Combofix hat nicht gemeckert, nur Avira hat kurz nach dem Start des Vorgangs etwas von einer blockierten Registry gemeldet, Avira war aber deaktiviert... Das Problem mit der Firewall scheint jetzt aber gelöst! Hier der Log: Code:
ComboFix 14-12-10.03 - User 12.12.2014 20:11:34.1.8 - x64
Microsoft Windows 7 Professional 6.1.7601.1.1252.49.1031.18.16333.13791 [GMT 1:00]
ausgeführt von:: c:\users\User\Desktop\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {4D041356-F94D-285F-8768-AAE50FA36859}
SP: Avira Desktop *Disabled/Updated* {F665F2B2-DF77-27D1-BDD8-9197742422E4}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\END
c:\program files (x86)\Google\Desktop\Install
c:\program files (x86)\Google\Desktop\Install\{dbf260a2-f801-1ee2-5b7a-e27ca335ef0d}\9519~1\A535~1\E628~1\{dbf260a2-f801-1ee2-5b7a-e27ca335ef0d}\@
c:\program files (x86)\Google\Desktop\Install\{dbf260a2-f801-1ee2-5b7a-e27ca335ef0d}\9519~1\A535~1\E628~1\{dbf260a2-f801-1ee2-5b7a-e27ca335ef0d}\L\6715e287
c:\program files (x86)\Google\Desktop\Install\{dbf260a2-f801-1ee2-5b7a-e27ca335ef0d}\9519~1\A535~1\E628~1\{dbf260a2-f801-1ee2-5b7a-e27ca335ef0d}\L\76603ac3
c:\program files (x86)\Google\Desktop\Install\{dbf260a2-f801-1ee2-5b7a-e27ca335ef0d}\9519~1\A535~1\E628~1\{dbf260a2-f801-1ee2-5b7a-e27ca335ef0d}\U\00000008.@
c:\program files (x86)\Google\Desktop\Install\{dbf260a2-f801-1ee2-5b7a-e27ca335ef0d}\9519~1\A535~1\E628~1\{dbf260a2-f801-1ee2-5b7a-e27ca335ef0d}\U\80000064.@
c:\users\User\AppData\Local\Microsoft\Windows\Temporary Internet Files\autoupdate.php
c:\windows\PFRO.log
.
.
((((((((((((((((((((((( Dateien erstellt von 2014-11-12 bis 2014-12-12 ))))))))))))))))))))))))))))))
.
.
2014-12-12 19:06 . 2014-12-12 19:06 -------- d-----w- c:\program files (x86)\VS Revo Group
2014-12-12 17:48 . 2014-12-12 17:48 -------- d-----w- C:\FRST
2014-12-12 17:16 . 2014-12-12 17:16 51496 ----a-w- c:\windows\system32\drivers\stflt.sys
2014-12-10 18:40 . 2014-12-10 18:40 -------- d-----w- c:\users\User\AppData\Local\Ubisoft
2014-11-28 19:05 . 2008-07-12 07:18 3851784 ----a-w- c:\windows\SysWow64\D3DX9_39.dll
2014-11-28 17:59 . 2007-04-04 17:53 81768 ----a-w- c:\windows\SysWow64\xinput1_3.dll
2014-11-15 21:05 . 2014-12-11 14:38 -------- d-----w- c:\users\User\AppData\Local\Ubisoft Game Launcher
2014-11-15 21:05 . 2014-12-11 14:34 -------- d-----w- c:\program files (x86)\Ubisoft
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-10-21 10:30 . 2014-09-17 17:15 348928 ----a-w- c:\windows\SysWow64\PnkBstrB.xtr
2014-10-21 10:30 . 2014-07-30 15:24 348928 ----a-w- c:\windows\SysWow64\PnkBstrB.exe
2014-10-21 10:30 . 2014-07-30 15:24 280904 ----a-w- c:\windows\SysWow64\PnkBstrB.ex0
2014-10-14 16:41 . 2013-05-16 15:05 43064 ----a-w- c:\windows\system32\drivers\avnetflt.sys
2014-10-14 16:40 . 2013-05-16 15:05 131608 ----a-w- c:\windows\system32\drivers\avipbb.sys
2014-10-14 16:39 . 2013-05-16 15:05 119272 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2014-09-17 17:19 . 2014-07-30 15:24 76152 ----a-w- c:\windows\SysWow64\PnkBstrA.exe
2014-09-17 04:51 . 2014-10-20 10:59 31520 ----a-w- c:\windows\system32\nvhdap64.dll
2014-09-17 04:51 . 2014-10-20 10:59 197408 ----a-w- c:\windows\system32\drivers\nvhda64v.sys
2014-09-17 04:51 . 2013-05-14 14:29 1538880 ----a-w- c:\windows\system32\nvhdagenco6420103.dll
2014-09-17 02:10 . 2014-10-20 11:00 2193560 ----a-w- c:\windows\SysWow64\nvspcap.dll
2014-09-17 02:10 . 2014-10-20 11:00 1291280 ----a-w- c:\windows\SysWow64\nvspbridge.dll
2014-09-17 02:10 . 2014-10-20 11:00 2799784 ----a-w- c:\windows\system32\nvspcap64.dll
2014-09-17 02:10 . 2014-10-20 11:00 1715224 ----a-w- c:\windows\system32\nvspbridge64.dll
2014-09-13 23:48 . 2014-10-20 10:59 957584 ----a-w- c:\windows\system32\NvIFR64.dll
2014-09-13 23:48 . 2014-10-20 10:59 925896 ----a-w- c:\windows\system32\NvFBC64.dll
2014-09-13 23:48 . 2014-10-20 10:59 919240 ----a-w- c:\windows\SysWow64\NvIFR.dll
2014-09-13 23:48 . 2014-10-20 10:59 894096 ----a-w- c:\windows\SysWow64\NvFBC.dll
2014-09-13 23:48 . 2014-10-20 10:59 867528 ----a-w- c:\windows\SysWow64\nvumdshim.dll
2014-09-13 23:48 . 2014-10-20 10:59 501064 ----a-w- c:\windows\system32\nvEncodeAPI64.dll
2014-09-13 23:48 . 2014-10-20 10:59 4287296 ----a-w- c:\windows\system32\nvcuvid.dll
2014-09-13 23:48 . 2014-10-20 10:59 417096 ----a-w- c:\windows\SysWow64\nvEncodeAPI.dll
2014-09-13 23:48 . 2014-10-20 10:59 4008592 ----a-w- c:\windows\SysWow64\nvcuvid.dll
2014-09-13 23:48 . 2014-10-20 10:59 393024 ----a-w- c:\windows\system32\NvIFROpenGL.dll
2014-09-13 23:48 . 2014-10-20 10:59 352016 ----a-w- c:\windows\system32\nvoglshim64.dll
2014-09-13 23:48 . 2014-10-20 10:59 348304 ----a-w- c:\windows\SysWow64\NvIFROpenGL.dll
2014-09-13 23:48 . 2014-10-20 10:59 31887680 ----a-w- c:\windows\system32\nvoglv64.dll
2014-09-13 23:48 . 2014-10-20 10:59 303600 ----a-w- c:\windows\SysWow64\nvoglshim32.dll
2014-09-13 23:48 . 2014-10-20 10:59 2838424 ----a-w- c:\windows\SysWow64\nvapi.dll
2014-09-13 23:48 . 2014-10-20 10:59 24552592 ----a-w- c:\windows\SysWow64\nvoglv32.dll
2014-09-13 23:48 . 2014-10-20 10:59 20922512 ----a-w- c:\windows\system32\nvcompiler.dll
2014-09-13 23:48 . 2014-10-20 10:59 1876296 ----a-w- c:\windows\system32\nvdispco6434411.dll
2014-09-13 23:48 . 2014-10-20 10:59 18106152 ----a-w- c:\windows\SysWow64\nvwgf2um.dll
2014-09-13 23:48 . 2014-10-20 10:59 174856 ----a-w- c:\windows\system32\nvinitx.dll
2014-09-13 23:48 . 2014-10-20 10:59 17259664 ----a-w- c:\windows\SysWow64\nvcompiler.dll
2014-09-13 23:48 . 2014-10-20 10:59 16875856 ----a-w- c:\windows\SysWow64\nvd3dum.dll
2014-09-13 23:48 . 2014-10-20 10:59 156840 ----a-w- c:\windows\SysWow64\nvinit.dll
2014-09-13 23:48 . 2014-10-20 10:59 1539272 ----a-w- c:\windows\system32\nvdispgenco6434411.dll
2014-09-13 23:48 . 2014-10-20 10:59 14026304 ----a-w- c:\windows\system32\nvopencl.dll
2014-09-13 23:48 . 2014-10-20 10:59 13939272 ----a-w- c:\windows\system32\nvcuda.dll
2014-09-13 23:48 . 2014-10-20 10:59 13157696 ----a-w- c:\windows\system32\drivers\nvlddmkm.sys
2014-09-13 23:48 . 2014-10-20 10:59 11392576 ----a-w- c:\windows\SysWow64\nvopencl.dll
2014-09-13 23:48 . 2014-10-20 10:59 11330776 ----a-w- c:\windows\SysWow64\nvcuda.dll
2014-09-13 23:48 . 2013-05-14 14:29 73872 ----a-w- c:\windows\system32\OpenCL.dll
2014-09-13 23:48 . 2013-05-14 14:29 60560 ----a-w- c:\windows\SysWow64\OpenCL.dll
2014-09-13 23:48 . 2013-05-14 14:29 984424 ----a-w- c:\windows\system32\nvumdshimx.dll
2014-09-13 23:48 . 2013-05-14 14:29 20589536 ----a-w- c:\windows\system32\nvwgf2umx.dll
2014-09-13 23:48 . 2013-05-14 14:29 3223120 ----a-w- c:\windows\system32\nvapi64.dll
2014-09-13 23:48 . 2013-05-14 14:29 19954520 ----a-w- c:\windows\system32\nvd3dumx.dll
2014-09-13 21:53 . 2013-05-14 14:29 6890696 ----a-w- c:\windows\system32\nvcpl.dll
2014-09-13 21:53 . 2013-05-14 14:29 3529872 ----a-w- c:\windows\system32\nvsvc64.dll
2014-09-13 21:53 . 2013-05-14 14:29 934216 ----a-w- c:\windows\system32\nvvsvc.exe
2014-09-13 21:53 . 2013-05-14 14:29 62608 ----a-w- c:\windows\system32\nvshext.dll
2014-09-13 21:53 . 2013-05-14 14:29 385168 ----a-w- c:\windows\system32\nvmctray.dll
2014-09-13 21:53 . 2013-05-14 14:29 2557640 ----a-w- c:\windows\system32\nvsvcr.dll
2014-09-13 20:13 . 2014-10-20 11:00 613696 ----a-w- c:\windows\SysWow64\nvStreaming.exe
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2014-06-24 22:04 131480 ----a-w- c:\users\User\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2014-06-24 22:04 131480 ----a-w- c:\users\User\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2014-06-24 22:04 131480 ----a-w- c:\users\User\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2014-06-24 22:04 131480 ----a-w- c:\users\User\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-21 1475584]
"Dxtory Update Checker 2.0"="c:\program files (x86)\Dxtory\UpdateChecker.exe" [2010-10-17 93696]
"AutoStartNPSAgent"="c:\program files (x86)\Samsung\Samsung New PC Studio\NPSAgent.exe" [2010-07-04 95576]
"puush"="c:\program files (x86)\puush\puush.exe" [2013-11-01 567880]
"Spotify Web Helper"="c:\users\User\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe" [2014-10-03 1514040]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2014-12-11 702768]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2013-04-21 59720]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2014-08-21 959176]
"SwitchBoard"="c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]
"AdobeCS6ServiceManager"="c:\program files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe" [2012-03-09 1073312]
"Adobe Acrobat Speed Launcher"="x:\adobe cs6\Acrobat 10.0\Acrobat\Acrobat_sl.exe" [2013-09-03 41336]
"Acrobat Assistant 8.0"="x:\adobe cs6\Acrobat 10.0\Acrobat\Acrotray.exe" [2013-09-03 840568]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2013-05-01 421888]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2013-10-23 152392]
.
c:\users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dropbox.lnk - c:\users\User\AppData\Roaming\Dropbox\bin\Dropbox.exe /systemstartup [2014-11-13 35419192]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Userinit"="userinit.exe"
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R3 cleanhlp;cleanhlp;c:\eek\Run\cleanhlp64.sys;c:\eek\Run\cleanhlp64.sys [x]
R3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys;c:\windows\SYSNATIVE\drivers\dmvsc.sys [x]
R3 Origin Client Service;Origin Client Service;c:\program files (x86)\Origin\OriginClientService.exe;c:\program files (x86)\Origin\OriginClientService.exe [x]
R3 SwitchBoard;Adobe SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [x]
R3 taphss6;Anchorfree HSS VPN Adapter;c:\windows\system32\DRIVERS\taphss6.sys;c:\windows\SYSNATIVE\DRIVERS\taphss6.sys [x]
R3 TFsExDisk;TFsExDisk;c:\windows\System32\Drivers\TFsExDisk.sys;c:\windows\SYSNATIVE\Drivers\TFsExDisk.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys;c:\windows\SYSNATIVE\Drivers\usbaapl64.sys [x]
S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys;c:\windows\SYSNATIVE\Drivers\PxHlpa64.sys [x]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys;c:\windows\SYSNATIVE\DRIVERS\avkmgr.sys [x]
S2 AntiVirMailService;Avira Email-Schutz;c:\program files (x86)\Avira\AntiVir Desktop\avmailc7.exe;c:\program files (x86)\Avira\AntiVir Desktop\avmailc7.exe [x]
S2 AntiVirSchedulerService;Avira Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [x]
S2 AntiVirWebService;Avira Browser-Schutz;c:\program files (x86)\Avira\AntiVir Desktop\avwebg7.exe;c:\program files (x86)\Avira\AntiVir Desktop\avwebg7.exe [x]
S2 avnetflt;avnetflt;c:\windows\system32\DRIVERS\avnetflt.sys;c:\windows\SYSNATIVE\DRIVERS\avnetflt.sys [x]
S2 GfExperienceService;NVIDIA GeForce Experience Service;c:\program files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe;c:\program files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [x]
S2 NvNetworkService;NVIDIA Network Service;c:\program files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe;c:\program files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [x]
S2 NvStreamSvc;NVIDIA Streamer Service;c:\program files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe;c:\program files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [x]
S2 PDF Architect Helper Service;PDF Architect Helper Service;c:\program files (x86)\PDF Architect\HelperService.exe;c:\program files (x86)\PDF Architect\HelperService.exe [x]
S2 PDF Architect Service;PDF Architect Service;c:\program files (x86)\PDF Architect\ConversionService.exe;c:\program files (x86)\PDF Architect\ConversionService.exe [x]
S2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [x]
S3 iusb3hub;Intel(R) USB 3.0-Hubtreiber;c:\windows\system32\DRIVERS\iusb3hub.sys;c:\windows\SYSNATIVE\DRIVERS\iusb3hub.sys [x]
S3 iusb3xhc;Intel(R) USB 3.0 eXtensible-Hostcontrollertreiber;c:\windows\system32\DRIVERS\iusb3xhc.sys;c:\windows\SYSNATIVE\DRIVERS\iusb3xhc.sys [x]
S3 NvStreamKms;NvStreamKms;c:\program files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys;c:\program files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [x]
S3 nvvad_WaveExtensible;NVIDIA Virtual Audio Device (Wave Extensible) (WDM);c:\windows\system32\drivers\nvvad64v.sys;c:\windows\SYSNATIVE\drivers\nvvad64v.sys [x]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - AVNETFLT
*NewlyCreated* - WS2IFSL
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2014-12-12 12:36 1087816 ----a-w- c:\program files (x86)\Google\Chrome\Application\39.0.2171.95\Installer\chrmstp.exe
.
Inhalt des "geplante Tasks" Ordners
.
2013-09-20 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-09-20 17:35]
.
2014-10-21 c:\windows\Tasks\GoogleUpdateTaskMachineCore1cf8e1753d3e5a.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-05-16 15:10]
.
2014-11-14 c:\windows\Tasks\GoogleUpdateTaskMachineCore1cfed4260c17e85.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-05-16 15:10]
.
2014-11-14 c:\windows\Tasks\GoogleUpdateTaskMachineCore1d0001f14ed5f66.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-05-16 15:10]
.
2013-08-12 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-05-16 15:10]
.
2014-09-06 c:\windows\Tasks\Toolbox.exe_{745A48BC-0720-4EBB-9A5A-E80AA31255C5}.job
- c:\program files\HP\HP Officejet 6100\Bin\Toolbox.exe [2012-11-01 11:58]
.
2014-01-30 c:\windows\Tasks\XboxStatTask.job
- c:\program files\Microsoft Xbox 360 Accessories\XBoxStat.exe [2009-10-01 00:57]
.
2014-11-17 c:\windows\Tasks\{49445805-4ACC-464B-AC09-0A7A5C123991}.job
- c:\program files (x86)\google\chrome\application\chrome.exe [2013-05-16 01:50]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2014-06-24 22:04 164760 ----a-w- c:\users\User\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2014-06-24 22:04 164760 ----a-w- c:\users\User\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2014-06-24 22:04 164760 ----a-w- c:\users\User\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2014-06-24 22:04 164760 ----a-w- c:\users\User\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDVCPL"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2011-12-13 13374568]
"AdobeAAMUpdater-1.0"="c:\program files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2012-04-04 446392]
"Logitech Download Assistant"="c:\windows\System32\LogiLDA.dll" [2012-09-20 1832760]
"XboxStat"="c:\program files\Microsoft Xbox 360 Accessories\XboxStat.exe" [2009-10-01 825184]
"NvBackend"="c:\program files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe" [2014-09-17 2461504]
"ShadowPlay"="c:\windows\system32\nvspcap64.dll" [2014-09-17 2799784]
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.bing.com
mDefault_Search_URL = about:blank
mDefault_Page_URL = about:blank
mStart Page = about:blank
mLocal Page = c:\windows\SysWOW64\blank.htm
mSearch Page = about:blank
uInternet Settings,ProxyOverride = *.local
IE: An vorhandene PDF-Datei anfügen - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
IE: In Adobe PDF konvertieren - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
IE: Linkziel an vorhandene PDF-Datei anhängen - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Linkziel in Adobe PDF konvertieren - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Nach Microsoft &Excel exportieren - c:\progra~2\MICROS~1\OFFICE11\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.0.1
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Wow6432Node-HKCU-Run-AdobeBridge - (no file)
Wow6432Node-HKLM-Run-<NO NAME> - (no file)
Wow6432Node-HKLM-Run-NPSStartup - (no file)
SafeBoot-54986205.sys
SafeBoot-96129455.sys
SafeBoot-CleanHlp
SafeBoot-CleanHlp.sys
BHO-{F9E4A054-E9B1-4BC3-83A3-76A1AE736170} - c:\program files (x86)\Hotspot Shield\HssIE\HssIE_64.dll
HKLM-Run-SpywareTerminatorShield - c:\program files (x86)\Spyware Terminator\SpywareTerminatorShield.exe
HKLM-Run-SpywareTerminatorUpdater - c:\program files (x86)\Spyware Terminator\SpywareTerminatorUpdate.exe
AddRemove-RollerCoaster Tycoon 3_is1 - x:\roller coaster tycoon 3\uninst\unins000.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\S-1-5-21-3718714907-2964286533-2459885760-1000\Software\SecuROM\License information*]
"datasecu"=hex:e9,90,a8,76,21,eb,54,96,d4,40,ab,ad,43,58,58,17,b3,b0,a1,c7,43,
41,6f,48,b0,0d,7a,8b,df,8e,8f,2a,53,4b,be,80,d2,54,9f,93,29,58,40,4f,78,e9,\
"rkeysecu"=hex:40,2a,eb,da,69,d6,b4,59,9b,74,7f,48,1f,37,84,8e
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_8_800_175_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_8_800_175_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{BEB3C0C7-B648-4257-96D9-B5D024816E27}\Version*Version]
"Version"=hex:fa,e2,f3,87,41,f5,4e,88,3f,b2,ea,a8,1f,28,c5,55,70,a2,ea,6f,9d,
a5,a3,c8,6f,b4,d6,5a,44,c4,cc,d5,21,68,0a,04,ef,01,c5,92,30,8b,3d,84,83,0a,\
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_8_800_175_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_8_800_175_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_8_800_175.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_8_800_175.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_8_800_175.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_8_800_175.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\*ß]
"7040110900063D11C8EF10054038389C"="C?\\Windows\\SysWOW64\\FM20ENU.DLL"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\*)›]
"7040110900063D11C8EF10054038389C"="C?\\Windows\\SysWOW64\\FM20ENU.DLL"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\PÔ2*]
"7040110900063D11C8EF10054038389C"="C?\\Windows\\SysWOW64\\FM20ENU.DLL"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\Ðï+*]
"7040110900063D11C8EF10054038389C"="C?\\Windows\\SysWOW64\\FM20ENU.DLL"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\€ðF*]
"7040110900063D11C8EF10054038389C"="C?\\Windows\\SysWOW64\\FM20ENU.DLL"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Minnetonka Audio Software\SurCode Dolby Digital Premiere\Version*Version]
"Version"=hex:fa,e2,f3,87,41,f5,4e,88,3f,b2,ea,a8,1f,28,c5,55,70,a2,ea,6f,9d,
a5,a3,c8,6f,b4,d6,5a,44,c4,cc,d5,21,68,0a,04,ef,01,c5,92,30,8b,3d,84,83,0a,\
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
c:\program files (x86)\Avira\AntiVir Desktop\avguard.exe
c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\windows\SysWOW64\PnkBstrA.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2014-12-12 20:15:52 - PC wurde neu gestartet
ComboFix-quarantined-files.txt 2014-12-12 19:15
.
Vor Suchlauf: 12 Verzeichnis(se), 17.348.644.864 Bytes frei
Nach Suchlauf: 15 Verzeichnis(se), 18.061.795.328 Bytes frei
.
- - End Of File - - F95E00738395AD557BC2F61B8620E1B3
A36C5E4F47E84449FF07ED3517B43A31
|
Revo Uninstaller (alternativ portable Revo Uninstaller) herunter.
Malwarebytes Anti-Malware 
AdwCleaner auf deinen Desktop.
SecurityCheck und:
dann auf 
und dann auf 
. 
WARNUNG an die MITLESER: 
