Windows 7, seit 6 Wochen ständiger unerwünschter Download

ComboFix 14-09-05.01 - Detlef Orthmann 05.09.2014  15:38:27.1.2 - x86
Microsoft Windows 7 Home Premium   6.1.7601.1.1252.49.1031.18.3263.1668 [GMT 2:00]
ausgeführt von:: c:\users\Detlef Orthmann\Desktop\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {4D041356-F94D-285F-8768-AAE50FA36859}
SP: Avira Desktop *Disabled/Updated* {F665F2B2-DF77-27D1-BDD8-9197742422E4}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 * Neuer Wiederherstellungspunkt wurde erstellt
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\Install.exe
c:\users\Detlef Orthmann\AppData\Local\Temp\avgnt.exe\Avira.OE.ExtApi.dll
c:\users\DETLEF~1\AppData\Local\Temp\avgnt.exe\Avira.OE.ExtApi.dll
c:\windows\system32\tmp139.tmp
c:\windows\system32\tmp13A.tmp
.
.
(((((((((((((((((((((((   Dateien erstellt von 2014-08-05 bis 2014-09-05  ))))))))))))))))))))))))))))))
.
.
2014-09-05 06:43 . 2014-09-05 06:45	--------	d-----w-	C:\FRST
2014-09-05 06:28 . 2014-09-05 12:32	--------	d-----w-	C:\AA Log
2014-09-05 05:01 . 2014-09-05 05:01	--------	d-----w-	c:\users\Detlef Orthmann\AppData\Roaming\Avira
2014-09-05 04:59 . 2014-09-05 05:08	--------	d-----w-	c:\program files\Avira
2014-09-05 04:59 . 2014-09-05 04:53	37352	----a-w-	c:\windows\system32\drivers\avkmgr.sys
2014-09-05 04:59 . 2014-09-05 04:53	136216	----a-w-	c:\windows\system32\drivers\avipbb.sys
2014-09-05 04:59 . 2014-09-05 04:53	97648	----a-w-	c:\windows\system32\drivers\avgntflt.sys
2014-09-05 03:46 . 2014-09-05 11:28	110296	----a-w-	c:\windows\system32\drivers\MBAMSwissArmy.sys
2014-09-05 03:45 . 2014-09-05 03:45	--------	d-----w-	c:\program files\ Malwarebytes Anti-Malware 
2014-09-05 03:45 . 2014-09-05 03:45	--------	d-----w-	c:\programdata\Malwarebytes
2014-09-05 03:45 . 2014-05-12 05:55	51928	----a-w-	c:\windows\system32\drivers\mwac.sys
2014-09-05 03:45 . 2014-05-12 05:54	74456	----a-w-	c:\windows\system32\drivers\mbamchameleon.sys
2014-09-05 03:45 . 2014-05-12 05:54	23256	----a-w-	c:\windows\system32\drivers\mbam.sys
2014-09-03 05:13 . 2009-12-15 02:46	24192	----a-w-	c:\windows\system32\drivers\tcpipBM.sys
2014-09-03 05:13 . 2009-12-15 02:46	13712	----a-w-	c:\windows\system32\sporder.dll
2014-09-03 05:13 . 2009-12-15 02:46	724608	----a-w-	c:\windows\system32\bmutil.dll
2014-09-03 05:13 . 2009-12-15 02:46	480384	----a-w-	c:\windows\system32\bmnet.dll
2014-09-03 05:13 . 2009-12-15 02:46	308352	----a-w-	c:\windows\system32\bminstall.dll
2014-09-03 05:13 . 2009-12-15 02:46	13184	----a-w-	c:\windows\system32\drivers\BMLoad.sys
2014-09-03 05:13 . 2009-12-15 02:46	132224	----a-w-	c:\windows\system32\bmdumpd.bin
2014-09-03 05:13 . 2011-08-19 10:25	106880	----a-w-	c:\windows\system32\drivers\HSPADataCardusbser.sys
2014-09-03 05:13 . 2011-08-19 10:25	106880	----a-w-	c:\windows\system32\drivers\HSPADataCardusbnmea.sys
2014-09-03 05:13 . 2011-08-19 10:25	106880	----a-w-	c:\windows\system32\drivers\HSPADataCardusbmdm.sys
2014-09-03 05:13 . 2011-08-19 10:25	10240	----a-w-	c:\windows\system32\drivers\massfilter.sys
2014-09-03 05:12 . 2014-09-03 05:12	--------	d-----w-	c:\program files\congstar
2014-09-02 12:52 . 2014-09-05 05:18	--------	d-----w-	C:\TCPView
2014-09-02 10:14 . 2014-09-02 13:29	--------	d-----w-	c:\users\Detlef Orthmann\AppData\Roaming\Wireshark
2014-09-02 10:11 . 2014-09-02 10:12	--------	d-----w-	c:\program files\Wireshark
2014-09-02 10:05 . 2014-09-02 10:12	--------	d-----w-	c:\program files\WinPcap
2014-09-02 06:57 . 2014-09-02 06:59	--------	d-----w-	c:\programdata\SystemExplorer
2014-09-02 06:57 . 2014-09-02 06:57	--------	d-----w-	c:\program files\System Explorer
2014-08-28 06:01 . 2014-08-23 01:46	305152	----a-w-	c:\windows\system32\gdi32.dll
2014-08-28 06:01 . 2014-08-23 00:42	2352640	----a-w-	c:\windows\system32\win32k.sys
2014-08-27 04:39 . 2014-05-14 16:23	45536	----a-w-	c:\windows\system32\wups2.dll
2014-08-27 04:39 . 2014-05-14 16:23	54240	----a-w-	c:\windows\system32\wuauclt.exe
2014-08-27 04:39 . 2014-05-14 16:23	1973728	----a-w-	c:\windows\system32\wuaueng.dll
2014-08-27 04:39 . 2014-05-14 16:17	2425856	----a-w-	c:\windows\system32\wucltux.dll
2014-08-27 04:39 . 2014-05-14 16:23	36320	----a-w-	c:\windows\system32\wups.dll
2014-08-27 04:39 . 2014-05-14 16:23	581600	----a-w-	c:\windows\system32\wuapi.dll
2014-08-27 04:39 . 2014-05-14 16:17	92672	----a-w-	c:\windows\system32\wudriver.dll
2014-08-27 04:39 . 2014-05-14 07:23	179656	----a-w-	c:\windows\system32\wuwebv.dll
2014-08-27 04:39 . 2014-05-14 07:17	33792	----a-w-	c:\windows\system32\wuapp.exe
2014-08-26 05:52 . 2014-09-04 14:10	--------	d-----w-	c:\users\Detlef Orthmann\AppData\Local\Battle.net
2014-08-26 05:52 . 2014-08-26 05:55	--------	d-----w-	c:\users\Detlef Orthmann\AppData\Roaming\Battle.net
2014-08-26 05:52 . 2014-08-26 05:52	--------	d-----w-	c:\program files\Common Files\Blizzard Entertainment
2014-08-26 05:52 . 2014-08-26 05:52	--------	d-----w-	c:\program files\Battle.net
2014-08-13 06:52 . 2014-03-09 21:47	99480	----a-w-	c:\windows\system32\infocardapi.dll
2014-08-13 06:51 . 2014-06-30 22:14	8856	----a-w-	c:\windows\system32\icardres.dll
2014-08-13 06:51 . 2014-03-09 21:47	619672	----a-w-	c:\windows\system32\icardagt.exe
2014-08-13 06:51 . 2014-06-06 06:16	35480	----a-w-	c:\windows\system32\TsWpfWrp.exe
2014-08-13 05:14 . 2014-07-16 02:46	2048	----a-w-	c:\windows\system32\tzres.dll
2014-08-13 05:14 . 2014-06-03 09:30	101824	----a-w-	c:\windows\system32\consent.exe
2014-08-13 05:14 . 2014-06-03 09:29	337408	----a-w-	c:\windows\system32\msihnd.dll
2014-08-13 05:14 . 2014-06-03 09:29	2363392	----a-w-	c:\windows\system32\msi.dll
2014-08-13 05:14 . 2014-06-03 09:29	1805824	----a-w-	c:\windows\system32\authui.dll
2014-08-13 05:14 . 2014-08-07 01:43	412160	----a-w-	c:\windows\system32\aepdu.dll
2014-08-13 05:14 . 2014-08-07 01:39	302592	----a-w-	c:\windows\system32\aeinv.dll
2014-08-13 05:13 . 2014-07-09 01:29	6144	----a-w-	c:\windows\system32\KBDYAK.DLL
2014-08-13 05:13 . 2014-07-09 01:29	6144	----a-w-	c:\windows\system32\KBDBASH.DLL
2014-08-08 06:43 . 2014-08-08 06:43	--------	d-----w-	c:\program files\Easeware
2014-08-07 04:31 . 2014-08-07 08:56	--------	d-----w-	c:\program files\OnlineCounter
2014-08-07 04:26 . 2014-08-07 04:26	--------	d-----w-	c:\users\Detlef Orthmann\AppData\Roaming\Abelssoft
2014-08-07 04:26 . 2014-08-07 04:26	--------	d-----w-	c:\programdata\XDMessagingv4
2014-08-07 04:26 . 2014-08-07 04:26	--------	d-----w-	c:\users\Detlef Orthmann\AppData\Local\Abelssoft
2014-08-07 04:26 . 2014-09-05 06:31	--------	d-----w-	c:\program files\CHIP Updater
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-08-06 13:23 . 2014-08-06 13:23	96680	----a-w-	c:\windows\system32\WindowsAccessBridge.dll
2014-07-09 08:31 . 2013-06-06 04:17	71344	----a-w-	c:\windows\system32\FlashPlayerCPLApp.cpl
2014-07-09 08:31 . 2013-06-06 04:17	699056	----a-w-	c:\windows\system32\FlashPlayerApp.exe
2014-06-18 01:51 . 2014-07-09 05:53	646144	----a-w-	c:\windows\system32\osk.exe
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2009-08-18 7711264]
"CTSyncService"="c:\program files\InstallShield Installation Information\{F3D9AC82-30F4-4BB9-B9AB-8697637568C1}\AMBSPISyncService.exe" [2009-07-08 1233195]
"VolPanel"="c:\program files\Creative\SB X-Fi MB\Volume Panel\VolPanlu.exe" [2009-05-04 241789]
"UpdReg"="c:\windows\UpdReg.EXE" [2000-05-10 90112]
"RunDLLEntry"="c:\windows\system32\AmbRunE.dll" [2009-02-26 14848]
"WinampAgent"="c:\program files\Winamp\winampa.exe" [2012-06-20 74752]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\x86\CLIStart.exe" [2013-12-06 747264]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2014-05-08 959904]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2014-07-25 256896]
"SystemExplorerAutoStart"="c:\program files\System Explorer\SystemExplorer.exe" [2014-08-21 3385192]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2014-09-05 751184]
"Avira Systray"="c:\program files\Avira\My Avira\Avira.OE.Systray.exe" [2014-08-04 161584]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"SPReview"="c:\windows\System32\SPReview\SPReview.exe" [2013-06-04 280576]
.
c:\users\Detlef Orthmann\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
CurseClientStartup.ccip [2013-6-8 0]
OpenOffice.org 3.4.1.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2012-8-13 1199104]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
MCtlSvc.lnk - c:\program files\congstar\Internet-Manager\Bin\mcserver.exe [2014-9-3 60688]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
R3 Creative ALchemy AL6 Licensing Service;Creative ALchemy AL6 Licensing Service;c:\program files\Common Files\Creative Labs Shared\Service\AL6Licensing.exe [2013-06-01 79360]
R3 Creative Audio Engine Licensing Service;Creative Audio Engine Licensing Service;c:\program files\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [2013-06-01 79360]
R3 HSPADataCardusbmdm;HSPADataCard Proprietary USB Driver;c:\windows\system32\DRIVERS\HSPADataCardusbmdm.sys [2011-08-19 106880]
R3 HSPADataCardusbnmea;HSPADataCard NMEA Port;c:\windows\system32\DRIVERS\HSPADataCardusbnmea.sys [2011-08-19 106880]
R3 HSPADataCardusbser;HSPADataCard Diagnostic Port;c:\windows\system32\DRIVERS\HSPADataCardusbser.sys [2011-08-19 106880]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe [2014-07-25 108032]
R3 massfilter;Mass Storage Filter Driver;c:\windows\system32\drivers\massfilter.sys [2011-08-19 10240]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224]
S0 BMLoad;Bytemobile Boot Time Load Driver;c:\windows\system32\drivers\BMLoad.sys [2009-12-15 13184]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys [2014-09-05 37352]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2013-12-06 209408]
S2 AntiVirSchedulerService;Avira Planer;c:\program files\Avira\AntiVir Desktop\sched.exe [2014-09-05 430160]
S2 Avira.OE.ServiceHost;Avira Service Host;c:\program files\Avira\My Avira\Avira.OE.ServiceHost.exe [2014-08-04 149296]
S2 Mobile Broadband HL Service;Mobile Broadband HL Service;c:\programdata\MobileBrServ\mbbservice.exe [2013-06-01 230240]
S2 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [2013-03-01 36600]
S2 WCUService;SmartView Software Updater Service;c:\program files\DeviceVM\SmartView Software Updater\WCUService.exe [2010-09-02 456976]
S3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW73.sys [2013-09-24 77312]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt86win7.sys [2009-07-30 187392]
S3 Sound Blaster X-Fi MB Licensing Service;Sound Blaster X-Fi MB Licensing Service;c:\program files\Common Files\Creative Labs Shared\Service\XMBLicensing.exe [2013-06-01 79360]
S3 SystemExplorerHelpService;System Explorer Service;c:\program files\System Explorer\service\SystemExplorerService.exe [2014-08-13 567144]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - SSMDRV
*NewlyCreated* - WS2IFSL
.
Inhalt des "geplante Tasks" Ordners
.
2014-09-05 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2013-06-06 08:31]
.
2014-03-03 c:\windows\Tasks\DriverEasy Scheduled Scan.job
- c:\program files\Easeware\DriverEasy\DriverEasy.exe [2014-08-08 10:07]
.
2014-09-05 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2013-06-24 18:16]
.
2014-09-05 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2013-06-24 18:16]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.search.ask.com/?o=APN10645A&gct=hp&d=406-362&v=n12521-331&t=4
TCP: DhcpNameServer = 192.168.1.1 192.168.1.1
FF - ProfilePath - c:\users\Detlef Orthmann\AppData\Roaming\Mozilla\Firefox\Profiles\j2017gti.default\
FF - prefs.js: browser.search.selectedEngine - Ask.com
FF - prefs.js: browser.startup.homepage - hxxp://www.google.de/
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
MSConfigStartUp-ApnUpdater - c:\program files\Ask.com\Updater\Updater.exe
MSConfigStartUp-wuauclt - c:\users\Detlef Orthmann\AppData\Local\WinUpdate.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\program files\Creative\Shared Files\CTAudSvc.exe
c:\windows\system32\atieclxx.exe
c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\program files\Avira\AntiVir Desktop\avshadow.exe
c:\windows\System32\WUDFHost.exe
c:\windows\system32\sppsvc.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\windows\system32\taskhost.exe
c:\windows\system32\conhost.exe
c:\windows\System32\rundll32.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
c:\users\DETLEF~1\AppData\Local\Temp\Sound_Blaster_X-Fi_MB_Cleanup.0001
c:\windows\system32\conhost.exe
c:\program files\OpenOffice.org 3\program\soffice.exe
c:\program files\congstar\Internet-Manager\Bin\dbus-daemon.exe
c:\program files\OpenOffice.org 3\program\soffice.bin
c:\program files\congstar\Internet-Manager\Bin\db_daemon.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
c:\program files\Realtek\Audio\HDA\RtHDVBg.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2014-09-05  15:51:17 - PC wurde neu gestartet
ComboFix-quarantined-files.txt  2014-09-05 13:51
.
Vor Suchlauf: 19 Verzeichnis(se), 348.586.803.200 Bytes frei
Nach Suchlauf: 23 Verzeichnis(se), 348.502.704.128 Bytes frei
.
- - End Of File - - FB694D76B875E4017B2759CCD19FCF5A
A36C5E4F47E84449FF07ED3517B43A31