Trojaner-Board
Seite 1 von 2 1 2
100 Beiträge dieses Themas auf einer Seite anzeigen

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   Windows 7 Pro gesperrt - 100 Euro- abgesicherter Modus funktioniert nicht (https://www.trojaner-board.de/109788-windows-7-pro-gesperrt-100-euro-abgesicherter-modus-funktioniert.html)

freeoutday 13.02.2012 14:00
Windows 7 Pro gesperrt - 100 Euro- abgesicherter Modus funktioniert nicht
 
Hallo,

Ich habe hier schon quergelesen und das gleiche Problem wie viele User hier. Plötzlich Bildschirm mit Aufforderung, dass ich eine nicht registrierte Windows Kopie hätte, die mit 100 Euro und Paysafe Bezahlung zu aktivieren wäre.
Habe versucht, im abgesicherten Modus (alle Varianten, mit/ ohne Netzwerktreiber) zu starten, ohne Erfolg. Man sieht kurzzeitig den typischen "abgesicherten Modus" Bildschirm mit allen Icons, dann aber schwarzer Bildschirm mit Versionsangabe Windows oben mittig und "abgesicherter Modus" Schriftzug in allen vier Bildschirmecken. Wenn man Keyboardcommands (z.B. Windows+E) ausführt, sieht man kurzfristig für einen Sekundenbruchteil die Effekte (in diesem Falle Explorer Fenster), springt aber sofort wieder in den oben beschriebenen schwarzen Bildschirm.
System: Windows 7 Pro mit SP 1, 64 bit
Was tun?

Schon mal vielen Dank für die Hilfe!!

markusg 13.02.2012 14:02
Mit einem sauberen 2. Rechner eine OTLPE-CD erstellen und den infizierten Rechner dann von dieser CD booten:

Falls Du kein Brennprogramm installiert hast, lade dir bitte ISOBurner herunter. Das Programm wird Dir erlauben, OTLPE auf eine CD zu brennen und sie bootfähig zu machen. Du brauchst das Tool nur zu installieren, der Rest läuft automatisch => Wie brenne ich eine ISO Datei auf CD/DVD.


Lade OTLpe Download OTLPENet.exe von OldTimer herunter und speichere sie auf Deinem Desktop. Anmerkung: Die Datei ist ca. 120 MB groß und es wird bei langsamer Internet-Verbindung ein wenig dauern, bis Du sie runtergeladen hast.
  • Wenn der Download fertig ist, mache einen Doppelklick auf die Datei und beantworte die Frage "Do you want to burn the CD?" mit Yes.
  • Lege eine leere CD in Deinen Brenner.
  • ImgBurn (oder Dein Brennprogramm) wird das Archiv extrahieren und OTLPE Network auf die CD brennen.
  • Wenn der Brenn-Vorgang abgeschlossen ist, wirst Du eine Dialogbox sehen => "Operation successfully completed".
  • Du kannst nun die Fenster des Brennprogramms schließen.
Nun boote von der OTLPE CD. Hinweis: Wie boote ich von CD


Bebilderte Anleitung: OTLpe-Scan
  • Dein System sollte nach einigen Minuten den REATOGO-X-PE Desktop anzeigen.
  • Mache einen Doppelklick auf das OTLPE Icon.
  • Hinweis: Damit OTLPE auch das richtige installierte Windows scant, musst du den Windows-Ordner des auf der Platte installierten Windows auswählen, einfach nur C: auswählen gibt einen Fehler!
  • Wenn Du gefragt wirst "Do you wish to load the remote registry", dann wähle Yes.
  • Wenn Du gefragt wirst "Do you wish to load remote user profile(s) for scanning", dann wähle Yes.
  • Vergewissere Dich, dass die Box "Automatically Load All Remaining Users" gewählt ist und drücke OK.
  • OTLpe sollte nun starten.
  • Drücke Run Scan, um den Scan zu starten.
  • Wenn der Scan fertig ist, werden die Dateien C:\OTL.Txt und C:\Extras.Txt erstellt
  • Kopiere diese Datei auf Deinen USB-Stick, wenn Du keine Internetverbindung auf diesem System hast.
  • Bitte poste den Inhalt von C:\OTL.txt und Extras.txt.

freeoutday 13.02.2012 15:42
Sieht gar nicht gut aus!
Alles wie beschrieben durchgeführt, System versucht auch das Reatogo Desktop zu laden, dann bekomme ich aber einen Bluescreen:
"A problem has been detected and windows has been shut down to prevent damage to your computer.."
Check for viruses on your computer. Remove any newly installed hard drives or hard drive controllers. Check your hard drive to make sure it is properly confirgured and terminated. Run chckdsk/F to check for hard drive corruption, and then restart your computer"
Technical information: ***STOP: 0x0000007B (0xF78DA528, 0xC0000034,0x00000000,0x00000000)

???

markusg 13.02.2012 15:51
gehe mal ins bios deines betriebssystem und prüfe ob ide oder Ahci eingestellt ist, endere es dann auf die jeweils gegenteilige einstellung und probiere es noch mal.

freeoutday 13.02.2012 16:59
Das Desktop läuft jetzt nach Umstellung auf IDE, sehr gut!
Leider bekomme ich mit dem Desktop weder Internetverbindung (WLAN oder LAN) noch einen USB Port zum funktionieren um den Custom Scan bzw. danach die Logfiles zu übertragen. Der USB Stick wird erkannt, kann aber nicht genutzt werden (gelbes Fragezeichen), wahrscheinlich, weil ein entsprechender Treiber fehlt. Was tun ?
Schwieriger Fall, sorry!

markusg 13.02.2012 17:09
stick raus, neustarten, dann wieder die otl cd starten und stick dann rein stecken, sollte dann gehen.

freeoutday 13.02.2012 18:04
Allright, hier mal das OTL Scan Logfile:

markusg 13.02.2012 18:47
hi


dieses script sowie evtl. folgende scripts sind nur für den jeweiligen user.
wenn ihr probleme habt, eröffnet eigene topics und wartet auf, für euch angepasste scripts.


• Starte bitte die OTL.exe
• Kopiere nun das Folgende in die Textbox.



Code:
:OTL
O4:64bit: - HKLM..\Run: [2C508BD5-F9C6-4955-B93A-09B835EC3C64] D:\Users\Olaf\AppData\Roaming\09A52917-B4FC-4f02-AE3B-BF55D9351F4A\msvcs.exe ()
O4 - HKU\Olaf_ON_D..\Run: [2C508BD5-F9C6-4955-B93A-09B835EC3C64] D:\Users\Olaf\AppData\Roaming\09A52917-B4FC-4f02-AE3B-BF55D9351F4A\msvcs.exe ()
O20:64bit: - HKLM Winlogon: UserInit - (C:\Users\Olaf\AppData\Roaming\09A52917-B4FC-4f02-AE3B-BF55D9351F4A\msvcs.exe /c) - D:\Users\Olaf\AppData\Roaming\09A52917-B4FC-4f02-AE3B-BF55D9351F4A\msvcs.exe ()
 :Files
D:\Users\Olaf\AppData\Roaming\09A52917
:Commands
[purity]
[EMPTYFLASH]
[emptytemp]
[Reboot]


• Schliesse bitte nun alle Programme.
• Klicke nun bitte auf den Fix Button.
• OTL kann gegebenfalls einen Neustart verlangen. Bitte dies zulassen.
• Nach dem Neustart findest Du ein Textdokument, dessen inhalt in deiner nächsten antwort hier reinkopieren.
starte in den normalen modus.

falls du keine symbole hast, dann rechtsklick, ansicht, desktop symbole einblenden

Drücke bitte die http://larusso.trojaner-board.de/Images/windows.jpg + E Taste.
  • Öffne dein Systemlaufwerk ( meistens C: )
  • Suche nun
    folgenden Ordner: _OTL und öffne diesen.
  • Mache einen Rechtsklick auf den Ordner Movedfiles --> Senden an --> Zip-Komprimierter Ordner

  • Dies wird eine Movedfiles.zip Datei in _OTL erstellen
  • Lade diese bitte in unseren Uploadchannel
    hoch. ( Durchsuchen --> C:\_OTL\Movedfiles.zip )
Teile mir mit ob der Upload problemlos geklappt hat. Danke im voraus :)

freeoutday 13.02.2012 20:21
Hat leider nicht richtig geklappt. Rechner hat nach Durchlauf des Fixes zwar angekuendigt, neu zu starten, es dann aber nicht gemacht, dementsprechend gab es auch kein Textfile. Habe dann versucht, manuell im Normalmodus zu starten, das endet leider mit Bluescreen und endlos Boot-Schleife. Die MOVED FILES habe ich hochgeladen.
1000 Dank fuer die Hilfe!
P.S: Lasse auf einem anderen Rechner gerade McAfee Vollscan laufen, hat jetzt bisher Generic Exploit!1up sowie diverse Generic.dx!bct4 entdeckt. War die ganze Zeit aktiviert und auch atuell (anderer Rechner als der mit dem Problem..).

markusg 13.02.2012 21:09
hi,
eröffne für den andern pc nen neues thema.
wir sind mit dem nicht fertig, bitte surfe damit nur auf von mir genannten seiten.
danke für den upload
Combofix darf ausschließlich ausgeführt werden, wenn dies von einem Team Mitglied angewiesen wurde!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich
ziehen und eine Bereinigung der Infektion noch erschweren.

Bitte downloade dir Combofix.exe und speichere es unbedingt auf deinem Desktop.
  • Besuche folgende Seite für Downloadlinks und Anweisungen für dieses
    Tool

    Ein Leitfaden und Tutorium zur Nutzung von ComboFix
  • Hinweis:
    Gehe sicher das all deine Anti Virus und Anti Malware Programme abgeschalten sind, damit diese Combofix nicht bei der Arbeit stören.
  • Poste bitte die C:\Combofix.txt in deiner nächsten Antwort.

freeoutday 13.02.2012 21:54
Danke fuer die Hilfe. Ich hoffe ich mache das alles richtig.
Nur noch mal zur Klarstellung: Ich kann immer noch nicht im Normalmodus starten, fahre den Rechner immer noch ueber das Reatogo-Desktop und habe auch keine Internetverbindung damit (klappt nicht), sondern kopiere mir bisher immer alle Files mit einem USB Stick hin und her..Das mache ich jetzt auch mit Combofix..
Ist das OK ?
Sorry, aber ich bin ganz schön am Verzweifeln.. Forschungsergebnisse etc...

freeoutday 13.02.2012 22:20
Leider funktioniert Combofix bei mir nicht vom Reatogo Desktop aus. Es möchte eine Datei zum Schreiben öffnen (x:\32788R22FWJFW\023.dat), die es aber irgendwie nicht öffnen kann. Weder "Abort" noch "Retry" noch "ignore" bringen mich da weiter. Wahrscheinlich sollte man es im Normalmodus ausführen? Der funktioniert bei mir ja leider noch nicht..

freeoutday 13.02.2012 22:46
+++ UPDATE +++
Habe jetzt im Bios die Festplatte wieder umgestellt (hatte ich vorher für Reatogo Desktop von AHCI auf IDE umgestellt).
Jetzt kann ich Windows im abgesicherten Modus fahren, habe auch Combofix so ausgeführt, hier das Log File. 1000 Dank schon mal für die Hilfe!

Code:
ComboFix 12-02-13.01 - Olaf 13.02.2012  22:29:11.1.4 - x64 NETWORK
Microsoft Windows 7 Professional  6.1.7601.1.1252.49.1031.18.4046.2953 [GMT 1:00]
ausgeführt von:: c:\users\Olaf\Desktop\ComboFix.exe
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 * Neuer Wiederherstellungspunkt wurde erstellt
.
.
((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\Thumbs.db
c:\windows\pkunzip.pif
c:\windows\pkzip.pif
.
.
(((((((((((((((((((((((  Dateien erstellt von 2012-01-13 bis 2012-02-13  ))))))))))))))))))))))))))))))
.
.
2012-02-13 23:58 . 2011-07-13 02:55        2237440        ----a-r-        C:\OTLPE.exe
2012-02-13 23:58 . 2012-02-13 23:58        --------        d-----w-        C:\_OTL
2012-02-13 21:33 . 2012-02-13 21:33        --------        d-----w-        c:\users\Default\AppData\Local\temp
2012-02-13 21:25 . 2012-02-13 21:25        --------        d-----w-        c:\users\Olaf\AppData\Local\ElevatedDiagnostics
2012-02-13 09:42 . 2012-02-13 23:58        --------        d-----w-        c:\users\Olaf\AppData\Roaming\09A52917-B4FC-4f02-AE3B-BF55D9351F4A
2012-02-10 07:33 . 2012-01-06 05:15        8602168        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{0FF703CE-8E7C-4E7D-A606-97A2547E577E}\mpengine.dll
2012-02-05 20:19 . 2012-02-05 20:19        --------        d-----w-        c:\users\Default\AppData\Local\Microsoft Help
2012-02-04 16:40 . 2012-02-04 16:40        --------        d-----w-        c:\users\Olaf\AppData\Local\SAS
2012-02-04 16:39 . 2012-02-04 16:39        --------        d-----w-        c:\program files (x86)\Common Files\InstallShield
2012-02-04 16:39 . 2012-02-04 16:39        --------        d-----w-        c:\program files\SAS
2012-02-04 16:39 . 2012-02-04 16:39        --------        d-----w-        c:\program files (x86)\Common Files\Java
2012-02-04 16:39 . 2012-02-04 16:39        411368        ----a-w-        c:\windows\SysWow64\deployJava1.dll
2012-02-04 16:39 . 2012-02-04 16:39        --------        d-----w-        c:\program files (x86)\Java
2012-02-04 16:39 . 2012-02-04 16:39        --------        d-----w-        c:\program files (x86)\SAS Institute Inc
2012-02-04 16:38 . 2012-02-04 16:38        --------        d-----w-        c:\program files (x86)\SAS
2012-02-04 15:36 . 2012-02-04 15:36        --------        d-----w-        c:\windows\PCHEALTH
2012-02-04 15:34 . 2012-02-04 15:34        --------        d-----w-        c:\program files (x86)\Microsoft Analysis Services
2012-02-04 15:33 . 2012-02-04 17:29        --------        d-----w-        c:\users\Olaf\AppData\Local\Microsoft Help
2012-02-04 15:33 . 2012-02-05 20:19        --------        d-----w-        c:\programdata\Microsoft Help
2012-02-04 15:33 . 2012-02-04 15:33        --------        d-----r-        C:\MSOCache
2012-02-02 17:43 . 2012-02-02 17:43        --------        d-----w-        c:\program files\Windows XP Mode
2012-02-02 16:59 . 2012-02-02 16:59        --------        d-----w-        c:\windows\SysWow64\Wat
2012-02-02 16:59 . 2012-02-02 16:59        --------        d-----w-        c:\windows\system32\Wat
2012-02-02 16:54 . 2012-02-02 16:57        --------        d-----w-        C:\0a44299d2b6f9612547671
2012-02-02 15:04 . 2012-02-02 16:32        --------        d-----w-        C:\ABP
2012-02-01 08:11 . 2012-02-01 08:11        --------        d-----w-        c:\program files (x86)\MSECache
2012-02-01 08:05 . 2012-02-01 08:05        --------        d-----w-        c:\users\Olaf\AppData\Roaming\Roxio Burn
2012-01-30 09:58 . 2012-02-08 21:31        --------        d-----w-        c:\users\Olaf\AppData\Roaming\Skype
2012-01-30 09:58 . 2012-01-30 09:58        --------        d-----r-        c:\program files (x86)\Skype
2012-01-30 09:58 . 2012-01-30 09:58        --------        d-----w-        c:\programdata\Skype
2012-01-30 08:59 . 2012-01-30 09:00        --------        d-----w-        c:\program files (x86)\A43
2012-01-29 20:43 . 2012-02-02 11:42        --------        d-----w-        c:\program files\ABP
2012-01-29 20:22 . 2012-01-30 10:20        --------        d-----w-        C:\_PROJECTS
2012-01-29 20:06 . 2012-01-30 08:26        --------        d-----w-        C:\Zotero
2012-01-29 19:43 . 2012-01-30 14:00        --------        d-----w-        C:\Dropbox
2012-01-29 19:40 . 2012-02-12 19:43        --------        d-----w-        c:\users\Olaf\AppData\Roaming\Dropbox
2012-01-29 19:24 . 2012-01-29 19:24        --------        d-----w-        c:\users\Olaf\AppData\Roaming\Thunderbird
2012-01-29 18:58 . 2012-01-29 18:58        --------        d-----w-        C:\Dokumente und Einstellungen
2012-01-29 18:42 . 2012-01-29 18:42        414368        ----a-w-        c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2012-01-29 07:17 . 2012-01-29 07:17        --------        d-----w-        c:\users\Olaf\AppData\Local\Diagnostics
2012-01-28 20:03 . 2011-10-26 05:25        1572864        ----a-w-        c:\windows\system32\quartz.dll
2012-01-28 20:03 . 2011-10-26 04:32        1328128        ----a-w-        c:\windows\SysWow64\quartz.dll
2012-01-28 20:03 . 2011-10-26 05:25        366592        ----a-w-        c:\windows\system32\qdvd.dll
2012-01-28 20:03 . 2011-10-26 04:32        514560        ----a-w-        c:\windows\SysWow64\qdvd.dll
2012-01-28 19:57 . 2011-11-17 05:38        1292080        ----a-w-        c:\windows\SysWow64\ntdll.dll
2012-01-28 19:57 . 2011-11-17 06:41        1731920        ----a-w-        c:\windows\system32\ntdll.dll
2012-01-28 19:56 . 2011-11-19 14:58        77312        ----a-w-        c:\windows\system32\packager.dll
2012-01-28 19:56 . 2011-11-19 14:01        67072        ----a-w-        c:\windows\SysWow64\packager.dll
2012-01-26 07:21 . 2012-01-26 07:21        --------        d-----w-        c:\programdata\ATI
2012-01-26 07:20 . 2012-01-26 07:20        --------        d-----w-        c:\program files (x86)\AMD APP
2012-01-24 15:28 . 2012-01-24 15:28        174680        ----a-w-        c:\windows\system32\drivers\jmcr.sys
2012-01-24 15:27 . 2012-01-24 15:27        654336        ------w-        c:\windows\system32\stapi64.dll
2012-01-24 15:27 . 2012-01-24 15:27        528384        ----a-w-        c:\windows\system32\drivers\stwrt64.sys
2012-01-24 15:27 . 2012-01-24 15:27        431616        ----a-w-        c:\windows\system32\stcplx64.dll
2012-01-24 15:27 . 2012-01-24 15:27        1965056        ----a-w-        c:\windows\system32\stapo64.dll
2012-01-24 15:27 . 2012-01-24 15:27        --------        d-----w-        c:\program files\IDT
2012-01-24 15:26 . 2012-01-24 15:26        8604672        ----a-w-        c:\windows\system32\drivers\NETwNs64.sys
2012-01-24 15:26 . 2012-01-24 15:26        --------        d-----w-        c:\program files (x86)\Common Files\LightScribe
2012-01-24 15:25 . 2012-01-24 15:25        --------        d-----w-        c:\program files (x86)\Common Files\SureThing Shared
2012-01-24 15:25 . 2012-01-24 15:25        --------        d-----w-        c:\program files\Roxio
2012-01-24 15:25 . 2012-01-24 15:25        --------        d-----w-        c:\program files (x86)\Common Files\Telespree
2012-01-24 15:24 . 2011-03-22 05:25        229888        ----a-w-        c:\windows\system32\wwansvc.dll
2012-01-24 15:23 . 2011-02-25 06:25        296320        ----a-w-        c:\windows\system32\drivers\volsnap.sys
2012-01-24 15:22 . 2012-01-24 15:22        27648        ----a-w-        c:\windows\system32\SzCcid.dll
2012-01-24 15:22 . 2012-01-24 15:22        --------        d-----w-        c:\programdata\SZCCID
2012-01-24 15:22 . 2012-01-24 15:22        --------        d-----w-        c:\program files (x86)\AlcorMicro
2012-01-24 15:22 . 2012-01-24 15:22        582144        ----a-w-        c:\program files (x86)\Common Files\Microsoft Shared\DAO\DAO350.DLL
2012-01-24 15:22 . 2012-01-24 15:22        368912        ----a-w-        c:\windows\SysWow64\VBAR332.DLL
2012-01-24 15:22 . 2012-01-24 15:22        252176        ----a-w-        c:\windows\SysWow64\MSRD2X35.DLL
2012-01-24 15:22 . 2012-01-24 15:22        24848        ----a-w-        c:\windows\SysWow64\MSJTER35.DLL
2012-01-24 15:22 . 2012-01-24 15:22        123664        ----a-w-        c:\windows\SysWow64\MSJINT35.DLL
2012-01-24 15:22 . 2012-01-24 15:22        1045776        ----a-w-        c:\windows\SysWow64\MSJET35.DLL
2012-01-24 14:50 . 2012-01-24 14:50        --------        d-----w-        c:\programdata\HP
.
.
.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-01-26 23:52 . 2011-12-22 17:59        279656        ------w-        c:\windows\system32\MpSigStub.exe
2012-01-26 07:13 . 2011-03-31 10:52        58880        ----a-w-        c:\windows\system32\coinst.dll
2012-01-26 07:13 . 2011-03-31 10:45        40960        ----a-w-        c:\windows\system32\atiuxp64.dll
2012-01-26 07:12 . 2011-03-31 11:03        4044288        ----a-w-        c:\windows\system32\atiumd6a.dll
2012-01-26 07:12 . 2011-03-31 10:53        5510144        ----a-w-        c:\windows\system32\atiumd64.dll
2012-01-26 07:12 . 2011-03-31 10:45        38912        ----a-w-        c:\windows\system32\atiu9p64.dll
2012-01-26 07:12 . 2011-03-31 11:20        423424        ----a-w-        c:\windows\system32\atipdl64.dll
2012-01-26 07:10 . 2011-03-31 11:22        466944        ----a-w-        c:\windows\system32\ATIDEMGX.dll
2012-01-26 07:10 . 2011-03-31 11:24        892416        ----a-w-        c:\windows\system32\aticfx64.dll
2012-01-26 07:10 . 2011-03-31 10:46        486912        ----a-w-        c:\windows\system32\atiadlxx.dll
2012-01-24 15:27 . 2011-11-27 10:28        6382080        ----a-w-        c:\windows\system32\IDTNGUI.exe
2012-01-24 15:27 . 2011-11-27 10:28        4933120        ----a-w-        c:\windows\system32\IDTNHP.dll
2012-01-24 15:27 . 2011-11-27 10:28        4780032        ----a-w-        c:\windows\system32\stlang64.dll
2012-01-24 15:27 . 2011-11-27 10:28        221184        ----a-w-        c:\windows\system32\HPToneCtrls64.dll
2012-01-24 15:27 . 2011-11-27 10:28        212480        ----a-w-        c:\windows\system32\IDTNJ.exe
2012-01-24 15:27 . 2011-11-27 10:28        1523712        ----a-w-        c:\windows\system32\IDTNC64.cpl
2012-01-24 15:27 . 2011-11-27 10:28        1128448        ----a-w-        c:\windows\sttray64.exe
2012-01-24 15:27 . 2011-11-27 10:28        1029120        ----a-w-        c:\windows\system32\IDTNX.dll
2012-01-24 15:27 . 2011-11-27 10:28        224256        ----a-w-        c:\windows\system32\staco64.dll
2012-01-24 15:27 . 2011-11-27 10:28        90624        ----a-w-        c:\windows\system32\AESTCo64.dll
2012-01-24 15:27 . 2011-11-27 10:28        68608        ----a-w-        c:\windows\system32\AESTAR64.dll
2012-01-24 15:27 . 2011-11-27 10:28        442368        ----a-w-        c:\windows\system32\AESTEC64.dll
2012-01-24 15:27 . 2011-11-27 10:28        162304        ----a-w-        c:\windows\system32\AESTAC64.dll
2012-01-24 15:24 . 2011-03-08 16:29        53248        ----a-w-        c:\windows\SysWow64\CSVer.dll
2012-01-02 07:54 . 2009-07-14 02:36        175616        ----a-w-        c:\windows\system32\msclmd.dll
2012-01-02 07:54 . 2009-07-14 02:36        152576        ----a-w-        c:\windows\SysWow64\msclmd.dll
2012-01-02 06:53 . 2012-01-02 06:53        91648        ----a-w-        c:\windows\system32\SetIEInstalledDate.exe
2012-01-02 06:53 . 2012-01-02 06:53        89088        ----a-w-        c:\windows\system32\RegisterIEPKEYs.exe
2012-01-02 06:53 . 2012-01-02 06:53        86528        ----a-w-        c:\windows\SysWow64\iesysprep.dll
2012-01-02 06:53 . 2012-01-02 06:53        85504        ----a-w-        c:\windows\system32\iesetup.dll
2012-01-02 06:53 . 2012-01-02 06:53        76800        ----a-w-        c:\windows\SysWow64\SetIEInstalledDate.exe
2012-01-02 06:53 . 2012-01-02 06:53        76800        ----a-w-        c:\windows\system32\tdc.ocx
2012-01-02 06:53 . 2012-01-02 06:53        74752        ----a-w-        c:\windows\SysWow64\RegisterIEPKEYs.exe
2012-01-02 06:53 . 2012-01-02 06:53        74752        ----a-w-        c:\windows\SysWow64\iesetup.dll
2012-01-02 06:53 . 2012-01-02 06:53        63488        ----a-w-        c:\windows\SysWow64\tdc.ocx
2012-01-02 06:53 . 2012-01-02 06:53        603648        ----a-w-        c:\windows\system32\vbscript.dll
2012-01-02 06:53 . 2012-01-02 06:53        49664        ----a-w-        c:\windows\system32\imgutil.dll
2012-01-02 06:53 . 2012-01-02 06:53        48640        ----a-w-        c:\windows\SysWow64\mshtmler.dll
2012-01-02 06:53 . 2012-01-02 06:53        48640        ----a-w-        c:\windows\system32\mshtmler.dll
2012-01-02 06:53 . 2012-01-02 06:53        448512        ----a-w-        c:\windows\system32\html.iec
2012-01-02 06:53 . 2012-01-02 06:53        420864        ----a-w-        c:\windows\SysWow64\vbscript.dll
2012-01-02 06:53 . 2012-01-02 06:53        367104        ----a-w-        c:\windows\SysWow64\html.iec
2012-01-02 06:53 . 2012-01-02 06:53        35840        ----a-w-        c:\windows\SysWow64\imgutil.dll
2012-01-02 06:53 . 2012-01-02 06:53        30720        ----a-w-        c:\windows\system32\licmgr10.dll
2012-01-02 06:53 . 2012-01-02 06:53        23552        ----a-w-        c:\windows\SysWow64\licmgr10.dll
2012-01-02 06:53 . 2012-01-02 06:53        222208        ----a-w-        c:\windows\system32\msls31.dll
2012-01-02 06:53 . 2012-01-02 06:53        173056        ----a-w-        c:\windows\system32\ieUnatt.exe
2012-01-02 06:53 . 2012-01-02 06:53        165888        ----a-w-        c:\windows\system32\iexpress.exe
2012-01-02 06:53 . 2012-01-02 06:53        161792        ----a-w-        c:\windows\SysWow64\msls31.dll
2012-01-02 06:53 . 2012-01-02 06:53        160256        ----a-w-        c:\windows\system32\wextract.exe
2012-01-02 06:53 . 2012-01-02 06:53        152064        ----a-w-        c:\windows\SysWow64\wextract.exe
2012-01-02 06:53 . 2012-01-02 06:53        150528        ----a-w-        c:\windows\SysWow64\iexpress.exe
2012-01-02 06:53 . 2012-01-02 06:53        142848        ----a-w-        c:\windows\SysWow64\ieUnatt.exe
2012-01-02 06:53 . 2012-01-02 06:53        135168        ----a-w-        c:\windows\system32\IEAdvpack.dll
2012-01-02 06:53 . 2012-01-02 06:53        12288        ----a-w-        c:\windows\system32\mshta.exe
2012-01-02 06:53 . 2012-01-02 06:53        11776        ----a-w-        c:\windows\SysWow64\mshta.exe
2012-01-02 06:53 . 2012-01-02 06:53        114176        ----a-w-        c:\windows\system32\admparse.dll
2012-01-02 06:53 . 2012-01-02 06:53        111616        ----a-w-        c:\windows\system32\iesysprep.dll
2012-01-02 06:53 . 2012-01-02 06:53        110592        ----a-w-        c:\windows\SysWow64\IEAdvpack.dll
2012-01-02 06:53 . 2012-01-02 06:53        101888        ----a-w-        c:\windows\SysWow64\admparse.dll
2011-11-27 10:36 . 2011-11-27 10:36        3120        ----a-w-        c:\windows\SysWow64\drivers\wdejfii.sys
2011-11-27 09:54 . 2011-11-27 09:54        800256        ----a-w-        c:\windows\system32\usp10.dll
2011-11-27 09:54 . 2011-11-27 09:54        7680        ----a-w-        c:\windows\system32\KBDINTAM.DLL
2011-11-27 09:54 . 2011-11-27 09:54        7680        ----a-w-        c:\windows\system32\KBDINMAL.DLL
2011-11-27 09:54 . 2011-11-27 09:54        7680        ----a-w-        c:\windows\system32\KBDINDEV.DLL
2011-11-27 09:54 . 2011-11-27 09:54        7680        ----a-w-        c:\windows\system32\KBDINBEN.DLL
2011-11-27 09:54 . 2011-11-27 09:54        7168        ----a-w-        c:\windows\SysWow64\KBDINTAM.DLL
2011-11-27 09:54 . 2011-11-27 09:54        7168        ----a-w-        c:\windows\SysWow64\KBDINORI.DLL
2011-11-27 09:54 . 2011-11-27 09:54        7168        ----a-w-        c:\windows\SysWow64\KBDINMAR.DLL
2011-11-27 09:54 . 2011-11-27 09:54        7168        ----a-w-        c:\windows\SysWow64\KBDINMAL.DLL
2011-11-27 09:54 . 2011-11-27 09:54        7168        ----a-w-        c:\windows\SysWow64\KBDINKAN.DLL
2011-11-27 09:54 . 2011-11-27 09:54        7168        ----a-w-        c:\windows\SysWow64\KBDINHIN.DLL
2011-11-27 09:54 . 2011-11-27 09:54        7168        ----a-w-        c:\windows\SysWow64\KBDINDEV.DLL
2011-11-27 09:54 . 2011-11-27 09:54        7168        ----a-w-        c:\windows\SysWow64\KBDINBEN.DLL
2011-11-27 09:54 . 2011-11-27 09:54        7168        ----a-w-        c:\windows\system32\KBDINTEL.DLL
2011-11-27 09:54 . 2011-11-27 09:54        7168        ----a-w-        c:\windows\system32\KBDINPUN.DLL
2011-11-27 09:54 . 2011-11-27 09:54        7168        ----a-w-        c:\windows\system32\KBDINORI.DLL
2011-11-27 09:54 . 2011-11-27 09:54        7168        ----a-w-        c:\windows\system32\KBDINMAR.DLL
2011-11-27 09:54 . 2011-11-27 09:54        7168        ----a-w-        c:\windows\system32\KBDINKAN.DLL
2011-11-27 09:54 . 2011-11-27 09:54        7168        ----a-w-        c:\windows\system32\KBDINHIN.DLL
2011-11-27 09:54 . 2011-11-27 09:54        7168        ----a-w-        c:\windows\system32\KBDINGUJ.DLL
2011-11-27 09:54 . 2011-11-27 09:54        7168        ----a-w-        c:\windows\system32\KBDINEN.DLL
2011-11-27 09:54 . 2011-11-27 09:54        7168        ----a-w-        c:\windows\system32\KBDINBE2.DLL
2011-11-27 09:54 . 2011-11-27 09:54        7168        ----a-w-        c:\windows\system32\KBDINBE1.DLL
2011-11-27 09:54 . 2011-11-27 09:54        7168        ----a-w-        c:\windows\system32\KBDINASA.DLL
2011-11-27 09:54 . 2011-11-27 09:54        6656        ----a-w-        c:\windows\SysWow64\KBDINTEL.DLL
2011-11-27 09:54 . 2011-11-27 09:54        6656        ----a-w-        c:\windows\SysWow64\KBDINPUN.DLL
2011-11-27 09:54 . 2011-11-27 09:54        6656        ----a-w-        c:\windows\SysWow64\KBDINGUJ.DLL
2011-11-27 09:54 . 2011-11-27 09:54        6656        ----a-w-        c:\windows\SysWow64\KBDINBE2.DLL
2011-11-27 09:54 . 2011-11-27 09:54        6656        ----a-w-        c:\windows\SysWow64\KBDINBE1.DLL
2011-11-27 09:54 . 2011-11-27 09:54        6656        ----a-w-        c:\windows\SysWow64\KBDINASA.DLL
2011-11-27 09:54 . 2011-11-27 09:54        626176        ----a-w-        c:\windows\SysWow64\usp10.dll
2011-11-24 04:52 . 2011-12-29 10:25        3145216        ----a-w-        c:\windows\system32\win32k.sys
.
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2012-01-18 18:49        94208        ----a-w-        c:\users\Olaf\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2012-01-18 18:49        94208        ----a-w-        c:\users\Olaf\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2012-01-18 18:49        94208        ----a-w-        c:\users\Olaf\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LightScribe Control Panel"="c:\program files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe" [2011-03-04 2736128]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"IMSS"="c:\program files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe" [2011-01-03 112152]
"IAStorIcon"="c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe" [2011-01-26 283160]
"NUSB3MON"="c:\program files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe" [2010-11-17 113288]
"Adobe Acrobat Speed Launcher"="c:\program files (x86)\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe" [2008-06-12 37232]
"Acrobat Assistant 8.0"="c:\program files (x86)\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe" [2008-06-11 640376]
"HPConnectionManager"="c:\program files (x86)\Hewlett-Packard\HP Connection Manager\HPCMDelayStart.exe" [2011-05-23 103992]
"Desktop Disc Tool"="c:\program files (x86)\Roxio\Roxio Burn\RoxioBurnLauncher.exe" [2011-04-18 522736]
"DsMgr"="c:\program files (x86)\Hewlett-Packard\HP GPS and Location\dsMgr.exe" [2011-04-20 93240]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2011-11-12 343168]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]
.
c:\users\Olaf\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dropbox.lnk - c:\users\Olaf\AppData\Roaming\Dropbox\bin\Dropbox.exe [2012-1-18 24246216]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2010-7-30 1132320]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
.
R2 AESTFilters;Andrea ST Filters Service;c:\program files\IDT\WDM\AESTSr64.exe [2012-01-24 89600]
R2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x]
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 HPDrvMntSvc.exe;HP Quick Synchronization Service;c:\program files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe [2011-09-01 227896]
R2 hpsrv;HP Service;c:\windows\system32\Hpservice.exe [x]
R2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [2011-01-26 13336]
R2 jhi_service;Intel(R) Identity Protection Technology Host Interface Service;c:\program files (x86)\Intel\Services\IPT\jhi_service.exe [2010-11-29 210896]
R2 McAfee Endpoint Encryption Agent;McAfee Endpoint Encryption Agent;c:\program files\Hewlett-Packard\Drive Encryption\EEAgent\MfeEpeHost.exe [x]
R2 PdiService;Portrait Displays SDK Service;c:\program files (x86)\Common Files\Portrait Displays\Drivers\pdisrvc.exe [2011-01-18 113264]
R2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2011-01-03 2656280]
R2 WMCoreService;Mobile Broadband Service;c:\program files (x86)\Ericsson\Mobile Broadband Drivers\WMCore\mini_WMCore.exe servicemode [x]
R3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [x]
R3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [x]
R3 AMPPAL;Intel® Centrino® Wireless Bluetooth® 3.0 + High Speed - Virtueller Adapter;c:\windows\system32\DRIVERS\AMPPAL.sys [x]
R3 ARCVCAM;ARCVCAM, ArcSoft Webcam Sharing Manager Driver;c:\windows\system32\DRIVERS\ArcSoftVCapture.sys [x]
R3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys [x]
R3 btwampfl;Bluetooth AMP USB Filter;c:\windows\system32\drivers\btwampfl.sys [x]
R3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys [x]
R3 GKUPRO2D;GKUPRO2D;c:\windows\system32\Drivers\GKUPRO2D.sys [x]
R3 h36wgps;HP  Mobile Broadband Module NMEA;c:\windows\system32\DRIVERS\h36wgps64.sys [x]
R3 hpCMSrv;HP Connection Manager 4 Service;c:\program files (x86)\Hewlett-Packard\HP Connection Manager\hpCMSrv.exe [2011-05-23 1098296]
R3 JMCR;JMCR;c:\windows\system32\DRIVERS\jmcr.sys [x]
R3 Mbm3DevMt;HP  Mobile Broadband Module Device Management Driver (WDM);c:\windows\system32\DRIVERS\Mbm3DevMt.sys [x]
R3 Mbm3mdfl;HP  Mobile Broadband Module Modem Filter;c:\windows\system32\DRIVERS\Mbm3mdfl.sys [x]
R3 Mbm3Mdm;HP  Mobile Broadband Module Modem Driver;c:\windows\system32\DRIVERS\Mbm3Mdm.sys [x]
R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4925184]
R3 RoxMediaDB12OEM;RoxMediaDB12OEM;c:\program files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxMediaDB12OEM.exe [2011-01-15 1116656]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 WatAdminSvc;Windows-Aktivierungstechnologieservice;c:\windows\system32\Wat\WatAdminSvc.exe [x]
S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys [x]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]
S3 e1cexpress;Intel(R) PRO/1000 PCI Express Network Connection Driver C;c:\windows\system32\DRIVERS\e1c62x64.sys [x]
S3 ecnssndis; Mobile Broadband Driver;c:\windows\system32\Drivers\wwuss64.sys [x]
S3 ecnssndisfltr; Mobile Broadband Driver Filter;c:\windows\system32\Drivers\wwussf64.sys [x]
S3 johci;JMicron 1394 Filter Driver;c:\windows\system32\DRIVERS\johci.sys [x]
S3 Mbm3CBus;HP hs2340 HSPA+ Mobile Broadband Module USB Device (WDM);c:\windows\system32\DRIVERS\Mbm3CBus.sys [x]
S3 MEIx64;Intel(R) Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [x]
S3 NETwNs64;___ Intel(R) Wireless WiFi Link der Serie 5000 Adaptertreiber für Windows 7 64-Bit;c:\windows\system32\DRIVERS\NETwNs64.sys [x]
S3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\nusb3hub.sys [x]
S3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;c:\windows\system32\DRIVERS\nusb3xhc.sys [x]
S3 WwanUsbServ;Mobile Broadband Driver;c:\windows\system32\DRIVERS\WwanUsbMp64.sys [x]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2011-03-04 11:29        451872        ----a-w-        c:\program files (x86)\Common Files\LightScribe\LSRunOnce.exe
.
Inhalt des "geplante Tasks" Ordners
.
2012-01-28 c:\windows\Tasks\HPCeeScheduleForHP-8560P-OLAF$.job
- c:\program files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-09-14 06:15]
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2012-01-18 18:49        97792        ----a-w-        c:\users\Olaf\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2012-01-18 18:49        97792        ----a-w-        c:\users\Olaf\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2012-01-18 18:49        97792        ----a-w-        c:\users\Olaf\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2012-01-18 18:49        97792        ----a-w-        c:\users\Olaf\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SysTrayApp"="c:\program files\IDT\WDM\sttray64.exe" [2012-01-24 1128448]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x0
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyServer = sun21.ukl.uni-freiburg.de:80
uInternet Settings,ProxyOverride = <local>
IE: An OneNote s&enden - c:\progra~2\MICROS~1\Office14\ONBttnIE.dll/105
IE: Nach Microsoft E&xcel exportieren - c:\progra~2\MICROS~1\Office14\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.178.1
FF - ProfilePath - c:\users\Olaf\AppData\Roaming\Mozilla\Firefox\Profiles\vfiszdss.default\
FF - prefs.js: browser.startup.homepage - hxxp://news.google.com/news?ned=fr
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files (x86)\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF - Ext: Zotero: zotero@chnm.gmu.edu - %profile%\extensions\zotero@chnm.gmu.edu
FF - Ext: Zotero Word for Windows Integration: zoteroWinWordIntegration@zotero.org - %profile%\extensions\zoteroWinWordIntegration@zotero.org
FF - Ext: ZotFile: zotfile@columbia.edu - %profile%\extensions\zotfile@columbia.edu
FF - Ext: FireFTP: {a7c6cf7f-112c-4500-a7ea-39801a327e5f} - %profile%\extensions\{a7c6cf7f-112c-4500-a7ea-39801a327e5f}
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Wow6432Node-HKCU-Run-2C508BD5-F9C6-4955-B93A-09B835EC3C64 - c:\users\Olaf\AppData\Roaming\09A52917-B4FC-4f02-AE3B-BF55D9351F4A\msvcs.exe
Wow6432Node-HKLM-Run-File Sanitizer - c:\program files (x86)\Hewlett-Packard\File Sanitizer\CoreShredder.exe
HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10m_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10m_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10m.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10m.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10m.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10m.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
@Denied: (A) (Everyone)
"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
"Key"="ActionsPane3"
"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2012-02-13  22:34:53
ComboFix-quarantined-files.txt  2012-02-13 21:34
.
Vor Suchlauf: 19 Verzeichnis(se), 377.862.017.024 Bytes frei
Nach Suchlauf: 25 Verzeichnis(se), 377.590.476.800 Bytes frei
.
- - End Of File - - 9C5585990D3EA44C9AAE5B7EBA217108

markusg 14.02.2012 11:55
bekommst du immernoch die fehlermeldung?
wurde combofix von dem betroffenen konto ausgeführt?

freeoutday 14.02.2012 12:12
Hi,

Ich habe Combofix jetzt und vorher als Administrator im abgesicherten Modus ausgeführt 8der Normalmodus geht ja noch nicht).
Hier noch mal das aktuelle Combofix Logfile von einem Durchlauf von vor 1 Minute

Code:
ComboFix 12-02-13.01 - Olaf 14.02.2012  12:02:50.2.4 - x64 NETWORK
Microsoft Windows 7 Professional  6.1.7601.1.1252.49.1031.18.4046.3317 [GMT 1:00]
ausgeführt von:: c:\users\Olaf\Desktop\ComboFix.exe
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 * Neuer Wiederherstellungspunkt wurde erstellt
.
.
(((((((((((((((((((((((  Dateien erstellt von 2012-01-14 bis 2012-02-14  ))))))))))))))))))))))))))))))
.
.
2012-02-14 11:07 . 2012-02-14 11:07        --------        d-----w-        c:\users\Default\AppData\Local\temp
2012-02-14 11:07 . 2012-02-14 11:07        --------        d-----w-        c:\users\Administrator\AppData\Local\temp
2012-02-13 23:58 . 2011-07-13 02:55        2237440        ----a-r-        C:\OTLPE.exe
2012-02-13 23:58 . 2012-02-13 23:58        --------        d-----w-        C:\_OTL
2012-02-13 21:25 . 2012-02-13 21:25        --------        d-----w-        c:\users\Olaf\AppData\Local\ElevatedDiagnostics
2012-02-13 09:42 . 2012-02-13 23:58        --------        d-----w-        c:\users\Olaf\AppData\Roaming\09A52917-B4FC-4f02-AE3B-BF55D9351F4A
2012-02-10 07:33 . 2012-01-06 05:15        8602168        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{0FF703CE-8E7C-4E7D-A606-97A2547E577E}\mpengine.dll
2012-02-05 20:19 . 2012-02-05 20:19        --------        d-----w-        c:\users\Default\AppData\Local\Microsoft Help
2012-02-04 16:40 . 2012-02-04 16:40        --------        d-----w-        c:\users\Olaf\AppData\Local\SAS
2012-02-04 16:39 . 2012-02-04 16:39        --------        d-----w-        c:\program files (x86)\Common Files\InstallShield
2012-02-04 16:39 . 2012-02-04 16:39        --------        d-----w-        c:\program files\SAS
2012-02-04 16:39 . 2012-02-04 16:39        --------        d-----w-        c:\program files (x86)\Common Files\Java
2012-02-04 16:39 . 2012-02-04 16:39        411368        ----a-w-        c:\windows\SysWow64\deployJava1.dll
2012-02-04 16:39 . 2012-02-04 16:39        --------        d-----w-        c:\program files (x86)\Java
2012-02-04 16:39 . 2012-02-04 16:39        --------        d-----w-        c:\program files (x86)\SAS Institute Inc
2012-02-04 16:38 . 2012-02-04 16:38        --------        d-----w-        c:\program files (x86)\SAS
2012-02-04 15:36 . 2012-02-04 15:36        --------        d-----w-        c:\windows\PCHEALTH
2012-02-04 15:34 . 2012-02-04 15:34        --------        d-----w-        c:\program files (x86)\Microsoft Analysis Services
2012-02-04 15:33 . 2012-02-04 17:29        --------        d-----w-        c:\users\Olaf\AppData\Local\Microsoft Help
2012-02-04 15:33 . 2012-02-05 20:19        --------        d-----w-        c:\programdata\Microsoft Help
2012-02-04 15:33 . 2012-02-04 15:33        --------        d-----r-        C:\MSOCache
2012-02-02 17:43 . 2012-02-02 17:43        --------        d-----w-        c:\program files\Windows XP Mode
2012-02-02 16:59 . 2012-02-02 16:59        --------        d-----w-        c:\windows\SysWow64\Wat
2012-02-02 16:59 . 2012-02-02 16:59        --------        d-----w-        c:\windows\system32\Wat
2012-02-02 16:54 . 2012-02-02 16:57        --------        d-----w-        C:\0a44299d2b6f9612547671
2012-02-02 15:04 . 2012-02-02 16:32        --------        d-----w-        C:\ABP
2012-02-01 08:11 . 2012-02-01 08:11        --------        d-----w-        c:\program files (x86)\MSECache
2012-02-01 08:05 . 2012-02-01 08:05        --------        d-----w-        c:\users\Olaf\AppData\Roaming\Roxio Burn
2012-01-30 09:58 . 2012-02-08 21:31        --------        d-----w-        c:\users\Olaf\AppData\Roaming\Skype
2012-01-30 09:58 . 2012-01-30 09:58        --------        d-----r-        c:\program files (x86)\Skype
2012-01-30 09:58 . 2012-01-30 09:58        --------        d-----w-        c:\programdata\Skype
2012-01-30 08:59 . 2012-01-30 09:00        --------        d-----w-        c:\program files (x86)\A43
2012-01-29 20:43 . 2012-02-02 11:42        --------        d-----w-        c:\program files\ABP
2012-01-29 20:22 . 2012-01-30 10:20        --------        d-----w-        C:\_PROJECTS
2012-01-29 20:06 . 2012-01-30 08:26        --------        d-----w-        C:\Zotero
2012-01-29 19:43 . 2012-01-30 14:00        --------        d-----w-        C:\Dropbox
2012-01-29 19:40 . 2012-02-12 19:43        --------        d-----w-        c:\users\Olaf\AppData\Roaming\Dropbox
2012-01-29 19:24 . 2012-01-29 19:24        --------        d-----w-        c:\users\Olaf\AppData\Roaming\Thunderbird
2012-01-29 18:58 . 2012-01-29 18:58        --------        d-----w-        C:\Dokumente und Einstellungen
2012-01-29 18:42 . 2012-01-29 18:42        414368        ----a-w-        c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2012-01-29 07:17 . 2012-01-29 07:17        --------        d-----w-        c:\users\Olaf\AppData\Local\Diagnostics
2012-01-28 20:03 . 2011-10-26 05:25        1572864        ----a-w-        c:\windows\system32\quartz.dll
2012-01-28 20:03 . 2011-10-26 04:32        1328128        ----a-w-        c:\windows\SysWow64\quartz.dll
2012-01-28 20:03 . 2011-10-26 05:25        366592        ----a-w-        c:\windows\system32\qdvd.dll
2012-01-28 20:03 . 2011-10-26 04:32        514560        ----a-w-        c:\windows\SysWow64\qdvd.dll
2012-01-28 19:57 . 2011-11-17 05:38        1292080        ----a-w-        c:\windows\SysWow64\ntdll.dll
2012-01-28 19:57 . 2011-11-17 06:41        1731920        ----a-w-        c:\windows\system32\ntdll.dll
2012-01-28 19:56 . 2011-11-19 14:58        77312        ----a-w-        c:\windows\system32\packager.dll
2012-01-28 19:56 . 2011-11-19 14:01        67072        ----a-w-        c:\windows\SysWow64\packager.dll
2012-01-26 07:21 . 2012-01-26 07:21        --------        d-----w-        c:\programdata\ATI
2012-01-26 07:20 . 2012-01-26 07:20        --------        d-----w-        c:\program files (x86)\AMD APP
2012-01-24 15:28 . 2012-01-24 15:28        174680        ----a-w-        c:\windows\system32\drivers\jmcr.sys
2012-01-24 15:27 . 2012-01-24 15:27        654336        ------w-        c:\windows\system32\stapi64.dll
2012-01-24 15:27 . 2012-01-24 15:27        528384        ----a-w-        c:\windows\system32\drivers\stwrt64.sys
2012-01-24 15:27 . 2012-01-24 15:27        431616        ----a-w-        c:\windows\system32\stcplx64.dll
2012-01-24 15:27 . 2012-01-24 15:27        1965056        ----a-w-        c:\windows\system32\stapo64.dll
2012-01-24 15:27 . 2012-01-24 15:27        --------        d-----w-        c:\program files\IDT
2012-01-24 15:26 . 2012-01-24 15:26        8604672        ----a-w-        c:\windows\system32\drivers\NETwNs64.sys
2012-01-24 15:26 . 2012-01-24 15:26        --------        d-----w-        c:\program files (x86)\Common Files\LightScribe
2012-01-24 15:25 . 2012-01-24 15:25        --------        d-----w-        c:\program files (x86)\Common Files\SureThing Shared
2012-01-24 15:25 . 2012-01-24 15:25        --------        d-----w-        c:\program files\Roxio
2012-01-24 15:25 . 2012-01-24 15:25        --------        d-----w-        c:\program files (x86)\Common Files\Telespree
2012-01-24 15:24 . 2011-03-22 05:25        229888        ----a-w-        c:\windows\system32\wwansvc.dll
2012-01-24 15:23 . 2011-02-25 06:25        296320        ----a-w-        c:\windows\system32\drivers\volsnap.sys
2012-01-24 15:22 . 2012-01-24 15:22        27648        ----a-w-        c:\windows\system32\SzCcid.dll
2012-01-24 15:22 . 2012-01-24 15:22        --------        d-----w-        c:\programdata\SZCCID
2012-01-24 15:22 . 2012-01-24 15:22        --------        d-----w-        c:\program files (x86)\AlcorMicro
2012-01-24 15:22 . 2012-01-24 15:22        582144        ----a-w-        c:\program files (x86)\Common Files\Microsoft Shared\DAO\DAO350.DLL
2012-01-24 15:22 . 2012-01-24 15:22        368912        ----a-w-        c:\windows\SysWow64\VBAR332.DLL
2012-01-24 15:22 . 2012-01-24 15:22        252176        ----a-w-        c:\windows\SysWow64\MSRD2X35.DLL
2012-01-24 15:22 . 2012-01-24 15:22        24848        ----a-w-        c:\windows\SysWow64\MSJTER35.DLL
2012-01-24 15:22 . 2012-01-24 15:22        123664        ----a-w-        c:\windows\SysWow64\MSJINT35.DLL
2012-01-24 15:22 . 2012-01-24 15:22        1045776        ----a-w-        c:\windows\SysWow64\MSJET35.DLL
2012-01-24 14:50 . 2012-01-24 14:50        --------        d-----w-        c:\programdata\HP
.
.
.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-01-26 23:52 . 2011-12-22 17:59        279656        ------w-        c:\windows\system32\MpSigStub.exe
2012-01-26 07:13 . 2011-03-31 10:52        58880        ----a-w-        c:\windows\system32\coinst.dll
2012-01-26 07:13 . 2011-03-31 10:45        40960        ----a-w-        c:\windows\system32\atiuxp64.dll
2012-01-26 07:12 . 2011-03-31 11:03        4044288        ----a-w-        c:\windows\system32\atiumd6a.dll
2012-01-26 07:12 . 2011-03-31 10:53        5510144        ----a-w-        c:\windows\system32\atiumd64.dll
2012-01-26 07:12 . 2011-03-31 10:45        38912        ----a-w-        c:\windows\system32\atiu9p64.dll
2012-01-26 07:12 . 2011-03-31 11:20        423424        ----a-w-        c:\windows\system32\atipdl64.dll
2012-01-26 07:10 . 2011-03-31 11:22        466944        ----a-w-        c:\windows\system32\ATIDEMGX.dll
2012-01-26 07:10 . 2011-03-31 11:24        892416        ----a-w-        c:\windows\system32\aticfx64.dll
2012-01-26 07:10 . 2011-03-31 10:46        486912        ----a-w-        c:\windows\system32\atiadlxx.dll
2012-01-24 15:27 . 2011-11-27 10:28        6382080        ----a-w-        c:\windows\system32\IDTNGUI.exe
2012-01-24 15:27 . 2011-11-27 10:28        4933120        ----a-w-        c:\windows\system32\IDTNHP.dll
2012-01-24 15:27 . 2011-11-27 10:28        4780032        ----a-w-        c:\windows\system32\stlang64.dll
2012-01-24 15:27 . 2011-11-27 10:28        221184        ----a-w-        c:\windows\system32\HPToneCtrls64.dll
2012-01-24 15:27 . 2011-11-27 10:28        212480        ----a-w-        c:\windows\system32\IDTNJ.exe
2012-01-24 15:27 . 2011-11-27 10:28        1523712        ----a-w-        c:\windows\system32\IDTNC64.cpl
2012-01-24 15:27 . 2011-11-27 10:28        1128448        ----a-w-        c:\windows\sttray64.exe
2012-01-24 15:27 . 2011-11-27 10:28        1029120        ----a-w-        c:\windows\system32\IDTNX.dll
2012-01-24 15:27 . 2011-11-27 10:28        224256        ----a-w-        c:\windows\system32\staco64.dll
2012-01-24 15:27 . 2011-11-27 10:28        90624        ----a-w-        c:\windows\system32\AESTCo64.dll
2012-01-24 15:27 . 2011-11-27 10:28        68608        ----a-w-        c:\windows\system32\AESTAR64.dll
2012-01-24 15:27 . 2011-11-27 10:28        442368        ----a-w-        c:\windows\system32\AESTEC64.dll
2012-01-24 15:27 . 2011-11-27 10:28        162304        ----a-w-        c:\windows\system32\AESTAC64.dll
2012-01-24 15:24 . 2011-03-08 16:29        53248        ----a-w-        c:\windows\SysWow64\CSVer.dll
2012-01-02 07:54 . 2009-07-14 02:36        175616        ----a-w-        c:\windows\system32\msclmd.dll
2012-01-02 07:54 . 2009-07-14 02:36        152576        ----a-w-        c:\windows\SysWow64\msclmd.dll
2012-01-02 06:53 . 2012-01-02 06:53        91648        ----a-w-        c:\windows\system32\SetIEInstalledDate.exe
2012-01-02 06:53 . 2012-01-02 06:53        89088        ----a-w-        c:\windows\system32\RegisterIEPKEYs.exe
2012-01-02 06:53 . 2012-01-02 06:53        86528        ----a-w-        c:\windows\SysWow64\iesysprep.dll
2012-01-02 06:53 . 2012-01-02 06:53        85504        ----a-w-        c:\windows\system32\iesetup.dll
2012-01-02 06:53 . 2012-01-02 06:53        76800        ----a-w-        c:\windows\SysWow64\SetIEInstalledDate.exe
2012-01-02 06:53 . 2012-01-02 06:53        76800        ----a-w-        c:\windows\system32\tdc.ocx
2012-01-02 06:53 . 2012-01-02 06:53        74752        ----a-w-        c:\windows\SysWow64\RegisterIEPKEYs.exe
2012-01-02 06:53 . 2012-01-02 06:53        74752        ----a-w-        c:\windows\SysWow64\iesetup.dll
2012-01-02 06:53 . 2012-01-02 06:53        63488        ----a-w-        c:\windows\SysWow64\tdc.ocx
2012-01-02 06:53 . 2012-01-02 06:53        603648        ----a-w-        c:\windows\system32\vbscript.dll
2012-01-02 06:53 . 2012-01-02 06:53        49664        ----a-w-        c:\windows\system32\imgutil.dll
2012-01-02 06:53 . 2012-01-02 06:53        48640        ----a-w-        c:\windows\SysWow64\mshtmler.dll
2012-01-02 06:53 . 2012-01-02 06:53        48640        ----a-w-        c:\windows\system32\mshtmler.dll
2012-01-02 06:53 . 2012-01-02 06:53        448512        ----a-w-        c:\windows\system32\html.iec
2012-01-02 06:53 . 2012-01-02 06:53        420864        ----a-w-        c:\windows\SysWow64\vbscript.dll
2012-01-02 06:53 . 2012-01-02 06:53        367104        ----a-w-        c:\windows\SysWow64\html.iec
2012-01-02 06:53 . 2012-01-02 06:53        35840        ----a-w-        c:\windows\SysWow64\imgutil.dll
2012-01-02 06:53 . 2012-01-02 06:53        30720        ----a-w-        c:\windows\system32\licmgr10.dll
2012-01-02 06:53 . 2012-01-02 06:53        23552        ----a-w-        c:\windows\SysWow64\licmgr10.dll
2012-01-02 06:53 . 2012-01-02 06:53        222208        ----a-w-        c:\windows\system32\msls31.dll
2012-01-02 06:53 . 2012-01-02 06:53        173056        ----a-w-        c:\windows\system32\ieUnatt.exe
2012-01-02 06:53 . 2012-01-02 06:53        165888        ----a-w-        c:\windows\system32\iexpress.exe
2012-01-02 06:53 . 2012-01-02 06:53        161792        ----a-w-        c:\windows\SysWow64\msls31.dll
2012-01-02 06:53 . 2012-01-02 06:53        160256        ----a-w-        c:\windows\system32\wextract.exe
2012-01-02 06:53 . 2012-01-02 06:53        152064        ----a-w-        c:\windows\SysWow64\wextract.exe
2012-01-02 06:53 . 2012-01-02 06:53        150528        ----a-w-        c:\windows\SysWow64\iexpress.exe
2012-01-02 06:53 . 2012-01-02 06:53        142848        ----a-w-        c:\windows\SysWow64\ieUnatt.exe
2012-01-02 06:53 . 2012-01-02 06:53        135168        ----a-w-        c:\windows\system32\IEAdvpack.dll
2012-01-02 06:53 . 2012-01-02 06:53        12288        ----a-w-        c:\windows\system32\mshta.exe
2012-01-02 06:53 . 2012-01-02 06:53        11776        ----a-w-        c:\windows\SysWow64\mshta.exe
2012-01-02 06:53 . 2012-01-02 06:53        114176        ----a-w-        c:\windows\system32\admparse.dll
2012-01-02 06:53 . 2012-01-02 06:53        111616        ----a-w-        c:\windows\system32\iesysprep.dll
2012-01-02 06:53 . 2012-01-02 06:53        110592        ----a-w-        c:\windows\SysWow64\IEAdvpack.dll
2012-01-02 06:53 . 2012-01-02 06:53        101888        ----a-w-        c:\windows\SysWow64\admparse.dll
2011-11-27 10:36 . 2011-11-27 10:36        3120        ----a-w-        c:\windows\SysWow64\drivers\wdejfii.sys
2011-11-27 09:54 . 2011-11-27 09:54        800256        ----a-w-        c:\windows\system32\usp10.dll
2011-11-27 09:54 . 2011-11-27 09:54        7680        ----a-w-        c:\windows\system32\KBDINTAM.DLL
2011-11-27 09:54 . 2011-11-27 09:54        7680        ----a-w-        c:\windows\system32\KBDINMAL.DLL
2011-11-27 09:54 . 2011-11-27 09:54        7680        ----a-w-        c:\windows\system32\KBDINDEV.DLL
2011-11-27 09:54 . 2011-11-27 09:54        7680        ----a-w-        c:\windows\system32\KBDINBEN.DLL
2011-11-27 09:54 . 2011-11-27 09:54        7168        ----a-w-        c:\windows\SysWow64\KBDINTAM.DLL
2011-11-27 09:54 . 2011-11-27 09:54        7168        ----a-w-        c:\windows\SysWow64\KBDINORI.DLL
2011-11-27 09:54 . 2011-11-27 09:54        7168        ----a-w-        c:\windows\SysWow64\KBDINMAR.DLL
2011-11-27 09:54 . 2011-11-27 09:54        7168        ----a-w-        c:\windows\SysWow64\KBDINMAL.DLL
2011-11-27 09:54 . 2011-11-27 09:54        7168        ----a-w-        c:\windows\SysWow64\KBDINKAN.DLL
2011-11-27 09:54 . 2011-11-27 09:54        7168        ----a-w-        c:\windows\SysWow64\KBDINHIN.DLL
2011-11-27 09:54 . 2011-11-27 09:54        7168        ----a-w-        c:\windows\SysWow64\KBDINDEV.DLL
2011-11-27 09:54 . 2011-11-27 09:54        7168        ----a-w-        c:\windows\SysWow64\KBDINBEN.DLL
2011-11-27 09:54 . 2011-11-27 09:54        7168        ----a-w-        c:\windows\system32\KBDINTEL.DLL
2011-11-27 09:54 . 2011-11-27 09:54        7168        ----a-w-        c:\windows\system32\KBDINPUN.DLL
2011-11-27 09:54 . 2011-11-27 09:54        7168        ----a-w-        c:\windows\system32\KBDINORI.DLL
2011-11-27 09:54 . 2011-11-27 09:54        7168        ----a-w-        c:\windows\system32\KBDINMAR.DLL
2011-11-27 09:54 . 2011-11-27 09:54        7168        ----a-w-        c:\windows\system32\KBDINKAN.DLL
2011-11-27 09:54 . 2011-11-27 09:54        7168        ----a-w-        c:\windows\system32\KBDINHIN.DLL
2011-11-27 09:54 . 2011-11-27 09:54        7168        ----a-w-        c:\windows\system32\KBDINGUJ.DLL
2011-11-27 09:54 . 2011-11-27 09:54        7168        ----a-w-        c:\windows\system32\KBDINEN.DLL
2011-11-27 09:54 . 2011-11-27 09:54        7168        ----a-w-        c:\windows\system32\KBDINBE2.DLL
2011-11-27 09:54 . 2011-11-27 09:54        7168        ----a-w-        c:\windows\system32\KBDINBE1.DLL
2011-11-27 09:54 . 2011-11-27 09:54        7168        ----a-w-        c:\windows\system32\KBDINASA.DLL
2011-11-27 09:54 . 2011-11-27 09:54        6656        ----a-w-        c:\windows\SysWow64\KBDINTEL.DLL
2011-11-27 09:54 . 2011-11-27 09:54        6656        ----a-w-        c:\windows\SysWow64\KBDINPUN.DLL
2011-11-27 09:54 . 2011-11-27 09:54        6656        ----a-w-        c:\windows\SysWow64\KBDINGUJ.DLL
2011-11-27 09:54 . 2011-11-27 09:54        6656        ----a-w-        c:\windows\SysWow64\KBDINBE2.DLL
2011-11-27 09:54 . 2011-11-27 09:54        6656        ----a-w-        c:\windows\SysWow64\KBDINBE1.DLL
2011-11-27 09:54 . 2011-11-27 09:54        6656        ----a-w-        c:\windows\SysWow64\KBDINASA.DLL
2011-11-27 09:54 . 2011-11-27 09:54        626176        ----a-w-        c:\windows\SysWow64\usp10.dll
2011-11-24 04:52 . 2011-12-29 10:25        3145216        ----a-w-        c:\windows\system32\win32k.sys
.
.
(((((((((((((((((((((((((((((  SnapShot@2012-02-13_21.33.05  )))))))))))))))))))))))))))))))))))))))))
.
- 2012-02-13 09:43 . 2012-02-13 21:23        2048              c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2012-02-14 09:34 . 2012-02-14 09:34        2048              c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2012-02-14 09:34 . 2012-02-14 09:34        2048              c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
- 2012-02-13 09:43 . 2012-02-13 21:23        2048              c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2012-01-18 18:49        94208        ----a-w-        c:\users\Olaf\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2012-01-18 18:49        94208        ----a-w-        c:\users\Olaf\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2012-01-18 18:49        94208        ----a-w-        c:\users\Olaf\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LightScribe Control Panel"="c:\program files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe" [2011-03-04 2736128]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"IMSS"="c:\program files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe" [2011-01-03 112152]
"IAStorIcon"="c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe" [2011-01-26 283160]
"NUSB3MON"="c:\program files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe" [2010-11-17 113288]
"Adobe Acrobat Speed Launcher"="c:\program files (x86)\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe" [2008-06-12 37232]
"Acrobat Assistant 8.0"="c:\program files (x86)\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe" [2008-06-11 640376]
"HPConnectionManager"="c:\program files (x86)\Hewlett-Packard\HP Connection Manager\HPCMDelayStart.exe" [2011-05-23 103992]
"Desktop Disc Tool"="c:\program files (x86)\Roxio\Roxio Burn\RoxioBurnLauncher.exe" [2011-04-18 522736]
"DsMgr"="c:\program files (x86)\Hewlett-Packard\HP GPS and Location\dsMgr.exe" [2011-04-20 93240]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2011-11-12 343168]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]
.
c:\users\Olaf\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dropbox.lnk - c:\users\Olaf\AppData\Roaming\Dropbox\bin\Dropbox.exe [2012-1-18 24246216]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2010-7-30 1132320]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
.
R2 AESTFilters;Andrea ST Filters Service;c:\program files\IDT\WDM\AESTSr64.exe [2012-01-24 89600]
R2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x]
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 HPDrvMntSvc.exe;HP Quick Synchronization Service;c:\program files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe [2011-09-01 227896]
R2 hpsrv;HP Service;c:\windows\system32\Hpservice.exe [x]
R2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [2011-01-26 13336]
R2 jhi_service;Intel(R) Identity Protection Technology Host Interface Service;c:\program files (x86)\Intel\Services\IPT\jhi_service.exe [2010-11-29 210896]
R2 McAfee Endpoint Encryption Agent;McAfee Endpoint Encryption Agent;c:\program files\Hewlett-Packard\Drive Encryption\EEAgent\MfeEpeHost.exe [x]
R2 PdiService;Portrait Displays SDK Service;c:\program files (x86)\Common Files\Portrait Displays\Drivers\pdisrvc.exe [2011-01-18 113264]
R2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2011-01-03 2656280]
R2 WMCoreService;Mobile Broadband Service;c:\program files (x86)\Ericsson\Mobile Broadband Drivers\WMCore\mini_WMCore.exe servicemode [x]
R3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [x]
R3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [x]
R3 AMPPAL;Intel® Centrino® Wireless Bluetooth® 3.0 + High Speed - Virtueller Adapter;c:\windows\system32\DRIVERS\AMPPAL.sys [x]
R3 ARCVCAM;ARCVCAM, ArcSoft Webcam Sharing Manager Driver;c:\windows\system32\DRIVERS\ArcSoftVCapture.sys [x]
R3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys [x]
R3 btwampfl;Bluetooth AMP USB Filter;c:\windows\system32\drivers\btwampfl.sys [x]
R3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys [x]
R3 GKUPRO2D;GKUPRO2D;c:\windows\system32\Drivers\GKUPRO2D.sys [x]
R3 h36wgps;HP  Mobile Broadband Module NMEA;c:\windows\system32\DRIVERS\h36wgps64.sys [x]
R3 hpCMSrv;HP Connection Manager 4 Service;c:\program files (x86)\Hewlett-Packard\HP Connection Manager\hpCMSrv.exe [2011-05-23 1098296]
R3 JMCR;JMCR;c:\windows\system32\DRIVERS\jmcr.sys [x]
R3 Mbm3DevMt;HP  Mobile Broadband Module Device Management Driver (WDM);c:\windows\system32\DRIVERS\Mbm3DevMt.sys [x]
R3 Mbm3mdfl;HP  Mobile Broadband Module Modem Filter;c:\windows\system32\DRIVERS\Mbm3mdfl.sys [x]
R3 Mbm3Mdm;HP  Mobile Broadband Module Modem Driver;c:\windows\system32\DRIVERS\Mbm3Mdm.sys [x]
R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4925184]
R3 RoxMediaDB12OEM;RoxMediaDB12OEM;c:\program files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxMediaDB12OEM.exe [2011-01-15 1116656]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 WatAdminSvc;Windows-Aktivierungstechnologieservice;c:\windows\system32\Wat\WatAdminSvc.exe [x]
S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys [x]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]
S3 e1cexpress;Intel(R) PRO/1000 PCI Express Network Connection Driver C;c:\windows\system32\DRIVERS\e1c62x64.sys [x]
S3 ecnssndis; Mobile Broadband Driver;c:\windows\system32\Drivers\wwuss64.sys [x]
S3 ecnssndisfltr; Mobile Broadband Driver Filter;c:\windows\system32\Drivers\wwussf64.sys [x]
S3 johci;JMicron 1394 Filter Driver;c:\windows\system32\DRIVERS\johci.sys [x]
S3 Mbm3CBus;HP hs2340 HSPA+ Mobile Broadband Module USB Device (WDM);c:\windows\system32\DRIVERS\Mbm3CBus.sys [x]
S3 MEIx64;Intel(R) Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [x]
S3 NETwNs64;___ Intel(R) Wireless WiFi Link der Serie 5000 Adaptertreiber für Windows 7 64-Bit;c:\windows\system32\DRIVERS\NETwNs64.sys [x]
S3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\nusb3hub.sys [x]
S3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;c:\windows\system32\DRIVERS\nusb3xhc.sys [x]
S3 WwanUsbServ;Mobile Broadband Driver;c:\windows\system32\DRIVERS\WwanUsbMp64.sys [x]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - WS2IFSL
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2011-03-04 11:29        451872        ----a-w-        c:\program files (x86)\Common Files\LightScribe\LSRunOnce.exe
.
Inhalt des "geplante Tasks" Ordners
.
2012-01-28 c:\windows\Tasks\HPCeeScheduleForHP-8560P-OLAF$.job
- c:\program files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-09-14 06:15]
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2012-01-18 18:49        97792        ----a-w-        c:\users\Olaf\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2012-01-18 18:49        97792        ----a-w-        c:\users\Olaf\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2012-01-18 18:49        97792        ----a-w-        c:\users\Olaf\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2012-01-18 18:49        97792        ----a-w-        c:\users\Olaf\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe" [BU]
"SysTrayApp"="c:\program files\IDT\WDM\sttray64.exe" [2012-01-24 1128448]
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyServer = sun21.ukl.uni-freiburg.de:80
uInternet Settings,ProxyOverride = <local>
IE: An OneNote s&enden - c:\progra~2\MICROS~1\Office14\ONBttnIE.dll/105
IE: Nach Microsoft E&xcel exportieren - c:\progra~2\MICROS~1\Office14\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.178.1
FF - ProfilePath - c:\users\Olaf\AppData\Roaming\Mozilla\Firefox\Profiles\vfiszdss.default\
FF - prefs.js: browser.startup.homepage - hxxp://news.google.com/news?ned=fr
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files (x86)\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF - Ext: Zotero: zotero@chnm.gmu.edu - %profile%\extensions\zotero@chnm.gmu.edu
FF - Ext: Zotero Word for Windows Integration: zoteroWinWordIntegration@zotero.org - %profile%\extensions\zoteroWinWordIntegration@zotero.org
FF - Ext: ZotFile: zotfile@columbia.edu - %profile%\extensions\zotfile@columbia.edu
FF - Ext: FireFTP: {a7c6cf7f-112c-4500-a7ea-39801a327e5f} - %profile%\extensions\{a7c6cf7f-112c-4500-a7ea-39801a327e5f}
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10m_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10m_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10m.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10m.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10m.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10m.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
@Denied: (A) (Everyone)
"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
"Key"="ActionsPane3"
"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2012-02-14  12:08:59
ComboFix-quarantined-files.txt  2012-02-14 11:08
ComboFix2.txt  2012-02-13 21:34
.
Vor Suchlauf: 24 Verzeichnis(se), 377.750.044.672 Bytes frei
Nach Suchlauf: 25 Verzeichnis(se), 377.446.473.728 Bytes frei
.
- - End Of File - - C53A95D68DCCF11DDCE4E2252E8834AF


Alle Zeitangaben in WEZ +1. Es ist jetzt 00:15 Uhr.
Seite 1 von 2 1 2
100 Beiträge dieses Themas auf einer Seite anzeigen

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19