Hallo Schrauber,
vielen Dank für die schnelle Antwort.
Combo ist 2 Stunden gelaufen, hier jetzt die Combo.txt:
Code:
Alles auswählen Aufklappen ATTFilter
ComboFix 14-10-04.01 - Ullerichs 05.10.2014 17:23:09.1.4 - x86
Microsoft Windows 7 Professional 6.1.7601.1.1252.49.1031.18.2999.1898 [GMT 2:00]
ausgeführt von:: c:\users\Ullerichs\Desktop\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {4D041356-F94D-285F-8768-AAE50FA36859}
SP: Avira Desktop *Disabled/Updated* {F665F2B2-DF77-27D1-BDD8-9197742422E4}
SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\dbrd.pad
C:\readme.txt
c:\users\Uli\AppData\Roaming\vso_ts_preview.xml
c:\windows\system32\drivers\etc\hosts.txt
c:\windows\wininit.ini
.
.
((((((((((((((((((((((( Dateien erstellt von 2014-09-05 bis 2014-10-05 ))))))))))))))))))))))))))))))
.
.
2014-10-05 17:09 . 2014-10-05 17:09 -------- d-----w- c:\users\Uli\AppData\Local\temp
2014-10-05 17:09 . 2014-10-05 17:09 -------- d-----w- c:\users\Default\AppData\Local\temp
2014-10-05 13:32 . 2014-10-05 14:50 -------- d-----w- c:\program files\VS Revo Group
2014-10-05 12:09 . 2014-10-05 12:11 -------- d-----w- C:\FRST
2014-10-05 12:05 . 2014-10-05 12:05 -------- d-sh--w- c:\programdata\360Quarant
2014-10-05 12:05 . 2014-10-05 12:05 -------- d-----w- C:\$360Section
2014-10-05 11:45 . 2014-10-05 14:50 56200 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{A253E93A-A012-468A-9F72-BC526869A373}\offreg.dll
2014-10-02 21:01 . 2014-10-02 21:01 -------- d-----w- C:\360SANDBOX
2014-10-02 21:00 . 2014-10-05 13:50 -------- d-----w- c:\program files\360
2014-10-02 21:00 . 2014-10-02 21:00 -------- d-----w- c:\users\Ullerichs\AppData\Roaming\HTThread
2014-10-02 21:00 . 2014-10-02 21:00 -------- d-----w- c:\users\Ullerichs\AppData\Roaming\Security Systems
2014-10-02 20:59 . 2014-10-05 13:42 -------- d-----w- c:\programdata\Spybot - Search & Destroy
2014-10-02 20:59 . 2014-10-05 13:49 -------- d-----w- c:\program files\Spybot - Search & Destroy 2
2014-10-02 20:34 . 2014-10-02 20:37 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2014-09-14 08:35 . 2014-09-14 08:36 -------- d-----w- c:\programdata\188F1432-103A-4ffb-80F1-36B633C5C9E1
2014-09-07 07:47 . 2014-09-07 07:47 -------- d-----w- c:\users\Ullerichs\AppData\Local\MicroVision Applications
2014-09-07 07:46 . 2014-09-07 07:46 -------- d-----w- c:\program files\Common Files\SureThing Shared
2014-09-07 07:46 . 2014-09-07 07:47 -------- d-----w- c:\program files\SureThing Disc Labeler 6
2014-09-07 07:23 . 2014-09-07 07:23 -------- d-----w- c:\users\Ullerichs\AppData\Roaming\Oracle
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-10-02 19:52 . 2012-09-08 10:05 71344 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2014-10-02 19:52 . 2012-09-08 10:05 701104 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2014-09-05 01:52 . 2014-09-11 19:18 445952 ----a-w- c:\windows\system32\aepdu.dll
2014-09-05 01:47 . 2014-09-11 19:18 302592 ----a-w- c:\windows\system32\aeinv.dll
2014-08-31 13:49 . 2012-07-17 12:37 23256 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
2014-08-23 01:46 . 2014-08-30 18:16 305152 ----a-w- c:\windows\system32\gdi32.dll
2014-08-23 00:42 . 2014-08-30 18:16 2352640 ----a-w- c:\windows\system32\win32k.sys
2014-08-18 22:08 . 2014-09-14 06:57 4232704 ----a-w- c:\windows\system32\jscript9.dll
2014-08-18 21:57 . 2014-09-14 06:57 2724864 ----a-w- c:\windows\system32\mshtml.tlb
2014-08-18 21:57 . 2014-09-14 06:57 4096 ----a-w- c:\windows\system32\ieetwcollectorres.dll
2014-08-18 21:46 . 2014-09-14 06:57 454656 ----a-w- c:\windows\system32\vbscript.dll
2014-08-18 21:45 . 2014-09-14 06:57 61952 ----a-w- c:\windows\system32\iesetup.dll
2014-08-18 21:44 . 2014-09-14 06:57 51200 ----a-w- c:\windows\system32\ieetwproxystub.dll
2014-08-18 21:44 . 2014-09-14 06:57 61952 ----a-w- c:\windows\system32\MshtmlDac.dll
2014-08-18 21:36 . 2014-09-14 06:57 112128 ----a-w- c:\windows\system32\ieUnatt.exe
2014-08-18 21:36 . 2014-09-14 06:57 108032 ----a-w- c:\windows\system32\ieetwcollector.exe
2014-08-18 21:35 . 2014-09-14 06:57 597504 ----a-w- c:\windows\system32\jscript9diag.dll
2014-08-18 21:30 . 2014-09-14 06:57 646144 ----a-w- c:\windows\system32\MsSpellCheckingFacility.exe
2014-08-18 21:22 . 2014-09-14 06:57 60416 ----a-w- c:\windows\system32\JavaScriptCollectionAgent.dll
2014-08-18 21:08 . 2014-09-14 06:57 2014208 ----a-w- c:\windows\system32\inetcpl.cpl
2014-08-18 21:07 . 2014-09-14 06:57 1068032 ----a-w- c:\windows\system32\mshtmlmedia.dll
2014-08-18 20:46 . 2014-09-14 06:57 1812992 ----a-w- c:\windows\system32\wininet.dll
2014-08-05 18:04 . 2013-06-30 20:56 35848 ----a-w- c:\windows\system32\drivers\avnetflt.sys
2014-08-01 11:35 . 2014-09-11 19:18 793600 ----a-w- c:\windows\system32\TSWorkspace.dll
2014-07-28 12:52 . 2014-07-28 12:52 6112072 ----a-w- c:\windows\system32\usbaaplrc.dll
2014-07-28 12:52 . 2014-07-28 12:52 45056 ----a-w- c:\windows\system32\drivers\usbaapl.sys
2014-07-25 10:55 . 2014-09-07 07:20 96680 ----a-w- c:\windows\system32\WindowsAccessBridge.dll
2014-07-25 00:35 . 2014-07-25 00:35 875688 ----a-w- c:\windows\system32\msvcr120_clr0400.dll
2014-07-16 02:46 . 2014-08-15 19:58 2048 ----a-w- c:\windows\system32\tzres.dll
2014-07-14 01:42 . 2014-08-15 19:59 654336 ----a-w- c:\windows\system32\rpcrt4.dll
2013-10-14 02:44 . 2013-10-14 02:44 2174976 ----a-w- c:\program files\Common Files\atimpenc.dll
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\~\Browser Helper Objects\{10921475-03CE-4E04-90CE-E2E7EF20C814}]
2014-01-12 09:39 752960 ----a-w- c:\program files\IObit\IObit Uninstaller\UninstallExplorer32.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\~\Browser Helper Objects\{C32F5BF7-6918-4F78-A97A-53CDF7D07C8C}]
2014-08-25 09:25 2243072 ----a-w- c:\users\Ullerichs\AppData\LocalLow\IE-BHO\bho.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AnyDVD"="c:\program files\SlySoft\AnyDVD\AnyDVDtray.exe" [2012-09-05 5045880]
"Adobe Acrobat Synchronizer"="c:\program files\Adobe\Acrobat 10.0\Acrobat\AdobeCollabSync.exe" [2010-10-25 1216416]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2011-05-22 39408]
"TomTomHOME.exe"="c:\program files\TomTom HOME 2\TomTomHOMERunner.exe" [2014-06-05 248176]
"LightScribe Control Panel"="c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe" [2013-01-16 2736128]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2010-02-09 8505888]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-11-24 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-11-24 175640]
"Persistence"="c:\windows\system32\igfxpers.exe" [2009-11-24 166936]
"IMSS"="c:\program files\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe" [2009-12-09 111640]
"IAStorIcon"="c:\program files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe" [2009-10-02 284696]
"BCSSync"="c:\program files\Microsoft Office\Office14\BCSSync.exe" [2012-11-05 89184]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2014-07-31 43816]
"Adobe Acrobat Speed Launcher"="c:\program files\Adobe\Acrobat 10.0\Acrobat\Acrobat_sl.exe" [2010-10-25 36760]
"Acrobat Assistant 8.0"="c:\program files\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe" [2010-10-25 821144]
"HTC Sync Loader"="c:\program files\HTC\HTC Sync 3.0\htcUPCTLoader.exe" [2012-12-12 655360]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2014-08-13 751184]
"CDAServer"="c:\program files\Common Files\Common Desktop Agent\CDASrv.exe" [2012-03-09 350072]
"MobileConnect"="c:\program files\Vodafone\Vodafone Mobile Connect\Bin\MobileConnect.exe" [2008-07-04 2072576]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2014-07-25 256896]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2014-09-01 152392]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"EnableLinkedConnections"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0\0sdnclean.exe
.
R1 BAPIDRV;BAPIDRV;c:\windows\system32\DRIVERS\BAPIDRV.sys [x]
R2 AntiVirMailService;Avira Email Schutz;c:\program files\Avira\AntiVir Desktop\avmailc.exe [2014-08-13 802384]
R2 HTService;HTService;c:\users\Ullerichs\AppData\Roaming\HTThread\hb.exe [2014-08-28 628736]
R2 LiveUpdateSvc;LiveUpdate;c:\program files\IObit\LiveUpdate\LiveUpdate.exe [2014-01-12 2151744]
R2 NAUpdate;Nero Update;c:\program files\Nero\Update\NASvc.exe [2013-07-18 762192]
R3 avmeject;AVM Eject;c:\windows\system32\drivers\avmeject.sys [2010-10-22 4352]
R3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys [2010-11-20 62464]
R3 HTCAND32;HTC Device Driver;c:\windows\system32\Drivers\ANDROIDUSB.sys [2009-10-26 25088]
R3 htcnprot;HTC NDIS Protocol Driver;c:\windows\system32\DRIVERS\htcnprot.sys [2012-12-07 23040]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe [2014-08-18 108032]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [2010-11-20 27264]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys [2013-12-06 37352]
S1 Uim_Vim;UIM Virtual Image Plugin;c:\windows\system32\Drivers\Uim_Vim.sys [2012-09-13 283472]
S2 AntiVirSchedulerService;Avira Planer;c:\program files\Avira\AntiVir Desktop\sched.exe [2014-08-13 430160]
S2 AntiVirWebService;Avira Browser-Schutz;c:\program files\Avira\AntiVir Desktop\AVWEBGRD.EXE [2014-08-13 1021008]
S2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [2009-10-02 13336]
S2 PassThru Service;Internet Pass-Through Service;c:\program files\HTC\Internet Pass-Through\PassThruSvr.exe [2012-12-07 167424]
S2 SSPORT;SSPORT;c:\windows\system32\Drivers\SSPORT.sys [2013-11-26 5120]
S2 TomTomHOMEService;TomTomHOMEService;c:\program files\TomTom HOME 2\TomTomHOMEService.exe [2014-06-05 93040]
S2 UNS;Intel(R) Management & Security Application User Notification Service;c:\program files\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2009-12-09 2320920]
S2 VMCService;Vodafone Mobile Connect Service;c:\program files\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe [2008-07-04 14336]
S3 dc3d;Microsoft-Hardware – Geräteerkennungstreiber;c:\windows\system32\DRIVERS\dc3d.sys [2013-01-22 64640]
S3 e1kexpress;Intel(R) PRO/1000 PCI Express Network Connection Driver K;c:\windows\system32\DRIVERS\e1k6232.sys [2009-09-23 208552]
S3 fwlanusbn;FRITZ!WLAN N;c:\windows\system32\DRIVERS\fwlanusbn.sys [2010-10-22 586752]
S3 IntcDAud;Intel(R) Display-Audio;c:\windows\system32\DRIVERS\IntcDAud.sys [2009-10-30 209920]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2013-01-16 10:46 454176 ----a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe
.
Inhalt des "geplante Tasks" Ordners
.
2014-10-05 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-09-08 19:52]
.
2014-10-05 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-05-22 10:28]
.
2014-10-05 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-05-22 10:28]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = www.bing.com
uDefault_Search_URL = hxxp://www.google.com
mStart Page = hxxp://www.google.com
uInternet Settings,ProxyOverride = <local>;*.local
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: An OneNote s&enden - c:\progra~1\MICROS~1\Office14\ONBttnIE.dll/105
IE: Nach Microsoft E&xcel exportieren - c:\progra~1\MICROS~1\Office14\EXCEL.EXE/3000
Trusted Zone: apemap.com
TCP: DhcpNameServer = 192.168.178.1
TCP: Interfaces\{FB7FB496-5CAF-45E4-B563-A5609A5B4958}: NameServer = 192.168.0.1
FF - ProfilePath - c:\users\Ullerichs\AppData\Roaming\Mozilla\Firefox\Profiles\petl0k33.default-1389516642415\
FF - user.js: extensions.blocklist.enabled - false
FF - user.js: app.update.auto - false
FF - user.js: security.mixed_content.block_active_content - false
FF - user.js: security.mixed_content.block_display_content - false
FF - user.js: app.update.staging.enabled - true
FF - user.js: app.update.interval - 31536000
FF - user.js: app.update.idletime - 31536000
FF - user.js: browser.search.update - false
FF - user.js: browser.search.update.interval - 31536000
FF - user.js: app.update.channel - default
FF - user.js: extensions.getAddons.cache.enabled - false
FF - user.js: app.update.download.backgroundInterval - 31536000
FF - user.js: browser.safebrowsing.appRepURL -
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\WISO Mein Steuer-Sparbuch heute.lnk - s:\wiso\Sparbuch 2014\mshaktuell.exe
AddRemove-{5A0C0737-6AFE-4DC6-A8B4-6DFE509ACD75}_is1 - c:\users\Ullerichs\AppData\Roaming\Mozilla\Firefox\Profiles\petl0k33.default-1389516642415\extensions\cliqz@cliqz.com\unins000.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2014-10-05 19:14:03
ComboFix-quarantined-files.txt 2014-10-05 17:14
.
Vor Suchlauf: 28 Verzeichnis(se), 160.441.282.560 Bytes frei
Nach Suchlauf: 36 Verzeichnis(se), 160.321.757.184 Bytes frei
.
- - End Of File - - 6A9E7965CA0C909D65508B3D59891E66
A36C5E4F47E84449FF07ED3517B43A31
Nachtrag:
System läuft weiterhin sehr langsam bis gar nicht