| Jams1906 | 14.06.2014 12:57 |
Hallo Jürgen,
ich hoffe du bist heute morgen gut aus dem Bett gekommen :pfeiff:
Schrauber hatte mir heute morgen in dem anderen Therad geantwortet und gesagt ich soll Combofix machen, hier das Ergebniss: Code:
ComboFix 14-06-13.01 - Janos Metz 14.06.2014 9:31.1.2 - x86
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.49.1031.18.3327.1416 [GMT 2:00]
ausgeführt von:: c:\users\Janos Metz\Downloads\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {4D041356-F94D-285F-8768-AAE50FA36859}
AV: Norton Internet Security *Disabled/Outdated* {D87FA2C0-F526-77B1-D6EC-0EDF3936CEDB}
FW: Norton Internet Security *Disabled* {E04423E5-BF49-76E9-FDB3-A7EAC7E589A0}
SP: Avira Desktop *Disabled/Updated* {F665F2B2-DF77-27D1-BDD8-9197742422E4}
SP: Norton Internet Security *Disabled/Outdated* {631E4324-D31C-783F-EC5C-35AD42B18466}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Janos Metz\4.0
c:\users\Janos Metz\AppData\Local\assembly\tmp
c:\windows\system32\pt
c:\windows\system32\pt\Lagoon.resources.dll
.
.
((((((((((((((((((((((( Dateien erstellt von 2014-05-14 bis 2014-06-14 ))))))))))))))))))))))))))))))
.
.
2014-06-14 07:43 . 2014-06-14 07:43 -------- d-----w- c:\users\Default\AppData\Local\temp
2014-06-13 22:02 . 2014-06-13 22:04 -------- d-----w- C:\FRST
2014-06-13 13:02 . 2014-03-04 09:20 3969984 ----a-w- c:\windows\system32\ntkrnlpa.exe
2014-06-13 13:01 . 2014-06-08 08:48 391680 ----a-w- c:\windows\system32\aepdu.dll
2014-06-13 13:01 . 2014-06-08 08:43 302592 ----a-w- c:\windows\system32\aeinv.dll
2014-06-13 12:59 . 2014-04-25 02:06 626688 ----a-w- c:\windows\system32\usp10.dll
2014-06-13 12:49 . 2014-06-14 07:13 -------- d-s---w- c:\windows\system32\CompatTel
2014-06-13 12:45 . 2014-06-14 07:19 -------- d-----w- c:\users\Janos Metz\AppData\Roaming\DropboxMaster
2014-05-16 06:56 . 2014-05-16 06:56 1619632 ----a-w- c:\program files\Common Files\Microsoft Shared\OFFICE12\OGL.DLL
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-06-13 12:51 . 2013-10-18 14:41 93528 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2014-06-13 12:51 . 2013-10-18 14:41 136216 ----a-w- c:\windows\system32\drivers\avipbb.sys
2014-04-03 08:22 . 2012-03-30 05:26 692616 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2014-04-03 08:22 . 2011-05-17 03:22 71048 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2014-03-31 20:46 . 2014-03-31 20:46 130712 ----a-w- c:\windows\system32\MSSTDFMT.DLL
2014-03-31 20:46 . 2014-03-31 20:46 1070232 ----a-w- c:\windows\system32\MSCOMCTL.OCX
2014-03-25 18:08 . 2013-10-18 14:41 69240 ----a-w- c:\windows\system32\drivers\avnetflt.sys
2014-03-23 13:28 . 2014-03-23 13:28 645120 ----a-w- c:\windows\system32\jsIntl.dll
2014-03-23 13:28 . 2014-03-23 13:28 194048 ----a-w- c:\windows\system32\elshyph.dll
2014-03-23 13:28 . 2014-03-23 13:28 71680 ----a-w- c:\windows\system32\RegisterIEPKEYs.exe
2014-03-23 13:28 . 2014-03-23 13:28 62464 ----a-w- c:\windows\system32\tdc.ocx
2014-03-23 13:28 . 2014-03-23 13:28 337408 ----a-w- c:\windows\system32\html.iec
2014-03-23 13:28 . 2014-03-23 13:28 24576 ----a-w- c:\windows\system32\licmgr10.dll
2014-03-23 13:28 . 2014-03-23 13:28 182272 ----a-w- c:\windows\system32\msls31.dll
2014-03-23 13:28 . 2014-03-23 13:28 151552 ----a-w- c:\windows\system32\iexpress.exe
2014-03-23 13:28 . 2014-03-23 13:28 139264 ----a-w- c:\windows\system32\wextract.exe
2014-03-23 13:28 . 2014-03-23 13:28 86016 ----a-w- c:\windows\system32\iesysprep.dll
2014-03-23 13:28 . 2014-03-23 13:28 74240 ----a-w- c:\windows\system32\SetIEInstalledDate.exe
2014-03-23 13:28 . 2014-03-23 13:28 61952 ----a-w- c:\windows\system32\MshtmlDac.dll
2014-03-23 13:28 . 2014-03-23 13:28 48640 ----a-w- c:\windows\system32\mshtmler.dll
2014-03-23 13:28 . 2014-03-23 13:28 36352 ----a-w- c:\windows\system32\imgutil.dll
2014-03-23 13:28 . 2014-03-23 13:28 13312 ----a-w- c:\windows\system32\mshta.exe
2014-03-23 13:28 . 2014-03-23 13:28 111616 ----a-w- c:\windows\system32\IEAdvpack.dll
2014-03-23 13:27 . 2014-03-23 13:27 640512 ----a-w- c:\windows\system32\advapi32.dll
2014-03-23 13:27 . 2014-03-23 13:27 619520 ----a-w- c:\windows\system32\tdh.dll
2014-03-23 13:27 . 2014-03-23 13:27 1289096 ----a-w- c:\windows\system32\ntdll.dll
2014-03-23 13:27 . 2014-03-23 13:27 338944 ----a-w- c:\windows\system32\drivers\afd.sys
2014-03-23 13:27 . 2014-03-23 13:27 231424 ----a-w- c:\windows\system32\mswsock.dll
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\~\Browser Helper Objects\{41564952-412D-5637-00A7-7A786E7484D7}]
2014-02-13 05:22 12240 ----a-w- c:\program files\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{41564952-412D-5637-00A7-7A786E7484D7}"= "c:\program files\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport.dll" [2014-02-13 12240]
.
[HKEY_CLASSES_ROOT\clsid\{41564952-412d-5637-00a7-7a786e7484d7}]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-10 23:54 131248 ----a-w- c:\users\Janos Metz\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-10 23:54 131248 ----a-w- c:\users\Janos Metz\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-10 23:54 131248 ----a-w- c:\users\Janos Metz\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1174016]
"AusweisApp"="c:\program files\AusweisApp\siqBootLoader.exe" [2013-01-04 2514560]
"HP Deskjet 3050A J611 series (NET)"="c:\program files\HP\HP Deskjet 3050A J611 series\Bin\ScanToPCActivationApp.exe" [2011-06-08 1804648]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CLMLServer"="c:\program files\CyberLink\Power2Go\CLMLSvc.exe" [2009-06-03 103720]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2009-11-10 7866912]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-11-21 959904]
"Windows Mobile Device Center"="c:\windows\WindowsMobile\wmdc.exe" [2007-05-31 648072]
"FreePDF Assistant"="c:\program files\FreePDF_XP\fpassist.exe" [2011-02-23 371200]
"HP Software Update"="c:\program files\Hp\HP Software Update\HPWuSchd2.exe" [2011-03-24 49208]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2013-04-21 59720]
"PDFPrint"="c:\program files\PDF24\pdf24.exe" [2013-03-20 162856]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2013-03-12 253816]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2013-05-31 152392]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2014-06-13 737872]
"ApnTBMon"="c:\program files\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe" [2014-02-13 1758160]
.
c:\users\Janos Metz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dropbox.lnk - c:\users\Janos Metz\AppData\Roaming\Dropbox\bin\Dropbox.exe /systemstartup [2014-5-20 33322312]
Facebook Messenger.lnk - c:\users\Janos Metz\AppData\Local\Facebook\Messenger\2.1.4814.0\FacebookMessenger.exe [2013-3-7 248240]
OpenOffice.org 3.3.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2010-12-13 1198592]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
R2 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [2013-10-23 172192]
R3 BBSvc;Bing Bar Update Service;c:\program files\Microsoft\BingBar\BBSvc.EXE [2011-02-28 183560]
R3 cjusb;REINER SCT cyberJack USB Driver;c:\windows\system32\DRIVERS\cjusb.sys [2011-03-29 28144]
R3 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance;c:\program files\Common Files\MAGIX Services\Database\bin\fbserver.exe [2008-08-07 3276800]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe [2014-05-30 108032]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224]
S0 nvamacpi;NVIDIA Away Mode System;c:\windows\system32\DRIVERS\NVAMACPI.sys [2009-06-04 24608]
S0 SymDS;Symantec Data Store;c:\windows\system32\drivers\NIS\1405000.01C\SYMDS.SYS [2013-05-21 367704]
S0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\NIS\1405000.01C\SYMEFA.SYS [2013-05-23 934488]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys [2013-10-10 37352]
S1 BHDrvx86;BHDrvx86;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.0.24\Definitions\BASHDefs\20131002.001\BHDrvx86.sys [2013-10-02 1097304]
S1 bizVSerial;Franson VSerial;c:\windows\system32\drivers\bizVSerialNT.sys [2007-05-31 14949]
S1 ccSet_NIS;Norton Internet Security Settings Manager;c:\windows\system32\drivers\NIS\1405000.01C\ccSetx86.sys [2013-04-16 134744]
S1 IDSVix86;IDSVix86;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.0.24\Definitions\IPSDefs\20131017.002\IDSvix86.sys [2013-10-17 393816]
S1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\NIS\1405000.01C\Ironx86.SYS [2013-03-05 175264]
S1 SymNetS;Symantec Network Security WFP Driver;c:\windows\System32\Drivers\NIS\1405000.01C\SYMNETS.SYS [2013-04-25 339544]
S2 AntiVirSchedulerService;Avira Planer;c:\program files\Avira\AntiVir Desktop\sched.exe [2014-06-13 430160]
S2 AntiVirWebService;Avira Browser-Schutz;c:\program files\Avira\AntiVir Desktop\avwebg7.exe [2014-06-13 1039952]
S2 APNMCP;Ask Aktualisierungsdienst;c:\program files\AskPartnerNetwork\Toolbar\apnmcp.exe [2014-02-13 166352]
S2 avnetflt;avnetflt;c:\windows\system32\DRIVERS\avnetflt.sys [2014-03-25 69240]
S2 cjpcsc;cyberJack PC/SC COM Service ;c:\windows\system32\cjpcsc.exe [2012-03-19 514128]
S2 Fabs;FABS - Helping agent for MAGIX media database;c:\program files\Common Files\MAGIX Services\Database\bin\FABS.exe [2009-02-03 1155072]
S2 NIS;Norton Internet Security;c:\program files\Norton Internet Security\Engine\20.5.0.28\ccSvcHst.exe [2013-05-21 144368]
S2 PDF Architect Helper Service;PDF Architect Helper Service;c:\program files\PDF Architect\HelperService.exe [2012-11-22 1522312]
S2 PDF Architect Service;PDF Architect Service;c:\program files\PDF Architect\ConversionService.exe [2012-11-22 905864]
S2 WMI_Hook_Service;WMI_Hook_Service;c:\program files\msi\OSD hot keys\WMI_Hook_Service.exe [2009-12-24 100152]
S3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2013-10-18 108120]
S3 hidkmdf;Microsoft HID Class Shim for KMDF;c:\windows\system32\DRIVERS\hidkmdf.sys [2009-10-29 10360]
S3 NW1950;NextWindow 1950 Touch Screen;c:\windows\system32\DRIVERS\NW1950.sys [2009-10-29 22392]
S3 NxpCap;CTX capture service;c:\windows\system32\DRIVERS\NxpCap.sys [2009-12-22 1558368]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt86win7.sys [2011-06-10 394856]
S3 rtl8192se;Realtek Wireless LAN 802.11n PCI-E NIC NT Driver;c:\windows\system32\DRIVERS\rtl8192se.sys [2010-04-01 1009184]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
WindowsMobile REG_MULTI_SZ wcescomm rapimgr
LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr
.
Inhalt des "geplante Tasks" Ordners
.
2014-06-14 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-03-30 08:22]
.
2014-06-13 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1747642106-1967193203-2002987569-1000Core.job
- c:\users\Janos Metz\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-08-28 17:18]
.
2014-06-13 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1747642106-1967193203-2002987569-1000UA.job
- c:\users\Janos Metz\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-08-28 17:18]
.
2014-06-14 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-10-02 13:26]
.
2014-06-13 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-10-02 13:26]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://feed.helperbar.com/?publisher=OC&dpid=OC&co=DE&userid=6c99c11c-06ac-4550-b7c7-cdeeef43afec&affid=111585&searchtype=hp&babsrc=lnkry_nt
uInternet Settings,ProxyOverride = *.local
uSearchAssistant = hxxp://feed.helperbar.com/?publisher=OC&dpid=OC&co=DE&userid=6c99c11c-06ac-4550-b7c7-cdeeef43afec&affid=111585&searchtype=ds&babsrc=lnkry&q={searchTerms}
IE: Nach Microsoft E&xel exportieren - c:\progra~1\MIF5BA~1\Office12\EXCEL.EXE/3000
IE: {{0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - hxxp://rover.ebay.com/rover/1/707-37276-17534-31/4
TCP: DhcpNameServer = 192.168.178.1
FF - ProfilePath - c:\users\Janos Metz\AppData\Roaming\Mozilla\Firefox\Profiles\d8a12ko5.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - www.spiegel.de
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Toolbar-10 - (no file)
.
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\NIS]
"ImagePath"="\"c:\program files\Norton Internet Security\Engine\20.5.0.28\ccSvcHst.exe\" /s \"NIS\" /m \"c:\program files\Norton Internet Security\Engine\20.5.0.28\diMaster.dll\" /prefetch:1"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil32_12_0_0_77_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil32_12_0_0_77_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2014-06-14 09:48:28
ComboFix-quarantined-files.txt 2014-06-14 07:48
.
Vor Suchlauf: 13 Verzeichnis(se), 871.671.435.264 Bytes frei
Nach Suchlauf: 17 Verzeichnis(se), 873.388.900.352 Bytes frei
.
- - End Of File - - E33045D57B98B1F02F9370B542DC30DF
C79B30CB8852157F6F908E4698CFE0D0
Seitdem hat er sich nicht mehr gemeldet, darf ich jetzt deine Schritte 1-4 machen?
Lieben Gruß
Janos | 