| |
| |||||||
Log-Analyse und Auswertung: Win32.Zbot / Email Anwalt MahnungWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
27.06.2013, 00:58
| #3 |
 |  Win32.Zbot / Email Anwalt Mahnung Huch, so spät noch jemand hier, sehr schön
__________________ Ja, hat mich auch etwas erschrocken. Eigentlich habe ich mich mit Kaspersky immer ziemlich in Sicherheit gefühlt. Was empfiehlst du denn? Er hat das Zip File geöffnet, dann darin das zip file geöffnet und daran die .com Datei auch geöffnet (alles mit Doppelklick und direkt in Winrar). Wäre natürlich schön, wenn sich das nicht ausgebreitet hat... Combofix Logfile: Code:
ATTFilter ComboFix 13-06-26.01 - Christian 27.06.2013 1:52.1.8 - x64
Microsoft Windows 7 Ultimate 6.1.7601.1.1252.49.1031.18.7893.6009 [GMT 2:00]
ausgeführt von:: c:\users\Christian\Desktop\ComboFix.exe
AV: Kaspersky Internet Security *Disabled/Updated* {C3113FBF-4BCB-4461-D78D-6EDFEC9593E5}
FW: Kaspersky Internet Security *Disabled* {FB2ABE9A-01A4-4539-FCD2-C7EA1246D49E}
SP: Kaspersky Internet Security *Disabled/Updated* {7870DE5B-6DF1-4BEF-ED3D-55AD9712D958}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Neuer Wiederherstellungspunkt wurde erstellt
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\ntuser.dat
c:\users\Christian\AppData\Local\assembly\tmp
c:\users\Christian\AppData\Local\MSoft
c:\users\Christian\AppData\Local\MSoft\meritum\ApplicationResources.dll
c:\users\Christian\AppData\Local\MSoft\meritum\Arbeitszeitvereinbarung.dll
c:\users\Christian\AppData\Local\MSoft\meritum\Baustelle.dll
c:\users\Christian\AppData\Local\MSoft\meritum\Beitragsnachweis.dll
c:\users\Christian\AppData\Local\MSoft\meritum\Client.dll
c:\users\Christian\AppData\Local\MSoft\meritum\ClientProxy.dll
c:\users\Christian\AppData\Local\MSoft\meritum\ClientProxy.XmlSerializers.dll
c:\users\Christian\AppData\Local\MSoft\meritum\Einrichtung.dll
c:\users\Christian\AppData\Local\MSoft\meritum\Erfassung.dll
c:\users\Christian\AppData\Local\MSoft\meritum\Feiertage.dll
c:\users\Christian\AppData\Local\MSoft\meritum\Firma.dll
c:\users\Christian\AppData\Local\MSoft\meritum\Kostenstelle.dll
c:\users\Christian\AppData\Local\MSoft\meritum\Krankenkasse.dll
c:\users\Christian\AppData\Local\MSoft\meritum\Lohnart.dll
c:\users\Christian\AppData\Local\MSoft\meritum\Meldecenter.dll
c:\users\Christian\AppData\Local\MSoft\meritum\Monatsabschluss.dll
c:\users\Christian\AppData\Local\MSoft\meritum\Personal.dll
c:\users\Christian\AppData\Local\MSoft\meritum\Protocol.dll
c:\users\Christian\AppData\Local\MSoft\meritum\ReportingProcess.dll
c:\users\Christian\AppData\Local\MSoft\meritum\SharedFunctions.dll
c:\users\Christian\AppData\Local\MSoft\meritum\Tarif.dll
c:\users\Christian\AppData\Local\MSoft\meritum\WebServiceCalls.dll
c:\users\Christian\AppData\Local\MSoft\meritum\WindowsClient.exe
c:\users\Christian\AppData\Local\MSoft\meritum\Wpf.dll
c:\users\Christian\AppData\Local\MSoft\meritum\WPFToolkit.dll
c:\users\Christian\AppData\Local\MSoft\meritum\Zahlungsverkehr.dll
c:\windows\IsUn0407.exe
c:\windows\UA000061.DLL
.
.
((((((((((((((((((((((( Dateien erstellt von 2013-05-26 bis 2013-06-26 ))))))))))))))))))))))))))))))
.
.
2013-06-26 23:54 . 2013-06-26 23:54 -------- d-----w- c:\users\Default\AppData\Local\temp
2013-06-26 23:54 . 2013-06-26 23:54 -------- d-----w- c:\users\Administrator\AppData\Local\temp
2013-06-26 03:47 . 2013-06-26 21:34 76232 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{9EC6B9B8-A01B-4FB1-9D88-F87D34133A09}\offreg.dll
2013-06-25 17:10 . 2013-06-12 03:08 9552976 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{9EC6B9B8-A01B-4FB1-9D88-F87D34133A09}\mpengine.dll
2013-06-12 17:17 . 2013-06-26 21:22 94656 ----a-w- c:\windows\system32\WPRO_41_2001woem.tmp
2013-06-12 13:07 . 2013-05-08 06:39 1910632 ----a-w- c:\windows\system32\drivers\tcpip.sys
2013-06-09 10:04 . 2013-06-09 10:04 -------- d-----w- c:\program files\iPod
2013-06-09 10:04 . 2013-06-09 10:04 -------- d-----w- c:\programdata\34BE82C4-E596-4e99-A191-52C6199EBF69
2013-06-09 10:04 . 2013-06-09 10:04 -------- d-----w- c:\program files\iTunes
2013-05-30 13:06 . 2012-08-24 18:09 458712 ----a-w- c:\windows\system32\drivers\cng.sys
2013-05-30 13:06 . 2012-08-24 18:05 340992 ----a-w- c:\windows\system32\schannel.dll
2013-05-30 13:06 . 2012-08-24 16:57 247808 ----a-w- c:\windows\SysWow64\schannel.dll
2013-05-30 13:06 . 2012-08-24 18:13 154480 ----a-w- c:\windows\system32\drivers\ksecpkg.sys
2013-05-30 13:06 . 2012-08-24 18:03 1448448 ----a-w- c:\windows\system32\lsasrv.dll
2013-05-30 13:06 . 2012-08-24 16:57 22016 ----a-w- c:\windows\SysWow64\secur32.dll
2013-05-30 13:06 . 2012-08-24 16:53 96768 ----a-w- c:\windows\SysWow64\sspicli.dll
2013-05-30 13:06 . 2012-05-04 11:00 366592 ----a-w- c:\windows\system32\qdvd.dll
2013-05-30 13:06 . 2012-05-04 09:59 514560 ----a-w- c:\windows\SysWow64\qdvd.dll
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-06-26 21:22 . 2012-09-23 00:55 34752 ----a-w- c:\windows\system32\drivers\WPRO_41_2001.sys
2013-06-25 12:29 . 2013-05-22 16:47 164880 ---ha-w- c:\users\Christian\AppData\Roaming\Microsoft\Virtual PC\VPCKeyboard.dll
2013-06-17 09:41 . 2012-06-08 09:38 54368 ----a-w- c:\windows\system32\drivers\kltdi.sys
2013-06-12 17:02 . 2012-09-27 14:35 75825640 ----a-w- c:\windows\system32\MRT.exe
2013-06-12 11:27 . 2012-09-22 19:38 71048 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-06-12 11:27 . 2012-09-22 19:38 692104 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2013-05-07 01:00 . 2013-05-07 01:00 97280 ----a-w- c:\windows\system32\mshtmled.dll
2013-05-07 01:00 . 2013-05-07 01:00 92160 ----a-w- c:\windows\system32\SetIEInstalledDate.exe
2013-05-07 01:00 . 2013-05-07 01:00 905728 ----a-w- c:\windows\system32\mshtmlmedia.dll
2013-05-07 01:00 . 2013-05-07 01:00 81408 ----a-w- c:\windows\system32\icardie.dll
2013-05-07 01:00 . 2013-05-07 01:00 77312 ----a-w- c:\windows\system32\tdc.ocx
2013-05-07 01:00 . 2013-05-07 01:00 762368 ----a-w- c:\windows\system32\ieapfltr.dll
2013-05-07 01:00 . 2013-05-07 01:00 73728 ----a-w- c:\windows\SysWow64\SetIEInstalledDate.exe
2013-05-07 01:00 . 2013-05-07 01:00 719360 ----a-w- c:\windows\SysWow64\mshtmlmedia.dll
2013-05-07 01:00 . 2013-05-07 01:00 62976 ----a-w- c:\windows\system32\pngfilt.dll
2013-05-07 01:00 . 2013-05-07 01:00 61952 ----a-w- c:\windows\SysWow64\tdc.ocx
2013-05-07 01:00 . 2013-05-07 01:00 599552 ----a-w- c:\windows\system32\vbscript.dll
2013-05-07 01:00 . 2013-05-07 01:00 523264 ----a-w- c:\windows\SysWow64\vbscript.dll
2013-05-07 01:00 . 2013-05-07 01:00 52224 ----a-w- c:\windows\system32\msfeedsbs.dll
2013-05-07 01:00 . 2013-05-07 01:00 51200 ----a-w- c:\windows\system32\imgutil.dll
2013-05-07 01:00 . 2013-05-07 01:00 48640 ----a-w- c:\windows\SysWow64\mshtmler.dll
2013-05-07 01:00 . 2013-05-07 01:00 48640 ----a-w- c:\windows\system32\mshtmler.dll
2013-05-07 01:00 . 2013-05-07 01:00 452096 ----a-w- c:\windows\system32\dxtmsft.dll
2013-05-07 01:00 . 2013-05-07 01:00 441856 ----a-w- c:\windows\system32\html.iec
2013-05-07 01:00 . 2013-05-07 01:00 38400 ----a-w- c:\windows\SysWow64\imgutil.dll
2013-05-07 01:00 . 2013-05-07 01:00 361984 ----a-w- c:\windows\SysWow64\html.iec
2013-05-07 01:00 . 2013-05-07 01:00 281600 ----a-w- c:\windows\system32\dxtrans.dll
2013-05-07 01:00 . 2013-05-07 01:00 27648 ----a-w- c:\windows\system32\licmgr10.dll
2013-05-07 01:00 . 2013-05-07 01:00 270848 ----a-w- c:\windows\system32\iedkcs32.dll
2013-05-07 01:00 . 2013-05-07 01:00 247296 ----a-w- c:\windows\system32\webcheck.dll
2013-05-07 01:00 . 2013-05-07 01:00 235008 ----a-w- c:\windows\system32\url.dll
2013-05-07 01:00 . 2013-05-07 01:00 23040 ----a-w- c:\windows\SysWow64\licmgr10.dll
2013-05-07 01:00 . 2013-05-07 01:00 226304 ----a-w- c:\windows\system32\elshyph.dll
2013-05-07 01:00 . 2013-05-07 01:00 216064 ----a-w- c:\windows\system32\msls31.dll
2013-05-07 01:00 . 2013-05-07 01:00 197120 ----a-w- c:\windows\system32\msrating.dll
2013-05-07 01:00 . 2013-05-07 01:00 185344 ----a-w- c:\windows\SysWow64\elshyph.dll
2013-05-07 01:00 . 2013-05-07 01:00 173568 ----a-w- c:\windows\system32\ieUnatt.exe
2013-05-07 01:00 . 2013-05-07 01:00 167424 ----a-w- c:\windows\system32\iexpress.exe
2013-05-07 01:00 . 2013-05-07 01:00 158720 ----a-w- c:\windows\SysWow64\msls31.dll
2013-05-07 01:00 . 2013-05-07 01:00 1509376 ----a-w- c:\windows\system32\inetcpl.cpl
2013-05-07 01:00 . 2013-05-07 01:00 150528 ----a-w- c:\windows\SysWow64\iexpress.exe
2013-05-07 01:00 . 2013-05-07 01:00 149504 ----a-w- c:\windows\system32\occache.dll
2013-05-07 01:00 . 2013-05-07 01:00 144896 ----a-w- c:\windows\system32\wextract.exe
2013-05-07 01:00 . 2013-05-07 01:00 1441280 ----a-w- c:\windows\SysWow64\inetcpl.cpl
2013-05-07 01:00 . 2013-05-07 01:00 1400416 ----a-w- c:\windows\system32\ieapfltr.dat
2013-05-07 01:00 . 2013-05-07 01:00 138752 ----a-w- c:\windows\SysWow64\wextract.exe
2013-05-07 01:00 . 2013-05-07 01:00 13824 ----a-w- c:\windows\system32\mshta.exe
2013-05-07 01:00 . 2013-05-07 01:00 137216 ----a-w- c:\windows\SysWow64\ieUnatt.exe
2013-05-07 01:00 . 2013-05-07 01:00 136192 ----a-w- c:\windows\system32\iepeers.dll
2013-05-07 01:00 . 2013-05-07 01:00 135680 ----a-w- c:\windows\system32\IEAdvpack.dll
2013-05-07 01:00 . 2013-05-07 01:00 12800 ----a-w- c:\windows\SysWow64\mshta.exe
2013-05-07 01:00 . 2013-05-07 01:00 12800 ----a-w- c:\windows\system32\msfeedssync.exe
2013-05-07 01:00 . 2013-05-07 01:00 110592 ----a-w- c:\windows\SysWow64\IEAdvpack.dll
2013-05-07 01:00 . 2013-05-07 01:00 1054720 ----a-w- c:\windows\system32\MsSpellCheckingFacility.exe
2013-05-07 01:00 . 2013-05-07 01:00 102912 ----a-w- c:\windows\system32\inseng.dll
2013-05-02 00:06 . 2012-09-22 19:47 278800 ------w- c:\windows\system32\MpSigStub.exe
2013-04-22 10:38 . 2012-08-13 14:49 178448 ----a-w- c:\windows\system32\drivers\kneps.sys
2013-04-22 10:38 . 2012-09-22 19:32 90208 ----a-w- c:\windows\system32\drivers\klflt.sys
2013-04-22 10:38 . 2012-09-22 19:32 620128 ----a-w- c:\windows\system32\drivers\klif.sys
2013-04-13 05:49 . 2013-05-15 16:59 135168 ----a-w- c:\windows\apppatch\AppPatch64\AcXtrnal.dll
2013-04-13 05:49 . 2013-05-15 16:59 350208 ----a-w- c:\windows\apppatch\AppPatch64\AcLayers.dll
2013-04-13 05:49 . 2013-05-15 16:59 308736 ----a-w- c:\windows\apppatch\AppPatch64\AcGenral.dll
2013-04-13 05:49 . 2013-05-15 16:59 111104 ----a-w- c:\windows\apppatch\AppPatch64\acspecfc.dll
2013-04-13 04:45 . 2013-05-15 16:59 474624 ----a-w- c:\windows\apppatch\AcSpecfc.dll
2013-04-13 04:45 . 2013-05-15 16:59 2176512 ----a-w- c:\windows\apppatch\AcGenral.dll
2013-04-12 16:59 . 2012-09-22 19:57 290816 ------w- c:\windows\Setup1.exe
2013-04-12 14:45 . 2013-04-24 04:53 1656680 ----a-w- c:\windows\system32\drivers\ntfs.sys
2013-04-10 06:01 . 2013-05-15 16:59 265064 ----a-w- c:\windows\system32\drivers\dxgmms1.sys
2013-04-10 06:01 . 2013-05-15 16:59 983400 ----a-w- c:\windows\system32\drivers\dxgkrnl.sys
2013-04-10 03:30 . 2013-05-15 16:59 3153920 ----a-w- c:\windows\system32\win32k.sys
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-25 00:36 130736 ----a-w- c:\users\Christian\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-25 00:36 130736 ----a-w- c:\users\Christian\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-25 00:36 130736 ----a-w- c:\users\Christian\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1475584]
"LANCAPI"="b:\program files (x86)\LANCOM\LANCAPI\rcapi.exe" [2011-06-16 482816]
"LANconfig"="b:\program files (x86)\LANCOM\LANconfig\lanconf.exe" [2013-04-17 4709376]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"IAStorIcon"="c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe" [2011-11-29 284440]
"USB3MON"="c:\program files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe" [2012-01-26 291608]
"AVP"="c:\program files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe" [2012-11-13 356376]
"GrooveMonitor"="c:\program files (x86)\Microsoft Office\Office12\GrooveMonitor.exe" [2009-02-26 30040]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-04-04 958576]
"“FjISIS WIA Service Checker"="c:\windows\pixtran\fujitsu\FiWiaChecker.exe" [2009-10-21 86016]
"Ulead AutoDetector v2"="c:\program files (x86)\Common Files\Ulead Systems\AutoDetector\monitor.exe" [2004-11-26 90112]
"FJTWAIN Setup"="c:\windows\Twain_32\fjscan32\FjtwMkup.exe" [2009-07-08 131072]
"FTPWRENV"="c:\windows\Twain_32\Fjscan32\FTPWREVT\FTPWREVT.exe" [2007-10-16 45056]
"FiWIA Service Checker"="c:\windows\Twain_32\Fjscan32\FiWiaChecker.exe" [2009-10-21 86016]
"AdobeCS4ServiceManager"="c:\program files (x86)\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" [2008-08-14 611712]
"iTunesHelper"="b:\program files (x86)\iTunes\iTunesHelper.exe" [2013-05-31 152392]
.
c:\users\Christian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dropbox.lnk - c:\users\Christian\AppData\Roaming\Dropbox\bin\Dropbox.exe /systemstartup [2013-5-25 27776968]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
VR-NetWorld Auftragsprüfung.lnk - b:\vr-networld\VRToolCheckOrder.exe /autostart [2012-9-23 1136640]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"EnableLinkedConnections"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"wave2"=AvmSnd.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
.
R1 OxPPort;OxPPort;c:\windows\system32\DRIVERS\OxPPort.sys;c:\windows\SYSNATIVE\DRIVERS\OxPPort.sys [x]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R3 AWEAlloc;AWE Memory Allocation Driver;c:\windows\system32\DRIVERS\awealloc.sys;c:\windows\SYSNATIVE\DRIVERS\awealloc.sys [x]
R3 FLEXnet Licensing Service 64;FLEXnet Licensing Service 64;c:\program files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe;c:\program files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe [x]
R3 ImDisk;ImDisk Virtual Disk Driver;c:\windows\system32\DRIVERS\imdisk.sys;c:\windows\SYSNATIVE\DRIVERS\imdisk.sys [x]
R3 ImDskSvc;ImDisk Virtual Disk Driver Helper;c:\windows\system32\imdsksvc.exe;c:\windows\SYSNATIVE\imdsksvc.exe [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]
R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys;c:\windows\SYSNATIVE\drivers\synth3dvsc.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys;c:\windows\SYSNATIVE\drivers\tsusbhub.sys [x]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys;c:\windows\SYSNATIVE\Drivers\usbaapl64.sys [x]
R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys;c:\windows\SYSNATIVE\drivers\rdvgkmd.sys [x]
R3 WatAdminSvc;Windows-Aktivierungstechnologieservice;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
R3 WSDScan;WSD-Scanunterstützung durch UMB;c:\windows\system32\DRIVERS\WSDScan.sys;c:\windows\SYSNATIVE\DRIVERS\WSDScan.sys [x]
R4 MSSQLServerADHelper100;SQL Active Directory Helper Service;c:\program files\Microsoft SQL Server\100\Shared\SQLADHLP.EXE;c:\program files\Microsoft SQL Server\100\Shared\SQLADHLP.EXE [x]
R4 RsFx0150;RsFx0150 Driver;c:\windows\system32\DRIVERS\RsFx0150.sys;c:\windows\SYSNATIVE\DRIVERS\RsFx0150.sys [x]
R4 SQLAgent$DAVID;SQL Server Agent (DAVID);c:\program files\Microsoft SQL Server\MSSQL10_50.DAVID\MSSQL\Binn\SQLAGENT.EXE;c:\program files\Microsoft SQL Server\MSSQL10_50.DAVID\MSSQL\Binn\SQLAGENT.EXE [x]
S0 asahci64;asahci64;c:\windows\system32\DRIVERS\asahci64.sys;c:\windows\SYSNATIVE\DRIVERS\asahci64.sys [x]
S0 iusb3hcs;Intel(R) USB 3.0 Hostcontroller-Switchtreiber;c:\windows\system32\DRIVERS\iusb3hcs.sys;c:\windows\SYSNATIVE\DRIVERS\iusb3hcs.sys [x]
S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys;c:\windows\SYSNATIVE\DRIVERS\dtsoftbus01.sys [x]
S1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter;c:\windows\system32\DRIVERS\klim6.sys;c:\windows\SYSNATIVE\DRIVERS\klim6.sys [x]
S1 kltdi;kltdi;c:\windows\system32\DRIVERS\kltdi.sys;c:\windows\SYSNATIVE\DRIVERS\kltdi.sys [x]
S1 kneps;kneps;c:\windows\system32\DRIVERS\kneps.sys;c:\windows\SYSNATIVE\DRIVERS\kneps.sys [x]
S2 acedrv11;acedrv11;c:\windows\system32\drivers\acedrv11.sys;c:\windows\SYSNATIVE\drivers\acedrv11.sys [x]
S2 FJTWMKSV;FJTWMKSV;c:\windows\twain_32\fjscan32\FJTWMKSV.exe;c:\windows\twain_32\fjscan32\FJTWMKSV.exe [x]
S2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [x]
S2 ISCTAgent;ISCT Always Updated Agent;c:\program files\Intel\Intel(R) Smart Connect Technology Agent\iSCTAgent.exe;c:\program files\Intel\Intel(R) Smart Connect Technology Agent\iSCTAgent.exe [x]
S2 LcsFwTool;LANCOM Systems FWTool;b:\program files (x86)\LANCOM\LANCAPI\fwtool.exe;b:\program files (x86)\LANCOM\LANCAPI\fwtool.exe [x]
S2 MSSQL$DAVID;SQL Server (DAVID);c:\program files\Microsoft SQL Server\MSSQL10_50.DAVID\MSSQL\Binn\sqlservr.exe;c:\program files\Microsoft SQL Server\MSSQL10_50.DAVID\MSSQL\Binn\sqlservr.exe [x]
S2 NAUpdate;Nero Update;c:\program files (x86)\Nero\Update\NASvc.exe;c:\program files (x86)\Nero\Update\NASvc.exe [x]
S2 Sentinel64;Sentinel64;c:\windows\System32\Drivers\Sentinel64.sys;c:\windows\SYSNATIVE\Drivers\Sentinel64.sys [x]
S2 SentinelKeysServer;Sentinel Keys Server;c:\program files (x86)\Common Files\SafeNet Sentinel\Sentinel Keys Server\sntlkeyssrvr.exe;c:\program files (x86)\Common Files\SafeNet Sentinel\Sentinel Keys Server\sntlkeyssrvr.exe [x]
S2 TeamViewer8;TeamViewer 8;c:\program files (x86)\TeamViewer\Version8\TeamViewer_Service.exe;c:\program files (x86)\TeamViewer\Version8\TeamViewer_Service.exe [x]
S2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [x]
S3 EtronHub3;Etron USB 3.0 Extensible Hub Driver;c:\windows\system32\Drivers\EtronHub3.sys;c:\windows\SYSNATIVE\Drivers\EtronHub3.sys [x]
S3 EtronXHCI;Etron USB 3.0 Extensible Host Controller Driver;c:\windows\system32\Drivers\EtronXHCI.sys;c:\windows\SYSNATIVE\Drivers\EtronXHCI.sys [x]
S3 ikbevent;Intel Upper keyboard Class Filter Driver;c:\windows\system32\DRIVERS\ikbevent.sys;c:\windows\SYSNATIVE\DRIVERS\ikbevent.sys [x]
S3 imsevent;Intel Upper Mouse Class Filter Driver;c:\windows\system32\DRIVERS\imsevent.sys;c:\windows\SYSNATIVE\DRIVERS\imsevent.sys [x]
S3 IntcDAud;Intel(R) Display-Audio;c:\windows\system32\DRIVERS\IntcDAud.sys;c:\windows\SYSNATIVE\DRIVERS\IntcDAud.sys [x]
S3 ISCT;Intel(R) Smart Connect Technology Device Driver;c:\windows\system32\DRIVERS\ISCTD64.sys;c:\windows\SYSNATIVE\DRIVERS\ISCTD64.sys [x]
S3 iusb3hub;Intel(R) USB 3.0-Hubtreiber;c:\windows\system32\DRIVERS\iusb3hub.sys;c:\windows\SYSNATIVE\DRIVERS\iusb3hub.sys [x]
S3 iusb3xhc;Intel(R) USB 3.0 eXtensible-Hostcontrollertreiber;c:\windows\system32\DRIVERS\iusb3xhc.sys;c:\windows\SYSNATIVE\DRIVERS\iusb3xhc.sys [x]
S3 k57nd60a;Broadcom NetLink (TM) Gigabit Ethernet - NDIS 6.0;c:\windows\system32\DRIVERS\k57nd60a.sys;c:\windows\SYSNATIVE\DRIVERS\k57nd60a.sys [x]
S3 klkbdflt;Kaspersky Lab KLKBDFLT;c:\windows\system32\DRIVERS\klkbdflt.sys;c:\windows\SYSNATIVE\DRIVERS\klkbdflt.sys [x]
S3 klmouflt;Kaspersky Lab KLMOUFLT;c:\windows\system32\DRIVERS\klmouflt.sys;c:\windows\SYSNATIVE\DRIVERS\klmouflt.sys [x]
S3 LcsCapiDrv;LANCAPI Driver;c:\windows\system32\DRIVERS\rcapi.sys;c:\windows\SYSNATIVE\DRIVERS\rcapi.sys [x]
S3 LCSWAN;LANCOM NDISWAN;c:\windows\system32\DRIVERS\lcswan.sys;c:\windows\SYSNATIVE\DRIVERS\lcswan.sys [x]
S3 MBfilt;MBfilt;c:\windows\system32\drivers\MBfilt64.sys;c:\windows\SYSNATIVE\drivers\MBfilt64.sys [x]
S3 MSSQLFDLauncher$DAVID;SQL Full-text Filter Daemon Launcher (DAVID);c:\program files\Microsoft SQL Server\MSSQL10_50.DAVID\MSSQL\Binn\fdlauncher.exe;c:\program files\Microsoft SQL Server\MSSQL10_50.DAVID\MSSQL\Binn\fdlauncher.exe [x]
S3 WPRO_41_2001;WinPcap Packet Driver (WPRO_41_2001);c:\windows\system32\drivers\WPRO_41_2001.sys;c:\windows\SYSNATIVE\drivers\WPRO_41_2001.sys [x]
.
.
Inhalt des "geplante Tasks" Ordners
.
2013-06-26 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-09-22 11:27]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-25 00:36 164016 ----a-w- c:\users\Christian\AppData\Roaming\Dropbox\bin\DropboxExt64.19.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-25 00:36 164016 ----a-w- c:\users\Christian\AppData\Roaming\Dropbox\bin\DropboxExt64.19.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-25 00:36 164016 ----a-w- c:\users\Christian\AppData\Roaming\Dropbox\bin\DropboxExt64.19.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-25 00:36 164016 ----a-w- c:\users\Christian\AppData\Roaming\Dropbox\bin\DropboxExt64.19.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Seagull Drivers"="ssdal_nc.exe startup" [X]
"RTHDVCPL"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2012-01-31 12446824]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2012-12-14 172144]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2012-12-14 399984]
"Persistence"="c:\windows\system32\igfxpers.exe" [2012-12-14 441968]
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.delta-search.com/?affID=119370&tt=040413_9114&babsrc=HP_ss&mntrId=20DEBC5FF43658E8
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
IE: An vorhandene PDF-Datei anfügen - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
IE: Linkziel an vorhandene PDF-Datei anhängen - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Linkziel in Adobe PDF konvertieren - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Nach Microsoft E&xel exportieren - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000
IE: {{0221703C-6E84-4915-9960-593A66B3D84E} - %ProgramFiles(x86)%\ELOprofessional\Prog\Client\EloArcConnect.exe
IE: {{39FC0E7F-84EA-4962-AB58-33913BC63CAB} - %ProgramFiles(x86)%\ELOprofessional\Prog\Client\EloInternetExplorer.htm
TCP: Interfaces\{5B1FBBE4-F061-4129-8F0D-BF08D34F237C}: NameServer = 192.168.0.1
FF - ProfilePath - c:\users\Christian\AppData\Roaming\Mozilla\Firefox\Profiles\3t87li6m.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.de/
FF - ExtSQL: 2013-06-06 07:09; {84b24861-62f6-364b-eba5-2e5e2061d7e6}; c:\users\Christian\AppData\Roaming\Mozilla\Firefox\Profiles\3t87li6m.default\extensions\{84b24861-62f6-364b-eba5-2e5e2061d7e6}
FF - user.js: extensions.delta.tlbrSrchUrl -
FF - user.js: extensions.delta.id - 20de0f2e000000000000bc5ff43658e8
FF - user.js: extensions.delta.appId - {C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}
FF - user.js: extensions.delta.instlDay - 15799
FF - user.js: extensions.delta.vrsn - 1.8.10.0
FF - user.js: extensions.delta.vrsni - 1.8.10.0
FF - user.js: extensions.delta.vrsnTs - 1.8.10.018:14
FF - user.js: extensions.delta.prtnrId - delta
FF - user.js: extensions.delta.prdct - delta
FF - user.js: extensions.delta.aflt - babsst
FF - user.js: extensions.delta.smplGrp - none
FF - user.js: extensions.delta.tlbrId - base
FF - user.js: extensions.delta.instlRef - sst
FF - user.js: extensions.delta.dfltLng - en
FF - user.js: extensions.delta.excTlbr - false
FF - user.js: extensions.delta.admin - false
FF - user.js: extensions.delta.autoRvrt - false
FF - user.js: extensions.delta.rvrt - false
FF - user.js: extensions.delta.newTab - false
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Toolbar-{9E131A93-EED7-4BEB-B015-A0ADB30B5646} - (no file)
Wow6432Node-HKCU-Run-LightScribe Control Panel - c:\program files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe
Wow6432Node-HKLM-Run-NWEReboot - (no file)
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
AddRemove-DATA BECKER - Die große CD-Druckerei - c:\windows\IsUn0407.exe
AddRemove-ScheerWin - c:\windows\IsUn0407.exe
AddRemove-T-Com MMS - c:\windows\IsUn0407.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\Approved Extensions]
@Denied: (2) (LocalSystem)
"{5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F}"=hex:51,66,7a,6c,4c,1d,38,12,1d,cf,77,
51,95,a1,d1,09,ee,9c,1f,b7,fe,e1,bb,5b
"{72853161-30C5-4D22-B7F9-0BBC1D38A37E}"=hex:51,66,7a,6c,4c,1d,38,12,0f,32,96,
76,f7,7e,4c,08,c8,ef,48,fc,18,66,e7,6a
"{73455575-E40C-433C-9784-C78DC7761455}"=hex:51,66,7a,6c,4c,1d,38,12,1b,56,56,
77,3e,aa,52,06,e8,92,84,cd,c2,28,50,41
"{9E6D0D23-3D72-4A94-AE1F-2D167624E3D9}"=hex:51,66,7a,6c,4c,1d,38,12,4d,0e,7e,
9a,40,73,fa,0f,d1,09,6e,56,73,7a,a7,cd
"{E33CF602-D945-461A-83F0-819F76A199F8}"=hex:51,66,7a,6c,4c,1d,38,12,6c,f5,2f,
e7,77,97,74,03,fc,e6,c2,df,73,ff,dd,ec
"{2A541AE1-5BF6-4665-A8A3-CFA9672E4291}"=hex:51,66,7a,6c,4c,1d,38,12,8f,19,47,
2e,c4,15,0b,03,d7,b5,8c,e9,62,70,06,85
"{FF059E31-CC5A-4E2E-BF3B-96E929D65503}"=hex:51,66,7a,6c,4c,1d,38,12,5f,9d,16,
fb,68,82,40,0b,c0,2d,d5,a9,2c,88,11,17
"{BDEADE7F-C265-11D0-BCED-00A0C90AB50F}"=hex:51,66,7a,6c,4c,1d,38,12,11,dd,f9,
b9,57,8c,be,54,c3,fb,43,e0,cc,54,f1,1b
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration]
@Denied: (2) (LocalSystem)
"Timestamp"=hex:f8,82,62,76,9c,66,ce,01
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (LocalSystem)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,d6,4c,cf,92,36,ab,a4,4b,97,ff,64,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,d6,4c,cf,92,36,ab,a4,4b,97,ff,64,\
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_7_700_224_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_7_700_224_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_7_700_224_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_7_700_224_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2013-06-27 01:56:05
ComboFix-quarantined-files.txt 2013-06-26 23:56
.
Vor Suchlauf: 16 Verzeichnis(se), 111.543.668.736 Bytes frei
Nach Suchlauf: 20 Verzeichnis(se), 113.413.427.200 Bytes frei
.
- - End Of File - - B6FC054035B2E422BB669A6F5589ACDE
D41D8CD98F00B204E9800998ECF8427E |
| Themen zu Win32.Zbot / Email Anwalt Mahnung |
| .com, anhang, anwalt, ausführung, bluescreen, datei, diverse, doppelt, email, entfernen, frage, fragen, gmer, guten, installiert, internet, kaspersky, programm, spam, spam email, trojan/win32.zbot, verursacht, virus, virustotal |
Baum-Darstellung