| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Adserverplus und Adwcleaner lässt sich nicht startenWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
| |
28.01.2014, 10:37
| #1 |
| /// the machine /// TB-Ausbilder    |  Adserverplus und Adwcleaner lässt sich nicht starten hi, Scan mit Combofix
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
28.01.2014, 15:47
| #2 |
 | Adserverplus und Adwcleaner lässt sich nicht starten Hallo Schrauber, hier der Log, allerdings weiß ich mit den CodeTags jetzt nichts anzufangen und hoffe, es passt auch so.
__________________Es gab während der ComboFix - Scannung keinerlei Probleme mit Antivirenprogrammen o.ä., hatte alles abgeschaltet wie gewünscht. Hier der Log: Code:
ATTFilter ComboFix 14-01-27.02 - Michael 28.01.2014 13:47:21.1.2 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.49.1031.18.4095.2430 [GMT 1:00]
ausgeführt von:: c:\users\Michael\Desktop\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {17AD7D40-BA12-9C46-7131-94903A54AD8B}
SP: avast! Antivirus *Disabled/Updated* {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Michael\AppData\Roaming\inst.exe
c:\windows\IsUn0407.exe
.
.
((((((((((((((((((((((( Dateien erstellt von 2013-12-28 bis 2014-01-28 ))))))))))))))))))))))))))))))
.
.
2014-01-28 13:00 . 2014-01-28 13:00 -------- d-----w- c:\users\Default\AppData\Local\temp
2014-01-27 11:13 . 2014-01-27 11:13 -------- d-----w- C:\FRST
2014-01-26 22:37 . 2014-01-26 22:45 -------- d-----w- c:\users\Michael\AppData\Roaming\LavasoftStatistics
2014-01-26 22:30 . 2014-01-26 22:30 -------- d-----w- c:\programdata\Lavasoft
2014-01-26 18:23 . 2014-01-26 18:23 -------- d-----w- c:\program files (x86)\Mozilla Thunderbird
2014-01-26 18:15 . 2014-01-26 18:15 96168 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll
2014-01-26 17:32 . 2014-01-26 17:32 -------- d-----w- c:\users\Michael\AppData\Roaming\AVAST Software
2014-01-26 17:31 . 2014-01-26 17:31 80184 ----a-w- c:\windows\system32\drivers\aswStm.sys
2014-01-26 17:31 . 2014-01-26 17:31 207904 ----a-w- c:\windows\system32\drivers\aswVmm.sys
2014-01-26 17:31 . 2014-01-26 17:31 65776 ----a-w- c:\windows\system32\drivers\aswRvrt.sys
2014-01-26 17:31 . 2014-01-26 17:31 1038072 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2014-01-26 17:31 . 2014-01-26 17:31 421704 ----a-w- c:\windows\system32\drivers\aswSP.sys
2014-01-26 17:31 . 2014-01-26 17:31 78648 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2014-01-26 17:31 . 2014-01-26 17:31 92544 ----a-w- c:\windows\system32\drivers\aswRdr2.sys
2014-01-26 17:31 . 2014-01-26 17:31 334136 ----a-w- c:\windows\system32\aswBoot.exe
2014-01-26 17:31 . 2014-01-26 17:31 43152 ----a-w- c:\windows\avastSS.scr
2014-01-26 17:30 . 2014-01-26 17:30 -------- d-----w- c:\program files\AVAST Software
2014-01-26 17:28 . 2014-01-26 17:28 -------- d-----w- c:\programdata\AVAST Software
2014-01-25 12:52 . 2014-01-25 13:22 -------- d-----w- c:\users\Michael\DVD Oma Helga
2014-01-22 17:47 . 2014-01-25 19:47 -------- d-----w- c:\users\Michael\Z Amazon
2014-01-22 17:23 . 2014-01-22 17:24 -------- d-----w- c:\users\Michael\AppData\Local\Amazon Cloud Player
2014-01-11 09:46 . 2013-10-14 17:00 28368 ----a-w- c:\windows\system32\IEUDINIT.EXE
2014-01-11 09:30 . 2014-01-11 09:30 940032 ----a-w- c:\windows\system32\MsSpellCheckingFacility.exe
2014-01-11 09:30 . 2014-01-11 09:30 194048 ----a-w- c:\windows\SysWow64\elshyph.dll
2014-01-10 21:37 . 2013-11-23 18:26 417792 ----a-w- c:\windows\SysWow64\WMPhoto.dll
2014-01-10 21:37 . 2013-11-23 17:47 465920 ----a-w- c:\windows\system32\WMPhoto.dll
2014-01-10 21:37 . 2013-04-17 07:02 1230336 ----a-w- c:\windows\SysWow64\WindowsCodecs.dll
2014-01-10 21:37 . 2013-04-17 06:24 1424384 ----a-w- c:\windows\system32\WindowsCodecs.dll
2014-01-10 21:31 . 2014-01-25 12:38 -------- d-----w- c:\users\Michael\AppData\Local\Windows Live Writer
2014-01-10 21:31 . 2014-01-16 20:40 -------- d-----w- c:\users\Michael\AppData\Roaming\Windows Live Writer
2014-01-10 21:22 . 2014-01-10 21:22 -------- d-----w- c:\windows\de
2014-01-10 21:19 . 2013-02-05 21:06 57840 ----a-w- c:\windows\system32\drivers\fssfltr.sys
2014-01-10 21:16 . 2010-06-02 03:55 77656 ----a-w- c:\windows\system32\XAPOFX1_5.dll
2014-01-10 21:16 . 2010-06-02 03:55 74072 ----a-w- c:\windows\SysWow64\XAPOFX1_5.dll
2014-01-10 21:16 . 2010-06-02 03:55 527192 ----a-w- c:\windows\SysWow64\XAudio2_7.dll
2014-01-10 21:16 . 2010-06-02 03:55 518488 ----a-w- c:\windows\system32\XAudio2_7.dll
2014-01-10 21:16 . 2010-05-26 10:41 2526056 ----a-w- c:\windows\system32\D3DCompiler_43.dll
2014-01-10 21:16 . 2010-05-26 10:41 276832 ----a-w- c:\windows\system32\d3dx11_43.dll
2014-01-10 21:15 . 2009-09-04 16:29 453456 ----a-w- c:\windows\SysWow64\d3dx10_42.dll
2014-01-10 21:15 . 2009-09-04 16:29 523088 ----a-w- c:\windows\system32\d3dx10_42.dll
2014-01-10 21:13 . 2006-11-29 12:06 4398360 ----a-w- c:\windows\system32\d3dx9_32.dll
2014-01-10 21:13 . 2006-11-29 12:06 3426072 ----a-w- c:\windows\SysWow64\d3dx9_32.dll
2014-01-10 21:11 . 2014-01-10 21:11 94040 ----a-w- c:\program files (x86)\Common Files\Windows Live\.cache\92c221801cf0e4803\DSETUP.dll
2014-01-10 21:11 . 2014-01-10 21:11 525656 ----a-w- c:\program files (x86)\Common Files\Windows Live\.cache\92c221801cf0e4803\DXSETUP.exe
2014-01-10 21:11 . 2014-01-10 21:11 1691480 ----a-w- c:\program files (x86)\Common Files\Windows Live\.cache\92c221801cf0e4803\dsetup32.dll
2014-01-10 21:11 . 2014-01-10 21:11 89944 ----a-w- c:\program files (x86)\Common Files\Windows Live\.cache\907fb3601cf0e4802\DSETUP.dll
2014-01-10 21:11 . 2014-01-10 21:11 537432 ----a-w- c:\program files (x86)\Common Files\Windows Live\.cache\907fb3601cf0e4802\DXSETUP.exe
2014-01-10 21:11 . 2014-01-10 21:11 1801048 ----a-w- c:\program files (x86)\Common Files\Windows Live\.cache\907fb3601cf0e4802\dsetup32.dll
2014-01-10 21:11 . 2014-01-10 21:11 89944 ----a-w- c:\program files (x86)\Common Files\Windows Live\.cache\8e635b401cf0e4801\DSETUP.dll
2014-01-10 21:11 . 2014-01-10 21:11 537432 ----a-w- c:\program files (x86)\Common Files\Windows Live\.cache\8e635b401cf0e4801\DXSETUP.exe
2014-01-10 21:11 . 2014-01-10 21:11 1801048 ----a-w- c:\program files (x86)\Common Files\Windows Live\.cache\8e635b401cf0e4801\dsetup32.dll
2014-01-10 21:11 . 2014-01-25 12:40 -------- d-----w- c:\users\Michael\AppData\Local\Windows Live
2014-01-07 15:47 . 2014-01-27 10:08 -------- d-----r- c:\users\Michael\Vaso unrein
2014-01-03 22:12 . 2014-01-03 22:12 -------- d-----w- c:\windows\SysWow64\wbem\en-US
2014-01-03 22:12 . 2014-01-03 22:12 -------- d-----w- c:\windows\system32\wbem\en-US
2014-01-03 21:34 . 2013-05-10 05:56 12625920 ----a-w- c:\windows\system32\wmploc.DLL
2014-01-03 21:34 . 2013-05-10 04:30 167424 ----a-w- c:\program files\Windows Media Player\wmplayer.exe
2014-01-03 21:34 . 2013-05-10 03:48 164864 ----a-w- c:\program files (x86)\Windows Media Player\wmplayer.exe
2014-01-03 21:34 . 2013-05-10 04:56 12625408 ----a-w- c:\windows\SysWow64\wmploc.DLL
2014-01-03 21:34 . 2013-05-10 05:56 14631424 ----a-w- c:\windows\system32\wmp.dll
2014-01-03 20:51 . 2012-07-26 07:46 2560 ----a-w- c:\windows\system32\drivers\de-DE\wdf01000.sys.mui
2014-01-03 19:48 . 2014-01-03 19:51 -------- d-----w- c:\windows\system32\MRT
2014-01-03 19:38 . 2013-06-15 04:32 39936 ----a-w- c:\windows\system32\drivers\tssecsrv.sys
2014-01-03 19:38 . 2013-09-08 02:30 1903552 ----a-w- c:\windows\system32\drivers\tcpip.sys
2014-01-03 19:38 . 2013-09-08 02:27 327168 ----a-w- c:\windows\system32\mswsock.dll
2014-01-03 19:38 . 2013-09-08 02:03 231424 ----a-w- c:\windows\SysWow64\mswsock.dll
2014-01-03 19:38 . 2013-10-04 02:16 116736 ----a-w- c:\windows\system32\drivers\drmk.sys
2014-01-03 19:38 . 2013-10-04 01:36 230400 ----a-w- c:\windows\system32\drivers\portcls.sys
2014-01-03 19:35 . 2013-02-15 06:06 3717632 ----a-w- c:\windows\system32\mstscax.dll
2014-01-03 19:35 . 2013-02-15 04:37 3217408 ----a-w- c:\windows\SysWow64\mstscax.dll
2014-01-03 19:35 . 2013-02-15 06:02 158720 ----a-w- c:\windows\system32\aaclient.dll
2014-01-03 19:35 . 2013-02-15 04:34 131584 ----a-w- c:\windows\SysWow64\aaclient.dll
2014-01-03 19:35 . 2013-02-15 06:08 44032 ----a-w- c:\windows\system32\tsgqec.dll
2014-01-03 19:35 . 2013-02-15 03:25 36864 ----a-w- c:\windows\SysWow64\tsgqec.dll
2014-01-03 19:34 . 2013-03-31 22:52 1887232 ----a-w- c:\windows\system32\d3d11.dll
2014-01-03 19:34 . 2013-04-25 23:30 1505280 ----a-w- c:\windows\SysWow64\d3d11.dll
2014-01-03 19:34 . 2013-07-09 05:51 1217024 ----a-w- c:\windows\system32\rpcrt4.dll
2014-01-03 19:34 . 2013-07-09 04:52 663552 ----a-w- c:\windows\SysWow64\rpcrt4.dll
2014-01-03 19:34 . 2013-04-12 14:45 1656680 ----a-w- c:\windows\system32\drivers\ntfs.sys
2014-01-03 19:32 . 2013-02-27 06:02 111448 ----a-w- c:\windows\system32\consent.exe
2014-01-03 19:32 . 2013-02-27 05:47 70144 ----a-w- c:\windows\system32\appinfo.dll
2014-01-03 19:32 . 2013-06-25 22:55 785624 ----a-w- c:\windows\system32\drivers\Wdf01000.sys
2014-01-03 19:32 . 2012-11-28 22:56 9728 ----a-w- c:\windows\system32\Wdfres.dll
2014-01-03 19:32 . 2012-11-28 22:56 54376 ----a-w- c:\windows\system32\drivers\WdfLdr.sys
2014-01-03 19:31 . 2013-07-09 05:52 224256 ----a-w- c:\windows\system32\wintrust.dll
2014-01-03 19:31 . 2013-07-09 04:52 175104 ----a-w- c:\windows\SysWow64\wintrust.dll
2014-01-03 19:29 . 2012-12-07 11:20 43520 ----a-w- c:\windows\system32\csrr.rs
2014-01-03 19:28 . 2012-12-07 11:19 20480 ----a-w- c:\windows\system32\pegi.rs
2014-01-03 19:27 . 2012-11-01 04:47 1236992 ----a-w- c:\windows\SysWow64\msxml3.dll
2014-01-03 19:27 . 2010-06-26 03:55 2048 ----a-w- c:\windows\system32\msxml3r.dll
2014-01-03 19:27 . 2010-06-26 03:24 2048 ----a-w- c:\windows\SysWow64\msxml3r.dll
2014-01-03 19:27 . 2013-07-04 12:57 259584 ----a-w- c:\windows\system32\WebClnt.dll
2014-01-03 19:27 . 2013-07-04 12:50 102400 ----a-w- c:\windows\system32\davclnt.dll
2014-01-03 19:27 . 2013-07-04 11:57 205824 ----a-w- c:\windows\SysWow64\WebClnt.dll
2014-01-03 19:27 . 2013-07-04 11:51 81920 ----a-w- c:\windows\SysWow64\davclnt.dll
2014-01-03 19:27 . 2013-07-04 10:11 140800 ----a-w- c:\windows\system32\drivers\mrxdav.sys
2014-01-03 19:25 . 2014-01-03 19:25 -------- d-----w- c:\program files\Microsoft Silverlight
2014-01-03 19:25 . 2014-01-03 19:25 -------- d-----w- c:\program files (x86)\Microsoft Silverlight
2014-01-03 19:25 . 2013-03-19 05:53 48640 ----a-w- c:\windows\system32\wwanprotdim.dll
2014-01-03 19:25 . 2013-03-19 05:53 230400 ----a-w- c:\windows\system32\wwansvc.dll
2014-01-03 19:24 . 2013-10-05 20:25 1474048 ----a-w- c:\windows\system32\crypt32.dll
2014-01-03 19:24 . 2013-10-05 19:57 1168384 ----a-w- c:\windows\SysWow64\crypt32.dll
2014-01-03 19:24 . 2013-07-09 05:46 184320 ----a-w- c:\windows\system32\cryptsvc.dll
2014-01-03 19:24 . 2013-07-09 05:46 139776 ----a-w- c:\windows\system32\cryptnet.dll
2014-01-03 19:24 . 2013-07-09 04:46 140288 ----a-w- c:\windows\SysWow64\cryptsvc.dll
2014-01-03 19:24 . 2013-07-09 04:46 103936 ----a-w- c:\windows\SysWow64\cryptnet.dll
2014-01-03 19:23 . 2013-10-04 02:28 190464 ----a-w- c:\windows\system32\SmartcardCredentialProvider.dll
2014-01-03 19:23 . 2013-10-04 02:25 197120 ----a-w- c:\windows\system32\credui.dll
2014-01-03 19:23 . 2013-10-04 02:24 1930752 ----a-w- c:\windows\system32\authui.dll
2014-01-03 19:23 . 2013-10-04 01:58 152576 ----a-w- c:\windows\SysWow64\SmartcardCredentialProvider.dll
2014-01-03 19:23 . 2013-10-04 01:56 168960 ----a-w- c:\windows\SysWow64\credui.dll
2014-01-03 19:23 . 2013-10-04 01:56 1796096 ----a-w- c:\windows\SysWow64\authui.dll
2014-01-03 19:21 . 2012-11-22 05:44 800768 ----a-w- c:\windows\system32\usp10.dll
2014-01-03 19:21 . 2012-11-22 04:45 626688 ----a-w- c:\windows\SysWow64\usp10.dll
2014-01-03 19:21 . 2013-09-28 01:09 497152 ----a-w- c:\windows\system32\drivers\afd.sys
2014-01-03 19:21 . 2013-11-12 02:23 2048 ----a-w- c:\windows\system32\tzres.dll
2014-01-03 19:21 . 2013-11-12 02:07 2048 ----a-w- c:\windows\SysWow64\tzres.dll
2014-01-03 19:21 . 2013-10-30 02:32 335360 ----a-w- c:\windows\system32\msieftp.dll
2014-01-03 19:21 . 2013-10-30 02:19 301568 ----a-w- c:\windows\SysWow64\msieftp.dll
2014-01-03 19:21 . 2013-07-12 10:41 185344 ----a-w- c:\windows\system32\drivers\usbvideo.sys
2014-01-03 19:21 . 2013-07-12 10:41 100864 ----a-w- c:\windows\system32\drivers\usbcir.sys
2014-01-03 19:21 . 2013-07-12 10:40 109824 ----a-w- c:\windows\system32\drivers\USBAUDIO.sys
2014-01-03 19:21 . 2013-08-05 02:25 155584 ----a-w- c:\windows\system32\drivers\ataport.sys
2014-01-03 19:20 . 2013-07-03 04:40 42496 ----a-w- c:\windows\system32\drivers\usbscan.sys
2014-01-03 19:20 . 2013-07-03 04:05 76800 ----a-w- c:\windows\system32\drivers\hidclass.sys
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-01-26 17:56 . 2013-01-29 09:42 692616 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2014-01-26 17:56 . 2011-08-17 17:38 71048 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2014-01-10 21:18 . 2012-07-17 13:37 22240 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
2013-12-26 12:38 . 2013-12-26 12:38 7123640 ----a-w- C:\fdminst.exe
2013-12-01 13:42 . 2011-12-30 00:58 90708896 ----a-w- c:\windows\system32\MRT.exe
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SSync"="c:\users\Michael\AppData\Roaming\SSync\SSync.exe" [2013-04-09 36864]
"DataMgr"="c:\users\Michael\AppData\Roaming\DataMgr\DataMgr.exe" [2013-06-26 168848]
"SCheck"="c:\users\Michael\AppData\Roaming\SCheck\SCheck.exe" [2013-12-09 37376]
"Intermediate"="c:\users\Michael\AppData\Roaming\Intermediate\Intermediate.exe" [2013-12-09 37376]
"Amazon Cloud Player"="c:\users\Michael\AppData\Local\Amazon Cloud Player\Amazon Music Helper.exe" [2014-01-14 3140608]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"F-Secure Manager"="c:\program files (x86)\F-Secure\apps\ComputerSecurity\Common\FSM32.EXE" [2011-10-04 311976]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2013-04-21 59720]
"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2013-05-08 41056]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-04-04 958576]
"ControlCenter3"="c:\program files (x86)\Brother\ControlCenter3\brctrcen.exe" [2008-12-24 114688]
"BrStsMon00"="c:\program files (x86)\Browny02\Brother\BrStMonW.exe" [2010-02-09 2621440]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2013-09-17 152392]
"AvastUI.exe"="c:\program files\AVAST Software\Avast\AvastUI.exe" [2014-01-26 3767096]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2013-07-02 254336]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux4"=wdmaud.drv
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [x]
R3 aswStm;aswStm;c:\windows\system32\drivers\aswStm.sys;c:\windows\SYSNATIVE\drivers\aswStm.sys [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 pcouffin;VSO Software pcouffin;c:\windows\system32\Drivers\pcouffin.sys;c:\windows\SYSNATIVE\Drivers\pcouffin.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys;c:\windows\SYSNATIVE\Drivers\usbaapl64.sys [x]
S0 aswRvrt;avast! Revert; [x]
S0 aswVmm;avast! VM Monitor; [x]
S1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys;c:\windows\SYSNATIVE\drivers\aswSnx.sys [x]
S1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys;c:\windows\SYSNATIVE\drivers\aswSP.sys [x]
S1 F-Secure HIPS;F-Secure HIPS Driver;c:\program files (x86)\F-Secure\apps\ComputerSecurity\HIPS\drivers\fshs.sys;c:\program files (x86)\F-Secure\apps\ComputerSecurity\HIPS\drivers\fshs.sys [x]
S1 fsvista;F-Secure Vista Support Driver;c:\program files (x86)\F-Secure\apps\ComputerSecurity\Anti-Virus\minifilter\fsvista.sys;c:\program files (x86)\F-Secure\apps\ComputerSecurity\Anti-Virus\minifilter\fsvista.sys [x]
S2 {1BA31E5A-C098-42d8-8F88-3C9F78A2FDDC};Power Control [2011/01/22 11:13];c:\program files (x86)\CyberLink\PowerDVD10\NavFilter\000.fcl;c:\program files (x86)\CyberLink\PowerDVD10\NavFilter\000.fcl [x]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe;c:\windows\SYSNATIVE\atiesrxx.exe [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys;c:\windows\SYSNATIVE\drivers\aswMonFlt.sys [x]
S2 MBAMScheduler;MBAMScheduler;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [x]
S3 BrYNSvc;BrYNSvc;c:\program files (x86)\Browny02\BrYNSvc.exe;c:\program files (x86)\Browny02\BrYNSvc.exe [x]
S3 F-Secure Gatekeeper;F-Secure Gatekeeper;c:\program files (x86)\F-Secure\apps\ComputerSecurity\Anti-Virus\minifilter\fsgk.sys;c:\program files (x86)\F-Secure\apps\ComputerSecurity\Anti-Virus\minifilter\fsgk.sys [x]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys;c:\windows\SYSNATIVE\drivers\mbam.sys [x]
S3 MTSBDA;TechniSat SkyStar HD2;c:\windows\system32\Drivers\MtsBda.sys;c:\windows\SYSNATIVE\Drivers\MtsBda.sys [x]
S3 MtsHID;TechniSat Mantis BDA HID Driver;c:\windows\system32\drivers\MtsHID.sys;c:\windows\SYSNATIVE\drivers\MtsHID.sys [x]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*Deregistered* - eeCtrl
*Deregistered* - EraserUtilRebootDrv
.
Inhalt des "geplante Tasks" Ordners
.
2014-01-27 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-01-29 17:56]
.
2014-01-28 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-01-08 07:14]
.
2014-01-28 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-01-08 07:14]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2014-01-26 17:31 287280 ----a-w- c:\program files\AVAST Software\Avast\ashShA64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2009-10-06 8158240]
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://trapeze.erfurter-bahn.de/
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
IE: {{EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} -
TCP: DhcpNameServer = 192.168.178.1
FF - ProfilePath - c:\users\Michael\AppData\Roaming\Mozilla\Firefox\Profiles\0ibqc6mr.default-1388339420361\
FF - prefs.js: browser.search.defaulturl - hxxp://wisersearch.com/search.php?channel=de&q=
FF - prefs.js: browser.startup.homepage - hxxp://web.de/
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
BHO-{EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - (no file)
Toolbar-10 - (no file)
Wow6432Node-HKCU-Run-Device Detection - c:\program files (x86)\Lidl_Fotos\dd.exe
Wow6432Node-HKLM-Run-Conime - c:\windows\system32\conime.exe
Wow6432Node-HKU-Default-RunOnce-KodakHomeCenter - c:\program files (x86)\Kodak\AiO\Center\AiOHomeCenter.exe
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
BHO-{EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - (no file)
Toolbar-10 - (no file)
WebBrowser-{40C3CC16-7269-4B32-9531-17F2950FB06F} - (no file)
AddRemove-Adobe Photoshop 6.0 - c:\windows\ISUN0407.EXE
AddRemove-dBpoweramp Music Converter - c:\windows\system32\SpoonUninstall.exe
AddRemove-FileKiddo Download Manager_is1 - c:\program files (x86)\FileKiddo Download Manager\uninstall.exe
AddRemove-Free Audio CD Burner_is1 - c:\program files (x86)\DVDVideoSoft\Free Audio CD Burner\unins000.exe
AddRemove-Micky auf Ganovenjagd - c:\windows\IsUn0407.exe
AddRemove-TinyTiger - c:\tt2\Uninst.isu
AddRemove-Trillian - c:\program files (x86)\Trillian\Trillian.exe
AddRemove-Uninstall_is1 - c:\program files (x86)\Common Files\DVDVideoSoft\unins000.exe
.
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\{1BA31E5A-C098-42d8-8F88-3C9F78A2FDDC}]
"ImagePath"="\??\c:\program files (x86)\CyberLink\PowerDVD10\NavFilter\000.fcl"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE09CC1-42E0-11DD-AE16-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\windows\\system32\\Macromed\\Flash\\FlashUtil10b.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE09CC1-42E0-11DD-AE16-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE09CC1-42E0-11DD-AE16-0800200C9A66}\LocalServer32]
@="c:\\windows\\SysWow64\\Macromed\\Flash\\FlashUtil10b.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE09CC1-42E0-11DD-AE16-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\windows\\SysWow64\\Macromed\\Flash\\Flash10b.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\windows\\SysWow64\\Macromed\\Flash\\Flash10b.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\windows\\SysWow64\\Macromed\\Flash\\Flash10b.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\windows\\SysWow64\\Macromed\\Flash\\Flash10b.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{DDF4CE26-4BDA-42BC-B0F0-0E75243AD285}]
@Denied: (A 2) (Everyone)
@="IFlashBroker2"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{DDF4CE26-4BDA-42BC-B0F0-0E75243AD285}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{DDF4CE26-4BDA-42BC-B0F0-0E75243AD285}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2014-01-28 14:09:59
ComboFix-quarantined-files.txt 2014-01-28 13:09
.
Vor Suchlauf: 16 Verzeichnis(se), 33.155.186.688 Bytes frei
Nach Suchlauf: 24 Verzeichnis(se), 34.453.151.744 Bytes frei
.
- - End Of File - - CB6361AFEB17E243ED525276C06B1884
A36C5E4F47E84449FF07ED3517B43A31
Diese eine Datei oben gleich c:\users\Michael\AppData\Roaming\inst.exe ist mir glaube schonmal aufgefallen beim Scannen mit Malwarebytes, bevor ich mich ans Forum gewendet habe. Klingt irgendwie gefährlich?! Nette Grüße, Michal Kurzer Nachtrag: Irgendwie scheint das Combofix - Programm schon erfolgreich gewesen zu sein? Auf den besuchten Internetseiten öffnen sich nun gar nicht mehr diese ominösen Fensterchen (welche sogar im Trojaner-Board fast wie gewollt in die Beiträge eingebettet waren)...? Wäre ja TOP! Gruß Michal |
|
| Themen zu Adserverplus und Adwcleaner lässt sich nicht starten |
| anhang, antivirus, avast, erneut, firewall, forum, kostenlos, mail, malwarebytes, meldung, nichts, norton, offline, ordner, popups, problem, programm, scan, scanner, seite, sekunden, speicher, speichern, starten, virenscanner, ändern |
WARNUNG an die MITLESER: 
Hybrid-Darstellung
