| |
| |||||||
Log-Analyse und Auswertung: "C:\Windows\System32\cmd.exe" wird bei Systemstart ausgeführtWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
16.12.2012, 18:54
| #5 |
| |  "C:\Windows\System32\cmd.exe" wird bei Systemstart ausgeführt Hier der Bericht: Combofix Logfile: Code:
ATTFilter ComboFix 12-12-14.01 - NAME_GEÄNDERT 16.12.2012 18:33:17.1.4 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.49.1031.18.8055.6202 [GMT 1:00]
ausgeführt von:: c:\users\NAME_GEÄNDERT\Desktop\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
AV: Microsoft Security Essentials *Disabled/Updated* {B140BF4E-23BB-4198-90AB-A51A4C60A69C}
FW: FireWall *Disabled* {CE40CCC0-8ADB-6D67-25A0-C5B6438E4B57}
SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Microsoft Security Essentials *Disabled/Updated* {0A215EAA-0581-4E16-AA1B-9E6837E7EC21}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files (x86)\Acer Bio Protection\PwdFilterV64.dll
c:\programdata\FullRemove.exe
c:\windows\SysWow64\muzapp.exe
c:\windows\SysWow64\System32\MASetupCleaner.exe
c:\windows\SysWow64\System32\muzapp.exe
.
.
((((((((((((((((((((((( Dateien erstellt von 2012-11-16 bis 2012-12-16 ))))))))))))))))))))))))))))))
.
.
2012-12-16 16:10 . 2012-11-08 17:24 9125352 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{C6EAE501-FF98-49F2-95BD-B2456B682683}\mpengine.dll
2012-12-14 16:30 . 2012-12-14 16:30 -------- d-----w- c:\users\NAME_GEÄNDERT\AppData\Local\Google
2012-12-13 18:04 . 2012-12-13 18:04 -------- d-----w- c:\program files (x86)\Metro 2033
2012-12-13 11:09 . 2012-12-13 11:09 -------- d-----w- c:\windows\Migration
2012-12-13 11:02 . 2012-08-21 14:20 46080 ----a-w- c:\windows\SysWow64\ncobjapi.dll
2012-12-13 11:02 . 2012-08-21 13:49 58368 ----a-w- c:\windows\system32\ncobjapi.dll
2012-12-13 11:02 . 2012-08-21 13:12 74240 ----a-w- c:\windows\system32\wbem\NCProv.dll
2012-12-13 10:58 . 2012-11-14 05:52 2382848 ----a-w- c:\windows\system32\mshtml.tlb
2012-12-13 10:58 . 2012-11-14 01:44 2382848 ----a-w- c:\windows\SysWow64\mshtml.tlb
2012-12-13 10:56 . 2012-11-08 17:24 9125352 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2012-12-13 10:55 . 2012-11-09 05:45 2048 ----a-w- c:\windows\system32\tzres.dll
2012-12-13 10:55 . 2012-11-09 04:42 2048 ----a-w- c:\windows\SysWow64\tzres.dll
2012-12-13 10:55 . 2012-11-22 03:26 3149824 ----a-w- c:\windows\system32\win32k.sys
2012-12-13 10:55 . 2012-11-05 21:35 46080 ----a-w- c:\windows\system32\atmlib.dll
2012-12-13 10:55 . 2012-11-05 20:41 367616 ----a-w- c:\windows\system32\atmfd.dll
2012-12-13 10:55 . 2012-11-05 20:32 295424 ----a-w- c:\windows\SysWow64\atmfd.dll
2012-12-13 10:55 . 2012-11-05 20:32 34304 ----a-w- c:\windows\SysWow64\atmlib.dll
2012-12-13 10:53 . 2012-11-02 05:59 478208 ----a-w- c:\windows\system32\dpnet.dll
2012-12-13 10:53 . 2012-11-02 05:11 376832 ----a-w- c:\windows\SysWow64\dpnet.dll
2012-12-02 21:22 . 2012-12-02 21:22 -------- d-----w- c:\program files (x86)\Common Files\Skype
2012-12-02 21:22 . 2012-12-02 21:22 -------- d-----r- c:\program files (x86)\Skype
2012-12-02 21:12 . 2012-12-02 21:12 -------- d-----w- c:\users\NAME_GEÄNDERT\AppData\Roaming\Apple Computer
2012-12-02 19:01 . 2012-12-02 19:01 -------- d-----w- c:\users\NAME_GEÄNDERT\AppData\Roaming\eu.computerworks.vectorworks.2012.help.deu.07222458214E034A0B494E83FAD6744C17D2B914.1
2012-12-02 11:44 . 2012-12-02 11:44 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin7.dll
2012-12-02 11:44 . 2012-12-02 11:44 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin6.dll
2012-12-02 11:44 . 2012-12-02 11:44 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin5.dll
2012-12-02 11:44 . 2012-12-02 11:44 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin4.dll
2012-12-02 11:44 . 2012-12-02 11:44 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin3.dll
2012-12-02 11:44 . 2012-12-02 11:44 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin2.dll
2012-12-02 11:44 . 2012-12-02 11:44 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin.dll
2012-12-02 11:44 . 2012-12-02 11:44 -------- d-----w- c:\program files (x86)\QuickTime
2012-12-02 11:44 . 2012-12-02 11:44 -------- d-----w- c:\programdata\Apple Computer
2012-12-02 11:42 . 2012-12-02 11:42 -------- d-----w- c:\program files (x86)\Common Files\Apple
2012-12-02 11:42 . 2012-12-02 11:42 -------- d-----w- c:\users\NAME_GEÄNDERT\AppData\Local\Apple
2012-12-02 11:42 . 2012-12-02 11:42 -------- d-----w- c:\program files (x86)\Apple Software Update
2012-12-02 11:03 . 2012-12-02 11:03 -------- d-----w- c:\users\NAME_GEÄNDERT\AppData\Local\Macromedia
2012-11-30 14:09 . 2012-11-30 14:09 -------- d-----w- c:\users\NAME_GEÄNDERT\AppData\Local\EgisTec IPS
2012-11-29 19:56 . 2012-11-29 19:56 -------- d-----w- c:\programdata\ATI
2012-11-29 19:46 . 2012-11-29 19:46 -------- d-----w- c:\programdata\AMD
2012-11-29 19:46 . 2012-11-29 19:46 -------- d-----w- c:\program files (x86)\AMD AVT
2012-11-29 19:46 . 2012-11-29 19:46 -------- d-----w- c:\program files (x86)\AMD APP
2012-11-29 19:46 . 2012-11-29 19:46 -------- d-----w- c:\program files\Common Files\ATI Technologies
2012-11-29 19:46 . 2012-11-29 19:46 -------- d-----w- c:\program files (x86)\Common Files\ATI Technologies
2012-11-29 19:44 . 2012-11-29 19:46 -------- d-----w- c:\program files\ATI Technologies
2012-11-20 20:43 . 2012-11-20 20:43 -------- d-----w- c:\program files (x86)\Lame For Audacity
2012-11-20 20:31 . 2012-11-20 21:03 -------- d-----w- c:\users\NAME_GEÄNDERT\AppData\Roaming\Audacity
2012-11-20 20:31 . 2012-11-20 20:31 -------- d-----w- c:\program files (x86)\Audacity
2012-11-20 20:22 . 2012-11-20 20:22 -------- d-----w- c:\program files (x86)\Windows Sidebar
2012-11-20 20:21 . 2012-11-20 20:21 -------- d-----w- c:\users\NAME_GEÄNDERT\AppData\Roaming\TuneUp Software
2012-11-20 20:21 . 2012-11-20 20:21 -------- d-----w- c:\programdata\TuneUp Software
2012-11-20 20:21 . 2012-11-20 20:21 -------- d-sh--w- c:\programdata\{C4ABDBC8-1C81-42C9-BFFC-4A68511E9E4F}
2012-11-20 20:21 . 2012-11-20 20:21 -------- d--h--w- c:\programdata\Common Files
2012-11-20 19:01 . 2012-11-21 17:58 -------- d-----w- c:\users\NAME_GEÄNDERT\AppData\Local\Spotify
2012-11-20 19:00 . 2012-11-21 17:58 -------- d-----w- c:\users\NAME_GEÄNDERT\AppData\Roaming\Spotify
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-12-13 11:30 . 2012-06-29 15:32 73656 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2012-12-13 11:30 . 2012-06-29 15:32 697272 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2012-12-13 10:59 . 2011-01-26 14:57 67413224 ----a-w- c:\windows\system32\MRT.exe
2012-11-14 01:57 . 2012-12-13 10:57 1129472 ----a-w- c:\windows\SysWow64\wininet.dll
2012-11-12 06:42 . 2012-11-12 06:42 25299 ----a-w- c:\windows\SysWow64\BRLM03A.DLL
2012-11-07 12:47 . 2012-05-09 21:06 140936 ----a-w- c:\windows\system32\drivers\avfwot.sys
2012-11-07 12:47 . 2012-05-09 21:06 114168 ----a-w- c:\windows\system32\drivers\avfwim.sys
2012-10-25 02:12 . 2012-10-25 02:12 94208 ----a-w- c:\windows\SysWow64\QuickTimeVR.qtx
2012-10-25 02:12 . 2012-10-25 02:12 69632 ----a-w- c:\windows\SysWow64\QuickTime.qts
2012-10-16 08:38 . 2012-11-29 13:15 135168 ----a-w- c:\windows\apppatch\AppPatch64\AcXtrnal.dll
2012-10-16 08:38 . 2012-11-29 13:15 350208 ----a-w- c:\windows\apppatch\AppPatch64\AcLayers.dll
2012-10-16 07:39 . 2012-11-29 13:15 561664 ----a-w- c:\windows\apppatch\AcLayers.dll
2012-10-09 18:17 . 2012-11-15 14:34 55296 ----a-w- c:\windows\system32\dhcpcsvc6.dll
2012-10-09 18:17 . 2012-11-15 14:34 226816 ----a-w- c:\windows\system32\dhcpcore6.dll
2012-10-09 17:40 . 2012-11-15 14:34 44032 ----a-w- c:\windows\SysWow64\dhcpcsvc6.dll
2012-10-09 17:40 . 2012-11-15 14:34 193536 ----a-w- c:\windows\SysWow64\dhcpcore6.dll
2012-10-04 16:47 . 2012-12-13 10:54 5120 ----a-w- c:\windows\SysWow64\wow32.dll
2012-10-04 16:40 . 2012-12-13 10:54 44032 ----a-w- c:\windows\apppatch\acwow64.dll
2012-10-03 17:56 . 2012-11-15 14:34 1914248 ----a-w- c:\windows\system32\drivers\tcpip.sys
2012-10-03 17:44 . 2012-11-15 14:34 303104 ----a-w- c:\windows\system32\nlasvc.dll
2012-10-03 17:44 . 2012-11-15 14:34 70656 ----a-w- c:\windows\system32\nlaapi.dll
2012-10-03 17:44 . 2012-11-15 14:34 246272 ----a-w- c:\windows\system32\netcorehc.dll
2012-10-03 17:44 . 2012-11-15 14:34 18944 ----a-w- c:\windows\system32\netevent.dll
2012-10-03 17:44 . 2012-11-15 14:34 216576 ----a-w- c:\windows\system32\ncsi.dll
2012-10-03 17:42 . 2012-11-15 14:34 569344 ----a-w- c:\windows\system32\iphlpsvc.dll
2012-10-03 16:42 . 2012-11-15 14:34 175104 ----a-w- c:\windows\SysWow64\netcorehc.dll
2012-10-03 16:42 . 2012-11-15 14:34 18944 ----a-w- c:\windows\SysWow64\netevent.dll
2012-10-03 16:42 . 2012-11-15 14:34 156672 ----a-w- c:\windows\SysWow64\ncsi.dll
2012-10-03 16:07 . 2012-11-15 14:34 45568 ----a-w- c:\windows\system32\drivers\tcpipreg.sys
2012-09-25 22:47 . 2012-11-15 14:32 78336 ----a-w- c:\windows\SysWow64\synceng.dll
2012-09-25 22:46 . 2012-11-15 14:32 95744 ----a-w- c:\windows\system32\synceng.dll
2012-09-24 13:32 . 2012-09-13 14:09 477168 ----a-w- c:\windows\SysWow64\npdeployJava1.dll
2012-09-24 13:32 . 2011-02-05 21:26 473072 ----a-w- c:\windows\SysWow64\deployJava1.dll
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Steam"="c:\program files (x86)\Steam\steam.exe" [2012-12-03 1354736]
"KiesHelper"="c:\program files (x86)\Samsung\Kies\KiesHelper.exe" [2012-04-04 954256]
"KiesPDLR"="c:\program files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe" [2012-04-04 21392]
"Spotify Web Helper"="c:\users\NAME_GEÄNDERT\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe" [2012-11-20 1199576]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"AMD AVT"="start AMD Accelerated Video Transcoding device initialization" [X]
"EgisUpdate"="c:\program files (x86)\EgisTec IPS\EgisUpdate.exe" [2010-03-11 201584]
"VitaKeyPdtWzd"="c:\program files (x86)\Acer Bio Protection\PdtWzd.exe" [2009-09-05 3567616]
"Trust Gaming Mouse"="c:\program files (x86)\Trust Gaming Mouse\Mouse.exe" [2011-01-17 2245632]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-07-27 919008]
"BrStsWnd"="c:\program files (x86)\Brownie\BrstsW64.exe" [2009-08-19 3695928]
"KiesTrayAgent"="c:\program files (x86)\Samsung\Kies\KiesTrayAgent.exe" [2012-04-04 3521424]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2012-08-09 348664]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-09-17 254896]
"SwitchBoard"="c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]
"AdobeCS6ServiceManager"="c:\program files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe" [2012-03-09 1073312]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2012-04-06 641664]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-10-11 59280]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2012-10-25 421888]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2010-6-25 1129760]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2012-11-09 160944]
R3 btwampfl;Bluetooth AMP USB Filter;c:\windows\system32\drivers\btwampfl.sys [2010-06-25 342056]
R3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys [2010-06-25 39464]
R3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudbus.sys [2011-12-08 98616]
R3 enecir;ENE CIR Receiver;c:\windows\system32\DRIVERS\enecir.sys [2007-04-25 36864]
R3 enecirhid;ENE CIR HID Receiver;c:\windows\system32\DRIVERS\enecirhid.sys [2009-05-19 14848]
R3 enecirhidma;ENE CIR HIDmini Filter;c:\windows\system32\DRIVERS\enecirhidma.sys [2008-04-24 6656]
R3 ghsmdm;Handset USB Modem;c:\windows\system32\DRIVERS\ghsmdm.sys [x]
R3 HTCAND64;HTC Device Driver;c:\windows\system32\Drivers\ANDROIDUSB.sys [x]
R3 massfilter_hs;HS HandSet Mass Storage Filter Driver;c:\windows\system32\drivers\massfilter_hs.sys [x]
R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [2012-08-30 128456]
R3 NisSrv;Microsoft-Netzwerkinspektion;c:\program files\Microsoft Security Client\NisSrv.exe [2012-09-12 368896]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2012-08-23 19456]
R3 ssudmdm;SAMSUNG Mobile USB Modem Drivers (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudmdm.sys [2011-12-08 203320]
R3 SwitchBoard;SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2012-08-23 57856]
R3 TurboBoost;TurboBoost;c:\program files\Intel\TurboBoost\TurboBoost.exe [2009-11-02 126352]
R3 wacmoumonitor;Wacom Mode Helper;c:\windows\system32\DRIVERS\wacmoumonitor.sys [2010-01-24 18216]
S0 johci;JMicron 1394 Filter Driver;c:\windows\system32\DRIVERS\johci.sys [2009-09-21 20392]
S1 avfwot;avfwot;c:\windows\system32\DRIVERS\avfwot.sys [2012-11-07 140936]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys [2012-05-09 27760]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2010-05-27 203264]
S2 AntiVirFireWallService;Avira FireWall;c:\program files (x86)\Avira\AntiVir Desktop\avfwsvc.exe [2012-05-14 619472]
S2 AntiVirMailService;Avira Email Schutz;c:\program files (x86)\Avira\AntiVir Desktop\avmailc.exe [2012-05-14 375760]
S2 AntiVirSchedulerService;Avira Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [2012-05-14 86224]
S2 AntiVirWebService;Avira Browser Schutz;c:\program files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [2012-05-14 465360]
S2 ePowerSvc;Acer ePower Service;c:\program files\Acer\Acer PowerSmart Manager\ePowerSvc.exe [2010-02-26 783392]
S2 FPSensor;EgisTec-Corp Fingerprint Reader Driver (FPSensor.sys);c:\windows\system32\Drivers\FPSensor.sys [2010-12-07 36400]
S2 GREGService;GREGService;c:\program files (x86)\Acer\Registration\GREGsvc.exe [2010-01-08 23584]
S2 IGBASVC;EgisTec Service;c:\program files (x86)\Acer Bio Protection\BASVC.exe [2009-09-05 3450368]
S2 STRATO HiDrive Service;STRATO HiDrive Service;c:\program files (x86)\STRATO AG\STRATO HiDrive\STRATO HiDrive Service.exe [2011-11-14 32768]
S2 TabletServiceWacom;TabletServiceWacom;c:\windows\system32\Wacom_Tablet.exe [2010-03-09 6245744]
S2 TurboB;Turbo Boost UI Monitor driver;c:\windows\system32\DRIVERS\TurboB.sys [2009-11-02 13784]
S2 UNS;Intel(R) Management & Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2009-09-30 2320920]
S2 Updater Service;Updater Service;c:\program files\Acer\Acer Updater\UpdaterService.exe [2010-01-28 243232]
S3 avfwim;AvFw Packet Filter Miniport;c:\windows\system32\DRIVERS\avfwim.sys [2012-11-07 114168]
S3 HECIx64;Intel(R) Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [2009-09-17 56344]
S3 Impcd;Impcd;c:\windows\system32\DRIVERS\Impcd.sys [2009-10-26 151936]
S3 JMCR;JMCR;c:\windows\system32\DRIVERS\jmcr.sys [2009-09-23 144496]
S3 k57nd60a;Broadcom NetLink (TM) Gigabit Ethernet - NDIS 6.0;c:\windows\system32\DRIVERS\k57nd60a.sys [2009-06-07 317480]
S3 trustms;Trust Mouse;c:\windows\system32\drivers\trustms.sys [2010-11-15 12416]
.
.
Inhalt des "geplante Tasks" Ordners
.
2012-12-16 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-06-29 11:30]
.
2012-12-16 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-06-01 13:22]
.
2012-12-16 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-06-01 13:22]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2009-12-15 9644576]
"IAAnotif"="c:\program files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2009-08-07 186904]
"Acer ePower Management"="c:\program files\Acer\Acer PowerSmart Manager\ePowerTrayLauncher.exe" [2010-02-26 496160]
"PLFSetI"="c:\windows\PLFSetI.exe" [2008-07-29 200704]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2012-09-12 1289704]
"AdobeAAMUpdater-1.0"="c:\program files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2012-04-04 446392]
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://acer.msn.com
uLocal Page = c:\windows\system32\blank.htm
mDefault_Page_URL = hxxp://acer.msn.com
mStart Page = hxxp://acer.msn.com
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: Bild an &Bluetooth-Gerät senden... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Seite an &Bluetooth-Gerät senden... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
LSP: c:\program files (x86)\Avira\AntiVir Desktop\avsda.dll
TCP: DhcpNameServer = 192.168.178.1
FF - ProfilePath - c:\users\NAME_GEÄNDERT\AppData\Roaming\Mozilla\Firefox\Profiles\c050l76i.default\
FF - ExtSQL: 2012-10-20 21:57; {CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA}; c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA}
FF - ExtSQL: 2012-12-11 22:27; {87eab3b7-a707-4459-99ae-c2fa06cfa36b}; c:\users\NAME_GEÄNDERT\AppData\Roaming\Mozilla\Firefox\Profiles\c050l76i.default\extensions\{87eab3b7-a707-4459-99ae-c2fa06cfa36b}.xpi
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Toolbar-Locked - (no file)
Wow6432Node-HKCU-Run-Akamai NetSession Interface - c:\users\NAME_GEÄNDERT\AppData\Local\Akamai\netsession_win.exe
Wow6432Node-HKCU-Run-EA Core - c:\program files (x86)\Electronic Arts\EADM\Core.exe
Wow6432Node-HKCU-Run-AdobeBridge - (no file)
Toolbar-Locked - (no file)
HKLM-Run-mwlDaemon - c:\program files (x86)\EgisTec MyWinLocker\x86\mwlDaemon.exe
HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe
AddRemove-Google Chrome - c:\users\NAME_GEÄNDERT\AppData\Local\Google\Chrome\Application\23.0.1271.91\Installer\setup.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\S-1-5-21-2347292157-3042307878-621166202-1000\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:41,0f,7d,a0,fc,0c,86,33,8e,6c,d8,d6,af,5c,24,2a,9a,af,d3,07,b6,72,29,
a8,aa,7b,8f,30,58,e3,5e,cf,f7,33,8c,af,bd,3a,06,d4,7c,dd,90,43,4b,c4,15,b3,\
"??"=hex:68,95,12,fe,c2,cb,e4,6b,15,45,58,a9,cb,1b,34,3b
.
[HKEY_USERS\S-1-5-21-2347292157-3042307878-621166202-1000\Software\SecuROM\License information*]
"datasecu"=hex:31,30,1d,e4,64,83,f5,66,9d,58,fb,9c,60,b0,7d,c4,c7,57,35,f2,e6,
3c,60,18,b4,6c,84,99,d4,86,84,0c,cd,fc,e5,34,e1,f5,57,4c,af,9f,30,d5,c8,5d,\
"rkeysecu"=hex:1d,b7,c6,f6,7e,0a,ac,e2,1c,4e,c5,28,d6,b6,07,36
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{BEB3C0C7-B648-4257-96D9-B5D024816E27}\Version*Version]
"Version"=hex:0e,07,56,c6,13,38,44,39,98,b4,94,01,20,09,69,1e,70,17,73,8c,78,
59,83,f4,2b,8f,a7,77,0f,67,0d,38,81,81,4e,d2,e2,ea,88,c9,1c,53,c2,48,f6,c2,\
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0005\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0006\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\program files (x86)\Acer Bio Protection\CompPtcVUI.exe
c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
c:\program files (x86)\Avira\AntiVir Desktop\avguard.exe
c:\program files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
c:\program files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe
c:\windows\SysWOW64\RunDll32.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2012-12-16 18:51:27 - PC wurde neu gestartet
ComboFix-quarantined-files.txt 2012-12-16 17:51
.
Vor Suchlauf: 13 Verzeichnis(se), 54.848.880.640 Bytes frei
Nach Suchlauf: 18 Verzeichnis(se), 55.106.674.688 Bytes frei
.
- - End Of File - - 406772FDBEDEEB64A9A3EAA023F930B9
PS.: Es ist erstaunlich was ihr/du aus diesen Berichten lesen kannst. Größten Respekt! Geändert von Gepetto (16.12.2012 um 18:58 Uhr) Grund: Namenszensur |
| Themen zu "C:\Windows\System32\cmd.exe" wird bei Systemstart ausgeführt |
| akamai, antivir, avira, bho, c:\windows\system32\cmd.exe, error, fehler, firefox, flash player, frage, helper, hijack, home, install.exe, jdownloader, logfile, mywinlocker, plug-in, problem, programm, realtek, registry, scan, security, sketchup, spotify web helper, svchost.exe, system, teamspeak, trojaner, viren, windows |
Baum-Darstellung