| |
| |||||||
Log-Analyse und Auswertung: Windows 7 x64: Firefox öffnet selbstständig Downloadfenster und will Datei downloadenWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
| |
14.12.2013, 22:57
| #1 | |
| /// the machine /// TB-Ausbilder    |  Windows 7 x64: Firefox öffnet selbstständig Downloadfenster und will Datei downloaden hi, Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!Downloade dir bitte Combofix vom folgenden Downloadspiegel Link 1 WICHTIG - Speichere Combofix auf deinem Desktop
Wenn Combofix fertig ist, wird es eine Logfile erstellen. Bitte poste die C:\Combofix.txt in deiner nächsten Antwort. Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten Zitat:
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
15.12.2013, 12:39
| #2 |
 | Windows 7 x64: Firefox öffnet selbstständig Downloadfenster und will Datei downloaden Hallo schrauber,
__________________herzlichen Dank für die schnelle Antwort.  Habe Combofix gerade durchlaufen lassen, anbei das Logfile dazu :Code:
ATTFilter ComboFix 13-12-13.01 - Sebastian 15.12.2013 12:26:09.1.4 - x64
Microsoft Windows 7 Ultimate 6.1.7601.1.1252.49.1031.18.8087.6016 [GMT 1:00]
ausgeführt von:: c:\users\Sebastian\Desktop\ComboFix.exe
AV: G Data InternetSecurity 2010 *Disabled/Updated* {54ACC2FC-837E-E665-7A92-5352D560D5EF}
FW: G Data Personal Firewall *Disabled* {6C9743D9-C911-E73D-51CD-FA672BB39294}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Neuer Wiederherstellungspunkt wurde erstellt
.
.
((((((((((((((((((((((( Dateien erstellt von 2013-11-15 bis 2013-12-15 ))))))))))))))))))))))))))))))
.
.
2013-12-15 11:30 . 2013-12-15 11:30 -------- d-----w- c:\users\DefaultAppPool\AppData\Local\temp
2013-12-15 11:30 . 2013-12-15 11:30 -------- d-----w- c:\users\Default\AppData\Local\temp
2013-12-14 17:57 . 2013-12-14 17:57 -------- d-----w- C:\FRST
2013-12-14 14:15 . 2013-12-14 14:15 -------- d-----w- c:\windows\Migration
2013-12-14 14:00 . 2013-12-14 14:01 -------- d-----w- c:\windows\system32\MRT
2013-12-14 13:58 . 2013-11-18 00:28 10285968 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{BB5B7B48-F3C6-4528-8B73-D1ACAF2FB1D9}\mpengine.dll
2013-12-11 23:25 . 2013-12-11 23:25 -------- d-----w- c:\program files (x86)\Samsung SSD Magician
2013-12-11 10:45 . 2013-12-11 10:45 -------- d-----w- c:\users\Sebastian\AppData\Roaming\Apple Computer
2013-12-10 10:31 . 2013-12-10 10:31 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin5.dll
2013-12-10 10:31 . 2013-12-10 10:31 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin4.dll
2013-12-10 10:31 . 2013-12-10 10:31 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin3.dll
2013-12-10 10:31 . 2013-12-10 10:31 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin2.dll
2013-12-10 10:31 . 2013-12-10 10:31 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin.dll
2013-12-10 10:31 . 2013-12-10 10:31 -------- d-----w- c:\programdata\Apple Computer
2013-12-10 10:31 . 2013-12-10 10:31 -------- d-----w- c:\program files (x86)\Common Files\Apple
2013-12-10 10:31 . 2013-12-10 10:31 -------- d-----w- c:\users\Sebastian\AppData\Local\Apple
2013-12-10 10:31 . 2013-12-10 10:31 -------- d-----w- c:\programdata\Apple
2013-12-10 10:31 . 2013-12-10 10:31 -------- d-----w- c:\program files (x86)\Apple Software Update
2013-12-04 20:34 . 2013-12-04 20:34 -------- d-----w- c:\programdata\ATI
2013-12-04 20:34 . 2013-12-04 20:34 -------- d-----w- c:\program files (x86)\AMD AVT
2013-12-03 13:17 . 2013-12-03 13:17 -------- d-----w- c:\program files (x86)\AMD
2013-11-29 17:58 . 2013-11-29 17:58 78432 ----a-w- c:\windows\system32\atimpc64.dll
2013-11-29 17:58 . 2013-11-29 17:58 78432 ----a-w- c:\windows\system32\amdpcom64.dll
2013-11-29 17:58 . 2013-11-29 17:58 71704 ----a-w- c:\windows\SysWow64\atimpc32.dll
2013-11-29 17:58 . 2013-11-29 17:58 71704 ----a-w- c:\windows\SysWow64\amdpcom32.dll
2013-11-29 17:54 . 2013-11-29 17:54 126336 ----a-w- c:\windows\SysWow64\atiuxpag.dll
2013-11-29 17:53 . 2013-11-29 17:53 115512 ----a-w- c:\windows\system32\atiu9p64.dll
2013-11-29 17:53 . 2013-11-29 17:53 98496 ----a-w- c:\windows\SysWow64\atiu9pag.dll
2013-11-29 17:51 . 2013-11-29 17:51 1100728 ----a-w- c:\windows\SysWow64\aticfx32.dll
2013-11-29 17:50 . 2013-11-29 17:50 8412680 ----a-w- c:\windows\SysWow64\atidxx32.dll
2013-11-29 17:49 . 2013-11-29 17:49 8287008 ----a-w- c:\windows\SysWow64\atiumdva.dll
2013-11-29 17:48 . 2013-11-29 17:48 6630232 ----a-w- c:\windows\SysWow64\atiumdag.dll
2013-11-29 17:47 . 2013-11-29 17:47 8927704 ----a-w- c:\windows\system32\atiumd6a.dll
2013-11-29 17:46 . 2013-11-29 17:46 7751920 ----a-w- c:\windows\system32\atiumd64.dll
2013-11-29 17:39 . 2013-11-29 17:39 13201920 ----a-w- c:\windows\system32\drivers\atikmdag.sys
2013-11-29 17:24 . 2013-11-29 17:24 230912 ----a-w- c:\windows\system32\clinfo.exe
2013-11-29 17:24 . 2013-11-29 17:24 100352 ----a-w- c:\windows\system32\OpenVideo64.dll
2013-11-29 17:23 . 2013-11-29 17:23 83968 ----a-w- c:\windows\SysWow64\OpenVideo.dll
2013-11-29 17:23 . 2013-11-29 17:23 86528 ----a-w- c:\windows\system32\OVDecode64.dll
2013-11-29 17:23 . 2013-11-29 17:23 73728 ----a-w- c:\windows\SysWow64\OVDecode.dll
2013-11-29 17:23 . 2013-11-29 17:23 29363712 ----a-w- c:\windows\system32\amdocl64.dll
2013-11-29 17:21 . 2013-11-29 17:21 24846848 ----a-w- c:\windows\SysWow64\amdocl.dll
2013-11-29 17:18 . 2013-11-29 17:18 63488 ----a-w- c:\windows\system32\OpenCL.dll
2013-11-29 17:18 . 2013-11-29 17:18 57344 ----a-w- c:\windows\SysWow64\OpenCL.dll
2013-11-29 17:13 . 2013-11-29 17:13 129536 ----a-w- c:\windows\system32\coinst_13.25.18.dll
2013-11-29 17:00 . 2013-11-29 17:00 26350592 ----a-w- c:\windows\system32\atio6axx.dll
2013-11-29 16:55 . 2013-11-29 16:55 368640 ----a-w- c:\windows\system32\atiapfxx.exe
2013-11-29 16:55 . 2013-11-29 16:55 62464 ----a-w- c:\windows\system32\aticalrt64.dll
2013-11-29 16:55 . 2013-11-29 16:55 52224 ----a-w- c:\windows\SysWow64\aticalrt.dll
2013-11-29 16:55 . 2013-11-29 16:55 55808 ----a-w- c:\windows\system32\aticalcl64.dll
2013-11-29 16:55 . 2013-11-29 16:55 49152 ----a-w- c:\windows\SysWow64\aticalcl.dll
2013-11-29 16:54 . 2013-11-29 16:54 15716352 ----a-w- c:\windows\system32\aticaldd64.dll
2013-11-29 16:51 . 2013-11-29 16:51 14302208 ----a-w- c:\windows\SysWow64\aticaldd.dll
2013-11-29 16:42 . 2013-11-29 16:42 22156288 ----a-w- c:\windows\SysWow64\atioglxx.dll
2013-11-29 16:35 . 2013-11-29 16:35 442368 ----a-w- c:\windows\system32\atidemgy.dll
2013-11-29 16:35 . 2013-11-29 16:35 31232 ----a-w- c:\windows\system32\atimuixx.dll
2013-11-29 16:35 . 2013-11-29 16:35 585216 ----a-w- c:\windows\system32\atieclxx.exe
2013-11-29 16:34 . 2013-11-29 16:34 239616 ----a-w- c:\windows\system32\atiesrxx.exe
2013-11-29 16:33 . 2013-11-29 16:33 190976 ----a-w- c:\windows\system32\atitmm64.dll
2013-11-29 16:05 . 2013-11-29 16:05 1145344 ----a-w- c:\windows\system32\atiadlxx.dll
2013-11-29 16:04 . 2013-11-29 16:04 825856 ----a-w- c:\windows\SysWow64\atiadlxy.dll
2013-11-29 16:04 . 2013-11-29 16:04 74752 ----a-w- c:\windows\system32\atig6pxx.dll
2013-11-29 16:04 . 2013-11-29 16:04 69632 ----a-w- c:\windows\SysWow64\atiglpxx.dll
2013-11-29 16:04 . 2013-11-29 16:04 69632 ----a-w- c:\windows\system32\atiglpxx.dll
2013-11-29 16:04 . 2013-11-29 16:04 100352 ----a-w- c:\windows\system32\atig6txx.dll
2013-11-29 16:04 . 2013-11-29 16:04 96768 ----a-w- c:\windows\SysWow64\atigktxx.dll
2013-11-29 16:04 . 2013-11-29 16:04 624128 ----a-w- c:\windows\system32\drivers\atikmpag.sys
2013-11-29 16:00 . 2013-11-29 16:00 43520 ----a-w- c:\windows\system32\drivers\ati2erec.dll
2013-11-29 11:34 . 2013-11-29 11:34 51200 ----a-w- c:\windows\system32\kdbsdk64.dll
2013-11-29 11:29 . 2013-11-29 11:29 38912 ----a-w- c:\windows\SysWow64\kdbsdk32.dll
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-12-01 13:42 . 2012-09-16 14:49 90708896 ----a-w- c:\windows\system32\MRT.exe
2013-11-29 17:55 . 2011-12-06 02:11 143304 ----a-w- c:\windows\system32\atiuxp64.dll
2013-11-29 17:52 . 2011-12-06 03:16 1319064 ----a-w- c:\windows\system32\aticfx64.dll
2013-11-29 17:50 . 2011-12-06 02:51 9764088 ----a-w- c:\windows\system32\atidxx64.dll
2013-11-19 02:33 . 2012-09-16 13:42 267936 ------w- c:\windows\system32\MpSigStub.exe
2013-11-17 17:53 . 2012-09-16 16:01 71048 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-11-17 17:53 . 2012-09-16 16:01 692616 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2013-11-08 18:04 . 2012-09-16 14:02 419840 ----a-w- c:\windows\system32\wrap_oal.dll
2013-11-08 18:04 . 2012-09-16 14:02 413696 ----a-w- c:\windows\SysWow64\wrap_oal.dll
2013-11-08 18:04 . 2012-09-16 14:02 133632 ----a-w- c:\windows\system32\OpenAL32.dll
2013-11-08 18:04 . 2012-09-16 14:02 110592 ----a-w- c:\windows\SysWow64\OpenAL32.dll
2013-09-24 14:53 . 2013-09-24 14:53 94208 ----a-w- c:\windows\system32\drivers\AtihdW76.sys
2013-09-24 14:51 . 2013-09-24 14:51 110080 ----a-w- c:\windows\system32\DelayAPO.dll
2013-09-18 20:08 . 2013-09-18 20:08 94208 ----a-w- c:\windows\SysWow64\dpl100.dll
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1475584]
"NoSleep!"="d:\anwendungen\No Sleep\NoSleep_1.4.2.exe" [2012-09-16 374272]
"HydraVisionDesktopManager"="c:\program files (x86)\ATI Technologies\HydraVision\HydraDM.exe" [2011-12-05 393216]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"USB3MON"="c:\program files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe" [2012-01-26 291608]
"GDFirewallTray"="c:\program files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe" [2009-09-24 1124424]
"G DATA AntiVirus Trayapplication"="c:\program files (x86)\G Data\InternetSecurity\AVKTray\AVKTray.exe" [2009-09-18 924232]
"P17RunE"="P17RunE.dll" [2008-03-28 14848]
"RemoteControl11"="d:\anwendungen\PowerDVD 11\PowerDVD11\PDVD11Serv.exe" [2011-09-14 230696]
"NBAgent"="d:\anwendungen\Nero 11\Nero 11\Nero BackItUp\NBAgent.exe" [2011-11-18 1492264]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-04-04 958576]
"UpdReg"="c:\windows\UpdReg.EXE" [2000-05-11 90112]
"amd_dc_opt"="c:\program files (x86)\AMD\Dual-Core Optimizer\amd_dc_opt.exe" [2008-07-22 77824]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe" [2013-11-29 766208]
"DivXUpdate"="c:\program files (x86)\DivX\DivX Update\DivXUpdate.exe" [2013-08-29 1861968]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2013-04-21 59720]
"QuickTime Task"="d:\anwendungen\QuickTime\QTTask.exe" [2013-05-01 421888]
.
c:\users\Sebastian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Samsung Magician.lnk - c:\program files (x86)\Samsung SSD Magician\Samsung Magician.exe /AUTOHIDE [2013-12-12 4580256]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"EnableLinkedConnections"= 1 (0x1)
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 Intel(R) ME Service;Intel(R) ME Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [x]
R3 Creative Audio Engine Licensing Service;Creative Audio Engine Licensing Service;c:\program files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe;c:\program files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [x]
R3 ggflt;SEMC USB Flash Driver Filter;c:\windows\system32\DRIVERS\ggflt.sys;c:\windows\SYSNATIVE\DRIVERS\ggflt.sys [x]
R3 ose64;Office 64 Source Engine;c:\program files\Common Files\Microsoft Shared\Source Engine\OSE.EXE;c:\program files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]
R3 Sony PC Companion;Sony PC Companion;c:\program files (x86)\Sony\Sony PC Companion\PCCService.exe;c:\program files (x86)\Sony\Sony PC Companion\PCCService.exe [x]
R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys;c:\windows\SYSNATIVE\drivers\synth3dvsc.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys;c:\windows\SYSNATIVE\drivers\tsusbhub.sys [x]
R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys;c:\windows\SYSNATIVE\drivers\rdvgkmd.sys [x]
R4 sptd;sptd;c:\windows\\SystemRoot\System32\Drivers\sptd.sys;c:\windows\\SystemRoot\System32\Drivers\sptd.sys [x]
S0 AsrRamDisk;AsrRamDisk;c:\windows\system32\DRIVERS\AsrRamDisk.sys;c:\windows\SYSNATIVE\DRIVERS\AsrRamDisk.sys [x]
S0 GDBehave;GDBehave;c:\windows\system32\drivers\GDBehave.sys;c:\windows\SYSNATIVE\drivers\GDBehave.sys [x]
S0 iusb3hcs;Intel(R) USB 3.0 Hostcontroller-Switchtreiber;c:\windows\system32\DRIVERS\iusb3hcs.sys;c:\windows\SYSNATIVE\DRIVERS\iusb3hcs.sys [x]
S0 NBVol;Nero Backup Volume Filter Driver;c:\windows\system32\DRIVERS\NBVol.sys;c:\windows\SYSNATIVE\DRIVERS\NBVol.sys [x]
S0 NBVolUp;Nero Backup Volume Upper Filter Driver;c:\windows\system32\DRIVERS\NBVolUp.sys;c:\windows\SYSNATIVE\DRIVERS\NBVolUp.sys [x]
S1 gdwfpcd;G DATA WFP CD;c:\windows\system32\DRIVERS\gdwfpcd64.sys;c:\windows\SYSNATIVE\DRIVERS\gdwfpcd64.sys [x]
S1 GRD;G Data Rootkit Detector Driver;c:\windows\system32\drivers\GRD.sys;c:\windows\SYSNATIVE\drivers\GRD.sys [x]
S2 {329F96B6-DF1E-4328-BFDA-39EA953C1312};Power Control [2012/09/16 21:43];d:\anwendungen\PowerDVD 11\PowerDVD11\Common\NavFilter\000.fcl;d:\anwendungen\PowerDVD 11\PowerDVD11\Common\NavFilter\000.fcl [x]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe;c:\windows\SYSNATIVE\atiesrxx.exe [x]
S2 AVKProxy;G Data AntiVirus Proxy;c:\program files (x86)\Common Files\G DATA\AVKProxy\AVKProxy.exe;c:\program files (x86)\Common Files\G DATA\AVKProxy\AVKProxy.exe [x]
S2 AVKService;G Data Scheduler;c:\program files (x86)\G Data\InternetSecurity\AVK\AVKService.exe;c:\program files (x86)\G Data\InternetSecurity\AVK\AVKService.exe [x]
S2 AVKWCtl;G Data Dateisystem Wächter;c:\program files (x86)\G Data\InternetSecurity\AVK\AVKWCtlX64.exe;c:\program files (x86)\G Data\InternetSecurity\AVK\AVKWCtlX64.exe [x]
S2 CLHNServiceForPowerDVD;CLHNServiceForPowerDVD;d:\anwendungen\PowerDVD 11\PowerDVD11\Kernel\DMP\CLHNServiceForPowerDVD.exe;d:\anwendungen\PowerDVD 11\PowerDVD11\Kernel\DMP\CLHNServiceForPowerDVD.exe [x]
S2 CyberLink PowerDVD 11.0 Monitor Service;CyberLink PowerDVD 11.0 Monitor Service;d:\anwendungen\PowerDVD 11\PowerDVD11\Common\MediaServer\CLMSMonitorService.exe;d:\anwendungen\PowerDVD 11\PowerDVD11\Common\MediaServer\CLMSMonitorService.exe [x]
S2 CyberLink PowerDVD 11.0 Service;CyberLink PowerDVD 11.0 Service;d:\anwendungen\PowerDVD 11\PowerDVD11\Common\MediaServer\CLMSServerForPDVD11.exe;d:\anwendungen\PowerDVD 11\PowerDVD11\Common\MediaServer\CLMSServerForPDVD11.exe [x]
S2 Intel(R) Capability Licensing Service Interface;Intel(R) Capability Licensing Service Interface;c:\program files\Intel\iCLS Client\HeciServer.exe;c:\program files\Intel\iCLS Client\HeciServer.exe [x]
S2 jhi_service;Intel(R) Dynamic Application Loader Host Interface Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [x]
S2 NAUpdate;Nero Update;c:\program files (x86)\Nero\Update\NASvc.exe;c:\program files (x86)\Nero\Update\NASvc.exe [x]
S2 ntk_PowerDVD;ntk_PowerDVD;d:\anwendungen\PowerDVD 11\PowerDVD11\Kernel\DMP\ntk_PowerDVD_64.sys;d:\anwendungen\PowerDVD 11\PowerDVD11\Kernel\DMP\ntk_PowerDVD_64.sys [x]
S2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [x]
S3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys;c:\windows\SYSNATIVE\drivers\AtihdW76.sys [x]
S3 GDFwSvc;G Data Personal Firewall;c:\program files (x86)\G Data\InternetSecurity\Firewall\GDFwSvcx64.exe;c:\program files (x86)\G Data\InternetSecurity\Firewall\GDFwSvcx64.exe [x]
S3 GDMnIcpt;GDMnIcpt;c:\windows\system32\drivers\MiniIcpt.sys;c:\windows\SYSNATIVE\drivers\MiniIcpt.sys [x]
S3 GDPkIcpt;GDPkIcpt;c:\windows\system32\drivers\PktIcpt.sys;c:\windows\SYSNATIVE\drivers\PktIcpt.sys [x]
S3 GDScan;G Data Scanner;c:\program files (x86)\Common Files\G DATA\GDScan\GDScan.exe;c:\program files (x86)\Common Files\G DATA\GDScan\GDScan.exe [x]
S3 HookCentre;HookCentre;c:\windows\system32\drivers\HookCentre.sys;c:\windows\SYSNATIVE\drivers\HookCentre.sys [x]
S3 IntcDAud;Intel(R) Display-Audio;c:\windows\system32\DRIVERS\IntcDAud.sys;c:\windows\SYSNATIVE\DRIVERS\IntcDAud.sys [x]
S3 iusb3hub;Intel(R) USB 3.0-Hubtreiber;c:\windows\system32\DRIVERS\iusb3hub.sys;c:\windows\SYSNATIVE\DRIVERS\iusb3hub.sys [x]
S3 iusb3xhc;Intel(R) USB 3.0 eXtensible-Hostcontrollertreiber;c:\windows\system32\DRIVERS\iusb3xhc.sys;c:\windows\SYSNATIVE\DRIVERS\iusb3xhc.sys [x]
S3 MBfilt;MBfilt;c:\windows\system32\drivers\MBfilt64.sys;c:\windows\SYSNATIVE\drivers\MBfilt64.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
iissvcs REG_MULTI_SZ w3svc was
apphost REG_MULTI_SZ apphostsvc
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2011-03-04 10:29 451872 ----a-w- c:\program files (x86)\Common Files\LightScribe\LSRunOnce.exe
.
Inhalt des "geplante Tasks" Ordners
.
2013-12-15 c:\windows\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d-Logon.job
- c:\program files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\Bootstrap.exe [2011-11-25 11:41]
.
2013-12-14 c:\windows\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d.job
- c:\program files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\Bootstrap.exe [2011-11-25 11:41]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDVCPL"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2011-10-17 13307496]
"Launch LGDCore"="c:\program files\Common Files\Logitech\G-series Software\LGDCore.exe" [2006-07-23 1783296]
"BCSSync"="c:\program files\Microsoft Office\Office14\BCSSync.exe" [2012-11-05 108144]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2012-12-14 172144]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2012-12-14 399984]
"Persistence"="c:\windows\system32\igfxpers.exe" [2012-12-14 441968]
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: Nach Microsoft E&xcel exportieren - c:\progra~1\MICROS~2\Office14\EXCEL.EXE/3000
IE: {{77F665FD-3F60-4B0A-AE14-EC124B7A7FCE} - c:\program files (x86)\ICQ7.7\ICQ.exe
TCP: DhcpNameServer = 192.168.178.1
FF - ProfilePath - c:\users\Sebastian\AppData\Roaming\Mozilla\Firefox\Profiles\61u2bfgx.default\
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Wow6432Node-HKCU-Run-ASRockXTU - (no file)
HKLM-Run-Launch LCDMon - c:\program files\Common Files\Logitech\LCD Manager\lcdmon.exe
.
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\{329F96B6-DF1E-4328-BFDA-39EA953C1312}]
"ImagePath"="\??\d:\anwendungen\PowerDVD 11\PowerDVD11\Common\NavFilter\000.fcl"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_4_402_265_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_4_402_265_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_4_402_265_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_4_402_265_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_265.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_265.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_265.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_265.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2013-12-15 12:32:10
ComboFix-quarantined-files.txt 2013-12-15 11:32
.
Vor Suchlauf: 12 Verzeichnis(se), 60.065.288.192 Bytes frei
Nach Suchlauf: 17 Verzeichnis(se), 63.763.701.760 Bytes frei
.
- - End Of File - - 5EEBD8865B0AAE6889324449C310E1BB
A36C5E4F47E84449FF07ED3517B43A31
microLotz |
|
| Themen zu Windows 7 x64: Firefox öffnet selbstständig Downloadfenster und will Datei downloaden |
| antivirus, branding, computer, cpu, excel, firefox, flash player, helper, iexplore.exe, karte, launch, mozilla, programm, pup.optional.1clickdownload.a, pup.optional.atdhenettvap.a, realtek, required, rundll, scan, services.exe, sicherheitsexperten, software, usb, windows |
Hybrid-Darstellung
