| |
| |||||||
Log-Analyse und Auswertung: Log-Analyse und AuswertungWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
| |
19.04.2012, 18:42
| #1 | |
| /// Winkelfunktion /// TB-Süch-Tiger™   |  Log-Analyse und Auswertung Dann bitte jetzt CF ausführen: ComboFix Ein Leitfaden und Tutorium zur Nutzung von ComboFix
Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat! Solltest du nach der Ausführung von Combofix Probleme beim Starten von Anwendungen haben und Meldungen erhalten wie Zitat:
__________________ Logfiles bitte immer in CODE-Tags posten  |
|
19.04.2012, 21:21
| #2 |
 | Log-Analyse und Auswertung Guten Abend, Arne! Hier also ComboFix-Log
__________________Combofix Logfile: Code:
ATTFilter ComboFix 12-04-19.01 - Adi 19.04.2012 21:58:46.1.4 - x64
Microsoft Windows 7 Professional 6.1.7601.1.1252.49.1031.18.3955.2399 [GMT 2:00]
ausgeführt von:: c:\users\Adi\Desktop\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\MtdAcqu.exe.lnk
c:\users\Adi\AppData\Local\Temp\ppcrlui_3460_2
c:\users\Adi\AppData\Roaming\Microsoft\Windows\Recent\DB Verbindungen - Ihre Anfrage.URL
c:\users\Adi\AppData\Roaming\Microsoft\Windows\Recent\LL-Loipen Steinmandl.de.url
c:\users\Adi\AppData\Roaming\Microsoft\Windows\Recent\Postbank Online-Banking.url
.
.
((((((((((((((((((((((( Dateien erstellt von 2012-03-19 bis 2012-04-19 ))))))))))))))))))))))))))))))
.
.
2012-04-19 18:55 . 2012-04-19 19:10 -------- d-----w- c:\program files (x86)\Observer
2012-04-19 15:24 . 2012-04-19 15:56 -------- d-----w- c:\programdata\Spybot - Search & Destroy
2012-04-19 15:24 . 2012-04-19 15:26 -------- d-----w- c:\program files (x86)\Spybot - Search & Destroy
2012-04-18 10:34 . 2012-04-18 10:34 246784 ----a-w- c:\windows\system32\NiCaptureCardCoInst.dll
2012-04-18 10:34 . 2012-04-18 10:34 117248 ----a-w- c:\windows\system32\NiCaptureCardClsInst.dll
2012-04-18 10:34 . 2012-04-18 10:34 543320 ----a-w- c:\windows\system32\drivers\OneGig2010.sys
2012-04-18 10:34 . 2012-04-18 10:34 541272 ----a-w- c:\windows\system32\drivers\fortyGig2010.sys
2012-04-18 10:34 . 2012-04-18 10:34 532056 ----a-w- c:\windows\system32\drivers\hundredGig2010.sys
2012-04-18 10:34 . 2012-04-18 10:34 530008 ----a-w- c:\windows\system32\drivers\tenGig2010.sys
2012-04-18 10:33 . 2012-04-18 10:33 119896 ----a-w- c:\windows\system32\drivers\NiOCCaptureCard.sys
2012-04-18 10:33 . 2012-04-18 10:33 105560 ----a-w- c:\windows\system32\drivers\NiNdisMon.sys
2012-04-18 10:33 . 2012-04-18 10:33 192600 ----a-w- c:\windows\system32\drivers\NiCaptureCard10GigAcel.sys
2012-04-18 10:33 . 2012-04-18 10:33 83032 ----a-w- c:\windows\system32\drivers\NiFr1S.SYS
2012-04-18 10:33 . 2012-04-18 10:33 62040 ----a-w- c:\windows\SysWow64\drivers\VMONI.sys
2012-04-18 10:33 . 2012-04-18 10:33 62040 ----a-w- c:\windows\system32\drivers\VMONI.SYS
2012-04-18 10:33 . 2012-04-18 10:33 118360 ----a-w- c:\windows\system32\drivers\NiFcCaptureCard.sys
2012-04-18 10:33 . 2012-04-18 10:33 116824 ----a-w- c:\windows\system32\drivers\NiCaptureCard.sys
2012-04-18 10:33 . 2012-04-18 10:33 111192 ----a-w- c:\windows\system32\drivers\NiFr3D.SYS
2012-04-18 10:33 . 2012-04-18 10:33 111192 ----a-w- c:\windows\system32\drivers\NiFr1SD600.SYS
2012-04-18 10:33 . 2012-04-18 10:33 111192 ----a-w- c:\windows\system32\drivers\NiFr1D.SYS
2012-04-18 10:33 . 2012-04-18 10:33 46680 ----a-w- c:\windows\system32\drivers\NiProbeMem.SYS
2012-04-18 10:20 . 2012-04-18 10:20 35840 ----a-w- c:\windows\SysWow64\NiWsdSrv.srv
2012-04-18 10:20 . 2012-04-18 10:20 2357760 ----a-w- c:\windows\system32\niwsd64.exe
2012-04-18 10:20 . 2012-04-18 10:20 849408 ----a-w- c:\windows\system32\NiSmtpWSD64.dll
2012-04-18 10:20 . 2012-04-18 10:20 33792 ----a-w- c:\windows\system32\NiResolveIpWSD64.dll
2012-04-18 10:20 . 2012-04-18 10:20 151552 ----a-w- c:\windows\system32\NiHashWSD64.dll
2012-04-17 18:54 . 2012-04-17 18:59 -------- d-----w- c:\users\Adi\AppData\Roaming\10-Se.HB
2012-04-17 18:24 . 2012-04-18 17:19 -------- d-----w- C:\_OTL
2012-04-17 18:13 . 2012-04-17 18:13 -------- d-----w- c:\users\TEMP.IIS APPPOOL.011
2012-04-16 12:52 . 2012-04-16 12:52 -------- d-----w- c:\program files (x86)\ESET
2012-04-16 11:46 . 2012-04-16 11:46 -------- d-----w- c:\users\Adi\AppData\Roaming\Malwarebytes
2012-04-16 09:03 . 2012-03-20 01:51 8669240 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{DED8793B-7B77-4429-A6BC-56B73E88661B}\mpengine.dll
2012-04-14 18:22 . 2012-04-14 18:22 -------- d-----w- c:\program files (x86)\MSXML 4.0
2012-04-13 13:02 . 2012-04-16 19:02 -------- d-----w- c:\users\Adi\AppData\Roaming\Media Player Classic
2012-04-13 09:34 . 2012-03-06 06:53 5559152 ----a-w- c:\windows\system32\ntoskrnl.exe
2012-04-13 09:34 . 2012-03-06 05:59 3968368 ----a-w- c:\windows\SysWow64\ntkrnlpa.exe
2012-04-13 09:34 . 2012-03-06 05:59 3913072 ----a-w- c:\windows\SysWow64\ntoskrnl.exe
2012-04-13 09:34 . 2012-03-01 06:46 23408 ----a-w- c:\windows\system32\drivers\fs_rec.sys
2012-04-13 09:34 . 2012-03-01 06:38 220672 ----a-w- c:\windows\system32\wintrust.dll
2012-04-13 09:34 . 2012-03-01 06:33 81408 ----a-w- c:\windows\system32\imagehlp.dll
2012-04-13 09:34 . 2012-03-01 05:37 172544 ----a-w- c:\windows\SysWow64\wintrust.dll
2012-04-13 09:34 . 2012-03-01 05:33 159232 ----a-w- c:\windows\SysWow64\imagehlp.dll
2012-04-13 09:34 . 2012-03-01 06:28 5120 ----a-w- c:\windows\system32\wmi.dll
2012-04-13 09:34 . 2012-03-01 05:29 5120 ----a-w- c:\windows\SysWow64\wmi.dll
2012-04-10 20:26 . 2012-04-13 13:22 -------- d-----w- c:\program files\MediaPlayerClassic-HC
2012-04-09 16:39 . 2012-04-09 17:13 -------- d-----w- C:\rsit
2012-04-06 15:02 . 2012-04-06 15:02 -------- d-----w- c:\users\Adi\AppData\Roaming\Ghostbuster
2012-04-06 15:00 . 2012-04-06 15:00 -------- d-----w- c:\program files (x86)\GhostBuster
2012-04-03 18:50 . 2012-04-14 16:45 -------- d-----w- c:\program files (x86)\Tunatic
2012-04-02 15:47 . 2012-04-02 15:47 -------- d-----w- c:\program files (x86)\NirSoft
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-04-19 15:14 . 2012-04-19 15:14 74913 ----a-w- C:\TDSSKiller.2.7.29.0_19.04.2012_16.50.03_log.zip
2012-04-18 17:11 . 2011-07-23 17:37 28352 ----a-w- c:\windows\SysWow64\drivers\MxlW2k.sys
2012-02-28 14:31 . 2011-05-19 16:30 414368 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2012-02-23 08:18 . 2011-05-10 17:25 279656 ------w- c:\windows\system32\MpSigStub.exe
2012-02-17 06:38 . 2012-03-14 08:30 1031680 ----a-w- c:\windows\system32\rdpcore.dll
2012-02-17 05:34 . 2012-03-14 08:30 826880 ----a-w- c:\windows\SysWow64\rdpcore.dll
2012-02-17 04:58 . 2012-03-14 08:30 210944 ----a-w- c:\windows\system32\drivers\rdpwd.sys
2012-02-17 04:57 . 2012-03-14 08:30 23552 ----a-w- c:\windows\system32\drivers\tdtcp.sys
2012-02-15 11:40 . 2011-10-15 16:01 132320 ----a-w- c:\windows\system32\drivers\avipbb.sys
2012-02-10 06:36 . 2012-03-14 08:32 1544192 ----a-w- c:\windows\system32\DWrite.dll
2012-02-10 05:38 . 2012-03-14 08:32 1077248 ----a-w- c:\windows\SysWow64\DWrite.dll
2012-02-03 04:34 . 2012-03-14 08:32 3145728 ----a-w- c:\windows\system32\win32k.sys
2012-01-25 06:38 . 2012-03-14 08:30 77312 ----a-w- c:\windows\system32\rdpwsx.dll
2012-01-25 06:38 . 2012-03-14 08:30 149504 ----a-w- c:\windows\system32\rdpcorekmts.dll
2012-01-25 06:33 . 2012-03-14 08:30 9216 ----a-w- c:\windows\system32\rdrmemptylst.exe
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1475584]
"MtdAcqu"="c:\program files (x86)\Creative\MediaSource5\MtdAcqu.exe" [2009-04-29 278528]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"LoadFUJ02E3"="c:\program files (x86)\Fujitsu\FUJ02E3\FUJ02E3.exe" [2009-06-16 36712]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2011-10-11 258512]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
"EnableLinkedConnections"= 1 (0x1)
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-05-27 136176]
R3 afcdp;afcdp;c:\windows\system32\DRIVERS\afcdp.sys [x]
R3 afcdpsrv;Acronis Nonstop Backup-Dienst;c:\program files (x86)\Common Files\Acronis\CDP\afcdpsrv.exe [2011-10-13 3246040]
R3 gupdatem;Google Update-Dienst (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-05-27 136176]
R3 ksaud;Creative USB Audio Driver;c:\windows\system32\drivers\ksaud.sys [x]
R3 Point64;Microsoft IntelliPoint Filter Driver;c:\windows\system32\DRIVERS\point64.sys [x]
R3 PowerSavingUtilityService;PowerSavingUtilityService;c:\program files\Fujitsu\PSUtility\PSUService.exe [2009-07-30 63336]
R3 qcusbnetsra2k;Gobi 2000 USB-NDIS miniport(1199-9001);c:\windows\system32\DRIVERS\qcusbnetsra2k.sys [x]
R3 ss_bbus;ss_bbus;c:\windows\system32\DRIVERS\ss_bbus.sys [x]
R3 ss_bmdfl;ss_bmdfl;c:\windows\system32\DRIVERS\ss_bmdfl.sys [x]
R3 ss_bmdm;ss_bmdm;c:\windows\system32\DRIVERS\ss_bmdm.sys [x]
R3 TFsExDisk;TFsExDisk;c:\windows\System32\Drivers\TFsExDisk.sys [2010-06-14 16448]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [x]
S0 FJGSDisk;G-Sensor Application Filter Driver;c:\windows\system32\DRIVERS\FJGSDisk.sys [x]
S0 tdrpman273;Acronis Try&Decide and Restore Points filter (build 273);c:\windows\system32\DRIVERS\tdrpm273.sys [x]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys [x]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]
S2 AntiVirSchedulerService;Avira Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [2011-10-11 86224]
S2 NiProbeMem;NiProbeMem;c:\windows\system32\drivers\NiProbeMem.SYS [x]
S2 QDLService2kSierra;Qualcomm Gobi 2000 Download Service (Sierra);c:\program files (x86)\QUALCOMM\QDLService2k\QDLService2kSierra.exe [2009-10-01 329976]
S2 SBSDWSCService;SBSD Security Center Service;c:\program files (x86)\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368]
S2 UNS;Intel(R) Management & Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2009-11-01 2314240]
S2 VFPRadioSupportService;Unterstützung für Bluetooth-Funktionen;c:\program files\CSR\Bluetooth Feature Pack 5.0\VFPRadioSupportService.exe [2009-10-12 145792]
S2 VMONI;VMONI Protocol Analyzer;c:\windows\system32\DRIVERS\VMONI.sys [2012-04-18 62040]
S3 ATSwpWDF;AuthenTec TruePrint USB WDF Driver;c:\windows\system32\Drivers\ATSwpWDF.sys [x]
S3 BthAvrcp;Bluetooth-AVRCP-Profil;c:\windows\system32\DRIVERS\BthAvrcp.sys [x]
S3 dc3d;Microsoft-Hardware – Geräteerkennungstreiber;c:\windows\system32\DRIVERS\dc3d.sys [x]
S3 e1kexpress;Intel(R) PRO/1000 PCI Express Network Connection Driver K;c:\windows\system32\DRIVERS\e1k62x64.sys [x]
S3 FUJ02E3;Fujitsu FUJ02E3 Device Driver;c:\windows\system32\DRIVERS\FUJ02E3.sys [x]
S3 HECIx64;Intel(R) Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [x]
S3 Impcd;Impcd;c:\windows\system32\DRIVERS\Impcd.sys [x]
S3 NETw5s64;Intel(R) Wireless WiFi Link Adaptertreiber für Windows 7 64-Bit;c:\windows\system32\DRIVERS\NETw5s64.sys [x]
S3 O2MDRDR;O2MDRDR;c:\windows\system32\DRIVERS\o2mdx64.sys [x]
S3 O2SDRDR;O2SDRDR;c:\windows\system32\DRIVERS\o2sdx64.sys [x]
S3 qcfiltersra2k;Gobi 2000 USB Composite Device Filter Driver(1199-9001);c:\windows\system32\DRIVERS\qcfiltersra2k.sys [x]
S3 qcusbsersra2k;Gobi 2000 USB Device for Legacy Serial Communication(1199-9001);c:\windows\system32\DRIVERS\qcusbsersra2k.sys [x]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - NIPROBEMEM
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
iissvcs REG_MULTI_SZ w3svc was
apphost REG_MULTI_SZ apphostsvc
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{2D46B6DC-2207-486B-B523-A557E6D54B47}]
2010-11-20 02:17 302592 ----a-w- c:\windows\System32\cmd.exe
.
Inhalt des "geplante Tasks" Ordners
.
2012-04-17 c:\windows\Tasks\Google Software Updater.job
- c:\program files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe [2011-10-22 19:53]
.
2012-04-19 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-05-27 09:01]
.
2012-04-19 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-05-27 09:01]
.
2012-04-19 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2546075381-1999097550-2100986278-1000Core.job
- c:\users\Adi\AppData\Local\Google\Update\GoogleUpdate.exe [2011-09-22 20:27]
.
2012-04-19 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2546075381-1999097550-2100986278-1000UA.job
- c:\users\Adi\AppData\Local\Google\Update\GoogleUpdate.exe [2011-09-22 20:27]
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2009-10-28 8312352]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x0
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.google.de/
mLocal Page = c:\windows\SysWOW64\blank.htm
TCP: DhcpNameServer = 192.168.178.1
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\S-1-5-21-2546075381-1999097550-2100986278-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eml\UserChoice]
@Denied: (2) (S-1-5-21-2546075381-1999097550-2100986278-1000)
@Denied: (2) (LocalSystem)
"Progid"="Microsoft Internet Mail Message"
.
[HKEY_USERS\S-1-5-21-2546075381-1999097550-2100986278-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vcf\UserChoice]
@Denied: (2) (S-1-5-21-2546075381-1999097550-2100986278-1000)
@Denied: (2) (LocalSystem)
"Progid"="WindowsLiveMail.VCard.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11f_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11f_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11f.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11f.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11f.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11f.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0005\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2012-04-19 22:04:55
ComboFix-quarantined-files.txt 2012-04-19 20:04
.
Vor Suchlauf: 16 Verzeichnis(se), 11.150.573.568 Bytes frei
Nach Suchlauf: 19 Verzeichnis(se), 10.987.589.632 Bytes frei
.
- - End Of File - - 9D0BA73FAB3B701433EDDC9C51E5BE62
Sei herzlich gegrüßt, von hvoag. P.S.: Observer ist für mich nicht möglich - alles too much englischspezial :-( |
|
| Themen zu Log-Analyse und Auswertung |
| antivir, avg, avira, bho, browser, desktop, device driver, explorer, google, helper, hijack, hijackthis, installation, internet, internet explorer, log-analyse und auswertung, logfile, mp3, notification, nvidia, plug-in, registry, security, server, sierra, software, svchost.exe, system, usb, windows, windows 7 64-bit, wscript.exe |
Hybrid-Darstellung
