| |
| |||||||
Log-Analyse und Auswertung: Notebook wird im Laufe der Zeit immer langsamerWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
02.03.2014, 20:43
| #5 |
| |  Notebook wird im Laufe der Zeit immer langsamer hu! Ok, erst mal noch ne Frage: Was war/ist denn nun mit MyWinLocker? Verstehe die Frage weiterhin leider nicht. Combofix hat lediglich eine Frage gestellt, die sich auf ein Ablaufdatum bezog, danach aber seinen Dienst (zumindest für mich so ersichtlich) getan. Hier das Ergebnis: Code:
ATTFilter ComboFix 14-02-24.02 - xxx 02.03.2014 20:30:00.1.4 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.49.1031.18.8044.6188 [GMT 1:00]
ausgeführt von:: c:\users\xxx\Desktop\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {4D041356-F94D-285F-8768-AAE50FA36859}
SP: Avira Desktop *Disabled/Updated* {F665F2B2-DF77-27D1-BDD8-9197742422E4}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
- REDUZIERTER FUNKTIONALITÄTSMODUS -
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\END
c:\users\xxx\AppData\Local\Temp\avgnt.exe\Avira.OE.ExtApi.dll
c:\users\VOLKER~1\AppData\Local\Temp\avgnt.exe\Avira.OE.ExtApi.dll
.
.
((((((((((((((((((((((( Dateien erstellt von 2014-02-02 bis 2014-03-02 ))))))))))))))))))))))))))))))
.
.
2014-03-02 19:31 . 2014-03-02 19:31 -------- d-----w- c:\users\Default\AppData\Local\temp
2014-03-02 13:15 . 2014-03-02 13:16 -------- d-----w- c:\users\xxx\AppData\Local\{600FEB10-4490-4F10-A35A-044E856014DC}
2014-03-01 15:49 . 2014-03-01 15:49 84720 ----a-w- c:\windows\system32\drivers\avnetflt.sys
2014-03-01 15:43 . 2014-03-01 15:43 -------- d-----w- c:\users\xxx\AppData\Roaming\Avira
2014-03-01 15:42 . 2014-02-14 10:00 28600 ----a-w- c:\windows\system32\drivers\avkmgr.sys
2014-03-01 15:42 . 2014-02-14 10:00 131576 ----a-w- c:\windows\system32\drivers\avipbb.sys
2014-03-01 15:42 . 2014-02-14 10:00 108440 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2014-03-01 15:35 . 2014-03-01 15:42 -------- d-----w- c:\program files (x86)\Avira
2014-03-01 15:34 . 2014-03-01 15:34 -------- d-----w- c:\programdata\Package Cache
2014-03-01 13:07 . 2014-03-01 13:08 -------- d-----w- C:\FRST
2014-03-01 12:51 . 2014-03-01 12:51 -------- d-----w- c:\windows\Migration
2014-03-01 07:20 . 2014-02-06 09:01 10536864 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{E8C9EB47-A6C4-4F2D-B274-7D6471D8CD11}\mpengine.dll
2014-02-21 16:05 . 2014-02-21 16:05 -------- d-----w- c:\users\xxx\AppData\Local\{5997FF15-E4A4-420D-81D1-23D1716133E6}
2014-02-20 20:13 . 2014-02-20 20:13 -------- d-----w- c:\users\xxx\AppData\Local\{ACB29AF5-CE9C-4928-852F-CE7E96003B13}
2014-02-19 21:44 . 2014-02-19 21:44 -------- d-----w- c:\users\xxx\AppData\Local\{3FE5F4E9-B490-4BD1-8881-C8096862E03C}
2014-02-18 18:03 . 2014-02-18 18:03 -------- d-----w- c:\users\xxx\AppData\Local\{D2CDD53B-689A-4792-A0DA-1A0DE3875E95}
2014-02-16 15:42 . 2014-02-16 15:42 -------- d-----w- c:\users\xxx\AppData\Local\{4BF32159-1A80-4C63-B340-5A12452C5BDA}
2014-02-13 19:13 . 2014-02-13 19:13 -------- d-----w- c:\users\xxx\AppData\Local\{97F3F0A4-5869-41FD-9574-196DB4DFFCE6}
2014-02-12 20:56 . 2013-12-21 09:53 548864 ----a-w- c:\windows\system32\vbscript.dll
2014-02-12 20:56 . 2013-12-21 08:56 454656 ----a-w- c:\windows\SysWow64\vbscript.dll
2014-02-12 16:31 . 2013-12-06 02:30 1882112 ----a-w- c:\windows\system32\msxml3.dll
2014-02-12 16:21 . 2014-02-12 16:22 -------- d-----w- c:\users\xxx\AppData\Local\{AF068FA4-0453-4D8F-919E-7BCCD188F6DD}
2014-02-02 21:28 . 2014-02-02 21:28 -------- d-----w- c:\programdata\34BE82C4-E596-4e99-A191-52C6199EBF69
2014-02-02 21:28 . 2014-02-02 21:28 -------- d-----w- c:\program files\iTunes
2014-02-02 21:28 . 2014-02-02 21:28 -------- d-----w- c:\program files (x86)\iTunes
2014-02-02 21:28 . 2014-02-02 21:28 -------- d-----w- c:\program files\iPod
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-02-17 21:01 . 2012-01-09 20:57 88567024 ----a-w- c:\windows\system32\MRT.exe
2013-12-18 05:13 . 2010-11-21 03:27 270496 ------w- c:\windows\system32\MpSigStub.exe
2013-12-08 08:59 . 2013-12-08 08:59 940032 ----a-w- c:\windows\system32\MsSpellCheckingFacility.exe
2013-12-08 08:59 . 2013-12-08 08:59 194048 ----a-w- c:\windows\SysWow64\elshyph.dll
2013-12-08 08:59 . 2013-12-08 08:59 235008 ----a-w- c:\windows\system32\elshyph.dll
2013-12-08 08:59 . 2013-12-08 08:59 71680 ----a-w- c:\windows\SysWow64\RegisterIEPKEYs.exe
2013-12-08 08:59 . 2013-12-08 08:59 645120 ----a-w- c:\windows\SysWow64\jsIntl.dll
2013-12-08 08:59 . 2013-12-08 08:59 62464 ----a-w- c:\windows\SysWow64\tdc.ocx
2013-12-08 08:59 . 2013-12-08 08:59 34816 ----a-w- c:\windows\SysWow64\JavaScriptCollectionAgent.dll
2013-12-08 08:59 . 2013-12-08 08:59 337408 ----a-w- c:\windows\SysWow64\html.iec
2013-12-08 08:59 . 2013-12-08 08:59 182272 ----a-w- c:\windows\SysWow64\msls31.dll
2013-12-08 08:59 . 2013-12-08 08:59 61952 ----a-w- c:\windows\SysWow64\MshtmlDac.dll
2013-12-08 08:59 . 2013-12-08 08:59 36352 ----a-w- c:\windows\SysWow64\imgutil.dll
2013-12-08 08:59 . 2013-12-08 08:59 24576 ----a-w- c:\windows\SysWow64\licmgr10.dll
2013-12-08 08:59 . 2013-12-08 08:59 151552 ----a-w- c:\windows\SysWow64\iexpress.exe
2013-12-08 08:59 . 2013-12-08 08:59 139264 ----a-w- c:\windows\SysWow64\wextract.exe
2013-12-08 08:59 . 2013-12-08 08:59 13312 ----a-w- c:\windows\SysWow64\mshta.exe
2013-12-08 08:59 . 2013-12-08 08:59 1051136 ----a-w- c:\windows\SysWow64\mshtmlmedia.dll
2013-12-08 08:59 . 2013-12-08 08:59 942592 ----a-w- c:\windows\system32\jsIntl.dll
2013-12-08 08:59 . 2013-12-08 08:59 90112 ----a-w- c:\windows\system32\SetIEInstalledDate.exe
2013-12-08 08:59 . 2013-12-08 08:59 86016 ----a-w- c:\windows\SysWow64\iesysprep.dll
2013-12-08 08:59 . 2013-12-08 08:59 86016 ----a-w- c:\windows\system32\RegisterIEPKEYs.exe
2013-12-08 08:59 . 2013-12-08 08:59 84992 ----a-w- c:\windows\system32\mshtmled.dll
2013-12-08 08:59 . 2013-12-08 08:59 81408 ----a-w- c:\windows\system32\icardie.dll
2013-12-08 08:59 . 2013-12-08 08:59 77312 ----a-w- c:\windows\system32\tdc.ocx
2013-12-08 08:59 . 2013-12-08 08:59 74240 ----a-w- c:\windows\SysWow64\SetIEInstalledDate.exe
2013-12-08 08:59 . 2013-12-08 08:59 616104 ----a-w- c:\windows\system32\ieapfltr.dat
2013-12-08 08:59 . 2013-12-08 08:59 52224 ----a-w- c:\windows\system32\msfeedsbs.dll
2013-12-08 08:59 . 2013-12-08 08:59 48640 ----a-w- c:\windows\SysWow64\mshtmler.dll
2013-12-08 08:59 . 2013-12-08 08:59 48640 ----a-w- c:\windows\system32\mshtmler.dll
2013-12-08 08:59 . 2013-12-08 08:59 453120 ----a-w- c:\windows\system32\dxtmsft.dll
2013-12-08 08:59 . 2013-12-08 08:59 413696 ----a-w- c:\windows\system32\html.iec
2013-12-08 08:59 . 2013-12-08 08:59 40448 ----a-w- c:\windows\system32\JavaScriptCollectionAgent.dll
2013-12-08 08:59 . 2013-12-08 08:59 30208 ----a-w- c:\windows\system32\licmgr10.dll
2013-12-08 08:59 . 2013-12-08 08:59 296960 ----a-w- c:\windows\system32\dxtrans.dll
2013-12-08 08:59 . 2013-12-08 08:59 263376 ----a-w- c:\windows\system32\iedkcs32.dll
2013-12-08 08:59 . 2013-12-08 08:59 247808 ----a-w- c:\windows\system32\msls31.dll
2013-12-08 08:59 . 2013-12-08 08:59 243200 ----a-w- c:\windows\system32\webcheck.dll
2013-12-08 08:59 . 2013-12-08 08:59 235520 ----a-w- c:\windows\system32\url.dll
2013-12-08 08:59 . 2013-12-08 08:59 167424 ----a-w- c:\windows\system32\iexpress.exe
2013-12-08 08:59 . 2013-12-08 08:59 143872 ----a-w- c:\windows\system32\wextract.exe
2013-12-08 08:59 . 2013-12-08 08:59 13312 ----a-w- c:\windows\system32\msfeedssync.exe
2013-12-08 08:59 . 2013-12-08 08:59 131072 ----a-w- c:\windows\system32\IEAdvpack.dll
2013-12-08 08:59 . 2013-12-08 08:59 1228800 ----a-w- c:\windows\system32\mshtmlmedia.dll
2013-12-08 08:59 . 2013-12-08 08:59 111616 ----a-w- c:\windows\SysWow64\IEAdvpack.dll
2013-12-08 08:59 . 2013-12-08 08:59 105984 ----a-w- c:\windows\system32\iesysprep.dll
2013-12-08 08:59 . 2013-12-08 08:59 101376 ----a-w- c:\windows\system32\inseng.dll
2013-12-08 08:59 . 2013-12-08 08:59 83968 ----a-w- c:\windows\system32\MshtmlDac.dll
2013-12-08 08:59 . 2013-12-08 08:59 774144 ----a-w- c:\windows\system32\jscript.dll
2013-12-08 08:59 . 2013-12-08 08:59 62464 ----a-w- c:\windows\system32\pngfilt.dll
2013-12-08 08:59 . 2013-12-08 08:59 48128 ----a-w- c:\windows\system32\imgutil.dll
2013-12-08 08:59 . 2013-12-08 08:59 147968 ----a-w- c:\windows\system32\occache.dll
2013-12-08 08:59 . 2013-12-08 08:59 13824 ----a-w- c:\windows\system32\mshta.exe
2013-12-08 08:59 . 2013-12-08 08:59 135680 ----a-w- c:\windows\system32\iepeers.dll
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpybotSD TeaTimer"="c:\program files (x86)\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"LManager"="c:\program files (x86)\Launch Manager\LManager.exe" [2011-07-01 1103440]
"NUSB3MON"="c:\program files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe" [2010-11-17 113288]
"IAStorIcon"="c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe" [2011-01-12 283160]
"Avira Systray"="c:\program files (x86)\Avira\My Avira\Avira.OE.Systray.exe" [2014-02-24 172624]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2014-02-14 689744]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"IsMyWinLockerReboot"="msiexec.exe" [2010-11-21 73216]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Userinit"="userinit.exe"
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\run-]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe"
"BackupManagerTray"="c:\program files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe" -h -k
"Dolby Advanced Audio v2"="c:\dolby pcee4\pcee4.exe" -autostart
"PDFPrint"=c:\program files (x86)\PDF24\pdf24.exe
.
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R3 androidusb;SAMSUNG Android Composite ADB Interface Driver;c:\windows\system32\Drivers\ssadadb.sys;c:\windows\SYSNATIVE\Drivers\ssadadb.sys [x]
R3 cmnsusbser;Mobile Connector USB Device for Legacy Serial Communication LCT2053s;c:\windows\system32\DRIVERS\cmnsusbser.sys;c:\windows\SYSNATIVE\DRIVERS\cmnsusbser.sys [x]
R3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudbus.sys;c:\windows\SYSNATIVE\DRIVERS\ssudbus.sys [x]
R3 FsUsbExDisk;FsUsbExDisk;c:\windows\SysWOW64\FsUsbExDisk.SYS;c:\windows\SysWOW64\FsUsbExDisk.SYS [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des;c:\windows\SYSNATIVE\GameMon.des [x]
R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\System32\Drivers\RtsUStor.sys;c:\windows\SYSNATIVE\Drivers\RtsUStor.sys [x]
R3 ssadbus;SAMSUNG Android USB Composite Device driver (WDM);c:\windows\system32\DRIVERS\ssadbus.sys;c:\windows\SYSNATIVE\DRIVERS\ssadbus.sys [x]
R3 ssadmdfl;SAMSUNG Android USB Modem (Filter);c:\windows\system32\DRIVERS\ssadmdfl.sys;c:\windows\SYSNATIVE\DRIVERS\ssadmdfl.sys [x]
R3 ssadmdm;SAMSUNG Android USB Modem Drivers;c:\windows\system32\DRIVERS\ssadmdm.sys;c:\windows\SYSNATIVE\DRIVERS\ssadmdm.sys [x]
R3 ssudmdm;SAMSUNG Mobile USB Modem Drivers (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudmdm.sys;c:\windows\SYSNATIVE\DRIVERS\ssudmdm.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
R3 TurboBoost;Intel(R) Turbo Boost Technology Monitor 2.0;c:\program files\Intel\TurboBoost\TurboBoost.exe;c:\program files\Intel\TurboBoost\TurboBoost.exe [x]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys;c:\windows\SYSNATIVE\Drivers\usbaapl64.sys [x]
R3 WatAdminSvc;Windows-Aktivierungstechnologieservice;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
R4 AntiVirWebService;Avira Browser-Schutz;c:\program files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE;c:\program files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [x]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe;c:\program files\Windows Live\Mesh\wlcrasvc.exe [x]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys;c:\windows\SYSNATIVE\DRIVERS\avkmgr.sys [x]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe;c:\windows\SYSNATIVE\atiesrxx.exe [x]
S2 AntiVirSchedulerService;Avira Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [x]
S2 Avira.OE.ServiceHost;Avira Service Host;c:\program files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe;c:\program files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [x]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
S2 DsiWMIService;Dritek WMI Service;c:\program files (x86)\Launch Manager\dsiwmis.exe;c:\program files (x86)\Launch Manager\dsiwmis.exe [x]
S2 ePowerSvc;ePower Service;c:\program files\Acer\Acer ePower Management\ePowerSvc.exe;c:\program files\Acer\Acer ePower Management\ePowerSvc.exe [x]
S2 GREGService;GREGService;c:\program files (x86)\Acer\Registration\GREGsvc.exe;c:\program files (x86)\Acer\Registration\GREGsvc.exe [x]
S2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [x]
S2 Live Updater Service;Live Updater Service;c:\program files\Acer\Acer Updater\UpdaterService.exe;c:\program files\Acer\Acer Updater\UpdaterService.exe [x]
S2 NTI IScheduleSvc;NTI IScheduleSvc;c:\program files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe;c:\program files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe [x]
S2 SBSDWSCService;SBSD Security Center Service;c:\program files (x86)\Spybot - Search & Destroy\SDWinSec.exe;c:\program files (x86)\Spybot - Search & Destroy\SDWinSec.exe [x]
S2 TurboB;Turbo Boost UI Monitor driver;c:\windows\system32\DRIVERS\TurboB.sys;c:\windows\SYSNATIVE\DRIVERS\TurboB.sys [x]
S3 dc3d;MS Hardware Device Detection Driver (USB);c:\windows\system32\DRIVERS\dc3d.sys;c:\windows\SYSNATIVE\DRIVERS\dc3d.sys [x]
S3 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys;c:\windows\SYSNATIVE\DRIVERS\dtsoftbus01.sys [x]
S3 ETD;ELAN PS/2 Port Input Device;c:\windows\system32\DRIVERS\ETD.sys;c:\windows\SYSNATIVE\DRIVERS\ETD.sys [x]
S3 IntcDAud;Intel(R) Display-Audio;c:\windows\system32\DRIVERS\IntcDAud.sys;c:\windows\SYSNATIVE\DRIVERS\IntcDAud.sys [x]
S3 intelkmd;intelkmd;c:\windows\system32\DRIVERS\igdpmd64.sys;c:\windows\SYSNATIVE\DRIVERS\igdpmd64.sys [x]
S3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\L1C62x64.sys;c:\windows\SYSNATIVE\DRIVERS\L1C62x64.sys [x]
S3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\nusb3hub.sys;c:\windows\SYSNATIVE\DRIVERS\nusb3hub.sys [x]
S3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;c:\windows\system32\DRIVERS\nusb3xhc.sys;c:\windows\SYSNATIVE\DRIVERS\nusb3xhc.sys [x]
S3 Point64;Microsoft IntelliPoint Filter Driver;c:\windows\system32\DRIVERS\point64k.sys;c:\windows\SYSNATIVE\DRIVERS\point64k.sys [x]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - WS2IFSL
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8192ec8b-6307-11e1-9b8e-dc0ea115d22e}]
\shell\AutoRun\command - E:\OriginInstaller.exe
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ba897b7d-42dc-11e1-b7da-dc0ea115d22e}]
\shell\AutoRun\command - E:\CitiesXL2011.exe
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{cd9244f7-47b5-11e2-8bcb-60d819200bc1}]
\shell\AutoRun\command - G:\autorun.exe
.
Inhalt des "geplante Tasks" Ordners
.
2014-03-02 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-06-03 16:28]
.
2014-03-02 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-06-03 16:28]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IntelTBRunOnce"="wscript.exe" [2013-10-12 168960]
"IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2009-11-05 2320752]
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.google.com
uLocal Page = c:\windows\system32\blank.htm
mDefault_Page_URL = hxxp://www.google.com
mStart Page = hxxp://www.google.com
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
IE: Nach Microsoft E&xel exportieren - c:\progra~2\MICROS~4\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.1.1
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Toolbar-Locked - (no file)
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
Toolbar-Locked - (no file)
HKLM-Run-ETDCtrl - c:\program files (x86)\Elantech\ETDCtrl.exe
.
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\npggsvc]
"ImagePath"="c:\windows\system32\GameMon.des -service"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11c_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11c_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11c.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11c.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11c.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11c.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\McAfee]
"SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
00,5c,00,6d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,6f,00,66,00,\
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
c:\program files (x86)\Avira\AntiVir Desktop\avguard.exe
c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files (x86)\Launch Manager\LMworker.exe
c:\program files (x86)\Launch Manager\LMutilps32.exe
c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
c:\program files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2014-03-02 20:37:32 - PC wurde neu gestartet
ComboFix-quarantined-files.txt 2014-03-02 19:37
.
Vor Suchlauf: 15 Verzeichnis(se), 636.662.005.760 Bytes frei
Nach Suchlauf: 22 Verzeichnis(se), 636.180.103.168 Bytes frei
.
- - End Of File - - 03FDAFCDC71F73CDCA04F356BBAF34F0
|
| Themen zu Notebook wird im Laufe der Zeit immer langsamer |
| antivir, branding, browser, excel, google, iexplore.exe, launch, mozilla, msiexec.exe, ntdll.dll, pup.optional.bundleinstaller.a, pup.optional.newtab.a, safer networking, security, svchost.exe, trojan.dropper.fj, wlan, wscript.exe |
Baum-Darstellung