:23:19 | 000,000,600 | ---- | C] () -- C:\Users\[**Mein Username**]\AppData\Roaming\winscp.rnd
[2010.07.31 23:16:50 | 000,000,419 | ---- | C] () -- C:\Windows\QIII.INI
[2010.07.08 13:32:45 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2010.07.06 00:03:30 | 002,112,958 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2010.07.05 22:13:01 | 001,612,392 | ---- | C] () -- C:\Windows\SysWow64\nView.dll
[2010.07.05 22:13:01 | 001,108,584 | ---- | C] () -- C:\Windows\SysWow64\nvwimg.dll
[2010.07.05 22:13:01 | 000,256,616 | ---- | C] () -- C:\Windows\SysWow64\nViewSetup.exe
[2009.07.14 06:38:36 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2009.07.14 03:35:51 | 000,000,741 | ---- | C] () -- C:\Windows\SysWow64\NOISE.DAT
[2009.07.14 03:34:42 | 000,215,943 | ---- | C] () -- C:\Windows\SysWow64\dssec.dat
[2009.07.14 01:10:29 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2009.07.14 00:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\SysWow64\BWContextHandler.dll
[2009.07.13 22:03:59 | 000,364,544 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll
[2009.06.10 22:26:10 | 000,673,088 | ---- | C] () -- C:\Windows\SysWow64\mlang.dat

< End of report >

--- --- ---

markusg · 14.12.2011, 16:06

hi
öffne bitte Malwarebytes logdateien poste die scan logs

Nahtal · 14.12.2011, 16:10

Code:

ATTFilter

Malwarebytes' Anti-Malware 1.51.2.1300
www.malwarebytes.org

Datenbank Version: 8367

Windows 6.1.7601 Service Pack 1
Internet Explorer 9.0.8112.16421

14.12.2011 02:02:49
mbam-log-2011-12-14 (02-02-49).txt

Art des Suchlaufs: Quick-Scan
Durchsuchte Objekte: 208323
Laufzeit: 1 Minute(n), 3 Sekunde(n)

Infizierte Speicherprozesse: 1
Infizierte Speichermodule: 1
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 3
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 2

Infizierte Speicherprozesse:
c:\Users\[**User**]\AppData\Local\dplaysvr.exe (Trojan.Agent) -> 4920 -> Unloaded process successfully.

Infizierte Speichermodule:
c:\Users\[**User**]\AppData\Local\dplayx.dll (Trojan.Agent) -> Delete on reboot.

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dplaysvr (Trojan.Agent) -> Value: dplaysvr -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dplaysvr (Trojan.Agent) -> Value: dplaysvr -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyServer (PUM.Bad.Proxy) -> Value: ProxyServer -> Quarantined and deleted successfully.

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
c:\Users\[**User**]\AppData\Local\dplayx.dll (Trojan.Agent) -> Quarantined and deleted successfully.
c:\Users\[**User**]\AppData\Local\dplaysvr.exe (Trojan.Agent) -> Quarantined and deleted successfully.

markusg · 14.12.2011, 16:40

Combofix darf ausschließlich ausgeführt werden, wenn dies von einem Team Mitglied angewiesen wurde!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich
ziehen und eine Bereinigung der Infektion noch erschweren.

Bitte downloade dir Combofix.exe und speichere es unbedingt auf deinem Desktop.

Besuche folgende Seite für Downloadlinks und Anweisungen für dieses
Tool

Ein Leitfaden und Tutorium zur Nutzung von ComboFix
Hinweis:
Gehe sicher das all deine Anti Virus und Anti Malware Programme abgeschalten sind, damit diese Combofix nicht bei der Arbeit stören.
Poste bitte die C:\Combofix.txt in deiner nächsten Antwort.

Nahtal · 14.12.2011, 17:16

Soweit so gut! Combofix hat einiges gefunden und behandelt. Der Sicherheitscenterdienst ist jetzt wieder da.

Vielen Dank erstmal!

Sind noch weitere Schritte zu tun?

Hier die CF Log:
Combofix Logfile:

Code:

ATTFilter

ComboFix 11-12-13.03 - Phil 14.12.2011  17:00:35.1.4 - x64
Microsoft Windows 7 Professional   6.1.7601.1.1252.49.1031.18.3956.2119 [GMT 1:00]
ausgeführt von:: D:\ComboFix.exe
AV: Microsoft Security Essentials *Enabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160}
SP: Microsoft Security Essentials *Enabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files (x86)\LP
c:\programdata\Roaming
c:\users\[**User**]\AppData\Roaming\EurekaLog
c:\windows\assembly\tmp\U
.
.
(((((((((((((((((((((((   Dateien erstellt von 2011-11-14 bis 2011-12-14  ))))))))))))))))))))))))))))))
.
.
2011-12-14 16:06 . 2011-12-14 16:06	69000	----a-w-	c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{03EE2C7E-A932-4A69-82C2-0FF5781B2081}\offreg.dll
2011-12-14 02:21 . 2011-11-21 11:40	8822856	----a-w-	c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{03EE2C7E-A932-4A69-82C2-0FF5781B2081}\mpengine.dll
2011-12-14 02:08 . 2011-11-05 05:32	2048	----a-w-	c:\windows\system32\tzres.dll
2011-12-14 02:08 . 2011-11-05 04:26	2048	----a-w-	c:\windows\SysWow64\tzres.dll
2011-12-14 02:06 . 2011-11-24 04:52	3145216	----a-w-	c:\windows\system32\win32k.sys
2011-12-14 02:06 . 2011-10-15 06:31	723456	----a-w-	c:\windows\system32\EncDec.dll
2011-12-14 02:06 . 2011-10-15 05:38	534528	----a-w-	c:\windows\SysWow64\EncDec.dll
2011-12-14 02:06 . 2011-10-26 05:21	43520	----a-w-	c:\windows\system32\csrsrv.dll
2011-12-14 01:12 . 2011-12-14 01:12	89088	----a-w-	c:\windows\system32\mbr.exe
2011-12-14 00:59 . 2011-12-14 00:59	--------	d-----w-	c:\users\[**User**]\AppData\Roaming\Malwarebytes
2011-12-14 00:59 . 2011-12-14 00:59	--------	d-----w-	c:\programdata\Malwarebytes
2011-12-14 00:59 . 2011-12-14 00:59	--------	d-----w-	c:\program files (x86)\Malwarebytes' Anti-Malware
2011-12-14 00:59 . 2011-08-31 16:00	25416	----a-w-	c:\windows\system32\drivers\mbam.sys
2011-12-14 00:26 . 2011-12-14 00:26	--------	d-----w-	c:\program files\CCleaner
2011-12-14 00:19 . 2011-12-14 00:19	388096	----a-r-	c:\users\[**User**]\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2011-12-14 00:19 . 2011-12-14 00:19	--------	d-----w-	c:\program files (x86)\Trend Micro
2011-12-13 23:38 . 2011-12-13 23:38	--------	d-----w-	c:\program files (x86)\ESET
2011-12-13 16:33 . 2011-12-13 20:48	--------	d-----w-	c:\users\[**User**]\AppData\Roaming\48A74
2011-12-13 15:59 . 2011-12-13 16:01	--------	d-----w-	c:\program files (x86)\WebReaper
2011-12-13 15:19 . 2011-12-13 20:48	--------	d-----w-	c:\users\[**User**]\AppData\Roaming\74508
2011-12-13 15:18 . 2011-12-13 15:21	--------	d-sh--w-	c:\users\[**User**]\AppData\Local\5d87cf71
2011-12-13 14:01 . 2011-12-13 14:15	--------	d-----w-	c:\users\[**User**]\AppData\Roaming\Inspyder Web2Disk
2011-12-13 13:46 . 2011-12-13 13:50	--------	d-----w-	c:\program files (x86)\Visual Web Spider
2011-12-12 13:32 . 2011-12-12 13:32	--------	d-----w-	c:\program files\TPFanControl
2011-12-12 13:32 . 2006-10-13 02:21	16080	----a-w-	c:\windows\system32\drivers\TVicPort64.sys
2011-12-12 13:32 . 2005-03-30 11:11	53248	----a-w-	c:\windows\system\TVicPort.dll
2011-11-28 03:10 . 2011-11-28 03:10	--------	d-----w-	c:\users\[**User**]\AppData\Roaming\com.adobe.bridge.PublishPanel
2011-11-25 20:03 . 2011-11-25 20:03	158056	----a-w-	c:\programdata\Microsoft\Windows\Sqm\Manifest\Sqm10139.bin
2011-11-23 18:11 . 2011-11-23 18:11	--------	d-----w-	c:\programdata\Intel
2011-11-23 18:10 . 2011-11-23 18:10	--------	d-----w-	c:\program files (x86)\Cisco
2011-11-23 18:10 . 2011-11-23 18:10	--------	d-----w-	c:\program files\Common Files\Intel
2011-11-16 16:11 . 2011-11-16 16:11	--------	d-----w-	c:\users\[**User**]\AppData\Roaming\MvvmLight
2011-11-16 16:11 . 2011-11-16 16:11	--------	d-----w-	c:\program files (x86)\Laurent Bugnion (GalaSoft)
2011-11-14 16:30 . 2011-11-14 16:30	--------	d-----w-	c:\program files (x86)\Mendeley Desktop
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-11-21 11:40 . 2010-07-06 23:17	8822856	----a-w-	c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2011-11-16 16:11 . 2011-04-06 10:38	1764960	----a-w-	c:\programdata\Microsoft\VisualStudio\10.0\1033\ResourceCache.dll
2011-11-16 16:11 . 2010-09-17 00:01	306528	----a-w-	c:\programdata\Microsoft\VPDExpress\10.0\1033\ResourceCache.dll
2011-11-14 12:11 . 2011-05-27 17:26	414368	----a-w-	c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2011-10-11 04:42 . 2011-10-11 04:42	917840	------w-	c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{15C5E4E1-F9E7-4422-A4C0-52F1F806F0E1}\gapaengine.dll
2011-10-03 03:06 . 2010-07-15 14:07	472808	----a-w-	c:\windows\SysWow64\deployJava1.dll
2011-09-29 16:29 . 2011-11-09 13:19	1923952	----a-w-	c:\windows\system32\drivers\tcpip.sys
2006-05-03 10:06	163328	--sha-r-	c:\windows\SysWOW64\flvDX.dll
2007-02-21 11:47	31232	--sha-r-	c:\windows\SysWOW64\msfDX.dll
2008-03-16 13:30	216064	--sha-r-	c:\windows\SysWOW64\nbDX.dll
2010-01-06 22:00	107520	--sha-r-	c:\windows\SysWOW64\TAKDSDecoder.dll
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12	94208	----a-w-	c:\users\[**User**]\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12	94208	----a-w-	c:\users\[**User**]\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12	94208	----a-w-	c:\users\[**User**]\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1475584]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"PWMTRV"="c:\progra~2\ThinkPad\UTILIT~1\PWMTR64V.DLL" [2011-02-04 1543016]
"DivXUpdate"="c:\program files (x86)\DivX\DivX Update\DivXUpdate.exe" [2010-09-16 1164584]
"KeePass 2 PreLoad"="c:\program files (x86)\KeePass Password Safe 2\KeePass.exe" [2011-01-02 1670656]
"RotateImage"="c:\program files (x86)\Integrated Camera Driver\X64\RCIMGDIR.exe" [2008-10-30 55808]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-06-06 937920]
"LifeCam"="c:\program files (x86)\Microsoft LifeCam\LifeExp.exe" [2010-12-13 135536]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696]
"Malwarebytes' Anti-Malware"="c:\program files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" [2011-08-31 449608]
.
c:\users\[**User**]\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dropbox.lnk - c:\users\[**User**]\AppData\Roaming\Dropbox\bin\Dropbox.exe [2011-5-25 24176560]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Windows Home Server.lnk - c:\windows\Installer\{21E49794-7C13-4E84-8659-55BD378267D5}\WHSTrayApp.exe [2011-9-6 672112]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
"DisableCAD"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"HideSCAHealth"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Notification Packages	REG_MULTI_SZ   	scecli c:\program files\ThinkVantage Fingerprint Software\psqlpwd.dll
Security Packages	REG_MULTI_SZ   	kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-07-05 136176]
R2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2011-08-31 366152]
R3 5U877;USB Video Device;c:\windows\system32\DRIVERS\5U877.sys [x]
R3 ALSysIO;ALSysIO;c:\users\[**User**]\AppData\Local\Temp\ALSysIO64.sys [x]
R3 AMPPALP;Intel® Centrino® Wireless Bluetooth® 3.0 + High Speed Protokoll;c:\windows\system32\DRIVERS\amppal.sys [x]
R3 dc3d;MS Hardware Device Detection Driver (USB);c:\windows\system32\DRIVERS\dc3d.sys [x]
R3 DozeSvc;Lenovo Doze Mode Service;c:\program files (x86)\ThinkPad\Utilities\DZSVC64.EXE [2011-02-04 155496]
R3 gupdatem;Google Update-Dienst (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-07-05 136176]
R3 HTCAND64;HTC Device Driver;c:\windows\system32\Drivers\ANDROIDUSB.sys [x]
R3 hwusbfake;Huawei DataCard USB Fake;c:\windows\system32\DRIVERS\ewusbfake.sys [x]
R3 iANSMiniport;Intel(R) Advanced Network Services Virtual Adapter;c:\windows\system32\DRIVERS\iansw60e.sys [x]
R3 IANSPROTOCOL;Intel(R) Advanced Network Services Protocol;c:\windows\system32\DRIVERS\iansw60e.sys [x]
R3 KinectCamera;Microsoft Kinect Camera Driver;c:\windows\system32\Drivers\kinectcamera.sys [x]
R3 libusb0;libusb-win32 - Kernel Driver 10/02/2010 1.2.2.0;c:\windows\system32\DRIVERS\libusb0.sys [x]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [x]
R3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\DRIVERS\MpNWMon.sys [x]
R3 NETw5s64;Intel(R) Wireless WiFi Link der Serie 5000 Adaptertreiber für Windows 7 64-Bit;c:\windows\system32\DRIVERS\NETw5s64.sys [x]
R3 NETwNv64;___ Intel(R) Wireless WiFi Link der Serie 5000 Adaptertreiber für Windows Vista 64-Bit;c:\windows\system32\DRIVERS\NETwNv64.sys [x]
R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [x]
R3 NisSrv;Microsoft-Netzwerkinspektion;c:\program files\Microsoft Security Client\Antimalware\NisSrv.exe [2011-04-27 288272]
R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4925184]
R3 Power Manager DBC Service;Power Manager DBC Service;c:\program files (x86)\ThinkPad\Utilities\PWMDBSVC.EXE [2011-02-04 79208]
R3 psdrv3;PrimeSense Sensor Device Driver Service v3.x;c:\windows\system32\Drivers\psdrv3.sys [x]
R3 SwitchBoard;SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2009-12-14 515560]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [x]
R3 vnet;Shrew Soft Virtual Adapter;c:\windows\system32\DRIVERS\virtualnet.sys [x]
R3 VSPerfDrv100;Performance Tools Driver 10.0;c:\program files (x86)\Microsoft Visual Studio 10.0\Team Tools\Performance Tools\x64\VSPerfDrv100.sys [2010-03-17 68440]
R3 WatAdminSvc;Windows-Aktivierungstechnologieservice;c:\windows\system32\Wat\WatAdminSvc.exe [x]
R3 WHSConnector;Windows Home Server-Connectordienst;c:\program files\Windows Home Server\WHSConnector.exe [2011-01-10 489840]
R3 WMZuneComm;Zune Windows Mobile Connectivity Service;c:\program files\Zune\WMZuneComm.exe [2011-08-05 306400]
R3 WSDPrintDevice;WSD-Druckunterstützung durch UMB;c:\windows\system32\DRIVERS\WSDPrint.sys [x]
R3 WSDScan;WSD-Scanunterstützung durch UMB;c:\windows\system32\DRIVERS\WSDScan.sys [x]
S0 DzHDD64;DzHDD64;c:\windows\System32\DRIVERS\DzHDD64.sys [x]
S1 lenovo.smi;Lenovo System Interface Driver;c:\windows\system32\DRIVERS\smiifx64.sys [x]
S1 nm3;Microsoft Network Monitor 3 Driver;c:\windows\system32\DRIVERS\nm3.sys [x]
S1 vflt;Shrew Soft Lightweight Filter;c:\windows\system32\DRIVERS\vfilter.sys [x]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-06-06 64952]
S2 AMPPALR3;Intel® Centrino® Wireless Bluetooth® 3.0 + High Speed Service;c:\program files\Intel\BluetoothHS\BTHSAmpPalService.exe [2011-08-31 1166848]
S2 arXfrSvc;Windows Media Center TV Archive Transfer Service;c:\program files\Windows Home Server\Microsoft.HomeServer.Archive.TransferService.exe [2011-01-10 231280]
S2 BTHSSecurityMgr;Intel(R) Centrino(R) Wireless Bluetooth(R) 3.0 + High Speed Security Service;c:\program files\Intel\BluetoothHS\BTHSSecurityMgr.exe [2011-06-03 134928]
S2 dtpd;ShrewSoft DNS Proxy Daemon;c:\program files\ShrewSoft\VPN Client\dtpd.exe [2010-10-08 56592]
S2 esClient;Windows Media Center Client Service;c:\program files\Windows Home Server\esClient.exe [2011-01-10 109936]
S2 iked;ShrewSoft IKE Daemon;c:\program files\ShrewSoft\VPN Client\iked.exe [2010-10-08 957712]
S2 ipsecd;ShrewSoft IPSEC Daemon;c:\program files\ShrewSoft\VPN Client\ipsecd.exe [2010-10-08 697616]
S2 KinectManagement;Kinect Management;c:\program files\Microsoft Research KinectSDK\Service\KinectManagementService.exe [2011-06-01 131072]
S2 LENOVO.CAMMUTE;Lenovo Camera Mute;c:\program files\Lenovo\Communications Utility\CAMMUTE.exe [2010-04-20 50536]
S2 LENOVO.MICMUTE;Lenovo Microphone Mute;c:\program files\LENOVO\HOTKEY\MICMUTE.exe [2010-11-24 45496]
S2 LENOVO.TPKNRSVC;Lenovo Keyboard Noise Reduction;c:\program files\Lenovo\Communications Utility\TPKNRSVC.exe [2010-04-20 74088]
S2 Lenovo.VIRTSCRLSVC;Lenovo Auto Scroll;c:\program files\LENOVO\VIRTSCRL\lvvsst.exe [2010-04-07 93032]
S2 rimspci;rimspci;c:\windows\system32\DRIVERS\rimspe64.sys [x]
S2 smihlp;SMI Helper Driver (smihlp);c:\program files\ThinkVantage Fingerprint Software\smihlp.sys [2009-03-13 13840]
S2 TPHKLOAD;Lenovo Hotkey Client Loader;c:\program files\LENOVO\HOTKEY\TPHKLOAD.exe [2010-12-03 114024]
S2 TPHKSVC;Anzeige am Bildschirm;c:\program files\LENOVO\HOTKEY\TPHKSVC.exe [2010-12-02 64440]
S2 TVicPort64;TVicPort64; [x]
S3 AMPPAL;Intel® Centrino® Wireless Bluetooth® 3.0 + High Speed - Virtueller Adapter;c:\windows\system32\DRIVERS\AMPPAL.sys [x]
S3 e1kexpress;Intel(R) PRO/1000 PCI Express Network Connection Driver K;c:\windows\system32\DRIVERS\e1k62x64.sys [x]
S3 LenovoRd;LenovoRd;c:\windows\system32\Drivers\LenovoRd.sys [x]
S3 NETwNs64;___ Intel(R) Wireless WiFi Link der Serie 5000 Adaptertreiber für Windows 7 64-Bit;c:\windows\system32\DRIVERS\NETwNs64.sys [x]
S3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda64v.sys [x]
S3 Point64;Microsoft IntelliPoint Filter Driver;c:\windows\system32\DRIVERS\point64.sys [x]
S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [x]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
iissvcs	REG_MULTI_SZ   	w3svc was
apphost	REG_MULTI_SZ   	apphostsvc
.
Inhalt des "geplante Tasks" Ordners
.
2011-12-14 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-07-05 23:22]
.
2011-12-14 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-07-05 23:22]
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\1TortoiseNormal]
@="{C5994560-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994560-53D9-4125-87C9-F193FC689CB2}]
2010-03-21 06:55	99080	----a-w-	c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\2TortoiseModified]
@="{C5994561-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994561-53D9-4125-87C9-F193FC689CB2}]
2010-03-21 06:55	99080	----a-w-	c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\3TortoiseConflict]
@="{C5994562-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994562-53D9-4125-87C9-F193FC689CB2}]
2010-03-21 06:55	99080	----a-w-	c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\4TortoiseLocked]
@="{C5994563-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994563-53D9-4125-87C9-F193FC689CB2}]
2010-03-21 06:55	99080	----a-w-	c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\5TortoiseReadOnly]
@="{C5994564-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994564-53D9-4125-87C9-F193FC689CB2}]
2010-03-21 06:55	99080	----a-w-	c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\6TortoiseDeleted]
@="{C5994565-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994565-53D9-4125-87C9-F193FC689CB2}]
2010-03-21 06:55	99080	----a-w-	c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\7TortoiseAdded]
@="{C5994566-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994566-53D9-4125-87C9-F193FC689CB2}]
2010-03-21 06:55	99080	----a-w-	c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\8TortoiseIgnored]
@="{C5994567-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994567-53D9-4125-87C9-F193FC689CB2}]
2010-03-21 06:55	99080	----a-w-	c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\9TortoiseUnversioned]
@="{C5994568-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994568-53D9-4125-87C9-F193FC689CB2}]
2010-03-21 06:55	99080	----a-w-	c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12	97792	----a-w-	c:\users\[**User**]\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12	97792	----a-w-	c:\users\[**User**]\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12	97792	----a-w-	c:\users\[**User**]\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12	97792	----a-w-	c:\users\[**User**]\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LENOVO.TPKNRRES"="c:\program files\Lenovo\Communications Utility\TPKNRRES.exe" [2010-04-20 62312]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2011-06-15 1436736]
"Zune Launcher"="c:\program files\Zune\ZuneLauncher.exe" [2011-08-05 163552]
"IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2011-08-01 2417032]
"TPFanControl"="c:\program files\TPFanControl\TPFanControl.exe" [2010-04-23 154112]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x0
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.bing.com/
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: Nach Microsoft E&xel exportieren - c:\progra~2\MICROS~4\Office12\EXCEL.EXE/3000
IE: Sothink SWF Catcher - c:\program files (x86)\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm
TCP: DhcpNameServer = 131.159.14.206 131.159.14.208
TCP: Interfaces\{45A3E5B8-AAAB-47D8-A902-DF89920FA93E}: NameServer = 194.24.128.100 81.3.216.100
TCP: Interfaces\{66903589-D907-47DE-94FE-52BF7291FFEF}: NameServer = 10.156.33.53,129.187.5.1
FF - ProfilePath - c:\users\[**User**]\AppData\Roaming\Mozilla\Firefox\Profiles\o6vs55r2.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.bing.com|hxxp://www.chilloutzone.to/|hxxp://www.wpcentral.com/|hxxp://www.heise.de/|hxxp://www.engadget.com/|hxxp://stackoverflow.com
FF - prefs.js: network.proxy.ftp - proxy.in.tum.de
FF - prefs.js: network.proxy.ftp_port - 8080
FF - prefs.js: network.proxy.gopher - proxy.in.tum.de
FF - prefs.js: network.proxy.gopher_port - 8080
FF - prefs.js: network.proxy.http - proxy.in.tum.de
FF - prefs.js: network.proxy.http_port - 8080
FF - prefs.js: network.proxy.socks - proxy.in.tum.de
FF - prefs.js: network.proxy.socks_port - 8080
FF - prefs.js: network.proxy.ssl - proxy.in.tum.de
FF - prefs.js: network.proxy.ssl_port - 8080
FF - prefs.js: network.proxy.type - 0
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
SafeBoot-89731251.sys
HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe
AddRemove-Quake III Arena - c:\spiele\Quake 3\QIII.isu
.
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\msftesql]
"ImagePath"="\"c:\program files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\msftesql.exe\" -s:MSSQL.1 -f:MSSQLSERVER"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\S-1-5-21-2351878647-1061357666-2917899573-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*m*p*g** \OpenWithList]
@Class="Shell"
"a"="vlc.exe"
"MRUList"="a"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10x_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10x_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10x.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10x.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10x.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10x.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
@Denied: (A) (Everyone)
"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
"Key"="ActionsPane3"
"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\program files (x86)\Bonjour\mDNSResponder.exe
c:\progra~1\LENOVO\VIRTSCRL\virtscrl.exe
c:\program files\LENOVO\HOTKEY\tposdsvc.exe
c:\program files\Lenovo\HOTKEY\TPONSCR.exe
c:\program files\Lenovo\Zoom\TpScrex.exe
c:\program files (x86)\Lenovo\System Update\SUService.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2011-12-14  17:09:11 - PC wurde neu gestartet
ComboFix-quarantined-files.txt  2011-12-14 16:09
.
Vor Suchlauf: 8 Verzeichnis(se), 20.940.353.536 Bytes frei
Nach Suchlauf: 14 Verzeichnis(se), 20.113.113.088 Bytes frei
.
- - End Of File - - F4F60F5A3F3F576721C154DFB525B018

--- --- ---

markusg · 14.12.2011, 17:28

nutzt du das system für onlinebanking einkäufe sonstige zahlungsabwicklungen oder ähnlich wichtiges, wie zb berufliches?

Nahtal · 14.12.2011, 17:30

Ja, gelegentlich für Onlineeinkäufe/banking. Die Passwörter ändere ich bereits... Kann ich davon ausgehen dass die Malware restlos entfernt wurde?

markusg · 14.12.2011, 17:35

naja welchen sinn machst von dem infiziertem pc aus passwörter zu endern?
nein davon kannst du erst ausgehen nach dem das system formatiert und windows neu aufgesetzt wurde.
1. onlinebanking sperren lassen.
rufe deine bank an, lasse onlinebanking wegen des zero access rootkits sperren.
falls die bank zu hat notfall nummer:
116 116
probieren.
2. daten sichern:
deaktiviere autorun
Tipparchiv - Autorun/Autoplay gezielt für Laufwerkstypen oder -buchstaben abschalten - WinTotal.de
sichere auf nen externen datenträger musik bilder dokumente filme.
3. pc formatieren windows neu instalieren.
falls du nicht weis wie das geht dann sag mir ob du ne windows cd recovery cd oder ne recovery partition nutzt, falls letzteres hersteller und gerätetypen deines pcs nennen.
4. pc absichern, anleitung erhältst du.
5. alle passwörter endern.
6. werde ich dann noch was zum sicheren onlinebanking sagen

Nahtal · 14.12.2011, 17:40

Alles klar. Dachte mir selbst dass neu aufsetzen wohl das klügste ist.

Eine Frage bleibt: ich weiss nicht wie ich mir das ganze eingefangen habe. Ich habe in den letzten Tagen keine externen Medien angeschlossen. Keine Programme aus dubiosen Quellen geladen... Was ist wenn sich der Schädling irgendwo in den Backups noch eingenistet hat?

Nahtal · 14.12.2011, 17:44

Ist es notwendig das Online banking sperren zu lassen? Ich meine, irgendwann muss ich es ja wieder aktivieren lassen um Überweisungen tätigen zu können... Reicht es nicht von einem sicheren Rechner aus die PIN zu ändern? Für Überweisungen braucht man ja ohnehin die entsprechende TAN, die der Angreifer nicht haben kann (mobile TAN).

markusg · 14.12.2011, 17:48

mobile tan ist auch nicht unbedingt sicher da hierbei 2 geräte genutzt werden die potentiell infiziert werden können.
deswegen werde ich dir ne bessere methode vorschlagen, mit cardreader klasse 3 (komfort reader) mit eigener tastatur und onlinebanking über eine spezielle software.
dies ist wesendlich sichererer als mobile tan aberdetails später
lasse es sicherheitshalber sperren und dann wenn wir fertig sind freischalten
die backups prüfen wir natürlich vorher also bleiben die so lange fern vom system bis meine tipps die ich dir noch gebe, umgesetzt sind.
wie du dir das eingefangen haben könntest, zb:
nutzt du streaming seiten für kinofilme?
wenn ja, 1. illegal 2. malware schläudern.
infizierte werbebanner die sicherheitslücken ausgenutzt haben könnten.
deswegen werde ich dir ja, wie gesagt, einiges an tipps geben, die, wenn sie umgesetzt werden, das system malware frei halten sollten bzw wenn du dir malware fängst, du die möglichkeit hast das system innerhalb von 115 minuten auf einen sauberen zustand zurück zu setzen

14.12.2011, 16:06	#2
markusg /// Malware-holic	Google Links auf Werbung, Windows-Sicherheitscenterdienst verschwunden hi öffne bitte Malwarebytes logdateien poste die scan logs __________________ __________________

14.12.2011, 17:28	#6
markusg /// Malware-holic	Google Links auf Werbung, Windows-Sicherheitscenterdienst verschwunden nutzt du das system für onlinebanking einkäufe sonstige zahlungsabwicklungen oder ähnlich wichtiges, wie zb berufliches? __________________ --> Google Links auf Werbung, Windows-Sicherheitscenterdienst verschwunden

Google Links auf Werbung, Windows-Sicherheitscenterdienst verschwunden

Plagegeister aller Art und deren Bekämpfung: Google Links auf Werbung, Windows-Sicherheitscenterdienst verschwunden