Rootkit Trojaner (Google-Anfragen werden weitergeleitet)

Joenig

Habe mir in diesem Forum bezüglich technischen Problems ein Thread durchgelsen und dann laut Anweisung mit Combofix mein Problem erfolgreich behoben. Jedoch habe ich gelesen dass ich meine Logfiles in solch ein Forum posten sollte falls sich noch Malware auf meinem Rechner versteckt hat.
___________________________________________________________________________

ComboFix 13-07-31.02 - Julian 31.07.2013 19:05:48.1.4 - x86
Microsoft Windows 7 Professional 6.1.7601.1.1252.49.1031.18.3326.2224 [GMT 2:00]
ausgeführt von:: c:\users\Julian\Desktop\cofi.exe
AV: Avira Desktop *Enabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
SP: Avira Desktop *Enabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\1372090463.bdinstall.bin
c:\programdata\1372434965.bdinstall.bin
c:\programdata\1372511330.bdinstall.bin
c:\programdata\1372949043.bdinstall.bin
c:\programdata\1372949044.bdinstall.bin
c:\users\Julian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk
c:\windows\$NtUninstallKB265$
c:\windows\$NtUninstallKB265$\1474798142
c:\windows\$NtUninstallKB265$\726674009\@
c:\windows\$NtUninstallKB265$\726674009\Desktop.ini
c:\windows\$NtUninstallKB265$\726674009\L\00000004.@
c:\windows\$NtUninstallKB265$\726674009\L\201d3dde
c:\windows\$NtUninstallKB265$\726674009\L\6715e287
c:\windows\$NtUninstallKB265$\726674009\L\76603ac3
c:\windows\$NtUninstallKB265$\726674009\L\xadqgnnk
c:\windows\$NtUninstallKB265$\726674009\U\00000004.@
c:\windows\$NtUninstallKB265$\726674009\U\00000008.@
c:\windows\$NtUninstallKB265$\726674009\U\000000cb.@
c:\windows\$NtUninstallKB265$\726674009\U\80000000.@
c:\windows\$NtUninstallKB265$\726674009\U\80000032.@
c:\windows\RazorDOX
c:\windows\RazorDOX\RazorDOX.dll
c:\windows\RazorDOX\RazorDOX.ini
c:\windows\system32\DEBUG.log
C:\x64drvsys
N:\install.exe
.
Infizierte Kopie von c:\windows\system32\drivers\dfsc.sys wurde gefunden und desinfiziert
Kopie von - The cat found it wurde wiederhergestellt
Infizierte Kopie von c:\windows\system32\Services.exe wurde gefunden und desinfiziert
Kopie von - c:\windows\winsxs\x86_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.1.7600.16385_none_cf36168b2e9c967b\services.exe wurde wiederhergestellt
.
.
((((((((((((((((((((((((((((((((((((((( Treiber/Dienste )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Service_NPF
.
.
((((((((((((((((((((((( Dateien erstellt von 2013-06-28 bis 2013-07-31 ))))))))))))))))))))))))))))))
.
.
2013-07-31 17:14 . 2013-07-31 17:16 -------- d-----w- c:\users\Julian\AppData\Local\temp
2013-07-31 17:14 . 2013-07-31 17:14 -------- d-----w- c:\users\UpdatusUser\AppData\Local\temp
2013-07-31 17:14 . 2013-07-31 17:14 -------- d-----w- c:\users\Default\AppData\Local\temp
2013-07-31 17:02 . 2010-11-20 21:29 78336 ----a-w- c:\windows\system32\drivers\dfsc.sys
2013-07-25 15:24 . 2013-07-25 15:24 -------- d-----w- c:\users\Julian\AppData\Roaming\OpenOffice
2013-07-25 12:06 . 2013-07-25 12:06 -------- d-----w- c:\windows\Sun
2013-07-16 22:03 . 2013-07-16 22:03 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin7.dll
2013-07-16 22:03 . 2013-07-16 22:03 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin6.dll
2013-07-16 22:03 . 2013-07-16 22:03 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin5.dll
2013-07-16 22:03 . 2013-07-16 22:03 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin4.dll
2013-07-16 22:03 . 2013-07-16 22:03 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin3.dll
2013-07-16 22:03 . 2013-07-16 22:03 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin2.dll
2013-07-16 22:03 . 2013-07-16 22:03 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin.dll
2013-07-16 22:03 . 2013-07-16 22:03 -------- d-----w- c:\program files\Java
2013-07-14 12:05 . 2013-07-14 12:05 -------- d-----w- c:\program files\AGEIA Technologies
2013-07-14 12:03 . 2013-06-21 12:02 9069344 ----a-w- c:\windows\system32\drivers\nvlddmkm.sys
2013-07-14 12:03 . 2013-06-21 12:02 6324360 ----a-w- c:\windows\system32\nvopencl.dll
2013-07-14 12:03 . 2013-06-21 12:02 21102368 ----a-w- c:\windows\system32\nvoglv32.dll
2013-07-14 12:03 . 2013-06-21 12:02 893728 ----a-w- c:\windows\system32\nvdispgenco3232049.dll
2013-07-14 12:03 . 2013-06-21 12:02 7687592 ----a-w- c:\windows\system32\nvcuda.dll
2013-07-14 12:03 . 2013-06-21 12:02 467232 ----a-w- c:\windows\system32\NvIFR.dll
2013-07-14 12:03 . 2013-06-21 12:02 465184 ----a-w- c:\windows\system32\NvFBC.dll
2013-07-14 12:03 . 2013-06-21 12:02 2777888 ----a-w- c:\windows\system32\nvcuvid.dll
2013-07-14 12:03 . 2013-06-21 12:02 2002720 ----a-w- c:\windows\system32\nvcuvenc.dll
2013-07-14 12:03 . 2013-06-21 12:02 1024288 ----a-w- c:\windows\system32\nvdispco3232049.dll
2013-07-14 12:03 . 2013-06-21 12:02 17560352 ----a-w- c:\windows\system32\nvcompiler.dll
2013-07-14 12:02 . 2013-07-14 12:02 -------- d-----w- C:\NVIDIA
2013-07-14 11:36 . 2013-07-14 12:06 -------- d-----w- c:\programdata\WarThunder
2013-07-14 11:36 . 2013-07-14 11:36 -------- d-----w- c:\users\Julian\AppData\Local\WarThunder
2013-07-11 14:02 . 2013-04-09 23:34 1247744 ----a-w- c:\windows\system32\DWrite.dll
2013-07-11 14:02 . 2013-06-04 04:53 509440 ----a-w- c:\windows\system32\qedit.dll
2013-07-11 14:02 . 2013-05-06 04:56 1620480 ----a-w- c:\windows\system32\WMVDECOD.DLL
2013-07-11 14:02 . 2013-06-05 03:05 2347520 ----a-w- c:\windows\system32\win32k.sys
2013-07-11 14:02 . 2013-04-10 05:04 1221632 ----a-w- c:\program files\Windows Journal\NBDoc.DLL
2013-07-11 14:02 . 2013-04-10 05:03 936448 ----a-w- c:\program files\Common Files\Microsoft Shared\ink\journal.dll
2013-07-11 14:02 . 2013-04-10 05:03 988672 ----a-w- c:\program files\Windows Journal\JNTFiltr.dll
2013-07-11 14:02 . 2013-04-10 05:03 969216 ----a-w- c:\program files\Windows Journal\JNWDRV.dll
2013-07-11 14:02 . 2013-05-27 04:57 680960 ----a-w- c:\program files\Windows Defender\MpSvc.dll
2013-07-11 14:02 . 2013-05-27 04:57 392704 ----a-w- c:\program files\Windows Defender\MpClient.dll
2013-07-11 14:02 . 2013-05-27 04:57 224768 ----a-w- c:\program files\Windows Defender\MpCommu.dll
2013-07-04 15:05 . 2013-07-04 15:05 -------- d-----w- c:\users\Gast
2013-07-04 14:53 . 2013-07-04 14:53 -------- d-----w- c:\users\Julian\AppData\Roaming\Avira
2013-07-04 14:48 . 2013-07-04 14:48 67168 ----a-w- c:\windows\system32\drivers\avnetflt.sys
2013-07-04 14:45 . 2013-03-06 14:13 37352 ----a-w- c:\windows\system32\drivers\avkmgr.sys
2013-07-04 14:45 . 2013-02-27 11:22 84744 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2013-07-04 14:45 . 2013-02-27 11:22 135136 ----a-w- c:\windows\system32\drivers\avipbb.sys
2013-07-04 14:45 . 2013-07-04 14:45 -------- d-----w- c:\programdata\Avira
2013-07-04 14:45 . 2013-07-04 14:45 -------- d-----w- c:\program files\Avira
2013-07-04 14:34 . 2013-07-05 21:18 -------- d-----w- c:\users\Julian\AppData\Roaming\Image Editor Packages
2013-07-04 14:34 . 2013-07-04 14:34 -------- d-----w- c:\users\Julian\AppData\Roaming\DSite
2013-07-04 14:34 . 2013-07-04 14:34 -------- d-----w- c:\program files\Image Converter
2013-07-04 14:34 . 2013-07-31 10:18 -------- d-----w- c:\programdata\Tarma Installer
2013-07-02 14:24 . 2013-07-02 14:24 -------- d-----w- c:\program files\PrivitizeVPN
2013-07-02 14:18 . 2013-07-02 14:18 -------- d-----w- c:\program files\VirtualDJ
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-07-25 12:05 . 2013-04-22 19:03 94632 ----a-w- c:\windows\system32\WindowsAccessBridge.dll
2013-07-25 12:05 . 2012-10-14 12:58 867240 ----a-w- c:\windows\system32\npDeployJava1.dll
2013-07-25 12:05 . 2012-10-14 12:58 789416 ----a-w- c:\windows\system32\deployJava1.dll
2013-07-22 12:17 . 2012-10-14 12:50 71048 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2013-07-22 12:17 . 2012-10-14 12:50 692104 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2013-06-24 13:41 . 2013-06-24 13:41 235 ----a-w- c:\windows\system32\nxEuUninstall.bat
2013-06-24 13:41 . 2013-06-24 13:41 446464 ----a-w- c:\windows\NEXON_EU_DownloaderUpdater.exe
2013-06-21 12:02 . 2012-10-14 13:03 53024 ----a-w- c:\windows\system32\OpenCL.dll
2013-06-21 12:02 . 2012-10-14 13:02 13411896 ----a-w- c:\windows\system32\nvwgf2um.dll
2013-06-21 12:02 . 2012-10-14 13:02 12427240 ----a-w- c:\windows\system32\nvd3dum.dll
2013-06-21 12:02 . 2012-10-14 13:02 2597856 ----a-w- c:\windows\system32\nvapi.dll
2013-06-21 09:52 . 2012-10-14 13:03 4192544 ----a-w- c:\windows\system32\nvcpl.dll
2013-06-21 09:52 . 2012-10-14 13:03 3045664 ----a-w- c:\windows\system32\nvsvc.dll
2013-06-21 09:52 . 2012-10-14 13:03 640288 ----a-w- c:\windows\system32\nvvsvc.exe
2013-06-21 09:52 . 2012-10-14 13:03 62752 ----a-w- c:\windows\system32\nvshext.dll
2013-06-21 09:52 . 2012-10-14 13:03 2555168 ----a-w- c:\windows\system32\nvsvcr.dll
2013-06-21 09:52 . 2012-10-14 13:03 223008 ----a-w- c:\windows\system32\nvmctray.dll
2013-06-21 03:16 . 2013-06-21 03:16 566048 ----a-w- c:\windows\system32\nvStreaming.exe
2013-06-12 04:18 . 2013-06-29 10:32 7068072 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{C8A054C9-D767-4988-8C1D-161C23187205}\mpengine.dll
2013-05-28 13:05 . 2013-06-18 18:25 163328 ----a-w- c:\windows\system32\FlashPlayerUpdateService.exe
2013-05-13 04:45 . 2013-06-12 11:30 140288 ----a-w- c:\windows\system32\cryptsvc.dll
2013-05-13 04:45 . 2013-06-12 11:30 1160192 ----a-w- c:\windows\system32\crypt32.dll
2013-05-13 04:45 . 2013-06-12 11:30 103936 ----a-w- c:\windows\system32\cryptnet.dll
2013-05-13 03:08 . 2013-06-12 11:30 903168 ----a-w- c:\windows\system32\certutil.exe
2013-05-13 03:08 . 2013-06-12 11:30 43008 ----a-w- c:\windows\system32\certenc.dll
2013-05-10 03:20 . 2013-06-12 11:30 24576 ----a-w- c:\windows\system32\cryptdlg.dll
2013-05-08 09:47 . 2012-07-17 13:37 22240 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
2013-05-08 05:38 . 2013-06-12 11:30 1293672 ----a-w- c:\windows\system32\drivers\tcpip.sys
2013-05-06 05:06 . 2013-06-12 11:30 3968872 ----a-w- c:\windows\system32\ntkrnlpa.exe
2013-05-06 05:06 . 2013-06-12 11:30 3913576 ----a-w- c:\windows\system32\ntoskrnl.exe
2013-05-03 10:37 . 2013-05-03 10:37 745472 ----a-w- c:\windows\system32\MsSpellCheckingFacility.exe
2013-05-03 10:37 . 2013-05-03 10:37 185344 ----a-w- c:\windows\system32\elshyph.dll
2013-05-03 10:37 . 2013-05-03 10:37 73728 ----a-w- c:\windows\system32\SetIEInstalledDate.exe
2013-05-03 10:37 . 2013-05-03 10:37 61952 ----a-w- c:\windows\system32\tdc.ocx
2013-05-03 10:37 . 2013-05-03 10:37 523264 ----a-w- c:\windows\system32\vbscript.dll
2013-05-03 10:37 . 2013-05-03 10:37 48640 ----a-w- c:\windows\system32\mshtmler.dll
2013-05-03 10:37 . 2013-05-03 10:37 38400 ----a-w- c:\windows\system32\imgutil.dll
2013-05-03 10:37 . 2013-05-03 10:37 361984 ----a-w- c:\windows\system32\html.iec
2013-05-03 10:37 . 2013-05-03 10:37 158720 ----a-w- c:\windows\system32\msls31.dll
2013-05-03 10:37 . 2013-05-03 10:37 150528 ----a-w- c:\windows\system32\iexpress.exe
2013-05-03 10:37 . 2013-05-03 10:37 138752 ----a-w- c:\windows\system32\wextract.exe
2013-05-03 10:37 . 2013-05-03 10:37 137216 ----a-w- c:\windows\system32\ieUnatt.exe
2013-05-03 10:37 . 2013-05-03 10:37 12800 ----a-w- c:\windows\system32\mshta.exe
2013-05-03 10:37 . 2013-05-03 10:37 110592 ----a-w- c:\windows\system32\IEAdvpack.dll
2013-05-03 10:37 . 2013-05-03 10:37 719360 ----a-w- c:\windows\system32\mshtmlmedia.dll
2013-05-03 10:37 . 2013-05-03 10:37 23040 ----a-w- c:\windows\system32\licmgr10.dll
2013-05-03 10:37 . 2013-05-03 10:37 1441280 ----a-w- c:\windows\system32\inetcpl.cpl
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive1]
@="{F241C880-6982-4CE5-8CF7-7085BA96DA5A}"
[HKEY_CLASSES_ROOT\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}]
2013-04-23 18:00 220632 ----a-w- c:\users\Julian\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\SkyDriveShell.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive2]
@="{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}"
[HKEY_CLASSES_ROOT\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}]
2013-04-23 18:00 220632 ----a-w- c:\users\Julian\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\SkyDriveShell.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive3]
@="{BBACC218-34EA-4666-9D7A-C78F2274A524}"
[HKEY_CLASSES_ROOT\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}]
2013-04-23 18:00 220632 ----a-w- c:\users\Julian\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\SkyDriveShell.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2013-04-21 59720]
"VirtualCloneDrive"="v:\virtualclonedrive\VCDDaemon.exe" [2011-03-07 89456]
"GrooveMonitor"="v:\microsoft office\Office12\GrooveMonitor.exe" [2009-02-26 30040]
"BCD2000"="c:\windows\system32\bcd2kcpan.exe" [2013-02-28 532480]
"Autodesk Sync"="c:\program files\Autodesk\Autodesk Sync\AdSync.exe" [2012-02-05 383424]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-04-04 958576]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2013-05-31 152392]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2013-07-04 345144]
"QuickTime Task"="v:\program files\QuickTime\QTTask.exe" [2011-10-24 421888]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2013-03-12 253816]
.
c:\users\Julian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Logitech Touch Mouse Server.lnk - v:\program files\Logitech Touch Mouse Server\iTouch-Server-Win.exe [2009-10-23 228352]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Orbit.lnk - v:\program files\Orbitdownloader\orbitdm.exe /H [2012-12-11 2674488]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"HideSCAHealth"= 1 (0x1)
.
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Orbit.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Orbit.lnk
backup=c:\windows\pss\Orbit.lnk.CommonStartup
backupExtension=.CommonStartup
.
[HKLM\~\startupfolder\C:^Users^Julian^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Facebook Messenger.lnk]
path=c:\users\Julian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Facebook Messenger.lnk
backup=c:\windows\pss\Facebook Messenger.lnk.Startup
backupExtension=.Startup
.
[HKLM\~\startupfolder\C:^Users^Julian^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OpenOffice.org 3.4.1.lnk]
path=c:\users\Julian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk
backup=c:\windows\pss\OpenOffice.org 3.4.1.lnk.Startup
backupExtension=.Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KPeerNexonEU]
2013-06-24 13:41 438272 ----a-w- c:\nexon\NEXON_EU_Downloader\nxEULauncher.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PrivitizeVPN]
2013-07-02 14:24 196784 ----a-w- c:\program files\PrivitizeVPN\PrivitizeVPN.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Spotify]
2013-04-03 11:55 4503448 ----a-w- c:\users\Julian\AppData\Roaming\Spotify\spotify.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Spotify Web Helper]
2013-04-03 11:55 1104280 ----a-w- c:\users\Julian\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
2013-03-15 16:29 1632680 ----a-w- v:\program files\Steam\steam.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\uTorrent]
2013-06-30 10:57 1045072 -c--a-w- v:\sicherung\uTorrent\uTorrent.exe
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"Google Update"="c:\users\Julian\AppData\Local\Google\Update\GoogleUpdate.exe" /c
"Steam"="v:\program files\Steam\Steam.exe" -silent
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe"
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe"
"Adobe_ID0EYTHM"=c:\progra~1\COMMON~1\Adobe\ADOBEV~1\Server\bin\VERSIO~2.EXE
.
R2 gupdate;Google Update-Dienst (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2013-04-25 116648]
R3 BCD2000;Behringer BCD2000 V1.1.1.0;c:\windows\system32\Drivers\BCD2000.SYS [2013-02-28 42400]
R3 BCD2000WDM;Behringer BCD2000WDM V1.1.1.0;c:\windows\system32\Drivers\BCD2000WDM.SYS [2013-02-28 21632]
R3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys [2010-11-20 62464]
R3 EagleXNt;EagleXNt;c:\windows\system32\drivers\EagleXNt.sys [x]
R3 gupdatem;Google Update-Dienst (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2013-04-25 116648]
R3 Netaapl;Apple Mobile Device Ethernet Service;c:\windows\system32\DRIVERS\netaapl.sys [2012-03-26 18432]
R3 NPF;WinPcap Packet Driver (NPF);c:\windows\system32\drivers\NPF.sys [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2012-08-23 14848]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2012-08-23 49664]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [2012-08-23 27136]
R4 TeamViewer7;TeamViewer 7;c:\program files\TeamViewer\Version7\TeamViewer_Service.exe [2012-10-23 2848168]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys [2013-03-06 37352]
S2 AntiVirSchedulerService;Avira Planer;c:\program files\Avira\AntiVir Desktop\sched.exe [2013-07-04 84024]
S2 Autodesk Content Service;Autodesk Content Service;c:\program files\Autodesk\Content Service\Connect.Service.ContentService.exe [2012-01-31 19232]
S2 BrowserProtect;BrowserProtect;c:\programdata\BrowserProtect\2.6.1339.144\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserProtect.exe [2013-06-03 3085264]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2013-06-21 413472]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt86win7.sys [2012-06-12 552080]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2013-07-31 16:15 1173456 ----a-w- c:\program files\Google\Chrome\Application\28.0.1500.95\Installer\chrmstp.exe
.
Inhalt des "geplante Tasks" Ordners
.
2013-07-28 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-10-14 13:05]
.
2013-07-28 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2013-04-25 14:47]
.
2013-07-29 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2013-04-25 14:47]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://search.babylon.com/?affID=44444&tt=gc_&babsrc=HP_ss_din2g&mntrId=08A300FFC6DF34E9
uInternet Settings,ProxyOverride = *.local
IE: &Download by Orbit - v:\program files\Orbitdownloader\orbitmxt.dll/201
IE: &Grab video by Orbit - v:\program files\Orbitdownloader\orbitmxt.dll/204
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: Do&wnload selected by Orbit - v:\program files\Orbitdownloader\orbitmxt.dll/203
IE: Down&load all by Orbit - v:\program files\Orbitdownloader\orbitmxt.dll/202
IE: Nach Microsoft E&xel exportieren - v:\micros~3\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.2.1
FF - ProfilePath - c:\users\Julian\AppData\Roaming\Mozilla\Firefox\Profiles\j3suaan6.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3176921&SearchSource=3&q={searchTerms}&CUI=UN12474768588977218
FF - prefs.js: browser.search.selectedEngine - Delta Search
FF - prefs.js: browser.startup.homepage - hxxp://www.google.de/
FF - ExtSQL: 2013-07-31 12:30; {4DC70064-89E2-4a55-8FC6-E8CDEAE3618C}; c:\users\Julian\AppData\Roaming\Mozilla\Firefox\Profiles\j3suaan6.default\extensions\{4DC70064-89E2-4a55-8FC6-E8CDEAE3618C}.xpi
FF - user.js: extensions.BabylonToolbar.tlbrSrchUrl - hxxp://search.babylon.com/?babsrc=TB_def&mntrId=08a39fc700000000000000ffc6df34e9&q=
FF - user.js: extensions.BabylonToolbar.id - 08a39fc700000000000000ffc6df34e9
FF - user.js: extensions.BabylonToolbar.appId - {BDB69379-802F-4eaf-B541-F8DE92DD98DB}
FF - user.js: extensions.BabylonToolbar.instlDay - 15735
FF - user.js: extensions.BabylonToolbar.vrsn - 1.8.7.2
FF - user.js: extensions.BabylonToolbar.vrsni - 1.8.7.2
FF - user.js: extensions.BabylonToolbar_i.vrsnTs - 1.8.7.214:58
FF - user.js: extensions.BabylonToolbar.prtnrId - babylon
FF - user.js: extensions.BabylonToolbar.prdct - BabylonToolbar
FF - user.js: extensions.BabylonToolbar.aflt - babsst
FF - user.js: extensions.BabylonToolbar_i.smplGrp - none
FF - user.js: extensions.BabylonToolbar.tlbrId - base
FF - user.js: extensions.BabylonToolbar.instlRef - sst
FF - user.js: extensions.BabylonToolbar.dfltLng - en
FF - user.js: extensions.BabylonToolbar_i.excTlbr - false
FF - user.js: extensions.BabylonToolbar.excTlbr - false
FF - user.js: extensions.BabylonToolbar.admin - false
FF - user.js: extensions.BabylonToolbar_i.babTrack - affID=117023
FF - user.js: extensions.BabylonToolbar_i.babExt -
FF - user.js: extensions.BabylonToolbar_i.srcExt - ss
FF - user.js: extensions.BabylonToolbar.autoRvrt - false
FF - user.js: extensions.BabylonToolbar.rvrt - false
FF - user.js: extensions.BabylonToolbar_i.newTab - false
FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: nglayout.initialpaint.delay - 600
FF - user.js: content.notify.interval - 600000
FF - user.js: content.max.tokenizing.time - 1800000
FF - user.js: content.switch.threshold - 600000
FF - user.js: extensions.delta.tlbrSrchUrl -
FF - user.js: extensions.delta.id - 08a39fc700000000000000ffc6df34e9
FF - user.js: extensions.delta.appId - {C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}
FF - user.js: extensions.delta.instlDay - 15852
FF - user.js: extensions.delta.vrsn - 1.8.21.5
FF - user.js: extensions.delta.vrsni - 1.8.21.5
FF - user.js: extensions.delta.vrsnTs - 1.8.21.520:58
FF - user.js: extensions.delta.prtnrId - delta
FF - user.js: extensions.delta.prdct - delta
FF - user.js: extensions.delta.aflt - babsst
FF - user.js: extensions.delta.smplGrp - none
FF - user.js: extensions.delta.tlbrId - base
FF - user.js: extensions.delta.instlRef - sst
FF - user.js: extensions.delta.dfltLng - en
FF - user.js: extensions.delta.excTlbr - false
FF - user.js: extensions.delta.ffxUnstlRst - true
FF - user.js: extensions.delta.admin - false
FF - user.js: extensions.delta_i.babTrack - affID=44444&tt=gc_
FF - user.js: extensions.delta_i.babExt -
FF - user.js: extensions.delta_i.srcExt - ss
FF - user.js: extensions.delta.autoRvrt - false
FF - user.js: extensions.delta.rvrt - false
FF - user.js: extensions.delta.newTab - false
.
.
------- Dateityp-Verknüpfung -------
.
.scr=AutoCADScriptFile
.txt=
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
URLSearchHooks-{88ac3cb6-596b-4217-964c-b6757ef9602d} - (no file)
Toolbar-{88ac3cb6-596b-4217-964c-b6757ef9602d} - (no file)
HKCU-Run-Facebook Update - c:\users\Julian\AppData\Local\Facebook\Update\FacebookUpdate.exe
HKLM-Run-WireLessMouse - c:\program files\Multimedia Combo Set\MouseDrv.exe
HKLM-Run-WireLessKeyboard - c:\program files\Multimedia Combo Set\PS2USBKbdDrv.exe
MSConfigStartUp-Allmyapps - c:\users\Julian\AppData\Roaming\Allmyapps\Allmyapps.exe
MSConfigStartUp-Allmyapps Update - c:\users\Julian\AppData\Roaming\Allmyapps\AllmyappsUpdater.exe
MSConfigStartUp-SweetIM - c:\program files\SweetIM\Messenger\SweetIM.exe
MSConfigStartUp-Sweetpacks Communicator - c:\program files\SweetIM\Communicator\SweetPacksUpdateManager.exe
AddRemove-7-Zip - v:\program files\7-Zip\Uninstall.exe
AddRemove-InstallShield_{2BF0AE92-C3BC-4112-9066-1546342B1FAE} - c:\program files\InstallShield Installation Information\{2BF0AE92-C3BC-4112-9066-1546342B1FAE}\setup.exe
AddRemove-WinLiveSuite - c:\program files\Windows Live\Installer\wlarp.exe
AddRemove-{4A4472E1-2A39-432D-9455-82AE293CA601}_is1 - v:\program files\Ultimate IP Changer\unins000.exe
AddRemove-{5783F2D7-B001-0000-0002-0060B0CE6BBA} - v:\program files\Autodesk\AutoCAD 2013\Setup\de-de\Setup\Setup.exe
AddRemove-{6592FDEC-2C1A-413A-9985-25FEC2F0848D} - c:\program files\InstallShield Installation Information\{6592FDEC-2C1A-413A-9985-25FEC2F0848D}\setup.exe
AddRemove-{8833FFB6-5B0C-4764-81AA-06DFEED9A476} - c:\program files\InstallShield Installation Information\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}\setup.exe
AddRemove-Image Editor Packages - c:\users\Julian\AppData\Roaming\Image Editor Packages\uninstaller.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\windows\system32\nvvsvc.exe
c:\program files\NVIDIA Corporation\Display\nvxdsync.exe
c:\windows\system32\nvvsvc.exe
c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
c:\program files\Avira\AntiVir Desktop\avshadow.exe
c:\windows\system32\conhost.exe
c:\windows\System32\WUDFHost.exe
c:\windows\System32\rundll32.exe
c:\program files\NVIDIA Corporation\Display\nvtray.exe
v:\program files\Orbitdownloader\orbitdm.exe
c:\windows\System32\rundll32.exe
c:\program files\iPod\bin\iPodService.exe
c:\windows\system32\DllHost.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\program files\Google\Update\1.3.21.153\GoogleCrashHandler.exe
c:\windows\system32\sppsvc.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2013-07-31 19:21:06 - PC wurde neu gestartet
ComboFix-quarantined-files.txt 2013-07-31 17:21
.
Vor Suchlauf: 14 Verzeichnis(se), 11.298.353.152 Bytes frei
Nach Suchlauf: 18 Verzeichnis(se), 10.862.510.080 Bytes frei
.
- - End Of File - - 373F8209E477462B95E846FDD81C7D3B
A36C5E4F47E84449FF07ED3517B43A31