Code:
Alles auswählen Aufklappen ATTFilter
ComboFix 12-09-23.02 - Sibert 23.09.2012 12:18:40.1.2 - x86
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.49.1031.18.767.214 [GMT 2:00]
ausgeführt von:: c:\users\Sibert\Desktop\ComboFix.exe
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Sibert\MagicLauncher.exe
c:\users\Sibert\Minecraft.exe
c:\users\Sibert\Nintendo_History_ScreenSaver_setup.exe
.
.
((((((((((((((((((((((( Dateien erstellt von 2012-08-23 bis 2012-09-23 ))))))))))))))))))))))))))))))
.
.
2012-09-23 10:24 . 2012-09-23 10:24 -------- d-----w- c:\users\Sibert\AppData\Local\temp
2012-09-23 10:24 . 2012-09-23 10:24 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-09-23 10:23 . 2012-09-23 10:23 56200 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{42CC3148-C95B-4D1C-BCBE-DC5BABD2E26E}\offreg.dll
2012-09-21 09:42 . 2012-08-30 08:17 6980552 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{42CC3148-C95B-4D1C-BCBE-DC5BABD2E26E}\mpengine.dll
2012-09-20 12:16 . 2012-09-20 12:16 -------- d-----w- C:\_OTL
2012-09-12 08:42 . 2012-08-22 17:16 712048 ----a-w- c:\windows\system32\drivers\ndis.sys
2012-09-12 08:42 . 2012-08-22 17:16 1292144 ----a-w- c:\windows\system32\drivers\tcpip.sys
2012-09-12 08:42 . 2012-08-22 17:16 240496 ----a-w- c:\windows\system32\drivers\netio.sys
2012-09-12 08:42 . 2012-08-22 17:16 187760 ----a-w- c:\windows\system32\drivers\FWPKCLNT.SYS
2012-09-12 08:42 . 2012-07-04 19:45 33280 ----a-w- c:\windows\system32\drivers\RNDISMP.sys
2012-09-12 08:42 . 2012-08-02 16:57 490496 ----a-w- c:\windows\system32\d3d10level9.dll
2012-09-07 13:21 . 2012-09-07 13:21 -------- d-----w- c:\program files\ESET
2012-09-03 14:10 . 2012-09-03 14:12 -------- d-----w- c:\users\Sibert\MBAM Logs
2012-08-28 14:10 . 2012-08-28 14:11 -------- d-----w- c:\users\Sibert\.idlerc
2012-08-28 14:06 . 2012-08-28 14:11 -------- d-----w- C:\Python32
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-08-28 18:24 . 2012-05-05 10:52 477168 ----a-w- c:\windows\system32\npdeployJava1.dll
2012-08-28 18:24 . 2012-05-05 10:52 473072 ----a-w- c:\windows\system32\deployJava1.dll
2012-08-16 10:09 . 2012-07-24 05:17 426184 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2012-08-16 10:09 . 2012-06-29 11:24 70344 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-07-18 17:47 . 2012-08-16 09:50 2345984 ----a-w- c:\windows\system32\win32k.sys
2012-07-04 21:14 . 2012-08-16 09:50 41984 ----a-w- c:\windows\system32\browcli.dll
2012-07-04 21:14 . 2012-08-16 09:50 102912 ----a-w- c:\windows\system32\browser.dll
2012-07-04 06:58 . 2012-07-04 06:58 10070016 ----a-w- c:\windows\system32\drivers\atikmdag.sys
2012-07-04 06:35 . 2012-07-04 06:35 19586048 ----a-w- c:\windows\system32\atioglxx.dll
2012-07-04 06:27 . 2012-07-04 06:27 159744 ----a-w- c:\windows\system32\atiapfxx.exe
2012-07-04 06:27 . 2011-06-27 19:49 918528 ----a-w- c:\windows\system32\aticfx32.dll
2012-07-04 06:21 . 2012-07-04 06:21 442368 ----a-w- c:\windows\system32\ATIDEMGX.dll
2012-07-04 06:21 . 2012-07-04 06:21 453632 ----a-w- c:\windows\system32\atieclxx.exe
2012-07-04 06:20 . 2012-07-04 06:20 217088 ----a-w- c:\windows\system32\atiesrxx.exe
2012-07-04 06:19 . 2012-07-04 06:19 163840 ----a-w- c:\windows\system32\atitmmxx.dll
2012-07-04 06:19 . 2012-07-04 06:19 20992 ----a-w- c:\windows\system32\atimuixx.dll
2012-07-04 06:19 . 2012-07-04 06:19 43520 ----a-w- c:\windows\system32\ati2edxx.dll
2012-07-04 06:18 . 2009-08-18 00:31 6811648 ----a-w- c:\windows\system32\atidxx32.dll
2012-07-04 05:36 . 2012-07-04 05:36 58368 ----a-w- c:\windows\system32\coinst_8.97.100.3.dll
2012-07-04 05:36 . 2012-07-04 05:36 1960960 ----a-w- c:\windows\system32\atiumdmv.dll
2012-07-04 05:35 . 2011-06-27 19:17 6245888 ----a-w- c:\windows\system32\atiumdag.dll
2012-07-04 05:28 . 2011-06-27 19:17 4749312 ----a-w- c:\windows\system32\atiumdva.dll
2012-07-04 05:11 . 2012-07-04 05:11 56832 ----a-w- c:\windows\system32\atimpc32.dll
2012-07-04 05:11 . 2012-07-04 05:11 56832 ----a-w- c:\windows\system32\amdpcom32.dll
2012-07-04 05:11 . 2012-07-04 05:11 364544 ----a-w- c:\windows\system32\atiadlxx.dll
2012-07-04 05:11 . 2012-07-04 05:11 14848 ----a-w- c:\windows\system32\atiglpxx.dll
2012-07-04 05:11 . 2012-07-04 05:11 33280 ----a-w- c:\windows\system32\atigktxx.dll
2012-07-04 05:10 . 2012-07-04 05:10 290304 ----a-w- c:\windows\system32\drivers\atikmpag.sys
2012-07-04 05:09 . 2011-06-27 19:01 42496 ----a-w- c:\windows\system32\atiuxpag.dll
2012-07-04 05:09 . 2011-06-27 19:01 32768 ----a-w- c:\windows\system32\atiu9pag.dll
2012-07-04 05:09 . 2012-07-04 05:09 53248 ----a-w- c:\windows\system32\drivers\ati2erec.dll
2012-07-04 05:04 . 2012-07-04 05:04 46080 ----a-w- c:\windows\system32\aticalrt.dll
2012-07-04 05:04 . 2012-07-04 05:04 44544 ----a-w- c:\windows\system32\aticalcl.dll
2012-07-04 04:59 . 2012-07-04 04:59 13402112 ----a-w- c:\windows\system32\aticaldd.dll
2012-07-04 00:32 . 2012-07-04 00:32 159232 ----a-w- c:\windows\system32\clinfo.exe
2012-07-04 00:32 . 2012-07-04 00:32 65024 ----a-w- c:\windows\system32\OpenVideo.dll
2012-07-04 00:31 . 2012-07-04 00:31 56320 ----a-w- c:\windows\system32\OVDecode.dll
2012-07-04 00:30 . 2012-07-04 00:30 13008384 ----a-w- c:\windows\system32\amdocl.dll
2012-07-04 00:30 . 2012-07-04 00:30 50176 ----a-w- c:\windows\system32\OpenCL.dll
2012-07-03 11:46 . 2012-06-29 13:07 22344 ----a-w- c:\windows\system32\drivers\mbam.sys
2012-06-25 14:04 . 2012-06-25 14:04 1394248 ----a-w- c:\windows\system32\msxml4.dll
2012-07-14 00:15 . 2012-07-25 14:49 136672 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"puush"="c:\program files\puush\puush.exe" [2012-07-18 565480]
"HydraVisionDesktopManager"="c:\program files\ATI Technologies\HydraVision\HydraDM.exe" [2012-04-05 393216]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AMD AVT"="start AMD Accelerated Video Transcoding device initialization" [X]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-01-18 254696]
"TrayServer"="c:\progra~1\MAGIX\VIDEO_~1\TrayServer_de.exe" [2008-08-07 90112]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-07-27 919008]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2012-07-04 641704]
.
c:\users\Sibert\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
DSL-Manager.lnk - c:\program files\T-Online\DSL-Manager\DslMgr.exe [2012-5-5 1085440]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
FILSHtray.lnk - c:\program files\FILSHtray\FILSHtray.exe [2012-4-18 594432]
.
c:\users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
DSL-Manager.lnk - c:\program files\T-Online\DSL-Manager\DslMgr.exe [2012-5-5 1085440]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
R2 Ca1528av;SPCA1528 Video Camera Service;c:\windows\system32\Drivers\Ca1528av.sys [x]
R2 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [x]
R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [x]
R3 Bulk1528;SPCA1528 Still Camera Service;c:\windows\system32\Drivers\Bulk1528.sys [x]
R3 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance;c:\program files\Common Files\MAGIX Services\Database\bin\fbserver.exe [x]
R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files\Mozilla Maintenance Service\maintenanceservice.exe [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
S1 DslMNLwf;DSL-Manager NDIS LightWeight Filter;c:\windows\system32\DRIVERS\dslmnlwf.sys [x]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe [x]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x]
S2 AMD FUEL Service;AMD FUEL Service;c:\program files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [x]
S2 Fabs;FABS - Helping agent for MAGIX media database;c:\program files\Common Files\MAGIX Services\Database\bin\FABS.exe [x]
S3 amdiox86;AMD IO Driver;c:\windows\system32\DRIVERS\amdiox86.sys [x]
S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [x]
S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [x]
S3 TDslMgrService;DSL-Manager;c:\program files\T-Online\DSL-Manager\DslMgrSvc.exe [x]
.
.
Inhalt des "geplante Tasks" Ordners
.
2012-09-21 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-07-24 10:09]
.
2012-09-21 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2136076275-3314329802-1407441424-1003Core.job
- c:\users\Sibert\AppData\Local\Google\Update\GoogleUpdate.exe [2012-05-05 10:06]
.
2012-09-23 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2136076275-3314329802-1407441424-1003UA.job
- c:\users\Sibert\AppData\Local\Google\Update\GoogleUpdate.exe [2012-05-05 10:06]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.google.de/
IE: Free YouTube Download - c:\users\Sibert\AppData\Roaming\DVDVideoSoftIEHelpers\freeytvdownloader.htm
IE: Free YouTube to MP3 Converter - c:\users\Sibert\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm
TCP: DhcpNameServer = 192.168.2.1
FF - ProfilePath - c:\users\Sibert\AppData\Roaming\Mozilla\Firefox\Profiles\sqa5tij2.default\
FF - prefs.js: browser.startup.homepage - hxxps://www.google.de/
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2012-09-23 12:26:40
ComboFix-quarantined-files.txt 2012-09-23 10:26
.
Vor Suchlauf: 9 Verzeichnis(se), 23.196.762.112 Bytes frei
Nach Suchlauf: 13 Verzeichnis(se), 22.970.519.552 Bytes frei
.
- - End Of File - - 0F1FDB1F4CB1A2AD6102F8F61A10A1B8
. . .
Ähm... kleine Frage. Warum steht am Anfang:
Zitat:
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Sibert\MagicLauncher.exe
c:\users\Sibert\Minecraft.exe
c:\users\Sibert\Nintendo_History_ScreenSaver_setup.exe
? Warum wurde das denn jetzt gelöscht? Die Dateien sind doch völlig in Ordnung!
MFG, Juri9