Trojaner-Board - Suchmaschinenergebnisse führen zu falschen Seiten!

sorry. natürlich will ich, dass du mir hilfst. folge jetzt strikt den anweisungen :-)..

hier das lig-file:

Combofix Logfile:
Code:
ComboFix 12-10-22.01 - VORNAME NACHNAME 22.10.2012  17:27:26.1.8 - x64

Microsoft Windows 7 Professional   6.1.7601.1.1252.49.1031.18.4087.2302 [GMT 2:00]

ausgeführt von:: e:\users\VORNAME NACHNAME\Desktop\ComboFix.exe

AV: Kaspersky Internet Security *Disabled/Updated* {2EAA32A5-1EE1-1B22-95DA-337730C6E984}

FW: Kaspersky Internet Security *Disabled* {1691B380-548E-1A7A-BE85-9A42CE15AEFF}

SP: Kaspersky Internet Security *Disabled/Updated* {95CBD341-38DB-14AC-AF6A-08054B41A339}

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

c:\windows\SysWow64\lsprst7.dll

.

.

(((((((((((((((((((((((   Dateien erstellt von 2012-09-22 bis 2012-10-22  ))))))))))))))))))))))))))))))

.

.

2012-10-22 15:30 . 2012-10-22 15:30        --------        d-----w-        c:\users\Lisa NACHNAME\AppData\Local\temp

2012-10-22 15:30 . 2012-10-22 15:30        --------        d-----w-        c:\users\Default\AppData\Local\temp

2012-10-21 19:36 . 2012-10-21 19:36        --------        d-----w-        c:\program files\CCleaner

2012-10-21 17:33 . 2012-10-21 17:33        --------        d-----w-        C:\TDSSKiller_Quarantine

2012-10-21 17:19 . 2012-10-21 17:19        --------        d-----w-        c:\users\VORNAME NACHNAME\AppData\Roaming\Malwarebytes

2012-10-21 17:19 . 2012-10-21 17:19        --------        d-----w-        c:\programdata\Malwarebytes

2012-10-21 17:19 . 2012-09-29 17:54        25928        ----a-w-        c:\windows\system32\drivers\mbam.sys

2012-10-21 17:05 . 2012-10-21 17:05        --------        d-----w-        c:\programdata\Sophos

2012-10-21 17:05 . 2012-10-21 17:05        73728        ----a-r-        c:\users\VORNAME NACHNAME\AppData\Roaming\Microsoft\Installer\{B829E117-D072-41EA-9606-9826A38D34C1}\SVRTgui.exe1_810EDD9E2F0A4E2BACF86673C38D9F48.exe

2012-10-21 17:05 . 2012-10-21 17:05        73728        ----a-r-        c:\users\VORNAME NACHNAME\AppData\Roaming\Microsoft\Installer\{B829E117-D072-41EA-9606-9826A38D34C1}\SVRTgui.exe_810EDD9E2F0A4E2BACF86673C38D9F48.exe

2012-10-21 17:05 . 2012-10-21 17:05        73728        ----a-r-        c:\users\VORNAME NACHNAME\AppData\Roaming\Microsoft\Installer\{B829E117-D072-41EA-9606-9826A38D34C1}\ARPPRODUCTICON.exe

2012-10-21 15:30 . 2012-10-21 15:30        --------        d-----w-        c:\program files (x86)\ESET

2012-10-19 19:58 . 2012-10-19 20:00        --------        d-----w-        c:\users\VORNAME NACHNAME\AppData\Roaming\Apple Computer

2012-10-19 19:58 . 2012-10-19 19:58        --------        d-----w-        c:\users\VORNAME NACHNAME\AppData\Local\Apple Computer

2012-10-19 19:58 . 2012-10-19 19:58        --------        dc----w-        c:\windows\system32\DRVSTORE

2012-10-19 19:58 . 2012-08-21 11:01        33240        ----a-w-        c:\windows\system32\drivers\GEARAspiWDM.sys

2012-10-19 19:56 . 2012-10-12 07:19        9291768        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{00990A6E-D3C2-435F-83D1-89BEC86FECB2}\mpengine.dll

2012-10-11 18:38 . 2012-06-02 05:41        1464320        ----a-w-        c:\windows\system32\crypt32.dll

2012-10-11 18:38 . 2012-06-02 05:41        184320        ----a-w-        c:\windows\system32\cryptsvc.dll

2012-10-11 18:38 . 2012-06-02 05:41        140288        ----a-w-        c:\windows\system32\cryptnet.dll

2012-10-11 18:38 . 2012-06-02 04:36        140288        ----a-w-        c:\windows\SysWow64\cryptsvc.dll

2012-10-11 18:38 . 2012-06-02 04:36        1159680        ----a-w-        c:\windows\SysWow64\crypt32.dll

2012-10-11 18:38 . 2012-06-02 04:36        103936        ----a-w-        c:\windows\SysWow64\cryptnet.dll

2012-10-03 12:42 . 2012-08-21 21:01        245760        ----a-w-        c:\windows\system32\OxpsConverter.exe

2012-10-03 12:42 . 2012-08-22 18:12        1913200        ----a-w-        c:\windows\system32\drivers\tcpip.sys

2012-10-03 12:42 . 2012-08-22 18:12        950128        ----a-w-        c:\windows\system32\drivers\ndis.sys

2012-10-03 12:42 . 2012-08-22 18:12        376688        ----a-w-        c:\windows\system32\drivers\netio.sys

2012-10-03 12:42 . 2012-08-22 18:12        288624        ----a-w-        c:\windows\system32\drivers\FWPKCLNT.SYS

2012-10-03 12:42 . 2012-07-04 20:26        41472        ----a-w-        c:\windows\system32\drivers\RNDISMP.sys

2012-10-03 12:13 . 2012-10-03 12:13        --------        d-----w-        c:\windows\system32\SPReview

2012-10-03 12:13 . 2012-10-03 12:13        --------        d-----w-        c:\windows\system32\EventProviders

.

.

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2012-10-11 19:52 . 2012-04-17 13:58        696760        ----a-w-        c:\windows\SysWow64\FlashPlayerApp.exe

2012-10-11 19:52 . 2012-02-25 13:13        73656        ----a-w-        c:\windows\SysWow64\FlashPlayerCPLApp.cpl

2012-10-11 19:40 . 2012-02-25 11:02        65309168        ----a-w-        c:\windows\system32\MRT.exe

2012-10-03 12:17 . 2009-07-14 02:36        175616        ----a-w-        c:\windows\system32\msclmd.dll

2012-10-03 12:17 . 2009-07-14 02:36        152576        ----a-w-        c:\windows\SysWow64\msclmd.dll

2012-08-28 21:53 . 2012-08-28 21:53        106496        ----a-w-        c:\windows\system32\ntlbnui2.exe

2012-08-26 20:30 . 2012-08-26 20:30        821736        ----a-w-        c:\windows\SysWow64\npDeployJava1.dll

2012-08-26 20:30 . 2012-08-26 20:30        746984        ----a-w-        c:\windows\SysWow64\deployJava1.dll

2012-08-26 20:30 . 2012-08-26 20:30        95208        ----a-w-        c:\windows\SysWow64\WindowsAccessBridge-32.dll

2012-08-21 11:01 . 2012-08-21 11:01        125872        ----a-w-        c:\windows\system32\GEARAspi64.dll

2012-08-21 11:01 . 2012-08-21 11:01        106928        ----a-w-        c:\windows\SysWow64\GEARAspi.dll

2012-08-20 17:38 . 2012-10-11 18:39        44032        ----a-w-        c:\windows\apppatch\acwow64.dll

2012-08-02 17:58 . 2012-09-12 15:22        574464        ----a-w-        c:\windows\system32\d3d10level9.dll

2012-08-02 16:57 . 2012-09-12 15:22        490496        ----a-w-        c:\windows\SysWow64\d3d10level9.dll

2012-07-28 04:09 . 2011-12-06 02:33        5538984        ----a-w-        c:\windows\SysWow64\atiumdag.dll

2012-07-28 04:07 . 2012-07-28 04:07        10278912        ----a-w-        c:\windows\system32\drivers\atikmdag.sys

2012-07-28 03:43 . 2012-07-28 03:43        70144        ----a-w-        c:\windows\system32\coinst_8.982.dll

2012-07-28 03:19 . 2012-07-28 03:19        24935424        ----a-w-        c:\windows\system32\atio6axx.dll

2012-07-28 02:50 . 2012-07-28 02:50        20546560        ----a-w-        c:\windows\SysWow64\atioglxx.dll

2012-07-28 02:15 . 2012-07-28 02:15        163840        ----a-w-        c:\windows\system32\atiapfxx.exe

2012-07-28 02:15 . 2011-12-06 03:17        931328        ----a-w-        c:\windows\SysWow64\aticfx32.dll

2012-07-28 02:13 . 2011-12-06 03:16        1100288        ----a-w-        c:\windows\system32\aticfx64.dll

2012-07-28 02:10 . 2012-07-28 02:10        442368        ----a-w-        c:\windows\system32\ATIDEMGX.dll

2012-07-28 02:10 . 2012-07-28 02:10        534528        ----a-w-        c:\windows\system32\atieclxx.exe

2012-07-28 02:09 . 2012-07-28 02:09        239616        ----a-w-        c:\windows\system32\atiesrxx.exe

2012-07-28 02:08 . 2012-07-28 02:08        120320        ----a-w-        c:\windows\system32\atitmm64.dll

2012-07-28 02:08 . 2012-07-28 02:08        21504        ----a-w-        c:\windows\system32\atimuixx.dll

2012-07-28 02:07 . 2012-07-28 02:07        59392        ----a-w-        c:\windows\system32\atiedu64.dll

2012-07-28 02:07 . 2012-07-28 02:07        43520        ----a-w-        c:\windows\SysWow64\ati2edxx.dll

2012-07-28 02:07 . 2012-06-11 17:16        6430208        ----a-w-        c:\windows\SysWow64\atidxx32.dll

2012-07-28 01:51 . 2011-12-06 02:51        7052288        ----a-w-        c:\windows\system32\atidxx64.dll

2012-07-28 01:41 . 2012-07-28 01:41        4266496        ----a-w-        c:\windows\system32\atiumd6a.dll

2012-07-28 01:35 . 2012-07-28 01:35        51200        ----a-w-        c:\windows\system32\aticalrt64.dll

2012-07-28 01:35 . 2012-07-28 01:35        46080        ----a-w-        c:\windows\SysWow64\aticalrt.dll

2012-07-28 01:35 . 2012-07-28 01:35        44544        ----a-w-        c:\windows\system32\aticalcl64.dll

2012-07-28 01:35 . 2012-07-28 01:35        44032        ----a-w-        c:\windows\SysWow64\aticalcl.dll

2012-07-28 01:34 . 2012-07-28 01:34        16034304        ----a-w-        c:\windows\system32\aticaldd64.dll

2012-07-28 01:32 . 2011-12-06 02:28        4751872        ----a-w-        c:\windows\SysWow64\atiumdva.dll

2012-07-28 01:30 . 2012-07-28 01:30        13605888        ----a-w-        c:\windows\SysWow64\aticaldd.dll

2012-07-28 01:25 . 2012-07-28 01:25        6676480        ----a-w-        c:\windows\system32\atiumd64.dll

2012-07-28 01:15 . 2012-07-28 01:15        540160        ----a-w-        c:\windows\system32\atiadlxx.dll

2012-07-28 01:15 . 2012-07-28 01:15        368640        ----a-w-        c:\windows\SysWow64\atiadlxy.dll

2012-07-28 01:15 . 2012-07-28 01:15        17920        ----a-w-        c:\windows\system32\atig6pxx.dll

2012-07-28 01:15 . 2012-07-28 01:15        14848        ----a-w-        c:\windows\SysWow64\atiglpxx.dll

2012-07-28 01:15 . 2012-07-28 01:15        14848        ----a-w-        c:\windows\system32\atiglpxx.dll

2012-07-28 01:15 . 2012-07-28 01:15        41984        ----a-w-        c:\windows\system32\atig6txx.dll

2012-07-28 01:14 . 2012-07-28 01:14        33280        ----a-w-        c:\windows\SysWow64\atigktxx.dll

2012-07-28 01:14 . 2012-07-28 01:14        368640        ----a-w-        c:\windows\system32\drivers\atikmpag.sys

2012-07-28 01:13 . 2011-12-06 02:11        129536        ----a-w-        c:\windows\system32\atiuxp64.dll

2012-07-28 01:13 . 2012-06-11 16:25        109568        ----a-w-        c:\windows\SysWow64\atiuxpag.dll

2012-07-28 01:13 . 2012-07-28 01:13        103936        ----a-w-        c:\windows\system32\atiu9p64.dll

2012-07-28 01:13 . 2011-12-06 02:11        83456        ----a-w-        c:\windows\SysWow64\atiu9pag.dll

2012-07-28 01:12 . 2012-07-28 01:12        53248        ----a-w-        c:\windows\system32\drivers\ati2erec.dll

2012-07-28 01:08 . 2012-07-28 01:08        56320        ----a-w-        c:\windows\system32\atimpc64.dll

2012-07-28 01:08 . 2012-07-28 01:08        56320        ----a-w-        c:\windows\system32\amdpcom64.dll

2012-07-28 01:08 . 2012-07-28 01:08        56832        ----a-w-        c:\windows\SysWow64\atimpc32.dll

2012-07-28 01:08 . 2012-07-28 01:08        56832        ----a-w-        c:\windows\SysWow64\amdpcom32.dll

2012-07-27 20:47 . 2012-07-27 20:47        187392        ----a-w-        c:\windows\system32\clinfo.exe

2012-07-27 20:47 . 2012-07-27 20:47        75776        ----a-w-        c:\windows\system32\OpenVideo64.dll

2012-07-27 20:47 . 2012-07-27 20:47        65024        ----a-w-        c:\windows\SysWow64\OpenVideo.dll

2012-07-27 20:47 . 2012-07-27 20:47        63488        ----a-w-        c:\windows\system32\OVDecode64.dll

2012-07-27 20:47 . 2012-07-27 20:47        56320        ----a-w-        c:\windows\SysWow64\OVDecode.dll

2012-07-27 20:46 . 2012-07-27 20:46        16464896        ----a-w-        c:\windows\system32\amdocl64.dll

2012-07-27 20:46 . 2012-07-27 20:46        13013504        ----a-w-        c:\windows\SysWow64\amdocl.dll

.

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]

@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]

2012-02-14 22:58        94208        ----a-w-        c:\users\VORNAME NACHNAME\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]

@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]

2012-02-14 22:58        94208        ----a-w-        c:\users\VORNAME NACHNAME\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]

@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]

2012-02-14 22:58        94208        ----a-w-        c:\users\VORNAME NACHNAME\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]

@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]

2012-02-14 22:58        94208        ----a-w-        c:\users\VORNAME NACHNAME\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2012-07-13 17418928]

"TomTomHOME.exe"="d:\program files (x86)\TomTom HOME 2\TomTomHOMERunner.exe" [2012-08-28 247768]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

"AMD AVT"="start AMD Accelerated Video Transcoding device initialization" [X]

"AVP"="c:\program files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe" [2011-04-24 202296]

"BCSSync"="d:\program files (x86)\Microsoft Office\Office14\BCSSync.exe" [2010-03-13 91520]

"RUSB3MON"="c:\program files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\rusb3mon.exe" [2012-02-25 115048]

"NUSB3MON"="c:\program files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe" [2012-02-25 113288]

"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-07-27 919008]

"WinampAgent"="d:\program files (x86)\Winamp\winampa.exe" [2011-12-09 74752]

"AdobeCS5ServiceManager"="c:\program files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe" [2010-02-22 406992]

"SwitchBoard"="c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]

"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-07-03 252848]

"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2012-08-06 642216]

"RIMBBLaunchAgent.exe"="c:\program files (x86)\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe" [2011-11-02 90448]

"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-08-27 59280]

"iTunesHelper"="d:\program files (x86)\iTunes\iTunesHelper.exe" [2012-09-09 421776]

.

c:\users\Lisa NACHNAME\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

Dropbox.lnk - c:\users\VORNAME NACHNAME\AppData\Roaming\Dropbox\bin\Dropbox.exe [2012-5-24 27112840]

.

c:\users\VORNAME NACHNAME\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

Dropbox.lnk - c:\users\VORNAME NACHNAME\AppData\Roaming\Dropbox\bin\Dropbox.exe [2012-5-24 27112840]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 0 (0x0)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableLUA"= 0 (0x0)

"EnableUIADesktopToggle"= 0 (0x0)

"PromptOnSecureDesktop"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]

"LoadAppInit_DLLs"=0 (0x0)

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]

"DisableMonitoring"=dword:00000001

.

R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]

R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2012-07-13 160944]

R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-10-11 250808]

R3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;d:\program files (x86)\Microsoft Office\Office14\GROOVE.EXE [2011-06-12 31125880]

R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-08-28 113120]

R3 SwitchBoard;SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]

R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 59392]

R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [2012-07-09 52736]

S1 kl2;kl2;c:\windows\system32\DRIVERS\kl2.sys [2011-03-04 11864]

S1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter;c:\windows\system32\DRIVERS\klim6.sys [2011-03-10 29488]

S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-14 59904]

S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-07-27 63960]

S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2012-07-28 239616]

S2 Application Updater;Application Updater;c:\program files (x86)\Application Updater\ApplicationUpdater.exe [2012-10-09 799112]

S2 at64;RAS-Verbindungsverwaltung Partitions-Manager pcmcia;c:\windows\system32\ntlbnui2.exe [2012-08-28 106496]

S2 TomTomHOMEService;TomTomHOMEService;d:\program files (x86)\TomTom HOME 2\TomTomHOMEService.exe [2012-08-28 92632]

S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [2012-07-28 10278912]

S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [2012-07-28 368640]

S3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys [2012-05-14 96896]

S3 klmouflt;Kaspersky Lab KLMOUFLT;c:\windows\system32\DRIVERS\klmouflt.sys [2009-11-02 22544]

S3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\nusb3hub.sys [2012-02-25 92672]

S3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;c:\windows\system32\DRIVERS\nusb3xhc.sys [2012-02-25 209408]

S3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4925184]

S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2011-06-10 539240]

.

.

Inhalt des "geplante Tasks" Ordners

.

2012-10-21 c:\windows\Tasks\Adobe Flash Player Updater.job

- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-17 19:52]

.

.

--------- X64 Entries -----------

.

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]

@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]

2012-02-14 22:58        97792        ----a-w-        c:\users\VORNAME NACHNAME\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]

@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]

2012-02-14 22:58        97792        ----a-w-        c:\users\VORNAME NACHNAME\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]

@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]

2012-02-14 22:58        97792        ----a-w-        c:\users\VORNAME NACHNAME\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]

@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]

2012-02-14 22:58        97792        ----a-w-        c:\users\VORNAME NACHNAME\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"AdobeAAMUpdater-1.0"="c:\program files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2010-03-06 500208]

.

------- Zusätzlicher Suchlauf -------

.

uLocal Page = c:\windows\system32\blank.htm

uStart Page = hxxp://www.n-tv.de/

mLocal Page = c:\windows\system32\blank.htm

uInternet Settings,ProxyOverride = *.local

TCP: DhcpNameServer = 192.168.1.1

FF - ProfilePath - c:\users\VORNAME NACHNAME\AppData\Roaming\Mozilla\Firefox\Profiles\gohbz5cg.default\

FF - prefs.js: browser.search.selectedEngine - Yahoo

FF - prefs.js: keyword.URL - hxxp://de.search.yahoo.com/search?fr=greentree_ff1&ei=utf-8&ilc=12&type=386496&p=

.

- - - - Entfernte verwaiste Registrierungseinträge - - - -

.

Toolbar-Locked - (no file)

Toolbar-{E634228A-03CF-4BC8-B0AB-668257F1FD8C} - (no file)

Wow6432Node-HKCU-Run-AdobeBridge - (no file)

Wow6432Node-HKLM-Run-<NO NAME> - (no file)

SafeBoot-58072519.sys

.

.

.

--------------------- Gesperrte Registrierungsschluessel ---------------------

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_4_402_287_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]

@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_4_402_287_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="IFlashBroker5"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_4_402_287_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_4_402_287_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Shockwave Flash Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_287.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]

@="0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]

@="ShockwaveFlash.ShockwaveFlash.11"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_287.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="ShockwaveFlash.ShockwaveFlash"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Macromedia Flash Factory Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_287.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]

@="FlashFactory.FlashFactory.1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_287.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="FlashFactory.FlashFactory"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="IFlashBroker5"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]

@Denied: (A) (Everyone)

"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]

@Denied: (A) (Everyone)

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]

"Key"="ActionsPane3"

"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

Zeit der Fertigstellung: 2012-10-22  17:32:19

ComboFix-quarantined-files.txt  2012-10-22 15:32

.

Vor Suchlauf: 8 Verzeichnis(se), 20.242.612.224 Bytes frei

Nach Suchlauf: 12 Verzeichnis(se), 20.723.310.592 Bytes frei

.

- - End Of File - - C61B2178643B0266390E9C2C1C21B059
--- --- ---
ach ja: das wort, das immer oben in dem reiter kutz anzeigt wird lautet: googlesyndication