Trojaner-Board - Rootkit.Zeroaccess

Combofix-log:
Code:
ComboFix 12-06-21.01 - *** 21.06.2012  18:04:35.6.2 - x86

Microsoft Windows 7 Professional   6.1.7601.1.1252.49.1031.18.2048.1249 [GMT 2:00]

ausgeführt von:: c:\users\***\Desktop\ComboFix.exe

Benutzte Befehlsschalter :: c:\users\***\Desktop\CfScript.txt

AV: Microsoft Security Essentials *Disabled/Updated* {9765EA51-0D3C-7DFB-6091-10E4E1F341F6}

SP: Microsoft Security Essentials *Disabled/Updated* {2C040BB5-2B06-7275-5A21-2B969A740B4B}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

FILE ::

"c:\windows\system32\DRIVERS\BazisVirtualCDBus.sys"

"c:\windows\System32\Drivers\sptd.sys"

.

.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

.

(((((((((((((((((((((((((((((((((((((((   Treiber/Dienste   )))))))))))))))))))))))))))))))))))))))))))))))))

.

.

-------\Legacy_SPTD

-------\Service_BazisVirtualCDBus

-------\Service_sptd

.

.

(((((((((((((((((((((((   Dateien erstellt von 2012-05-21 bis 2012-06-21  ))))))))))))))))))))))))))))))

.

.

2012-06-21 16:13 . 2012-06-21 16:13        --------        d-----w-        c:\users\Default\AppData\Local\temp

2012-06-21 16:00 . 2012-06-21 16:00        56200        ----a-w-        c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{893DD31B-8FEB-482F-8A84-C6CA8021BFA2}\offreg.dll

2012-06-21 15:55 . 2012-06-21 15:55        770384        ----a-w-        c:\program files\Mozilla Firefox\msvcr100.dll

2012-06-21 15:55 . 2012-06-21 15:55        421200        ----a-w-        c:\program files\Mozilla Firefox\msvcp100.dll

2012-06-20 18:56 . 2012-06-20 18:56        --------        d-----w-        c:\windows\system32\wbem\en-US

2012-06-20 14:53 . 2011-03-25 02:57        43008        ----a-w-        c:\windows\system32\drivers\usbehci.sys

2012-06-20 14:53 . 2011-03-25 02:58        258560        ----a-w-        c:\windows\system32\drivers\usbhub.sys

2012-06-20 14:53 . 2011-03-25 02:58        284672        ----a-w-        c:\windows\system32\drivers\usbport.sys

2012-06-20 14:53 . 2011-03-25 02:58        75776        ----a-w-        c:\windows\system32\drivers\usbccgp.sys

2012-06-20 14:53 . 2011-03-25 02:57        20480        ----a-w-        c:\windows\system32\drivers\usbohci.sys

2012-06-20 14:53 . 2011-03-25 02:57        24064        ----a-w-        c:\windows\system32\drivers\usbuhci.sys

2012-06-20 14:53 . 2011-03-25 02:57        5888        ----a-w-        c:\windows\system32\drivers\usbd.sys

2012-06-20 10:19 . 2012-05-31 03:41        6762896        ----a-w-        c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{893DD31B-8FEB-482F-8A84-C6CA8021BFA2}\mpengine.dll

2012-06-18 14:16 . 2012-03-01 05:46        19824        ----a-w-        c:\windows\system32\drivers\fs_rec.sys

2012-06-18 14:16 . 2012-03-01 05:33        159232        ----a-w-        c:\windows\system32\imagehlp.dll

2012-06-18 14:12 . 2012-01-04 08:58        442880        ----a-w-        c:\windows\system32\ntshrui.dll

2012-06-18 14:12 . 2012-04-07 11:26        2342400        ----a-w-        c:\windows\system32\msi.dll

2012-06-18 14:11 . 2011-06-15 08:55        86016        ----a-w-        c:\windows\system32\odbccu32.dll

2012-06-18 14:11 . 2011-06-15 08:55        81920        ----a-w-        c:\windows\system32\odbccr32.dll

2012-06-18 14:11 . 2011-06-15 08:55        319488        ----a-w-        c:\windows\system32\odbcjt32.dll

2012-06-18 14:11 . 2011-06-15 08:55        163840        ----a-w-        c:\windows\system32\odbctrac.dll

2012-06-18 14:11 . 2011-06-15 08:55        122880        ----a-w-        c:\windows\system32\odbccp32.dll

2012-06-18 14:11 . 2011-06-15 08:54        94208        ----a-w-        c:\program files\Common Files\System\Ole DB\msdaosp.dll

2012-06-18 14:11 . 2012-03-31 04:39        3968368        ----a-w-        c:\windows\system32\ntkrnlpa.exe

2012-06-18 14:11 . 2012-03-31 04:39        3913072        ----a-w-        c:\windows\system32\ntoskrnl.exe

2012-06-18 14:09 . 2011-08-17 04:24        465408        ----a-w-        c:\windows\system32\psisdecd.dll

2012-06-18 13:59 . 2012-04-24 04:36        140288        ----a-w-        c:\windows\system32\cryptsvc.dll

2012-06-18 13:59 . 2012-04-24 04:36        1158656        ----a-w-        c:\windows\system32\crypt32.dll

2012-06-18 13:59 . 2012-04-24 04:36        103936        ----a-w-        c:\windows\system32\cryptnet.dll

2012-06-18 12:05 . 2012-05-08 07:40        6737808        ----a-w-        c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll

2012-06-18 11:46 . 2012-06-18 11:46        --------        d-----w-        c:\windows\system32\SPReview

2012-06-18 10:59 . 2010-11-20 02:21        868864        ----a-w-        c:\program files\Common Files\Microsoft Shared\ink\tipskins.dll

2012-06-18 10:58 . 2010-11-20 02:19        954288        ----a-w-        c:\windows\system32\mfc40u.dll

2012-06-18 10:56 . 2010-11-20 02:18        630784        ----a-w-        c:\windows\system32\DXPTaskRingtone.dll

2012-06-18 10:56 . 2010-11-20 02:18        399872        ----a-w-        c:\windows\system32\DXP.dll

2012-06-18 10:56 . 2010-11-20 02:18        242176        ----a-w-        c:\windows\system32\eapp3hst.dll

2012-06-18 10:56 . 2010-11-20 02:18        17408        ----a-w-        c:\windows\system32\credssp.dll

2012-06-18 10:56 . 2010-11-20 02:18        139264        ----a-w-        c:\windows\system32\cscobj.dll

2012-06-18 10:56 . 2010-11-20 02:18        109568        ----a-w-        c:\windows\system32\CscMig.dll

2012-06-18 10:56 . 2010-11-19 22:44        388096        ----a-w-        c:\windows\system32\drivers\csc.sys

2012-06-18 10:56 . 2010-11-20 02:18        863744        ----a-w-        c:\windows\system32\diagperf.dll

2012-06-18 10:56 . 2010-11-20 02:16        128000        ----a-w-        c:\windows\system32\desk.cpl

2012-06-18 10:56 . 2010-11-19 23:50        31232        ----a-w-        c:\windows\system32\drivers\CompositeBus.sys

2012-06-18 10:56 . 2010-11-20 02:18        546304        ----a-w-        c:\windows\system32\cscsvc.dll

2012-06-18 10:24 . 2012-06-18 10:24        --------        d-----w-        c:\windows\CheckSur

2012-06-18 10:02 . 2012-06-18 10:02        --------        d-----w-        c:\program files\Common Files\Java

2012-06-18 10:01 . 2012-06-18 10:01        --------        d-----w-        c:\program files\Oracle

2012-06-18 10:00 . 2012-05-04 17:29        772504        ----a-w-        c:\windows\system32\npDeployJava1.dll

2012-06-18 09:03 . 2012-06-18 09:03        --------        d-----w-        c:\program files\Bonjour

2012-06-15 15:16 . 2012-06-15 15:16        --------        d-----w-        c:\program files\Microsoft Silverlight

2012-06-14 13:57 . 2012-06-14 13:57        --------        d-----w-        c:\users\***\AppData\Local\Macromedia

2012-06-14 13:14 . 2012-06-14 13:14        713784        ------w-        c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{3366CA71-E991-46A0-85A5-37675C5E4324}\gapaengine.dll

2012-06-14 13:12 . 2012-06-14 13:12        --------        d-----w-        c:\program files\Microsoft Security Client

2012-06-14 08:03 . 2012-06-14 08:03        --------        d-----w-        c:\program files\ESET

2012-06-14 07:23 . 2012-05-14 23:43        6737808        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{CD78EDD8-09EB-4428-8FF8-A4C1555F2B4F}\mpengine.dll

2012-06-14 04:56 . 2012-06-14 05:18        70304        ----a-w-        c:\windows\system32\FlashPlayerCPLApp.cpl

2012-06-14 04:56 . 2012-06-14 05:18        419488        ----a-w-        c:\windows\system32\FlashPlayerApp.exe

2012-06-12 17:00 . 2012-06-21 16:16        --------        d-----w-        c:\users\***\AppData\Local\temp

2012-06-05 20:48 . 2012-06-05 20:48        --------        d-----w-        c:\windows\system32\EventProviders

2012-06-04 15:28 . 2012-06-04 15:28        --------        d-----w-        c:\users\***\AppData\Roaming\Malwarebytes

2012-06-04 15:28 . 2012-06-04 15:28        --------        d-----w-        c:\programdata\Malwarebytes

2012-06-04 15:28 . 2012-06-11 20:06        --------        d-----w-        c:\program files\Malwarebytes' Anti-Malware

2012-06-04 15:28 . 2012-04-04 13:56        22344        ----a-w-        c:\windows\system32\drivers\mbam.sys

2012-05-24 07:04 . 2012-06-21 16:14        --------        d-----w-        c:\program files\Mozilla Maintenance Service

2012-05-24 07:04 . 2012-06-21 15:55        157608        ----a-w-        c:\program files\Mozilla Firefox\maintenanceservice_installer.exe

2012-05-24 07:04 . 2012-06-21 15:55        113120        ----a-w-        c:\program files\Mozilla Firefox\maintenanceservice.exe

.

.

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2012-06-20 18:36 . 2012-06-20 18:36        1129472        ----a-w-        c:\windows\system32\wininet.dll

2012-06-20 18:36 . 2012-06-20 18:36        63488        ----a-w-        c:\windows\system32\tdc.ocx

2012-06-20 18:36 . 2012-06-20 18:36        420864        ----a-w-        c:\windows\system32\vbscript.dll

2012-06-20 18:36 . 2012-06-20 18:36        152064        ----a-w-        c:\windows\system32\wextract.exe

2012-06-18 11:37 . 2009-07-14 02:05        152576        ----a-w-        c:\windows\system32\msclmd.dll

2012-06-02 22:19 . 2012-06-21 12:38        53784        ----a-w-        c:\windows\system32\wuauclt.exe

2012-06-02 22:19 . 2012-06-21 12:38        45080        ----a-w-        c:\windows\system32\wups2.dll

2012-06-02 22:19 . 2012-06-21 12:38        1933848        ----a-w-        c:\windows\system32\wuaueng.dll

2012-06-02 22:12 . 2012-06-21 12:38        2422272        ----a-w-        c:\windows\system32\wucltux.dll

2012-06-02 13:19 . 2012-06-21 12:37        171904        ----a-w-        c:\windows\system32\wuwebv.dll

2012-06-02 13:12 . 2012-06-21 12:37        33792        ----a-w-        c:\windows\system32\wuapp.exe

2012-05-15 01:05 . 2012-06-18 14:09        2343936        ----a-w-        c:\windows\system32\win32k.sys

2012-05-04 17:29 . 2010-08-09 15:09        687504        ----a-w-        c:\windows\system32\deployJava1.dll

2012-04-18 18:56 . 2012-04-18 18:56        94208        ----a-w-        c:\windows\system32\QuickTimeVR.qtx

2012-04-18 18:56 . 2012-04-18 18:56        69632        ----a-w-        c:\windows\system32\QuickTime.qts

2012-06-21 15:55 . 2011-06-02 21:07        85472        ----a-w-        c:\program files\mozilla firefox\components\browsercomps.dll

.

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"SoundMan"="SOUNDMAN.EXE" [2009-04-14 604704]

"REGSHAVE"="c:\program files\REGSHAVE\REGSHAVE.EXE" [2002-02-04 53248]

"dlcxmon.exe"="c:\program files\Dell Photo AIO Printer 926\dlcxmon.exe" [2007-01-12 292336]

"MemoryCardManager"="c:\program files\Dell Photo AIO Printer 926\memcard.exe" [2006-11-03 304008]

"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-09-24 421160]

"DLCXCATS"="c:\windows\system32\spool\DRIVERS\W32X86\3\DLCXtime.dll" [2006-10-15 106496]

"dleamon.exe"="c:\program files\Dell V310-V510 Series\dleamon.exe" [2011-01-24 770728]

"EzPrint"="c:\program files\Dell V310-V510 Series\ezprint.exe" [2011-01-24 139944]

"Dell V310-V510 Series Fax Server"="c:\program files\Dell V310-V510 Series\fm3032.exe" [2011-01-24 316072]

"TrayServer"="c:\program files\MAGIX\Video_deluxe_MX\TrayServer_de.exe" [2008-08-07 90112]

"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-04-04 462408]

"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2012-03-26 931200]

"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2012-04-18 421888]

"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-01-17 252296]

.

c:\users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

OpenOffice.org 3.1.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2009-8-18 384000]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 0 (0x0)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableLUA"= 0 (0x0)

"EnableUIADesktopToggle"= 0 (0x0)

"PromptOnSecureDesktop"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]

@="Service"

.

R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-06-14 257696]

R3 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance;c:\program files\Common Files\MAGIX Services\Database\bin\fbserver.exe [2011-04-26 2702848]

R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files\Mozilla Maintenance Service\maintenanceservice.exe [2012-06-21 113120]

R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [2012-03-20 74112]

R3 NisSrv;Microsoft-Netzwerkinspektion;c:\program files\Microsoft Security Client\NisSrv.exe [2012-03-26 214952]

R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224]

S2 dlcx_device;dlcx_device;c:\windows\system32\dlcxcoms.exe [2006-10-11 532480]

S2 dlea_device;dlea_device;c:\windows\system32\dleacoms.exe [2009-07-01 602792]

S2 Fabs;FABS - Helping agent for MAGIX media database;c:\program files\Common Files\MAGIX Services\Database\bin\FABS.exe [2011-05-24 1840128]

S2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [2012-04-04 654408]

S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2012-04-04 22344]

S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt86win7.sys [2011-06-10 394856]

.

.

Inhalt des "geplante Tasks" Ordners

.

2012-06-21 c:\windows\Tasks\Adobe Flash Player Updater.job

- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-06-14 05:18]

.

.

------- Zusätzlicher Suchlauf -------

.

uStart Page = hxxp://www.google.de/

uInternet Settings,ProxyOverride = *.local

TCP: DhcpNameServer = 192.168.1.254

FF - ProfilePath - c:\users\***\AppData\Roaming\Mozilla\Firefox\Profiles\4329hxqe.default\

FF - prefs.js: browser.startup.homepage - hxxp://www.google.de/

.

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\services\.csc]

"ImagePath"="\?"

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\services\.tdx]

"ImagePath"="\?"

.

--------------------- Gesperrte Registrierungsschluessel ---------------------

.

[HKEY_USERS\S-1-5-21-2232143414-1069646403-3848905212-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.032\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Foto-Manager 12.032"

.

[HKEY_USERS\S-1-5-21-2232143414-1069646403-3848905212-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.abr\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Foto-Manager 12.abr"

.

[HKEY_USERS\S-1-5-21-2232143414-1069646403-3848905212-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ANI\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Foto-Manager 12.ani"

.

[HKEY_USERS\S-1-5-21-2232143414-1069646403-3848905212-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.apd\UserChoice]

@Denied: (2) (S-1-5-21-2232143414-1069646403-3848905212-1000)

@Denied: (2) (LocalSystem)

"Progid"="ACDSeePhotoEditor.apd"

.

[HKEY_USERS\S-1-5-21-2232143414-1069646403-3848905212-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.arw\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Foto-Manager 12.arw"

.

[HKEY_USERS\S-1-5-21-2232143414-1069646403-3848905212-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bay\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Foto-Manager 12.bay"

.

[HKEY_USERS\S-1-5-21-2232143414-1069646403-3848905212-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Foto-Manager 12.bmp"

.

[HKEY_USERS\S-1-5-21-2232143414-1069646403-3848905212-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bw\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Foto-Manager 12.bw"

.

[HKEY_USERS\S-1-5-21-2232143414-1069646403-3848905212-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.CR2\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Foto-Manager 12.cr2"

.

[HKEY_USERS\S-1-5-21-2232143414-1069646403-3848905212-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.CRW\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Foto-Manager 12.crw"

.

[HKEY_USERS\S-1-5-21-2232143414-1069646403-3848905212-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cs1\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Foto-Manager 12.cs1"

.

[HKEY_USERS\S-1-5-21-2232143414-1069646403-3848905212-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.CUR\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Foto-Manager 12.cur"

.

[HKEY_USERS\S-1-5-21-2232143414-1069646403-3848905212-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dcr\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Foto-Manager 12.dcr"

.

[HKEY_USERS\S-1-5-21-2232143414-1069646403-3848905212-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DCX\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Foto-Manager 12.dcx"

.

[HKEY_USERS\S-1-5-21-2232143414-1069646403-3848905212-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Foto-Manager 12.dib"

.

[HKEY_USERS\S-1-5-21-2232143414-1069646403-3848905212-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.djv\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Foto-Manager 12.djv"

.

[HKEY_USERS\S-1-5-21-2232143414-1069646403-3848905212-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DJVU\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Foto-Manager 12.djvu"

.

[HKEY_USERS\S-1-5-21-2232143414-1069646403-3848905212-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dng\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Foto-Manager 12.dng"

.

[HKEY_USERS\S-1-5-21-2232143414-1069646403-3848905212-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.emf\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Foto-Manager 12.emf"

.

[HKEY_USERS\S-1-5-21-2232143414-1069646403-3848905212-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.EPS\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Foto-Manager 12.eps"

.

[HKEY_USERS\S-1-5-21-2232143414-1069646403-3848905212-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.erf\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Foto-Manager 12.erf"

.

[HKEY_USERS\S-1-5-21-2232143414-1069646403-3848905212-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.fff\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Foto-Manager 12.fff"

.

[HKEY_USERS\S-1-5-21-2232143414-1069646403-3848905212-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.FPX\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Foto-Manager 12.fpx"

.

[HKEY_USERS\S-1-5-21-2232143414-1069646403-3848905212-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Foto-Manager 12.gif"

.

[HKEY_USERS\S-1-5-21-2232143414-1069646403-3848905212-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.hdr\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Foto-Manager 12.hdr"

.

[HKEY_USERS\S-1-5-21-2232143414-1069646403-3848905212-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ICL\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Foto-Manager 12.icl"

.

[HKEY_USERS\S-1-5-21-2232143414-1069646403-3848905212-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.icn\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Foto-Manager 12.icn"

.

[HKEY_USERS\S-1-5-21-2232143414-1069646403-3848905212-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.IFF\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Foto-Manager 12.iff"

.

[HKEY_USERS\S-1-5-21-2232143414-1069646403-3848905212-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ilbm\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Foto-Manager 12.ilbm"

.

[HKEY_USERS\S-1-5-21-2232143414-1069646403-3848905212-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.int\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Foto-Manager 12.int"

.

[HKEY_USERS\S-1-5-21-2232143414-1069646403-3848905212-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.inta\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Foto-Manager 12.inta"

.

[HKEY_USERS\S-1-5-21-2232143414-1069646403-3848905212-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.iw4\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Foto-Manager 12.iw4"

.

[HKEY_USERS\S-1-5-21-2232143414-1069646403-3848905212-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.j2c\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Foto-Manager 12.j2c"

.

[HKEY_USERS\S-1-5-21-2232143414-1069646403-3848905212-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.j2k\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Foto-Manager 12.j2k"

.

[HKEY_USERS\S-1-5-21-2232143414-1069646403-3848905212-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jbr\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Foto-Manager 12.jbr"

.

[HKEY_USERS\S-1-5-21-2232143414-1069646403-3848905212-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jfif\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Foto-Manager 12.jfif"

.

[HKEY_USERS\S-1-5-21-2232143414-1069646403-3848905212-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jif\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Foto-Manager 12.jif"

.

[HKEY_USERS\S-1-5-21-2232143414-1069646403-3848905212-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.JP2\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Foto-Manager 12.jp2"

.

[HKEY_USERS\S-1-5-21-2232143414-1069646403-3848905212-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpc\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Foto-Manager 12.jpc"

.

[HKEY_USERS\S-1-5-21-2232143414-1069646403-3848905212-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpe\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Foto-Manager 12.jpe"

.

[HKEY_USERS\S-1-5-21-2232143414-1069646403-3848905212-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Foto-Manager 12.jpeg"

.

[HKEY_USERS\S-1-5-21-2232143414-1069646403-3848905212-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Foto-Manager 12.jpg"

.

[HKEY_USERS\S-1-5-21-2232143414-1069646403-3848905212-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpk\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Foto-Manager 12.jpk"

.

[HKEY_USERS\S-1-5-21-2232143414-1069646403-3848905212-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpx\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Foto-Manager 12.jpx"

.

[HKEY_USERS\S-1-5-21-2232143414-1069646403-3848905212-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.KDC\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Foto-Manager 12.kdc"

.

[HKEY_USERS\S-1-5-21-2232143414-1069646403-3848905212-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.lbm\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Foto-Manager 12.lbm"

.

[HKEY_USERS\S-1-5-21-2232143414-1069646403-3848905212-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mef\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Foto-Manager 12.mef"

.

[HKEY_USERS\S-1-5-21-2232143414-1069646403-3848905212-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mos\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Foto-Manager 12.mos"

.

[HKEY_USERS\S-1-5-21-2232143414-1069646403-3848905212-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mrw\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Foto-Manager 12.mrw"

.

[HKEY_USERS\S-1-5-21-2232143414-1069646403-3848905212-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.nef\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Foto-Manager 12.nef"

.

[HKEY_USERS\S-1-5-21-2232143414-1069646403-3848905212-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.nrw\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Foto-Manager 12.nrw"

.

[HKEY_USERS\S-1-5-21-2232143414-1069646403-3848905212-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.orf\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Foto-Manager 12.orf"

.

[HKEY_USERS\S-1-5-21-2232143414-1069646403-3848905212-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.PBM\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Foto-Manager 12.pbm"

.

[HKEY_USERS\S-1-5-21-2232143414-1069646403-3848905212-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pbr\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Foto-Manager 12.pbr"

.

[HKEY_USERS\S-1-5-21-2232143414-1069646403-3848905212-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.PCD\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Foto-Manager 12.pcd"

.

[HKEY_USERS\S-1-5-21-2232143414-1069646403-3848905212-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pct\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Foto-Manager 12.pct"

.

[HKEY_USERS\S-1-5-21-2232143414-1069646403-3848905212-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.PCX\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Foto-Manager 12.pcx"

.

[HKEY_USERS\S-1-5-21-2232143414-1069646403-3848905212-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pef\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Foto-Manager 12.pef"

.

[HKEY_USERS\S-1-5-21-2232143414-1069646403-3848905212-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.PGM\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Foto-Manager 12.pgm"

.

[HKEY_USERS\S-1-5-21-2232143414-1069646403-3848905212-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pic\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Foto-Manager 12.pic"

.

[HKEY_USERS\S-1-5-21-2232143414-1069646403-3848905212-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pict\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Foto-Manager 12.pict"

.

[HKEY_USERS\S-1-5-21-2232143414-1069646403-3848905212-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pix\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Foto-Manager 12.pix"

.

[HKEY_USERS\S-1-5-21-2232143414-1069646403-3848905212-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Foto-Manager 12.png"

.

[HKEY_USERS\S-1-5-21-2232143414-1069646403-3848905212-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.PPM\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Foto-Manager 12.ppm"

.

[HKEY_USERS\S-1-5-21-2232143414-1069646403-3848905212-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.PSD\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Foto-Manager 12.psd"

.

[HKEY_USERS\S-1-5-21-2232143414-1069646403-3848905212-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.PSP\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Foto-Manager 12.psp"

.

[HKEY_USERS\S-1-5-21-2232143414-1069646403-3848905212-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pspbrush\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Foto-Manager 12.pspbrush"

.

[HKEY_USERS\S-1-5-21-2232143414-1069646403-3848905212-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pspimage\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Foto-Manager 12.pspimage"

.

[HKEY_USERS\S-1-5-21-2232143414-1069646403-3848905212-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.raf\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Foto-Manager 12.raf"

.

[HKEY_USERS\S-1-5-21-2232143414-1069646403-3848905212-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.RAS\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Foto-Manager 12.ras"

.

[HKEY_USERS\S-1-5-21-2232143414-1069646403-3848905212-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.RAW\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Foto-Manager 12.raw"

.

[HKEY_USERS\S-1-5-21-2232143414-1069646403-3848905212-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rgb\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Foto-Manager 12.rgb"

.

[HKEY_USERS\S-1-5-21-2232143414-1069646403-3848905212-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rgba\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Foto-Manager 12.rgba"

.

[HKEY_USERS\S-1-5-21-2232143414-1069646403-3848905212-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rle\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Foto-Manager 12.rle"

.

[HKEY_USERS\S-1-5-21-2232143414-1069646403-3848905212-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rsb\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Foto-Manager 12.rsb"

.

[HKEY_USERS\S-1-5-21-2232143414-1069646403-3848905212-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rw2\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Foto-Manager 12.rw2"

.

[HKEY_USERS\S-1-5-21-2232143414-1069646403-3848905212-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rwl\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Foto-Manager 12.rwl"

.

[HKEY_USERS\S-1-5-21-2232143414-1069646403-3848905212-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.SGI\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Foto-Manager 12.sgi"

.

[HKEY_USERS\S-1-5-21-2232143414-1069646403-3848905212-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.sr2\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Foto-Manager 12.sr2"

.

[HKEY_USERS\S-1-5-21-2232143414-1069646403-3848905212-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.srf\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Foto-Manager 12.srf"

.

[HKEY_USERS\S-1-5-21-2232143414-1069646403-3848905212-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TGA\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Foto-Manager 12.tga"

.

[HKEY_USERS\S-1-5-21-2232143414-1069646403-3848905212-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.thm\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Foto-Manager 12.thm"

.

[HKEY_USERS\S-1-5-21-2232143414-1069646403-3848905212-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tif\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Foto-Manager 12.tif"

.

[HKEY_USERS\S-1-5-21-2232143414-1069646403-3848905212-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Foto-Manager 12.tiff"

.

[HKEY_USERS\S-1-5-21-2232143414-1069646403-3848905212-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ttc\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Foto-Manager 12.ttc"

.

[HKEY_USERS\S-1-5-21-2232143414-1069646403-3848905212-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ttf\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Foto-Manager 12.ttf"

.

[HKEY_USERS\S-1-5-21-2232143414-1069646403-3848905212-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.v30po\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Foto-Manager 12.v30po"

.

[HKEY_USERS\S-1-5-21-2232143414-1069646403-3848905212-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.v30pp\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Foto-Manager 12.v30pp"

.

[HKEY_USERS\S-1-5-21-2232143414-1069646403-3848905212-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.v30ppf\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Foto-Manager 12.v30ppf"

.

[HKEY_USERS\S-1-5-21-2232143414-1069646403-3848905212-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wbm\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Foto-Manager 12.wbm"

.

[HKEY_USERS\S-1-5-21-2232143414-1069646403-3848905212-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WBMP\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Foto-Manager 12.wbmp"

.

[HKEY_USERS\S-1-5-21-2232143414-1069646403-3848905212-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmf\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Foto-Manager 12.wmf"

.

[HKEY_USERS\S-1-5-21-2232143414-1069646403-3848905212-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.XBM\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Foto-Manager 12.xbm"

.

[HKEY_USERS\S-1-5-21-2232143414-1069646403-3848905212-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xif\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Foto-Manager 12.xif"

.

[HKEY_USERS\S-1-5-21-2232143414-1069646403-3848905212-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xmp\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Foto-Manager 12.xmp"

.

[HKEY_USERS\S-1-5-21-2232143414-1069646403-3848905212-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.XPM\UserChoice]

@Denied: (2) (LocalSystem)

"Progid"="ACDSee Foto-Manager 12.xpm"

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

------------------------ Weitere laufende Prozesse ------------------------

.

c:\program files\Microsoft Security Client\MsMpEng.exe

c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

c:\program files\Bonjour\mDNSResponder.exe

c:\windows\system32\taskhost.exe

c:\windows\system32\conhost.exe

c:\windows\SOUNDMAN.EXE

c:\programme\FinePixViewer\QuickDCF2.exe

c:\windows\servicing\TrustedInstaller.exe

c:\program files\OpenOffice.org 3\program\soffice.exe

c:\program files\OpenOffice.org 3\program\soffice.bin

c:\program files\Windows Media Player\wmpnetwk.exe

c:\program files\iPod\bin\iPodService.exe

c:\windows\system32\sppsvc.exe

.

**************************************************************************

.

Zeit der Fertigstellung: 2012-06-21  18:24:01 - PC wurde neu gestartet

ComboFix-quarantined-files.txt  2012-06-21 16:24

ComboFix2.txt  2012-06-20 10:10

.

Vor Suchlauf: 8.944.373.760 Bytes frei

Nach Suchlauf: 8.886.247.424 Bytes frei

.

- - End Of File - - 004428BCCB66A4D005CA8D1F19B8949D