| |
| |||||||
Log-Analyse und Auswertung: Browser funktionieren nur im abgesicherten ModusWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
04.06.2014, 19:05
| #3 |
 |  Browser funktionieren nur im abgesicherten Modus Hi Matthias!
__________________Lieben Dank für deine Hilfe! Habe combofix durchlaufen lassen im normalen Modus. Er hat gemekert und zwar wegen Norton 360: Meldung war so ungefäht: antivirus und antispyware von Norton 360 aktiv. Bitte deaktivieren. Konnte ich ja leider nicht, da Norton gar nicht mehr reagiert (auch nicht deinstallieren etc. updaten oder irgendwas). Anbei nun die log Datei. Code:
ATTFilter ComboFix 14-06-04.01 - Home 04.06.2014 19:43:37.1.4 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.49.1031.18.4095.3006 [GMT 2:00]
ausgeführt von:: c:\users\Home\Desktop\ComboFix.exe
AV: Norton 360 *Enabled/Updated* {D87FA2C0-F526-77B1-D6EC-0EDF3936CEDB}
FW: Norton 360 *Enabled* {E04423E5-BF49-76E9-FDB3-A7EAC7E589A0}
SP: Norton 360 *Enabled/Updated* {631E4324-D31C-783F-EC5C-35AD42B18466}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Home\AppData\Roaming\LocalLow
c:\users\Honichbiene\AppData\Roaming\LocalLow
c:\users\Honichbiene\AppData\Roaming\LocalLow\Toolbar\RSSClient\TMP\904dc73f9f3db3897658543c2ae8cd07
.
.
((((((((((((((((((((((( Dateien erstellt von 2014-05-04 bis 2014-06-04 ))))))))))))))))))))))))))))))
.
.
2014-06-04 15:46 . 2014-06-04 15:48 -------- d-----w- C:\FRST
2014-06-03 13:02 . 2014-05-06 04:40 23544320 ----a-w- c:\windows\system32\mshtml.dll
2014-06-03 13:02 . 2014-05-06 03:00 84992 ----a-w- c:\windows\system32\mshtmled.dll
2014-06-03 13:02 . 2014-05-06 04:17 2724864 ----a-w- c:\windows\system32\mshtml.tlb
2014-06-03 13:02 . 2014-05-06 03:07 2724864 ----a-w- c:\windows\SysWow64\mshtml.tlb
2014-06-02 15:59 . 2014-03-06 08:32 574976 ----a-w- c:\windows\system32\ieui.dll
2014-06-02 15:59 . 2014-03-06 06:00 359936 ----a-w- c:\program files\Internet Explorer\IEShims.dll
2014-06-02 15:59 . 2014-03-06 05:50 257536 ----a-w- c:\program files (x86)\Internet Explorer\IEShims.dll
2014-06-02 15:59 . 2014-03-06 08:57 548352 ----a-w- c:\windows\system32\vbscript.dll
2014-06-02 15:59 . 2014-03-06 08:02 455168 ----a-w- c:\windows\SysWow64\vbscript.dll
2014-06-02 15:16 . 2014-06-02 15:16 -------- d-s---w- c:\windows\system32\CompatTel
2014-06-01 14:55 . 2014-02-04 02:32 1424384 ----a-w- c:\windows\system32\WindowsCodecs.dll
2014-06-01 14:55 . 2014-02-04 02:04 1230336 ----a-w- c:\windows\SysWow64\WindowsCodecs.dll
2014-06-01 14:55 . 2014-01-28 02:32 228864 ----a-w- c:\windows\system32\wwansvc.dll
2014-06-01 14:55 . 2014-03-25 02:43 14175744 ----a-w- c:\windows\system32\shell32.dll
2014-06-01 14:55 . 2014-05-09 06:14 477184 ----a-w- c:\windows\system32\aepdu.dll
2014-06-01 14:55 . 2014-05-09 06:11 424448 ----a-w- c:\windows\system32\aeinv.dll
2014-06-01 14:54 . 2014-01-29 02:32 484864 ----a-w- c:\windows\system32\wer.dll
2014-06-01 14:54 . 2014-01-29 02:06 381440 ----a-w- c:\windows\SysWow64\wer.dll
2014-05-28 15:59 . 2014-02-07 01:23 3156480 ----a-w- c:\windows\system32\win32k.sys
2014-05-28 15:59 . 2014-04-12 02:19 1460736 ----a-w- c:\windows\system32\lsasrv.dll
2014-05-28 15:59 . 2014-03-04 09:44 728064 ----a-w- c:\windows\system32\kerberos.dll
2014-05-28 15:59 . 2014-03-04 09:20 3969984 ----a-w- c:\windows\SysWow64\ntkrnlpa.exe
2014-05-28 15:59 . 2014-03-04 09:20 3914176 ----a-w- c:\windows\SysWow64\ntoskrnl.exe
2014-05-28 15:59 . 2014-03-04 09:17 550912 ----a-w- c:\windows\SysWow64\kerberos.dll
2014-05-28 15:59 . 2014-03-04 09:47 5550016 ----a-w- c:\windows\system32\ntoskrnl.exe
2014-05-28 15:59 . 2014-03-04 09:44 722944 ----a-w- c:\windows\system32\objsel.dll
2014-05-28 15:59 . 2014-03-04 09:44 314880 ----a-w- c:\windows\system32\msv1_0.dll
2014-05-28 15:59 . 2014-03-04 09:43 455168 ----a-w- c:\windows\system32\winlogon.exe
2014-05-28 15:59 . 2014-03-04 09:17 259584 ----a-w- c:\windows\SysWow64\msv1_0.dll
2014-05-28 15:57 . 2014-02-04 02:32 624128 ----a-w- c:\windows\system32\qedit.dll
2014-05-28 15:57 . 2014-02-04 02:04 509440 ----a-w- c:\windows\SysWow64\qedit.dll
2014-05-28 15:56 . 2014-03-04 09:44 1163264 ----a-w- c:\windows\system32\kernel32.dll
2014-05-28 15:56 . 2014-03-04 09:44 243712 ----a-w- c:\windows\system32\wow64.dll
2014-05-28 15:56 . 2014-03-04 09:44 362496 ----a-w- c:\windows\system32\wow64win.dll
2014-05-28 15:56 . 2014-03-04 09:16 25600 ----a-w- c:\windows\SysWow64\setup16.exe
2014-05-28 15:56 . 2014-03-04 09:44 16384 ----a-w- c:\windows\system32\ntvdm64.dll
2014-05-28 15:56 . 2014-03-04 09:44 13312 ----a-w- c:\windows\system32\wow64cpu.dll
2014-05-28 15:56 . 2014-03-04 09:17 14336 ----a-w- c:\windows\SysWow64\ntvdm64.dll
2014-05-28 15:56 . 2014-03-04 09:16 5120 ----a-w- c:\windows\SysWow64\wow32.dll
2014-05-28 15:56 . 2014-03-04 08:09 7680 ----a-w- c:\windows\SysWow64\instnm.exe
2014-05-28 15:56 . 2014-03-04 08:09 2048 ----a-w- c:\windows\SysWow64\user.exe
2014-05-28 15:55 . 2014-05-28 16:18 -------- d-----w- c:\users\Home\AppData\Local\Diagnostics
2014-05-28 15:54 . 2014-01-24 02:37 1684928 ----a-w- c:\windows\system32\drivers\ntfs.sys
2014-05-19 15:44 . 2014-05-19 15:44 -------- d-----w- c:\users\Home\AppData\Roaming\SupTab
2014-05-19 15:44 . 2014-05-26 18:07 -------- d-----w- c:\programdata\IePluginServices
2014-05-19 15:44 . 2014-05-26 18:07 -------- d-----w- c:\program files (x86)\SupTab
2014-05-19 15:44 . 2014-05-26 18:07 -------- d-----w- c:\programdata\WPM
2014-05-19 15:41 . 2014-05-26 18:06 -------- d-----w- c:\users\Home\AppData\Local\Tempf5f4f50b18053e4957ce338650a97011
2014-05-19 15:40 . 2014-05-26 18:06 -------- d-----w- c:\users\Home\AppData\Local\Temp80e64e090e3eb58e9f2ead87f01d3295
2014-05-19 15:40 . 2014-05-26 18:06 -------- d-----w- c:\users\Home\AppData\Roaming\BupSystem
2014-05-19 15:40 . 2014-05-26 18:06 -------- d-----w- c:\users\Home\AppData\Roaming\Security System 2
2014-05-19 15:40 . 2014-05-26 18:06 -------- d-----w- c:\users\Home\AppData\Local\Temp6081bf91e3c29f4490a509b7bb9d2b11
2014-05-19 15:25 . 2014-05-26 18:07 -------- d-----w- c:\program files (x86)\7-Zip
2014-05-19 15:15 . 2014-05-26 18:06 -------- d-----w- c:\users\Home\AppData\Local\Tempcc88ec6d1fb33686032b1fb6f845af54
2014-05-19 15:15 . 2014-05-19 15:15 -------- d-----w- c:\users\Home\ChromeExtensions
2014-05-15 23:22 . 2014-05-15 23:22 -------- d-----w- c:\users\Home\AppData\Roaming\DropboxMaster
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-05-04 15:12 . 2011-01-15 16:50 93223848 ----a-w- c:\windows\system32\MRT.exe
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-10 23:54 131248 ----a-w- c:\users\Home\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-10 23:54 131248 ----a-w- c:\users\Home\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-10 23:54 131248 ----a-w- c:\users\Home\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Device Detection"="c:\program files (x86)\Lidl_Fotos\dd.exe" [2013-02-13 857456]
"AmazonMP3DownloaderHelper"="c:\users\Home\AppData\Local\Program Files\Amazon\MP3 Downloader\AmazonMP3DownloaderHelper.exe" [2013-05-22 400704]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2010-10-26 98304]
"SoundMAXPnP"="c:\program files (x86)\Analog Devices\Core\smax4pnp.exe" [2009-06-05 1310720]
"CanonSolutionMenuEx"="c:\program files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE" [2010-04-02 1185112]
"ArcSoft Connection Service"="c:\program files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe" [2010-10-27 207424]
.
c:\users\Home\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dropbox.lnk - c:\users\Home\AppData\Roaming\Dropbox\bin\Dropbox.exe /systemstartup [2014-1-3 30714328]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"EnableSecureUIAPath"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
.
R1 BHDrvx64;BHDrvx64;c:\program files (x86)\Norton 360\NortonData\21.1.1.7\Definitions\BASHDefs\20140214.001\BHDrvx64.sys;c:\program files (x86)\Norton 360\NortonData\21.1.1.7\Definitions\BASHDefs\20140214.001\BHDrvx64.sys [x]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 Freemake Improver;Freemake Improver;c:\programdata\Freemake\FreemakeUtilsService\FreemakeUtilsService.exe;c:\programdata\Freemake\FreemakeUtilsService\FreemakeUtilsService.exe [x]
R2 MBAMScheduler;MBAMScheduler;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [x]
R2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 lgmdbus;LG Mobile driver (WDM);c:\windows\system32\DRIVERS\lgmdbus.sys;c:\windows\SYSNATIVE\DRIVERS\lgmdbus.sys [x]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys;c:\windows\SYSNATIVE\drivers\mbam.sys [x]
R3 RTL8167;Realtek 8167 NT-Treiber;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
R3 Soda PDF 2012 Helper Service;Soda PDF 2012 Helper Service;c:\program files (x86)\Soda PDF 2012\HelperService.exe;c:\program files (x86)\Soda PDF 2012\HelperService.exe [x]
R3 ss_bbus;SAMSUNG USB Mobile Device (WDM);c:\windows\system32\DRIVERS\ss_bbus.sys;c:\windows\SYSNATIVE\DRIVERS\ss_bbus.sys [x]
R3 ss_bmdfl;SAMSUNG USB Mobile Modem (Filter);c:\windows\system32\DRIVERS\ss_bmdfl.sys;c:\windows\SYSNATIVE\DRIVERS\ss_bmdfl.sys [x]
R3 ss_bmdm;SAMSUNG USB Mobile Modem;c:\windows\system32\DRIVERS\ss_bmdm.sys;c:\windows\SYSNATIVE\DRIVERS\ss_bmdm.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
S0 SymDS;Symantec Data Store;c:\windows\system32\drivers\N360x64\1501010.007\SYMDS64.SYS;c:\windows\SYSNATIVE\drivers\N360x64\1501010.007\SYMDS64.SYS [x]
S0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\N360x64\1501010.007\SYMEFA64.SYS;c:\windows\SYSNATIVE\drivers\N360x64\1501010.007\SYMEFA64.SYS [x]
S1 ccSet_N360;N360 Settings Manager;c:\windows\system32\drivers\N360x64\1501010.007\ccSetx64.sys;c:\windows\SYSNATIVE\drivers\N360x64\1501010.007\ccSetx64.sys [x]
S1 IDSVia64;IDSVia64;c:\program files (x86)\Norton 360\NortonData\21.1.1.7\Definitions\IPSDefs\20140309.001\IDSvia64.sys;c:\program files (x86)\Norton 360\NortonData\21.1.1.7\Definitions\IPSDefs\20140309.001\IDSvia64.sys [x]
S1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\N360x64\1501010.007\Ironx64.SYS;c:\windows\SYSNATIVE\drivers\N360x64\1501010.007\Ironx64.SYS [x]
S1 SymNetS;Symantec Network Security WFP Driver;c:\windows\System32\Drivers\N360x64\1501010.007\SYMNETS.SYS;c:\windows\SYSNATIVE\Drivers\N360x64\1501010.007\SYMNETS.SYS [x]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe;c:\windows\SYSNATIVE\atiesrxx.exe [x]
S2 c2cautoupdatesvc;Skype Click to Call Updater;c:\program files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe;c:\program files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [x]
S2 c2cpnrsvc;Skype Click to Call PNR Service;c:\program files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe;c:\program files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [x]
S2 N360;Norton 360;c:\program files (x86)\Norton 360\Engine\21.1.1.7\N360.exe;c:\program files (x86)\Norton 360\Engine\21.1.1.7\N360.exe [x]
S2 Soda PDF 2012 Service;Soda PDF 2012 Service;c:\program files (x86)\Soda PDF 2012\ConversionService.exe;c:\program files (x86)\Soda PDF 2012\ConversionService.exe [x]
S3 MicNgBas;Cinergy 2400i DT Base Driver;c:\windows\system32\DRIVERS\MicNgBas.sys;c:\windows\SYSNATIVE\DRIVERS\MicNgBas.sys [x]
S3 MicNgCap;Cinergy 2400i DT Capture Driver;c:\windows\system32\DRIVERS\MicNgCap.sys;c:\windows\SYSNATIVE\DRIVERS\MicNgCap.sys [x]
S3 MicNgTun;Cinergy 2400i DT Tuner Driver;c:\windows\system32\DRIVERS\MicNgTun.sys;c:\windows\SYSNATIVE\DRIVERS\MicNgTun.sys [x]
S3 RTL8187;Realtek RTL8187 Wireless 802.11b/g 54Mbps USB 2.0 Network Adapter;c:\windows\system32\DRIVERS\RTL8187.sys;c:\windows\SYSNATIVE\DRIVERS\RTL8187.sys [x]
S3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x64.sys;c:\windows\SYSNATIVE\DRIVERS\yk62x64.sys [x]
.
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-10 23:54 164016 ----a-w- c:\users\Home\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-10 23:54 164016 ----a-w- c:\users\Home\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-10 23:54 164016 ----a-w- c:\users\Home\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-10 23:54 164016 ----a-w- c:\users\Home\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.google.de/
mLocal Page = c:\windows\SysWOW64\blank.htm
uSearchAssistant = hxxp://www.google.com
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: Free YouTube to DVD Converter - c:\users\Home\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetodvdconverter.htm
IE: Free YouTube to MP3 Converter - c:\users\Home\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm
IE: Nach Microsoft E&xel exportieren - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.2.1
FF - ProfilePath - c:\users\Home\AppData\Roaming\Mozilla\Firefox\Profiles\239ymr5l.default-1401215718104\
FF - prefs.js: browser.startup.homepage - www.google.de
FF - prefs.js: network.proxy.type - 4
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
AddRemove-HelixYUVCodecs - c:\windows\system32\uninstHelixYUV.exe
AddRemove-Legend - Legacy Of The Dragons_is1 - c:\program files (x86)\Mail.Ru\DragonsEn\unins000.exe
AddRemove-metaCrawler - c:\program files (x86)\metaCrawler\1.8.19.0\uninstall.exe
.
.
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\N360]
"ImagePath"="\"c:\program files (x86)\Norton 360\Engine\21.1.1.7\N360.exe\" /s \"N360\" /m \"c:\program files (x86)\Norton 360\Engine\21.1.1.7\diMaster.dll\" /prefetch:1"
"ImagePath"="\SystemRoot\System32\Drivers\N360x64\1501010.007\SYMNETS.SYS"
"TrustedImagePaths"="c:\program files (x86)\Norton 360\Engine\21.1.1.7;c:\program files (x86)\Norton 360\Engine64\21.1.1.7"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\S-1-5-21-433733618-1293826757-3301219268-1000\Software\SecuROM\License information*]
"datasecu"=hex:3f,e8,32,38,8b,9d,53,e8,f3,18,73,52,3f,19,d2,62,3f,d5,11,9a,a8,
f6,99,c1,c8,75,3f,b3,78,e7,c7,ba,f9,96,31,0f,aa,37,fe,40,43,21,a8,38,c4,4d,\
"rkeysecu"=hex:3e,db,a4,d7,46,d3,d2,54,01,52,84,eb,6f,a9,de,05
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2014-06-04 19:56:32
ComboFix-quarantined-files.txt 2014-06-04 17:56
.
Vor Suchlauf: 18 Verzeichnis(se), 884.978.032.640 Bytes frei
Nach Suchlauf: 20 Verzeichnis(se), 884.392.370.176 Bytes frei
.
- - End Of File - - CC39E4AE70664E06D15D17485A7331E7
A36C5E4F47E84449FF07ED3517B43A31
|
Baum-Darstellung