Trojaner-Board - IHAVENET Trojaner !

Hier gehts weiter:

Combofix Logfile:
Code:
ComboFix 13-03-01.01 - ***** 01.03.2013  18:03:01.1.8 - x64

Microsoft Windows 7 Professional   6.1.7601.1.1252.49.1031.18.4086.1255 [GMT 1:00]

ausgeführt von:: c:\users\*****\Desktop\Trojaner\ComboFix.exe

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

 * Neuer Wiederherstellungspunkt wurde erstellt

.

.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

c:\users\*****\AppData\Local\assembly\tmp

c:\users\Karen *****\AppData\Local\assembly\tmp

c:\users\Karen *****\AppData\Roaming\xpsrchvwl.dll

.

Infizierte Kopie von c:\windows\SysWow64\userinit.exe wurde gefunden und desinfiziert 

Kopie von - c:\windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe wurde wiederhergestellt 

.

.

(((((((((((((((((((((((   Dateien erstellt von 2013-02-01 bis 2013-03-01  ))))))))))))))))))))))))))))))

.

.

2013-03-01 17:14 . 2013-03-01 17:14        --------        d-----w-        c:\users\Default\AppData\Local\temp

2013-03-01 17:14 . 2013-03-01 17:14        --------        d-----w-        c:\users\Peter *****\AppData\Local\temp

2013-03-01 17:14 . 2013-03-01 17:14        --------        d-----w-        c:\users\Monika *****\AppData\Local\temp

2013-03-01 17:14 . 2013-03-01 17:14        --------        d-----w-        c:\users\Michael *****\AppData\Local\temp

2013-03-01 17:14 . 2013-03-01 17:14        --------        d-----w-        c:\users\Friedhelm *****\AppData\Local\temp

2013-03-01 12:42 . 2013-03-01 12:55        --------        d-----w-        c:\users\*****\AppData\Local\CrashDumps

2013-03-01 07:06 . 2013-02-08 00:28        9162192        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{ED8C6DCB-B373-4333-8136-2A525F0175CC}\mpengine.dll

2013-02-25 15:12 . 2013-02-25 15:12        --------        d-----w-        c:\programdata\pcvisit Software AG

2013-02-25 15:12 . 2013-02-25 15:12        --------        d-----w-        c:\windows\Sun

2013-02-25 15:12 . 2013-02-25 15:12        --------        d-----w-        c:\program files (x86)\Common Files\Java

2013-02-25 15:12 . 2013-02-25 15:11        861088        ----a-w-        c:\windows\SysWow64\npDeployJava1.dll

2013-02-25 15:12 . 2013-02-25 15:11        782240        ----a-w-        c:\windows\SysWow64\deployJava1.dll

2013-02-25 15:12 . 2013-02-25 15:11        95648        ----a-w-        c:\windows\SysWow64\WindowsAccessBridge-32.dll

2013-02-25 15:11 . 2013-02-25 15:11        --------        d-----w-        c:\program files (x86)\Java

2013-02-18 14:28 . 2013-02-18 14:28        --------        d-----w-        c:\users\Karen *****\AppData\Local\Macromedia

2013-02-18 12:10 . 2013-02-18 12:10        --------        d-----w-        c:\users\*****\AppData\Local\Macromedia

2013-02-18 12:09 . 2013-02-18 12:09        --------        d-----w-        c:\programdata\McAfee

2013-02-14 02:03 . 2013-01-09 01:10        996352        ----a-w-        c:\program files\Common Files\Microsoft Shared\VGX\VGX.dll

2013-02-14 02:03 . 2013-01-08 22:01        768000        ----a-w-        c:\program files (x86)\Common Files\Microsoft Shared\VGX\VGX.dll

2013-02-13 07:11 . 2013-01-05 05:53        5553512        ----a-w-        c:\windows\system32\ntoskrnl.exe

2013-02-13 07:11 . 2013-01-05 05:00        3967848        ----a-w-        c:\windows\SysWow64\ntkrnlpa.exe

2013-02-13 07:11 . 2013-01-05 05:00        3913064        ----a-w-        c:\windows\SysWow64\ntoskrnl.exe

2013-02-13 07:11 . 2013-01-04 03:26        3153408        ----a-w-        c:\windows\system32\win32k.sys

2013-02-13 07:11 . 2013-01-04 05:46        215040        ----a-w-        c:\windows\system32\winsrv.dll

2013-02-13 07:11 . 2013-01-04 04:51        5120        ----a-w-        c:\windows\SysWow64\wow32.dll

2013-02-13 07:11 . 2013-01-04 02:47        25600        ----a-w-        c:\windows\SysWow64\setup16.exe

2013-02-13 07:11 . 2013-01-04 02:47        7680        ----a-w-        c:\windows\SysWow64\instnm.exe

2013-02-13 07:11 . 2013-01-04 02:47        14336        ----a-w-        c:\windows\SysWow64\ntvdm64.dll

2013-02-13 07:11 . 2013-01-04 02:47        2048        ----a-w-        c:\windows\SysWow64\user.exe

2013-02-13 07:11 . 2013-01-03 06:00        1913192        ----a-w-        c:\windows\system32\drivers\tcpip.sys

2013-02-13 07:11 . 2013-01-03 06:00        288088        ----a-w-        c:\windows\system32\drivers\FWPKCLNT.SYS

2013-02-06 11:30 . 2013-02-06 11:30        --------        d-----w-        c:\users\Karen *****\AppData\Roaming\FVBS

2013-02-06 10:51 . 2013-02-06 11:16        --------        d-----w-        c:\users\Karen *****\AppData\Roaming\Finanzportal24

2013-02-06 10:51 . 2013-02-06 11:16        --------        d-----w-        c:\programdata\Finanzportal24

.

.

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2013-02-27 10:13 . 2012-06-26 18:39        71024        ----a-w-        c:\windows\SysWow64\FlashPlayerCPLApp.cpl

2013-02-27 10:13 . 2012-06-26 18:39        691568        ----a-w-        c:\windows\SysWow64\FlashPlayerApp.exe

2013-02-14 02:05 . 2012-06-26 16:57        70004024        ----a-w-        c:\windows\system32\MRT.exe

2013-01-17 00:28 . 2010-11-21 03:27        273840        ------w-        c:\windows\system32\MpSigStub.exe

2013-01-04 04:43 . 2013-02-13 07:11        44032        ----a-w-        c:\windows\apppatch\acwow64.dll

2012-12-16 17:11 . 2012-12-21 16:27        46080        ----a-w-        c:\windows\system32\atmlib.dll

2012-12-16 14:45 . 2012-12-21 16:27        367616        ----a-w-        c:\windows\system32\atmfd.dll

2012-12-16 14:13 . 2012-12-21 16:27        295424        ----a-w-        c:\windows\SysWow64\atmfd.dll

2012-12-16 14:13 . 2012-12-21 16:27        34304        ----a-w-        c:\windows\SysWow64\atmlib.dll

2012-12-07 13:20 . 2013-01-09 07:30        441856        ----a-w-        c:\windows\system32\Wpc.dll

2012-12-07 13:15 . 2013-01-09 07:30        2746368        ----a-w-        c:\windows\system32\gameux.dll

2012-12-07 12:26 . 2013-01-09 07:30        308736        ----a-w-        c:\windows\SysWow64\Wpc.dll

2012-12-07 12:20 . 2013-01-09 07:30        2576384        ----a-w-        c:\windows\SysWow64\gameux.dll

2012-12-07 11:20 . 2013-01-09 07:30        30720        ----a-w-        c:\windows\system32\usk.rs

2012-12-07 11:20 . 2013-01-09 07:30        43520        ----a-w-        c:\windows\system32\csrr.rs

2012-12-07 11:20 . 2013-01-09 07:30        23552        ----a-w-        c:\windows\system32\oflc.rs

2012-12-07 11:20 . 2013-01-09 07:30        45568        ----a-w-        c:\windows\system32\oflc-nz.rs

2012-12-07 11:20 . 2013-01-09 07:30        44544        ----a-w-        c:\windows\system32\pegibbfc.rs

2012-12-07 11:20 . 2013-01-09 07:30        20480        ----a-w-        c:\windows\system32\pegi-fi.rs

2012-12-07 11:20 . 2013-01-09 07:30        20480        ----a-w-        c:\windows\system32\pegi-pt.rs

2012-12-07 11:19 . 2013-01-09 07:30        20480        ----a-w-        c:\windows\system32\pegi.rs

2012-12-07 11:19 . 2013-01-09 07:30        46592        ----a-w-        c:\windows\system32\fpb.rs

2012-12-07 11:19 . 2013-01-09 07:30        40960        ----a-w-        c:\windows\system32\cob-au.rs

2012-12-07 11:19 . 2013-01-09 07:30        21504        ----a-w-        c:\windows\system32\grb.rs

2012-12-07 11:19 . 2013-01-09 07:30        15360        ----a-w-        c:\windows\system32\djctq.rs

2012-12-07 11:19 . 2013-01-09 07:30        55296        ----a-w-        c:\windows\system32\cero.rs

2012-12-07 11:19 . 2013-01-09 07:30        51712        ----a-w-        c:\windows\system32\esrb.rs

2012-12-07 10:46 . 2013-01-09 07:30        43520        ----a-w-        c:\windows\SysWow64\csrr.rs

2012-12-07 10:46 . 2013-01-09 07:30        30720        ----a-w-        c:\windows\SysWow64\usk.rs

2012-12-07 10:46 . 2013-01-09 07:30        45568        ----a-w-        c:\windows\SysWow64\oflc-nz.rs

2012-12-07 10:46 . 2013-01-09 07:30        44544        ----a-w-        c:\windows\SysWow64\pegibbfc.rs

2012-12-07 10:46 . 2013-01-09 07:30        23552        ----a-w-        c:\windows\SysWow64\oflc.rs

2012-12-07 10:46 . 2013-01-09 07:30        20480        ----a-w-        c:\windows\SysWow64\pegi-pt.rs

2012-12-07 10:46 . 2013-01-09 07:30        20480        ----a-w-        c:\windows\SysWow64\pegi-fi.rs

2012-12-07 10:46 . 2013-01-09 07:30        46592        ----a-w-        c:\windows\SysWow64\fpb.rs

2012-12-07 10:46 . 2013-01-09 07:30        20480        ----a-w-        c:\windows\SysWow64\pegi.rs

2012-12-07 10:46 . 2013-01-09 07:30        21504        ----a-w-        c:\windows\SysWow64\grb.rs

2012-12-07 10:46 . 2013-01-09 07:30        40960        ----a-w-        c:\windows\SysWow64\cob-au.rs

2012-12-07 10:46 . 2013-01-09 07:30        15360        ----a-w-        c:\windows\SysWow64\djctq.rs

2012-12-07 10:46 . 2013-01-09 07:30        55296        ----a-w-        c:\windows\SysWow64\cero.rs

2012-12-07 10:46 . 2013-01-09 07:30        51712        ----a-w-        c:\windows\SysWow64\esrb.rs

.

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-12-03 946352]

"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2012-08-09 348664]

"Act.Outlook.Service"="c:\program files (x86)\ACT\Act for Windows\Act.Outlook.Service.exe" [2011-11-15 18432]

"Act! Preloader"="c:\program files (x86)\ACT\Act for Windows\ActSage.exe" [2011-11-15 337224]

"FreePDF Assistant"="c:\program files (x86)\FreePDF_XP\fpassist.exe" [2011-02-23 371200]

"SweetIM"="c:\program files (x86)\SweetIM\Messenger\SweetIM.exe" [2012-10-04 115032]

"Sweetpacks Communicator"="c:\program files (x86)\SweetIM\Communicator\SweetPacksUpdateManager.exe" [2012-08-15 231768]

"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-07-03 252848]

.

c:\users\*****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

Persbackup.lnk - c:\program files (x86)\Personal Backup 5\Persbackup.exe [N/A]

.

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

Sage ACT! Integration.lnk - c:\program files (x86)\ACT\Act for Windows\Sage.ACT.Integration.exe [2011-11-15 97792]

Snagit 11.lnk - c:\program files (x86)\TechSmith\Snagit 11\Snagit32.exe [2012-3-8 8873888]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 0 (0x0)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableLUA"= 0 (0x0)

"EnableUIADesktopToggle"= 0 (0x0)

"PromptOnSecureDesktop"= 0 (0x0)

.

R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]

R2 Sage ACT! Scheduler;Sage ACT! Scheduler;c:\program files (x86)\ACT\Act for Windows\Act.Scheduler.exe [2011-11-15 81920]

R3 BthKicker;Apple Bluetooth Device Driver;c:\windows\system32\DRIVERS\BthKicker.sys [2011-03-25 8704]

R3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys [2010-11-21 71168]

R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2012-08-23 19456]

R3 SNTUSB64;SafeNet USB SuperPro/UltraPro/HardwareKey;c:\windows\system32\DRIVERS\SNTUSB64.SYS [2010-10-20 59048]

R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2012-08-23 57856]

R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [2012-08-23 30208]

R4 MSSQLServerADHelper100;SQL Active Directory Helper Service;c:\program files\Microsoft SQL Server\100\Shared\SQLADHLP.EXE [2011-09-21 59744]

R4 RsFx0151;RsFx0151 Driver;c:\windows\system32\DRIVERS\RsFx0151.sys [2011-06-17 313696]

R4 SQLAgent$ACT7;SQL Server Agent (ACT7);c:\program files\Microsoft SQL Server\MSSQL10_50.ACT7\MSSQL\Binn\SQLAGENT.EXE [2011-06-17 431456]

S0 AppleHFS;AppleHFS; [x]

S0 AppleMNT;AppleMNT; [x]

S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys [2012-05-09 27760]

S2 ActService;ACT! Service Host;c:\program files (x86)\ACT\Act for Windows\Act.Server.Host.exe [2011-11-15 18432]

S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2011-06-13 203776]

S2 AntiVirMailService;Avira Email Schutz;c:\program files (x86)\Avira\AntiVir Desktop\avmailc.exe [2012-05-09 375760]

S2 AntiVirSchedulerService;Avira Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [2012-05-09 86224]

S2 AntiVirWebService;Avira Browser Schutz;c:\program files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [2012-05-09 465360]

S2 AppleOSSMgr;Apple OS Switch Manager;c:\windows\system32\AppleOSSMgr.exe [2011-06-29 224640]

S2 AppleTimeSrv;Apple-Time-Server;c:\windows\system32\AppleTimeSrv.exe [2011-06-29 111488]

S2 FVBS_ASS_DBKunden;FVBS_ASS_DBKunden;c:\program files (x86)\FVBS\FVBS_ASS_DBKunden.exe [2013-01-07 1087488]

S2 FVBS_ASS_DBMain_IB;FVBS_ASS_DBMain_IB;c:\program files (x86)\FVBS\FVBS_ASS_DBMain_IB.exe [2012-07-13 920576]

S2 FVBS_ASS_Lizenz;FVBS_ASS_Lizenz;c:\program files (x86)\FVBS\FVBS_ASS_Lizenz.exe [2013-01-03 616960]

S2 KeyAgent;KeyAgent;c:\windows\system32\drivers\KeyAgent.sys [2011-06-29 17752]

S2 MacHALDriver;Mac HAL;c:\windows\system32\drivers\MacHALDriver.sys [2011-06-29 22872]

S2 MSSQL$ACT7;SQL Server (ACT7);c:\program files\Microsoft SQL Server\MSSQL10_50.ACT7\MSSQL\Binn\sqlservr.exe [2011-06-17 62111072]

S2 Sentinel64;Sentinel64;c:\windows\System32\Drivers\Sentinel64.sys [2009-09-17 145448]

S3 AppleDisplayFlt;Apple Display Driver;c:\windows\system32\DRIVERS\aaplmonf.sys [2011-03-25 10752]

S3 KeyMagic;USB Keyboard HID Filter;c:\windows\system32\DRIVERS\KeyMagic.sys [2011-05-26 32256]

.

.

Inhalt des "geplante Tasks" Ordners

.

2013-03-01 c:\windows\Tasks\Adobe Flash Player Updater.job

- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-06-26 10:13]

.

2013-03-01 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-09-14 07:15]

.

2013-03-01 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-09-14 07:15]

.

.

--------- X64 Entries -----------

.

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2011-03-25 8114720]

"Apple_KbdMgr"="c:\program files\Boot Camp\Bootcamp.exe" [2011-06-29 741760]

.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost  - LocalService

FontCache

.

------- Zusätzlicher Suchlauf -------

.

uLocal Page = c:\windows\system32\blank.htm

uStart Page = hxxp://www.google.de/

mLocal Page = c:\windows\SysWOW64\blank.htm

IE: An OneNote s&enden - c:\progra~2\MICROS~1\Office14\ONBttnIE.dll/105

IE: Google Sidewiki... - c:\program files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_6CE5017F567343CA.dll/cmsidewiki.html

IE: Nach Microsoft E&xcel exportieren - c:\progra~2\MICROS~1\Office14\EXCEL.EXE/3000

LSP: c:\program files (x86)\Avira\AntiVir Desktop\avsda.dll

TCP: DhcpNameServer = 192.168.251.221 212.95.97.144

FF - ProfilePath - c:\users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\9tgdaliy.default\

FF - prefs.js: keyword.URL - hxxp://search.sweetim.com/search.asp?barid={E287FAF6-E61A-11E1-88D2-00236CBAFC27}&src=2&q=

.

.

--------------------- Gesperrte Registrierungsschluessel ---------------------

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_6_602_171_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]

@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_6_602_171_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="IFlashBroker5"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_6_602_171_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_6_602_171_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Shockwave Flash Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_171.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]

@="0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]

@="ShockwaveFlash.ShockwaveFlash.11"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_171.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="ShockwaveFlash.ShockwaveFlash"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Macromedia Flash Factory Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_171.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]

@="FlashFactory.FlashFactory.1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_171.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="FlashFactory.FlashFactory"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="IFlashBroker5"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]

@Denied: (A) (Everyone)

"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]

@Denied: (A) (Everyone)

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]

"Key"="ActionsPane3"

"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

------------------------ Weitere laufende Prozesse ------------------------

.

c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

c:\program files (x86)\Avira\AntiVir Desktop\avguard.exe

c:\progra~2\Borland\INTERB~1\Bin\ibguard.exe

c:\program files (x86)\Common Files\Protexis\License Service\PsiService_2.exe

c:\program files (x86)\Microsoft SQL Server\90\Shared\sqlbrowser.exe

c:\progra~2\Borland\INTERB~1\Bin\ibserver.exe

c:\program files (x86)\TechSmith\Snagit 11\TSCHelp.exe

c:\program files (x86)\TechSmith\Snagit 11\SnagPriv.exe

c:\program files (x86)\TechSmith\Snagit 11\snagiteditor.exe

.

**************************************************************************

.

Zeit der Fertigstellung: 2013-03-01  18:24:59 - PC wurde neu gestartet

ComboFix-quarantined-files.txt  2013-03-01 17:24

.

Vor Suchlauf: 10 Verzeichnis(se), 251.068.678.144 Bytes frei

Nach Suchlauf: 16 Verzeichnis(se), 252.861.235.200 Bytes frei

.

- - End Of File - - 4F547AFAD4B9708593DAEDFAF8E8B73F
--- --- ---
[/CODE]