| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Firefox staret automatisch http://ad.adserverplus.com/ mit leerem FensterWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
10.11.2012, 19:47
| #3 |
 |  Firefox staret automatisch http://ad.adserverplus.com/ mit leerem Fenster Hallo, Matthias,
__________________danke für die schnelle Antwort. Ich habe zunächst sicherheitshalber eine Rückfrage hinsichtlich deiner Anleitung: Im Schritt 3 schreibst du, ich solle Combofix nur auf ausdrückliche Anweisung ausgeführt werden. Um nichts zu riskieren: Habe ich deine Anweisung oder benötige ich sie noch extra? Danke und Gruß Masin Hallo Matthias, habe mich nun doch entschlossen, alle drei Schritte deiner Anleitung auszuführen, die Logs folgen. Nur noch folgende Bemerkungen zum Ablauf: Schritt 2: Mein GData Internet Security 2013 ließ mich das Junkware Removal Tool nicht herunterladen, sondern sperrte die Website sofort. Vielleicht sollte der Hinweis zum Sperren der Schutzsoftware vor der Aufforderung zum Download erfolgen? Schritt 3: Combofix hängte sich zweimal während des Entpackens auf. Nach Abschluss aller drei Schritte habe ich die JRT.exe wieder vom Rechner gelöscht, weil GData sich mit dem Vorhandensein dieser Datei nicht abfinden wollte. Nun die Logs sowie Dank und Gruß! Masin # AdwCleaner v2.007 - Datei am 11/11/2012 um 08:59:57 erstellt # Aktualisiert am 06/11/2012 von Xplode # Betriebssystem : Windows 7 Professional Service Pack 1 (64 bits) # Benutzer : Hans-Dieter - HDS-NEU # Bootmodus : Normal # Ausgeführt unter : C:\Users\Hans-Dieter\Desktop\adwcleaner.exe # Option [Löschen] **** [Dienste] **** ***** [Dateien / Ordner] ***** Datei Gelöscht : C:\Users\Hans-Dieter\AppData\Roaming\Mozilla\Firefox\Profiles\l63f1fcz.default\searchplugins\Web Search.xml Ordner Gelöscht : C:\Users\Hans-Dieter\AppData\Roaming\pdfforge ***** [Registrierungsdatenbank] ***** Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{813A22E0-3E2B-4188-9BDA-ECA9878B8D48} Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{BCFF5F55-6F44-11D2-86F8-00104B265ED5} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{813A22E0-3E2B-4188-9BDA-ECA9878B8D48} Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{BCFF5F55-6F44-11D2-86F8-00104B265ED5} ***** [Internet Browser] ***** -\\ Internet Explorer v9.0.8112.16421 [OK] Die Registrierungsdatenbank ist sauber. -\\ Mozilla Firefox v16.0.2 (de) Profilname : default Datei : C:\Users\Hans-Dieter\AppData\Roaming\Mozilla\Firefox\Profiles\l63f1fcz.default\prefs.js [OK] Die Datei ist sauber. -\\ Google Chrome v [Version kann nicht ermittelt werden] Datei : C:\Users\Hans-Dieter\AppData\Local\Google\Chrome\User Data\Default\Preferences [OK] Die Datei ist sauber. ************************* AdwCleaner[S1].txt - [1537 octets] - [11/11/2012 08:59:57] ########## EOF - C:\AdwCleaner[S1].txt - [1597 octets] ########## ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Junkware Removal Tool (JRT) by Thisisu Version: 2.9.7 (11.10.2012) OS: Windows 7 Professional x64 Ran by Hans-Dieter on 11.11.2012 at 9:02:59,94 Blog: Malware Analysis and Removal ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~ Services ~~~ Registry Values ~~~ Registry Keys ~~~ Files ~~~ Folders ~~~ Event Viewer Logs were cleared ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Scan was completed on 11.11.2012 at 9:07:34,78 End of JRT log ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Combofix Logfile: Code:
ATTFilter ComboFix 12-11-09.02 - Hans-Dieter 11.11.2012 9:29.1.4 - x64
Microsoft Windows 7 Professional 6.1.7601.1.1252.49.1031.18.6103.4131 [GMT 1:00]
ausgeführt von:: c:\users\Hans-Dieter\Desktop\ComboFix.exe
AV: G Data InternetSecurity 2013 *Disabled/Updated* {39B780B4-63C2-05B0-3B40-8F7A21E4F496}
FW: G Data Personal Firewall *Disabled* {018C0191-29AD-04E8-101F-264FDF37B3ED}
SP: G Data InternetSecurity 2013 *Disabled/Updated* {82D66150-45F8-0A3E-01F0-B4085A63BE2B}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\PCDr\6032\AddOnDownloaded\087abda5-3ca9-433a-8a4e-6b9fc9285607.dll
c:\programdata\PCDr\6032\AddOnDownloaded\0f6f4769-e33b-4059-ac7e-958f5cedf6f3.dll
c:\programdata\PCDr\6032\AddOnDownloaded\16535d13-dd9f-48ff-8ae3-e3135157e6da.dll
c:\programdata\PCDr\6032\AddOnDownloaded\2f733848-355c-4a6f-89a5-08a4dcc89c5c.dll
c:\programdata\PCDr\6032\AddOnDownloaded\305a1406-381f-449d-9486-32504a38e5b0.dll
c:\programdata\PCDr\6032\AddOnDownloaded\3b429c4f-8ba9-4a7d-bbb4-4548bb6d2539.dll
c:\programdata\PCDr\6032\AddOnDownloaded\3c49c05a-0eb3-4044-a0f8-d4ea2a439295.dll
c:\programdata\PCDr\6032\AddOnDownloaded\45d3827c-bce8-440f-bcda-3bd183a7bac3.dll
c:\programdata\PCDr\6032\AddOnDownloaded\4704833a-6508-40cc-b98b-5ebd235e52ca.dll
c:\programdata\PCDr\6032\AddOnDownloaded\5cd81d7c-326c-42d2-8929-1ee85c69dc1d.dll
c:\programdata\PCDr\6032\AddOnDownloaded\5f169f6e-cfce-411e-b266-aa53ac35ce83.dll
c:\programdata\PCDr\6032\AddOnDownloaded\7119bf4b-d404-4b31-8779-44fac71761fa.dll
c:\programdata\PCDr\6032\AddOnDownloaded\819a7f02-352c-4ccc-8fd0-40d8959b0b10.dll
c:\programdata\PCDr\6032\AddOnDownloaded\8c199aef-9eca-4ab6-863d-c9136ebec654.dll
c:\programdata\PCDr\6032\AddOnDownloaded\a875f6ee-9729-4447-8d2c-63bd2e6396c1.dll
c:\programdata\PCDr\6032\AddOnDownloaded\aacbd8d1-f46e-4872-a1aa-7197c56e7bee.dll
c:\programdata\PCDr\6032\AddOnDownloaded\af728edb-0984-4c06-9a4b-0878bcfa9a26.dll
c:\programdata\PCDr\6032\AddOnDownloaded\b510dd11-341c-4dfa-9f1e-dd5ddcc444f4.dll
c:\programdata\PCDr\6032\AddOnDownloaded\cf9bce06-e765-4c6f-afa9-0d82a3adc417.dll
c:\programdata\PCDr\6032\AddOnDownloaded\dbecb802-efe1-453f-828f-29af4ab73508.dll
c:\programdata\PCDr\6032\AddOnDownloaded\dc959002-1065-4317-b1a1-f360412a88d3.dll
c:\programdata\PCDr\6032\AddOnDownloaded\e1ce76af-328a-41dc-b2c4-0dd9771f6aa1.dll
c:\programdata\PCDr\6032\AddOnDownloaded\e3e252fe-80ab-4f89-82a9-b607007220bd.dll
c:\programdata\PCDr\6032\AddOnDownloaded\eb115e4d-8592-4082-bffa-e65ae6b21e95.dll
c:\programdata\PCDr\6032\AddOnDownloaded\ed26c1b3-d9f9-42e8-80e0-cd62e65fd901.dll
c:\programdata\PCDr\6032\AddOnDownloaded\ed2cc678-a9e6-4ef7-89b6-9bada02d1a74.dll
c:\programdata\PCDr\6032\AddOnDownloaded\f28ef68b-8cc4-4c00-891d-473fb67bd0b0.dll
c:\users\Hans-Dieter\AppData\Local\assembly\tmp
E:\install.exe
.
.
((((((((((((((((((((((( Dateien erstellt von 2012-10-11 bis 2012-11-11 ))))))))))))))))))))))))))))))
.
.
2012-11-11 08:38 . 2012-11-11 08:38 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-11-11 08:32 . 2012-11-11 08:32 69000 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{BF2BC6CF-209D-4189-ADDF-B79C412A31A9}\offreg.dll
2012-11-10 18:17 . 2012-11-10 18:17 -------- d-----w- c:\windows\ERUNT
2012-11-10 18:17 . 2012-11-11 08:07 -------- d-----w- C:\JRT
2012-11-10 08:34 . 2012-11-10 08:34 -------- d-----w- c:\users\Hans-Dieter\AppData\Roaming\Malwarebytes
2012-11-10 08:34 . 2012-11-10 08:34 -------- d-----w- c:\programdata\Malwarebytes
2012-11-10 08:34 . 2012-11-10 08:34 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
2012-11-10 08:34 . 2012-09-29 18:54 25928 ----a-w- c:\windows\system32\drivers\mbam.sys
2012-11-09 08:07 . 2012-11-08 17:24 4918219 ----a-w- c:\windows\exiftool.exe
2012-11-09 06:40 . 2012-10-12 07:19 9291768 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{BF2BC6CF-209D-4189-ADDF-B79C412A31A9}\mpengine.dll
2012-11-06 13:29 . 2012-11-06 13:47 -------- d-----w- c:\users\Hans-Dieter\AppData\Roaming\eXPert PDF Editor
2012-11-06 13:28 . 2012-11-06 13:28 -------- d-----w- c:\program files (x86)\Visagesoft
2012-11-06 13:18 . 2012-11-06 13:18 -------- d-----w- c:\users\Hans-Dieter\AppData\Roaming\CAD-KAS
2012-11-06 13:18 . 2012-11-06 13:18 87704 ----a-w- c:\windows\cadkasdeinst01.exe
2012-11-06 13:18 . 2012-11-06 13:20 -------- d-----w- c:\program files (x86)\PDF Editor 3
2012-11-06 13:18 . 2012-11-06 13:18 -------- d-----w- c:\users\Hans-Dieter\AppData\Roaming\DesktopIconForAmazon
2012-11-06 13:18 . 2011-05-13 13:16 493056 ----a-w- c:\windows\SysWow64\dhRichClient3.dll
2012-11-06 13:18 . 2011-03-25 21:42 338432 ----a-w- c:\windows\SysWow64\sqlite36_engine.dll
2012-10-31 11:32 . 2012-10-31 11:32 -------- d-----w- c:\program files\Common Files\DESIGNER
2012-10-31 09:05 . 2012-10-12 06:34 100864 ----a-w- c:\windows\system32\pdfcmon.dll
2012-10-31 09:05 . 2012-05-05 10:54 137000 ----a-w- c:\windows\SysWow64\MSMAPI32.OCX
2012-10-31 09:05 . 2012-10-31 09:05 -------- d-----w- c:\program files (x86)\PDFCreator
2012-10-31 09:05 . 2012-05-05 10:54 23552 ----a-w- c:\windows\SysWow64\MSMPIDE.DLL
2012-10-31 09:05 . 1998-07-06 17:55 158208 ----a-w- c:\windows\SysWow64\MSCMCDE.DLL
2012-10-31 09:05 . 1998-07-06 17:55 64512 ----a-w- c:\windows\SysWow64\MSCC2DE.DLL
2012-10-31 09:05 . 2012-10-31 09:05 -------- d-----w- c:\users\Hans-Dieter\AppData\Local\Programs
2012-10-21 12:53 . 2012-10-21 12:54 -------- d-----w- c:\users\Hans-Dieter\AppData\Roaming\PC-FAX TX
2012-10-18 15:16 . 2012-10-18 15:16 -------- d-----w- c:\users\Hans-Dieter\AppData\Local\Apple Computer
2012-10-18 15:16 . 2012-08-21 11:01 33240 ----a-w- c:\windows\system32\drivers\GEARAspiWDM.sys
2012-10-18 15:15 . 2012-10-18 15:15 -------- d-----w- c:\program files\iPod
2012-10-18 15:15 . 2012-10-18 15:16 -------- d-----w- c:\programdata\34BE82C4-E596-4e99-A191-52C6199EBF69
2012-10-18 15:15 . 2012-10-18 15:16 -------- d-----w- c:\program files\iTunes
2012-10-18 15:15 . 2012-10-18 15:16 -------- d-----w- c:\program files (x86)\iTunes
2012-10-18 15:14 . 2012-10-18 15:14 -------- d-----w- c:\program files\Common Files\Apple
2012-10-18 15:14 . 2012-10-18 15:14 -------- d-----w- c:\program files\Bonjour
2012-10-18 15:14 . 2012-10-18 15:14 -------- d-----w- c:\program files (x86)\Bonjour
2012-10-17 09:04 . 2012-10-17 09:04 -------- d-----w- c:\users\Hans-Dieter\AppData\Local\kiwi.software.NET
2012-10-17 09:03 . 2012-10-17 09:03 -------- d-----w- c:\program files (x86)\kiwi.software.NET
2012-10-14 13:43 . 2012-10-14 14:24 -------- d-----w- c:\users\Hans-Dieter\AppData\Roaming\TeamViewer
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-11-08 11:49 . 2012-09-26 14:03 697272 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2012-11-08 11:49 . 2012-09-26 10:15 73656 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2012-10-10 20:23 . 2012-09-26 14:42 65309168 ----a-w- c:\windows\system32\MRT.exe
2012-10-03 08:16 . 2012-09-25 15:54 60320 ----a-w- c:\windows\system32\drivers\PktIcpt.sys
2012-10-03 05:47 . 2012-09-25 15:54 126880 ----a-w- c:\windows\system32\drivers\MiniIcpt.sys
2012-10-03 05:47 . 2012-09-25 15:54 64416 ----a-w- c:\windows\system32\drivers\gdwfpcd64.sys
2012-10-03 05:47 . 2012-09-25 15:54 54176 ----a-w- c:\windows\system32\drivers\GDBehave.sys
2012-10-01 12:48 . 2012-10-01 12:48 53248 ----a-r- c:\users\Hans-Dieter\AppData\Roaming\Microsoft\Installer\{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}\ARPPRODUCTICON.exe
2012-10-01 12:48 . 2012-10-01 12:43 18960 ----a-w- c:\windows\system32\drivers\LNonPnP.sys
2012-09-28 13:42 . 2012-09-28 13:42 227216 ----a-w- c:\windows\SysWow64\ddBACCTM.cpl
2012-09-28 13:42 . 2012-09-28 13:42 825232 ----a-w- c:\windows\SysWow64\Ddbaccpl.cpl
2012-09-27 11:58 . 2009-07-14 02:36 152576 ----a-w- c:\windows\SysWow64\msclmd.dll
2012-09-27 11:58 . 2009-07-14 02:36 175616 ----a-w- c:\windows\system32\msclmd.dll
2012-09-26 16:26 . 2012-09-26 16:26 86528 ----a-w- c:\windows\SysWow64\iesysprep.dll
2012-09-26 16:26 . 2012-09-26 16:26 76800 ----a-w- c:\windows\SysWow64\SetIEInstalledDate.exe
2012-09-26 16:26 . 2012-09-26 16:26 74752 ----a-w- c:\windows\SysWow64\RegisterIEPKEYs.exe
2012-09-26 16:26 . 2012-09-26 16:26 74752 ----a-w- c:\windows\SysWow64\iesetup.dll
2012-09-26 16:26 . 2012-09-26 16:26 63488 ----a-w- c:\windows\SysWow64\tdc.ocx
2012-09-26 16:26 . 2012-09-26 16:26 48640 ----a-w- c:\windows\SysWow64\mshtmler.dll
2012-09-26 16:26 . 2012-09-26 16:26 420864 ----a-w- c:\windows\SysWow64\vbscript.dll
2012-09-26 16:26 . 2012-09-26 16:26 367104 ----a-w- c:\windows\SysWow64\html.iec
2012-09-26 16:26 . 2012-09-26 16:26 2382848 ----a-w- c:\windows\SysWow64\mshtml.tlb
2012-09-26 16:26 . 2012-09-26 16:26 23552 ----a-w- c:\windows\SysWow64\licmgr10.dll
2012-09-26 16:26 . 2012-09-26 16:26 1800704 ----a-w- c:\windows\SysWow64\jscript9.dll
2012-09-26 16:26 . 2012-09-26 16:26 161792 ----a-w- c:\windows\SysWow64\msls31.dll
2012-09-26 16:26 . 2012-09-26 16:26 152064 ----a-w- c:\windows\SysWow64\wextract.exe
2012-09-26 16:26 . 2012-09-26 16:26 150528 ----a-w- c:\windows\SysWow64\iexpress.exe
2012-09-26 16:26 . 2012-09-26 16:26 1427968 ----a-w- c:\windows\SysWow64\inetcpl.cpl
2012-09-26 16:26 . 2012-09-26 16:26 1129472 ----a-w- c:\windows\SysWow64\wininet.dll
2012-09-26 16:26 . 2012-09-26 16:26 110592 ----a-w- c:\windows\SysWow64\IEAdvpack.dll
2012-09-26 16:26 . 2012-09-26 16:26 142848 ----a-w- c:\windows\SysWow64\ieUnatt.exe
2012-09-26 16:26 . 2012-09-26 16:26 35840 ----a-w- c:\windows\SysWow64\imgutil.dll
2012-09-26 16:26 . 2012-09-26 16:26 11776 ----a-w- c:\windows\SysWow64\mshta.exe
2012-09-26 16:26 . 2012-09-26 16:26 101888 ----a-w- c:\windows\SysWow64\admparse.dll
2012-09-26 16:26 . 2012-09-26 16:26 89088 ----a-w- c:\windows\system32\RegisterIEPKEYs.exe
2012-09-26 16:26 . 2012-09-26 16:26 85504 ----a-w- c:\windows\system32\jsproxy.dll
2012-09-26 16:26 . 2012-09-26 16:26 222208 ----a-w- c:\windows\system32\msls31.dll
2012-09-26 16:26 . 2012-09-26 16:26 2144768 ----a-w- c:\windows\system32\iertutil.dll
2012-09-26 16:26 . 2012-09-26 16:26 197120 ----a-w- c:\windows\system32\msrating.dll
2012-09-26 16:26 . 2012-09-26 16:26 1392128 ----a-w- c:\windows\system32\wininet.dll
2012-09-26 16:26 . 2012-09-26 16:26 1346048 ----a-w- c:\windows\system32\urlmon.dll
2012-09-26 16:26 . 2012-09-26 16:26 17810944 ----a-w- c:\windows\system32\mshtml.dll
2012-09-26 16:26 . 2012-09-26 16:26 2382848 ----a-w- c:\windows\system32\mshtml.tlb
2012-09-26 16:26 . 2012-09-26 16:26 96768 ----a-w- c:\windows\system32\mshtmled.dll
2012-09-26 16:26 . 2012-09-26 16:26 91648 ----a-w- c:\windows\system32\SetIEInstalledDate.exe
2012-09-26 16:26 . 2012-09-26 16:26 89088 ----a-w- c:\windows\system32\ie4uinit.exe
2012-09-26 16:26 . 2012-09-26 16:26 85504 ----a-w- c:\windows\system32\iesetup.dll
2012-09-26 16:26 . 2012-09-26 16:26 82432 ----a-w- c:\windows\system32\icardie.dll
2012-09-26 16:26 . 2012-09-26 16:26 816640 ----a-w- c:\windows\system32\jscript.dll
2012-09-26 16:26 . 2012-09-26 16:26 76800 ----a-w- c:\windows\system32\tdc.ocx
2012-09-26 16:26 . 2012-09-26 16:26 729088 ----a-w- c:\windows\system32\msfeeds.dll
2012-09-26 16:26 . 2012-09-26 16:26 65024 ----a-w- c:\windows\system32\pngfilt.dll
2012-09-26 16:26 . 2012-09-26 16:26 599040 ----a-w- c:\windows\system32\vbscript.dll
2012-09-26 16:26 . 2012-09-26 16:26 55296 ----a-w- c:\windows\system32\msfeedsbs.dll
2012-09-26 16:26 . 2012-09-26 16:26 534528 ----a-w- c:\windows\system32\ieapfltr.dll
2012-09-26 16:26 . 2012-09-26 16:26 49664 ----a-w- c:\windows\system32\imgutil.dll
2012-09-26 16:26 . 2012-09-26 16:26 48640 ----a-w- c:\windows\system32\mshtmler.dll
2012-09-26 16:26 . 2012-09-26 16:26 452608 ----a-w- c:\windows\system32\dxtmsft.dll
2012-09-26 16:26 . 2012-09-26 16:26 448512 ----a-w- c:\windows\system32\html.iec
2012-09-26 16:26 . 2012-09-26 16:26 403248 ----a-w- c:\windows\system32\iedkcs32.dll
2012-09-26 16:26 . 2012-09-26 16:26 39936 ----a-w- c:\windows\system32\iernonce.dll
2012-09-26 16:26 . 2012-09-26 16:26 3695416 ----a-w- c:\windows\system32\ieapfltr.dat
2012-09-26 16:26 . 2012-09-26 16:26 30720 ----a-w- c:\windows\system32\licmgr10.dll
2012-09-26 16:26 . 2012-09-26 16:26 282112 ----a-w- c:\windows\system32\dxtrans.dll
2012-09-26 16:26 . 2012-09-26 16:26 267776 ----a-w- c:\windows\system32\ieaksie.dll
2012-09-26 16:26 . 2012-09-26 16:26 249344 ----a-w- c:\windows\system32\webcheck.dll
2012-09-26 16:26 . 2012-09-26 16:26 248320 ----a-w- c:\windows\system32\ieui.dll
2012-09-26 16:26 . 2012-09-26 16:26 237056 ----a-w- c:\windows\system32\url.dll
2012-09-26 16:26 . 2012-09-26 16:26 2312704 ----a-w- c:\windows\system32\jscript9.dll
2012-09-26 16:26 . 2012-09-26 16:26 173056 ----a-w- c:\windows\system32\ieUnatt.exe
2012-09-26 16:26 . 2012-09-26 16:26 165888 ----a-w- c:\windows\system32\iexpress.exe
2012-09-26 16:26 . 2012-09-26 16:26 163840 ----a-w- c:\windows\system32\ieakui.dll
2012-09-26 16:26 . 2012-09-26 16:26 160256 ----a-w- c:\windows\system32\wextract.exe
2012-09-26 16:26 . 2012-09-26 16:26 160256 ----a-w- c:\windows\system32\ieakeng.dll
2012-09-26 16:26 . 2012-09-26 16:26 149504 ----a-w- c:\windows\system32\occache.dll
2012-09-26 16:26 . 2012-09-26 16:26 1494528 ----a-w- c:\windows\system32\inetcpl.cpl
2012-09-26 16:26 . 2012-09-26 16:26 145920 ----a-w- c:\windows\system32\iepeers.dll
2012-09-26 16:26 . 2012-09-26 16:26 135168 ----a-w- c:\windows\system32\IEAdvpack.dll
2012-09-26 16:26 . 2012-09-26 16:26 12288 ----a-w- c:\windows\system32\mshta.exe
2012-09-26 16:26 . 2012-09-26 16:26 114176 ----a-w- c:\windows\system32\admparse.dll
2012-09-26 16:26 . 2012-09-26 16:26 111616 ----a-w- c:\windows\system32\iesysprep.dll
2012-09-26 16:26 . 2012-09-26 16:26 10925568 ----a-w- c:\windows\system32\ieframe.dll
2012-09-26 16:26 . 2012-09-26 16:26 10752 ----a-w- c:\windows\system32\msfeedssync.exe
2012-09-26 16:26 . 2012-09-26 16:26 103936 ----a-w- c:\windows\system32\inseng.dll
2012-09-26 12:46 . 2012-09-26 12:46 129784 ------w- c:\windows\SysWow64\pxafs.dll
2012-09-26 12:46 . 2012-09-26 12:46 116472 ------w- c:\windows\SysWow64\pxcpyi64.exe
2012-09-26 12:46 . 2012-09-26 12:46 10488 ------w- c:\windows\system32\drivers\cdralw2k.sys
2012-09-26 12:46 . 2012-09-26 12:46 10488 ------w- c:\windows\system32\drivers\cdr4_xp.sys
2012-09-26 12:46 . 2012-09-26 12:46 52856 ------w- c:\windows\system32\drivers\PxHlpa64.sys
2012-09-26 12:46 . 2012-09-26 12:46 118520 ------w- c:\windows\SysWow64\pxinsi64.exe
2012-09-26 09:16 . 2012-09-26 09:16 477168 ----a-w- c:\windows\SysWow64\npdeployJava1.dll
2012-09-26 09:16 . 2012-09-26 09:16 473072 ----a-w- c:\windows\SysWow64\deployJava1.dll
2012-09-26 08:37 . 2012-09-26 08:37 367200 ----a-w- c:\windows\system32\drivers\afcdp.sys
2012-09-26 08:37 . 2012-09-26 08:37 1294432 ----a-w- c:\windows\system32\drivers\tdrpman.sys
2012-09-26 08:37 . 2012-09-26 08:37 994912 ----a-w- c:\windows\system32\drivers\timntr.sys
2012-09-26 08:37 . 2012-09-26 08:37 211552 ----a-w- c:\windows\system32\drivers\vididr.sys
2012-09-26 08:37 . 2012-09-26 08:37 146528 ----a-w- c:\windows\system32\drivers\vsflt67.sys
2012-09-26 08:37 . 2012-09-26 08:37 320096 ----a-w- c:\windows\system32\drivers\snapman.sys
2012-09-26 08:37 . 2012-09-26 08:37 137312 ----a-w- c:\windows\system32\drivers\fltsrv.sys
2012-09-25 15:54 . 2012-09-25 15:54 64376 ----a-w- c:\windows\system32\drivers\HookCentre.sys
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"dradio-RecorderTimer"="c:\program files (x86)\dradio-Recorder\phonostarTimer.exe" [2012-04-03 41472]
"Microsoft Location Finder"="c:\program files (x86)\Microsoft Location Finder\LocationFinder.exe" [2006-11-14 121640]
"PC Suite Tray"="c:\program files (x86)\Nokia\Nokia PC Suite 7\PCSuite.exe" [2010-05-14 1479680]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"G Data AntiVirus Tray Application"="c:\program files (x86)\G Data\InternetSecurity\AVKTray\AVKTray.exe" [2012-09-17 995352]
"GDFirewallTray"="c:\program files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe" [2012-01-27 1470968]
"LifeCam"="c:\program files (x86)\Microsoft LifeCam\LifeExp.exe" [2010-05-20 119152]
"AdobeCS4ServiceManager"="c:\program files (x86)\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" [2008-08-14 611712]
"BrStsMon00"="c:\program files (x86)\Browny02\Brother\BrStMonW.exe" [2011-05-19 2629632]
"TrueImageMonitor.exe"="c:\program files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe" [2012-06-28 5993216]
"AcronisTimounterMonitor"="c:\program files (x86)\Acronis\TrueImageHome\TimounterMonitor.exe" [2012-06-28 1173712]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-07-27 919008]
"NBAgent"="c:\program files (x86)\Nero\Nero 11\Nero BackItUp\NBAgent.exe" [2012-01-13 1493288]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2010-11-10 98304]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-08-27 59280]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2012-04-18 421888]
"ShwiconXP9106"="c:\program files (x86)\Multimedia Card Reader(9106)\ShwiconXP9106.exe" [2010-01-27 237568]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2012-09-09 421776]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - c:\program files (x86)\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2012-9-26 113664]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\AutorunsDisabled
Lexware Info Service.lnk - c:\program files (x86)\Common Files\Lexware\Update Manager\LxUpdateManager.exe [2011-7-31 189808]
Quicken 2011 Zahlungserinnerung.lnk - c:\program files (x86)\Lexware\Quicken\2011\billmind.exe [2010-11-24 198000]
Quicken Jubiläumsversion Zahlungserinnerung.lnk - c:\windows\Installer\{A907A713-DA24-4352-8786-96C7A6944646}\BillMinder.8C5DA79E_7079_4AB3_81F7_712153351D0D.exe [2012-9-29 40960]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"EnableLinkedConnections"= 1 (0x1)
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2012-07-13 160944]
R3 ose64;Office 64 Source Engine;c:\program files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2010-01-09 174440]
R3 PCDSRVC{1E208CE0-FB7451FF-06020200}_0;PCDSRVC{1E208CE0-FB7451FF-06020200}_0 - PCDR Kernel Mode Service Helper Driver;c:\program files\dell support center\pcdsrvc_x64.pkms [2012-09-04 25584]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 59392]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [2012-07-09 52736]
R3 vpcuxd;USB-Virtualisierungsstubdienst;c:\windows\system32\drivers\vpcuxd.sys [2010-11-20 16384]
R4 Cosptsvfcrls;Cosptsvfcrls; [x]
S0 fltsrv;Acronis Storage Filter Management;c:\windows\system32\DRIVERS\fltsrv.sys [2012-09-26 137312]
S0 GDBehave;GDBehave;c:\windows\system32\drivers\GDBehave.sys [2012-10-03 54176]
S0 NBVol;Nero Backup Volume Filter Driver;c:\windows\system32\DRIVERS\NBVol.sys [2011-12-01 72240]
S0 NBVolUp;Nero Backup Volume Upper Filter Driver;c:\windows\system32\DRIVERS\NBVolUp.sys [2011-12-01 15920]
S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys [2012-09-26 52856]
S0 vididr;Acronis Virtual Disk;c:\windows\system32\DRIVERS\vididr.sys [2012-09-26 211552]
S0 vidsflt67;Acronis Disk Storage Filter (67);c:\windows\system32\DRIVERS\vsflt67.sys [2012-09-26 146528]
S1 GDMnIcpt;GDMnIcpt;c:\windows\system32\drivers\MiniIcpt.sys [2012-10-03 126880]
S1 gdwfpcd;G Data WFP CD;c:\windows\system32\drivers\gdwfpcd64.sys [2012-10-03 64416]
S1 HookCentre;HookCentre;c:\windows\system32\drivers\HookCentre.sys [2012-09-25 64376]
S2 afcdpsrv;Acronis Nonstop Backup Service;c:\program files (x86)\Common Files\Acronis\CDP\afcdpsrv.exe [2012-09-26 3491792]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2010-11-10 203776]
S2 AVKProxy;G Data AntiVirus Proxy;c:\program files (x86)\Common Files\G Data\AVKProxy\AVKProxy.exe [2012-08-23 1542680]
S2 AVKService;G Data Scheduler;c:\program files (x86)\G Data\InternetSecurity\AVK\AVKService.exe [2012-01-27 468472]
S2 AVKWCtl;G Data Dateisystem Wächter;c:\program files (x86)\G Data\InternetSecurity\AVK\AVKWCtlX64.exe [2012-08-30 2011568]
S2 MBAMScheduler;MBAMScheduler;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [2012-09-29 399432]
S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-09-29 676936]
S2 NAUpdate;Nero Update;c:\program files (x86)\Nero\Update\NASvc.exe [2011-11-25 687400]
S2 OS Selector;Acronis OS Selector Activator;c:\program files (x86)\Acronis\DiskDirector\OSS\reinstall_svc.exe [2011-11-15 2155848]
S2 syncagentsrv;Acronis Sync Agent Service;c:\program files (x86)\Common Files\Acronis\SyncAgent\syncagentsrv.exe [2012-06-28 5924712]
S2 TeamViewer7;TeamViewer 7;c:\program files (x86)\TeamViewer\Version7\TeamViewer_Service.exe [2012-08-31 2754984]
S2 TomTomHOMEService;TomTomHOMEService;c:\program files (x86)\TomTom HOME 2\TomTomHOMEService.exe [2012-08-28 92632]
S3 afcdp;afcdp;c:\windows\system32\DRIVERS\afcdp.sys [2012-09-26 367200]
S3 AtiHDAudioService;ATI Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys [2010-09-24 116752]
S3 AVMCOWAN;AVM ISDN CoNDIS WAN CAPI Driver;c:\windows\system32\DRIVERS\AVMCOWAN.sys [2009-06-10 79872]
S3 BrYNSvc;BrYNSvc;c:\program files (x86)\Browny02\BrYNSvc.exe [2010-01-25 245760]
S3 FPCIBASE;AVM FRITZ!Card PCI;c:\windows\system32\DRIVERS\fpcibase.sys [2009-06-10 899328]
S3 GDFwSvc;G Data Personal Firewall;c:\program files (x86)\G Data\InternetSecurity\Firewall\GDFwSvcx64.exe [2012-06-04 1766464]
S3 GDPkIcpt;GDPkIcpt;c:\windows\system32\drivers\PktIcpt.sys [2012-10-03 60320]
S3 GDScan;G Data Scanner;c:\program files (x86)\Common Files\G Data\GDScan\GDScan.exe [2012-03-29 470008]
S3 HECIx64;Intel(R) Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [2009-09-17 56344]
S3 k57nd60a;Broadcom NetLink (TM) Gigabit Ethernet - NDIS 6.0;c:\windows\system32\DRIVERS\k57nd60a.sys [2009-10-16 321064]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2012-09-29 25928]
S3 MSHUSBVideo;NX6000/NX3000/VX2000/VX5000/VX5500/VX7000/Cinema Filter Driver;c:\windows\system32\Drivers\nx6000.sys [2010-01-28 36720]
S3 WSDScan;WSD-Scanunterstützung durch UMB;c:\windows\system32\DRIVERS\WSDScan.sys [2009-07-14 25088]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\AutorunsDisabled\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2011-03-04 10:29 451872 ----a-w- c:\program files (x86)\Common Files\LightScribe\LSRunOnce.exe
.
Inhalt des "geplante Tasks" Ordners
.
2012-11-11 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-09-26 11:49]
.
2012-11-11 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-09-26 11:19]
.
2012-11-11 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-09-26 11:19]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Acronis Scheduler2 Service"="c:\program files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe" [2012-06-28 403688]
"EvtMgr6"="c:\program files\Logitech\SetPointP\SetPoint.exe" [2011-10-07 1744152]
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = <local>;*.local
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: An OneNote s&enden - c:\progra~1\MICROS~2\Office14\ONBttnIE.dll/105
IE: Nach Microsoft E&xcel exportieren - c:\progra~1\MICROS~2\Office14\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.178.1
DPF: {45830FF9-D9E6-4F41-86ED-B266933D8E90} - hxxp://bmontessori12.dyndns.org:1120/RtspVaPgDec.cab
FF - ProfilePath - c:\users\Hans-Dieter\AppData\Roaming\Mozilla\Firefox\Profiles\l63f1fcz.default\
FF - prefs.js: browser.search.selectedEngine - Wikipedia (de)
FF - prefs.js: browser.startup.homepage - about:home
FF - prefs.js: network.proxy.type - 0
FF - ExtSQL: 2012-09-12 14:40; fb_add_on@avm.de; c:\users\Hans-Dieter\AppData\Roaming\Mozilla\Firefox\Profiles\l63f1fcz.default\extensions\fb_add_on@avm.de
FF - ExtSQL: 2012-09-25 19:46; {BCC877E7-7F3F-4632-8338-DAEE4475DE35}; c:\users\Hans-Dieter\AppData\Roaming\Mozilla\Firefox\Profiles\l63f1fcz.default\extensions\{BCC877E7-7F3F-4632-8338-DAEE4475DE35}.xpi
FF - ExtSQL: 2012-09-26 11:16; {CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA}; c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA}
FF - ExtSQL: 2012-10-03 07:47; {906305f7-aafc-45e9-8bbd-941950a84dad}; c:\program files (x86)\Mozilla Firefox\extensions\{906305f7-aafc-45e9-8bbd-941950a84dad}
FF - ExtSQL: 2012-10-18 15:35; maps@ovi.com; c:\users\Hans-Dieter\AppData\Roaming\Mozilla\Firefox\Profiles\l63f1fcz.default\extensions\maps@ovi.com
FF - ExtSQL: 2012-11-06 14:18; extension@preispilot.com; c:\users\Hans-Dieter\AppData\Roaming\Mozilla\Firefox\Profiles\l63f1fcz.default\extensions\extension@preispilot.com.xpi
FF - ExtSQL: 2012-11-06 14:18; mail@shopping-preise.de; c:\users\Hans-Dieter\AppData\Roaming\Mozilla\Firefox\Profiles\l63f1fcz.default\extensions\mail@shopping-preise.de
FF - ExtSQL: 2012-11-06 14:18; firejump@firejump.net; c:\users\Hans-Dieter\AppData\Roaming\Mozilla\Firefox\Profiles\l63f1fcz.default\extensions\firejump@firejump.net
FF - ExtSQL: !HIDDEN! 2012-11-06 14:18; mail@shopping-preise.de; c:\users\Hans-Dieter\AppData\Roaming\Mozilla\Firefox\Profiles\l63f1fcz.default\extensions\mail@shopping-preise.de
FF - ExtSQL: !HIDDEN! 2012-11-06 14:18; firejump@firejump.net; c:\users\Hans-Dieter\AppData\Roaming\Mozilla\Firefox\Profiles\l63f1fcz.default\extensions\firejump@firejump.net
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Wow6432Node-HKLM-Run-<NO NAME> - (no file)
Wow6432Node-HKLM-Run-ControlCenter4 - c:\program files (x86)\ControlCenter4\BrCcBoot.exe
ShellIconOverlayIdentifiers- - (no file)
ShellIconOverlayIdentifiers- - (no file)
ShellIconOverlayIdentifiers- - (no file)
.
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PCDSRVC{1E208CE0-FB7451FF-06020200}_0]
"ImagePath"="\??\c:\program files\dell support center\pcdsrvc_x64.pkms"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_4_402_287_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_4_402_287_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_4_402_287_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_4_402_287_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_287.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_287.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_287.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_287.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2012-11-11 09:42:06
ComboFix-quarantined-files.txt 2012-11-11 08:42
.
Vor Suchlauf: 11 Verzeichnis(se), 143.753.400.320 Bytes frei
Nach Suchlauf: 15 Verzeichnis(se), 144.133.267.456 Bytes frei
.
- - End Of File - - 45C56C0255CF0093A86B2EAD23B5A9A9
|
| Themen zu Firefox staret automatisch http://ad.adserverplus.com/ mit leerem Fenster |
| 7-zip, akamai, antivirus, bho, bonjour, brief, canon, desktop, document, email, error, expert pdf, fehler, firefox, flash player, format, helper, home, iexplore.exe, install.exe, logfile, lotus, mozilla, plug-in, problem, registry, richtlinie, rundll, scan, security, senden, software, svchost.exe, visual studio, windows |
Baum-Darstellung