Trojaner-Board - TR/ATRAPS.Gen2 wie entfernen?

Code:
ComboFix 13-07-13.01 - Sebastian 14.07.2013  13:53:21.1.4 - x64

Microsoft Windows 7 Home Premium   6.1.7601.1.1252.49.1031.18.6127.4267 [GMT 2:00]

ausgeführt von:: c:\users\Sebastian\Downloads\ComboFix.exe

AV: Avira Desktop *Enabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}

SP: Avira Desktop *Enabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

c:\users\Sebastian\AppData\Local\assembly\tmp

c:\users\Sebastian\AppData\Roaming\15001.001

c:\users\Sebastian\AppData\Roaming\15001.001\components\AcroFF.txt

c:\users\Sebastian\AppData\Roaming\15001.001\install.rdf

c:\users\Sebastian\AppData\Roaming\AcroIEHelpe.txt

c:\users\Sebastian\AppData\Roaming\BabMaint.exe

c:\users\Sebastian\AppData\Roaming\edxLabs

c:\users\Sebastian\AppData\Roaming\edxLabs\edxSilkroadLoader\edxSilkroadLoader.ini

c:\users\Sebastian\AppData\Roaming\edxLabs\edxSilkroadLoader5\edxSilkroadLoader5.ini

c:\users\Sebastian\AppData\Roaming\host.dll

c:\users\Sebastian\AppData\Roaming\Microsoft\Windows\Recent\Call of Duty Modern Warfare 3 - Multiplayer.url

c:\users\Sebastian\AppData\Roaming\MyFolder

c:\users\Sebastian\AppData\Roaming\r6j5on4h.default.tmp

c:\users\Sebastian\AppData\Roaming\srvblck5.tmp

c:\users\Sebastian\AppData\Roaming\Winsoc32.exe

c:\windows\assembly\GAC_32\Desktop.ini

c:\windows\assembly\GAC_64\Desktop.ini

c:\windows\Installer\{267a6958-1258-6520-a720-10185e3c12b6}\@

c:\windows\Installer\{267a6958-1258-6520-a720-10185e3c12b6}\L\00000004.@

c:\windows\Installer\{267a6958-1258-6520-a720-10185e3c12b6}\L\201d3dde

c:\windows\Installer\{267a6958-1258-6520-a720-10185e3c12b6}\L\6715e287

c:\windows\Installer\{267a6958-1258-6520-a720-10185e3c12b6}\L\76603ac3

c:\windows\Installer\{267a6958-1258-6520-a720-10185e3c12b6}\U\00000004.@

c:\windows\Installer\{267a6958-1258-6520-a720-10185e3c12b6}\U\00000008.@

c:\windows\Installer\{267a6958-1258-6520-a720-10185e3c12b6}\U\000000cb.@

c:\windows\Installer\{267a6958-1258-6520-a720-10185e3c12b6}\U\80000000.@

c:\windows\Installer\{267a6958-1258-6520-a720-10185e3c12b6}\U\80000032.@

c:\windows\Installer\{267a6958-1258-6520-a720-10185e3c12b6}\U\80000064.@

c:\windows\SysWow64\frapsvid.dll

.

Infizierte Kopie von c:\windows\system32\services.exe wurde gefunden und desinfiziert 

Kopie von - c:\windows\winsxs\amd64_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.1.7600.16385_none_2b54b20ee6fa07b1\services.exe wurde wiederhergestellt 

.

.

(((((((((((((((((((((((   Dateien erstellt von 2013-06-14 bis 2013-07-14  ))))))))))))))))))))))))))))))

.

.

2013-07-14 11:58 . 2013-07-14 11:58        --------        d-----w-        c:\users\UpdatusUser\AppData\Local\temp

2013-07-14 11:58 . 2013-07-14 11:58        --------        d-----w-        c:\users\Default\AppData\Local\temp

2013-07-14 09:52 . 2013-07-14 09:52        --------        d-----w-        c:\users\Sebastian\AppData\Roaming\Simply Super Software

2013-07-14 09:52 . 2013-07-14 09:52        --------        d-----w-        c:\program files (x86)\Trojan Remover

2013-07-14 09:52 . 2013-07-14 09:52        --------        d-----w-        c:\programdata\Simply Super Software

2013-07-10 12:20 . 2013-07-10 12:20        --------        d-----w-        c:\program files (x86)\1-click run

2013-07-09 12:21 . 2013-07-09 12:21        --------        d-----w-        c:\program files\Microsoft Silverlight

2013-07-09 12:21 . 2013-07-09 12:21        --------        d-----w-        c:\program files (x86)\Microsoft Silverlight

2013-07-03 13:50 . 2013-07-03 13:50        --------        d-----w-        c:\program files (x86)\LogMeIn Hamachi

2013-06-29 10:45 . 2004-08-18 08:34        442368        ----a-r-        c:\windows\SysWow64\vp6vfw.dll

2013-06-26 15:21 . 2013-06-26 15:21        --------        d-sh--w-        c:\users\Sebastian\wc

2013-06-26 14:51 . 2013-06-26 14:56        --------        d-sh--w-        c:\users\Sebastian\AppData\Roaming\wyUpdate AU

2013-06-26 10:08 . 2013-06-26 10:36        --------        d-----w-        c:\users\Sebastian\AppData\Roaming\asoftech

2013-06-26 10:07 . 2013-06-26 10:07        --------        d-----w-        c:\program files (x86)\Asoftech

2013-06-26 10:07 . 2013-06-26 10:07        270468        ----a-w-        c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\0700\Intel32\Setup.dll

2013-06-26 10:07 . 2013-06-26 10:07        159876        ----a-w-        c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\0700\Intel32\IGdi.dll

2013-06-26 10:07 . 2002-08-05 08:46        57344        ----a-w-        c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\0700\Intel32\ctor.dll

2013-06-26 10:07 . 2002-08-02 01:10        5632        ----a-w-        c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\0700\Intel32\DotNetInstaller.exe

2013-06-26 10:07 . 2002-08-02 00:20        634880        ----a-w-        c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\0700\Intel32\iKernel.dll

2013-06-26 10:07 . 2002-08-02 00:20        237568        ----a-w-        c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\0700\Intel32\iscript.dll

2013-06-26 10:07 . 2002-08-02 00:20        151552        ----a-w-        c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\0700\Intel32\iuser.dll

2013-06-26 09:35 . 2013-06-26 15:18        --------        d-----w-        c:\users\Sebastian\AppData\Local\Skymonk2

2013-06-23 12:14 . 2013-06-23 12:14        --------        d-----w-        c:\users\Sebastian\AppData\Local\Programs

2013-06-19 17:50 . 2013-05-28 13:05        163328        ----a-w-        c:\windows\SysWow64\FlashPlayerUpdateService.exe

2013-06-19 17:50 . 2013-06-19 17:50        --------        d-----w-        c:\users\Sebastian\AppData\Roaming\File Scout

2013-06-16 11:50 . 2013-06-26 15:11        --------        d-----w-        c:\users\Sebastian\AppData\Roaming\WinHost

.

.

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2013-07-13 23:19 . 2012-06-14 20:57        119296        ----a-w-        c:\windows\SysWow64\zlib.dll

2013-07-01 12:46 . 2013-03-23 10:43        692104        ----a-w-        c:\windows\SysWow64\FlashPlayerApp.exe

2013-07-01 12:46 . 2012-01-02 16:51        71048        ----a-w-        c:\windows\SysWow64\FlashPlayerCPLApp.cpl

2013-06-12 03:08 . 2013-06-28 06:22        9552976        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{025E5139-D8F0-4F06-A382-C4A036541522}\mpengine.dll

2013-06-04 07:15 . 2013-06-04 07:15        103448        ----a-w-        c:\windows\system32\drivers\ssudbus.sys

2013-06-04 07:15 . 2013-06-04 07:15        203672        ----a-w-        c:\windows\system32\drivers\ssudmdm.sys

2013-05-17 01:25 . 2013-06-13 12:04        1767936        ----a-w-        c:\windows\SysWow64\wininet.dll

2013-05-17 01:25 . 2013-06-13 12:04        2877440        ----a-w-        c:\windows\SysWow64\jscript9.dll

2013-05-17 01:25 . 2013-06-13 12:04        61440        ----a-w-        c:\windows\SysWow64\iesetup.dll

2013-05-17 01:25 . 2013-06-13 12:04        109056        ----a-w-        c:\windows\SysWow64\iesysprep.dll

2013-05-17 00:59 . 2013-06-13 12:04        51712        ----a-w-        c:\windows\system32\ie4uinit.exe

2013-05-17 00:59 . 2013-06-13 12:04        2241024        ----a-w-        c:\windows\system32\wininet.dll

2013-05-17 00:58 . 2013-06-13 12:04        603136        ----a-w-        c:\windows\system32\msfeeds.dll

2013-05-17 00:58 . 2013-06-13 12:04        855552        ----a-w-        c:\windows\system32\jscript.dll

2013-05-17 00:58 . 2013-06-13 12:04        3958784        ----a-w-        c:\windows\system32\jscript9.dll

2013-05-17 00:58 . 2013-06-13 12:04        53248        ----a-w-        c:\windows\system32\jsproxy.dll

2013-05-17 00:58 . 2013-06-13 12:04        67072        ----a-w-        c:\windows\system32\iesetup.dll

2013-05-17 00:58 . 2013-06-13 12:04        39936        ----a-w-        c:\windows\system32\iernonce.dll

2013-05-17 00:58 . 2013-06-13 12:04        136704        ----a-w-        c:\windows\system32\iesysprep.dll

2013-05-14 12:23 . 2013-06-13 12:04        89600        ----a-w-        c:\windows\system32\RegisterIEPKEYs.exe

2013-05-14 08:40 . 2013-06-13 12:04        71680        ----a-w-        c:\windows\SysWow64\RegisterIEPKEYs.exe

2013-05-13 05:51 . 2013-06-12 10:53        184320        ----a-w-        c:\windows\system32\cryptsvc.dll

2013-05-13 05:51 . 2013-06-12 10:53        1464320        ----a-w-        c:\windows\system32\crypt32.dll

2013-05-13 05:51 . 2013-06-12 10:53        139776        ----a-w-        c:\windows\system32\cryptnet.dll

2013-05-13 05:50 . 2013-06-12 10:53        52224        ----a-w-        c:\windows\system32\certenc.dll

2013-05-13 04:45 . 2013-06-12 10:53        140288        ----a-w-        c:\windows\SysWow64\cryptsvc.dll

2013-05-13 04:45 . 2013-06-12 10:53        1160192        ----a-w-        c:\windows\SysWow64\crypt32.dll

2013-05-13 04:45 . 2013-06-12 10:53        103936        ----a-w-        c:\windows\SysWow64\cryptnet.dll

2013-05-13 03:43 . 2013-06-12 10:53        1192448        ----a-w-        c:\windows\system32\certutil.exe

2013-05-13 03:08 . 2013-06-12 10:53        903168        ----a-w-        c:\windows\SysWow64\certutil.exe

2013-05-13 03:08 . 2013-06-12 10:53        43008        ----a-w-        c:\windows\SysWow64\certenc.dll

2013-05-10 05:49 . 2013-06-12 10:53        30720        ----a-w-        c:\windows\system32\cryptdlg.dll

2013-05-10 03:20 . 2013-06-12 10:53        24576        ----a-w-        c:\windows\SysWow64\cryptdlg.dll

2013-05-08 18:12 . 2010-06-24 10:33        22240        ----a-w-        c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll

2013-05-08 06:39 . 2013-06-12 10:53        1910632        ----a-w-        c:\windows\system32\drivers\tcpip.sys

2013-05-07 20:46 . 2013-05-07 20:46        97280        ----a-w-        c:\windows\system32\mshtmled.dll

2013-05-07 20:46 . 2013-05-07 20:46        92160        ----a-w-        c:\windows\system32\SetIEInstalledDate.exe

2013-05-07 20:46 . 2013-05-07 20:46        905728        ----a-w-        c:\windows\system32\mshtmlmedia.dll

2013-05-07 20:46 . 2013-05-07 20:46        81408        ----a-w-        c:\windows\system32\icardie.dll

2013-05-07 20:46 . 2013-05-07 20:46        762368        ----a-w-        c:\windows\system32\ieapfltr.dll

2013-05-07 20:46 . 2013-05-07 20:46        73728        ----a-w-        c:\windows\SysWow64\SetIEInstalledDate.exe

2013-05-07 20:46 . 2013-05-07 20:46        719360        ----a-w-        c:\windows\SysWow64\mshtmlmedia.dll

2013-05-07 20:46 . 2013-05-07 20:46        62976        ----a-w-        c:\windows\system32\pngfilt.dll

2013-05-07 20:46 . 2013-05-07 20:46        61952        ----a-w-        c:\windows\SysWow64\tdc.ocx

2013-05-07 20:46 . 2013-05-07 20:46        599552        ----a-w-        c:\windows\system32\vbscript.dll

2013-05-07 20:46 . 2013-05-07 20:46        523264        ----a-w-        c:\windows\SysWow64\vbscript.dll

2013-05-07 20:46 . 2013-05-07 20:46        52224        ----a-w-        c:\windows\system32\msfeedsbs.dll

2013-05-07 20:46 . 2013-05-07 20:46        51200        ----a-w-        c:\windows\system32\imgutil.dll

2013-05-07 20:46 . 2013-05-07 20:46        48640        ----a-w-        c:\windows\SysWow64\mshtmler.dll

2013-05-07 20:46 . 2013-05-07 20:46        452096        ----a-w-        c:\windows\system32\dxtmsft.dll

2013-05-07 20:46 . 2013-05-07 20:46        441856        ----a-w-        c:\windows\system32\html.iec

2013-05-07 20:46 . 2013-05-07 20:46        38400        ----a-w-        c:\windows\SysWow64\imgutil.dll

2013-05-07 20:46 . 2013-05-07 20:46        361984        ----a-w-        c:\windows\SysWow64\html.iec

2013-05-07 20:46 . 2013-05-07 20:46        281600        ----a-w-        c:\windows\system32\dxtrans.dll

2013-05-07 20:46 . 2013-05-07 20:46        27648        ----a-w-        c:\windows\system32\licmgr10.dll

2013-05-07 20:46 . 2013-05-07 20:46        270848        ----a-w-        c:\windows\system32\iedkcs32.dll

2013-05-07 20:46 . 2013-05-07 20:46        247296        ----a-w-        c:\windows\system32\webcheck.dll

2013-05-07 20:46 . 2013-05-07 20:46        235008        ----a-w-        c:\windows\system32\url.dll

2013-05-07 20:46 . 2013-05-07 20:46        23040        ----a-w-        c:\windows\SysWow64\licmgr10.dll

2013-05-07 20:46 . 2013-05-07 20:46        226304        ----a-w-        c:\windows\system32\elshyph.dll

2013-05-07 20:46 . 2013-05-07 20:46        216064        ----a-w-        c:\windows\system32\msls31.dll

2013-05-07 20:46 . 2013-05-07 20:46        197120        ----a-w-        c:\windows\system32\msrating.dll

2013-05-07 20:46 . 2013-05-07 20:46        185344        ----a-w-        c:\windows\SysWow64\elshyph.dll

2013-05-07 20:46 . 2013-05-07 20:46        173568        ----a-w-        c:\windows\system32\ieUnatt.exe

2013-05-07 20:46 . 2013-05-07 20:46        167424        ----a-w-        c:\windows\system32\iexpress.exe

2013-05-07 20:46 . 2013-05-07 20:46        158720        ----a-w-        c:\windows\SysWow64\msls31.dll

2013-05-07 20:46 . 2013-05-07 20:46        1509376        ----a-w-        c:\windows\system32\inetcpl.cpl

2013-05-07 20:46 . 2013-05-07 20:46        150528        ----a-w-        c:\windows\SysWow64\iexpress.exe

2013-05-07 20:46 . 2013-05-07 20:46        149504        ----a-w-        c:\windows\system32\occache.dll

2013-05-07 20:46 . 2013-05-07 20:46        144896        ----a-w-        c:\windows\system32\wextract.exe

2013-05-07 20:46 . 2013-05-07 20:46        1441280        ----a-w-        c:\windows\SysWow64\inetcpl.cpl

2013-05-07 20:46 . 2013-05-07 20:46        1400416        ----a-w-        c:\windows\system32\ieapfltr.dat

2013-05-07 20:46 . 2013-05-07 20:46        138752        ----a-w-        c:\windows\SysWow64\wextract.exe

2013-05-07 20:46 . 2013-05-07 20:46        13824        ----a-w-        c:\windows\system32\mshta.exe

2013-05-07 20:46 . 2013-05-07 20:46        137216        ----a-w-        c:\windows\SysWow64\ieUnatt.exe

2013-05-07 20:46 . 2013-05-07 20:46        136192        ----a-w-        c:\windows\system32\iepeers.dll

2013-05-07 20:46 . 2013-05-07 20:46        135680        ----a-w-        c:\windows\system32\IEAdvpack.dll

2013-05-07 20:46 . 2013-05-07 20:46        12800        ----a-w-        c:\windows\SysWow64\mshta.exe

2013-05-07 20:46 . 2013-05-07 20:46        12800        ----a-w-        c:\windows\system32\msfeedssync.exe

2013-05-07 20:46 . 2013-05-07 20:46        110592        ----a-w-        c:\windows\SysWow64\IEAdvpack.dll

2013-05-07 20:46 . 2013-05-07 20:46        1054720        ----a-w-        c:\windows\system32\MsSpellCheckingFacility.exe

2013-05-07 20:46 . 2013-05-07 20:46        102912        ----a-w-        c:\windows\system32\inseng.dll

2013-05-07 20:46 . 2013-05-07 20:46        77312        ----a-w-        c:\windows\system32\tdc.ocx

2013-05-07 20:46 . 2013-05-07 20:46        48640        ----a-w-        c:\windows\system32\mshtmler.dll

2013-05-02 00:06 . 2011-08-18 13:59        278800        ------w-        c:\windows\system32\MpSigStub.exe

2013-04-26 05:51 . 2013-06-12 10:53        751104        ----a-w-        c:\windows\system32\win32spl.dll

2013-04-26 04:55 . 2013-06-12 10:53        492544        ----a-w-        c:\windows\SysWow64\win32spl.dll

2013-04-25 23:30 . 2013-06-12 10:53        1505280        ----a-w-        c:\windows\SysWow64\d3d11.dll

2013-04-17 07:02 . 2013-06-12 10:53        1230336        ----a-w-        c:\windows\SysWow64\WindowsCodecs.dll

2013-04-17 06:24 . 2013-06-12 10:53        1424384        ----a-w-        c:\windows\system32\WindowsCodecs.dll

.

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"BitTorrent"="c:\program files (x86)\BitTorrent\BitTorrent.exe" [2013-06-09 882520]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2012-08-09 348664]

"TrojanScanner"="c:\program files (x86)\Trojan Remover\Trjscan.exe" [2013-06-17 1653008]

.

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

WiFi Station N.lnk - c:\program files (x86)\Hercules\WiFiStationN\WiFiN.exe -s [2012-1-2 128296]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 0 (0x0)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableLUA"= 0 (0x0)

"EnableUIADesktopToggle"= 0 (0x0)

"PromptOnSecureDesktop"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]

"LoadAppInit_DLLs"=1 (0x1)

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]

"mixer4"=wdmaud.drv

.

R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]

R2 KMService;KMService;c:\windows\system32\srvany.exe;c:\windows\SYSNATIVE\srvany.exe [x]

R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]

R3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudbus.sys;c:\windows\SYSNATIVE\DRIVERS\ssudbus.sys [x]

R3 dump_wmimmc;dump_wmimmc;c:\downloads\Directlinks\EliteSRO\EliteSRO\GameGuard\dump_wmimmc.sys;c:\downloads\Directlinks\EliteSRO\EliteSRO\GameGuard\dump_wmimmc.sys [x]

R3 GamesAppService;GamesAppService;c:\program files (x86)\WildTangent Games\App\GamesAppService.exe;c:\program files (x86)\WildTangent Games\App\GamesAppService.exe [x]

R3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des;c:\windows\SYSNATIVE\GameMon.des [x]

R3 PCDSRVC{7368CD8C-6118E123-06020101}_0;PCDSRVC{7368CD8C-6118E123-06020101}_0 - PCDR Kernel Mode Service Helper Driver;c:\users\admini~1\appdata\local\temp\nqtxzf39bo1g\pcdrdiag\bin\pcdsrvc_x64.pkms;c:\users\admini~1\appdata\local\temp\nqtxzf39bo1g\pcdrdiag\bin\pcdsrvc_x64.pkms [x]

R3 ss_bbus;SAMSUNG USB Mobile Device (WDM);c:\windows\system32\DRIVERS\ss_bbus.sys;c:\windows\SYSNATIVE\DRIVERS\ss_bbus.sys [x]

R3 ss_bmdfl;SAMSUNG USB Mobile Modem (Filter);c:\windows\system32\DRIVERS\ss_bmdfl.sys;c:\windows\SYSNATIVE\DRIVERS\ss_bmdfl.sys [x]

R3 ss_bmdm;SAMSUNG USB Mobile Modem;c:\windows\system32\DRIVERS\ss_bmdm.sys;c:\windows\SYSNATIVE\DRIVERS\ss_bmdm.sys [x]

R3 ssudmdm;SAMSUNG  Mobile USB Modem Drivers (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudmdm.sys;c:\windows\SYSNATIVE\DRIVERS\ssudmdm.sys [x]

R3 SwitchBoard;SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [x]

R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]

R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys;c:\windows\SYSNATIVE\Drivers\usbaapl64.sys [x]

R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe;c:\program files\Windows Live\Mesh\wlcrasvc.exe [x]

S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys;c:\windows\SYSNATIVE\DRIVERS\avkmgr.sys [x]

S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys;c:\windows\SYSNATIVE\DRIVERS\dtsoftbus01.sys [x]

S2 AntiVirSchedulerService;Avira Scheduler;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [x]

S2 GREGService;GREGService;c:\program files (x86)\Packard Bell\Registration\GREGsvc.exe;c:\program files (x86)\Packard Bell\Registration\GREGsvc.exe [x]

S2 Hamachi2Svc;LogMeIn Hamachi Tunneling Engine;c:\program files (x86)\LogMeIn Hamachi\hamachi-2.exe;c:\program files (x86)\LogMeIn Hamachi\hamachi-2.exe [x]

S2 MBAMScheduler;MBAMScheduler;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [x]

S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [x]

S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [x]

S2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [x]

S2 Updater Service;Updater Service;c:\program files\Packard Bell\Packard Bell Updater\UpdaterService.exe;c:\program files\Packard Bell\Packard Bell Updater\UpdaterService.exe [x]

S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys;c:\windows\SYSNATIVE\drivers\mbam.sys [x]

S3 RTL8192su;Realtek RTL8192SU Wireless LAN 802.11n USB 2.0 Network Adapter;c:\windows\system32\DRIVERS\RTL8192su.sys;c:\windows\SYSNATIVE\DRIVERS\RTL8192su.sys [x]

.

.

.

--------- X64 Entries -----------

.

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2010-10-05 11474024]

.

------- Zusätzlicher Suchlauf -------

.

uLocal Page = c:\windows\system32\blank.htm

uStart Page = hxxp://www2.delta-search.com/?affID=121479&tt=gc_&babsrc=HP_ss&mntrId=C8C90008D3805850

mLocal Page = c:\windows\SysWOW64\blank.htm

IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~3\Office14\EXCEL.EXE/3000

IE: Nach Microsoft &Excel exportieren - c:\progra~2\MICROS~3\Office10\EXCEL.EXE/3000

IE: Se&nd to OneNote - c:\progra~2\MICROS~3\Office14\ONBttnIE.dll/105

Trusted Zone: clonewarsadventures.com

Trusted Zone: freerealms.com

Trusted Zone: soe.com

Trusted Zone: sony.com

FF - ProfilePath - c:\users\Sebastian\AppData\Roaming\Mozilla\Firefox\Profiles\a7tuyadb.default\

FF - user.js: network.cookie.cookieBehavior - 0

FF - user.js: privacy.clearOnShutdown.cookies - false

FF - user.js: security.warn_viewing_mixed - false

FF - user.js: security.warn_viewing_mixed.show_once - false

FF - user.js: security.warn_submit_insecure - false

FF - user.js: security.warn_submit_insecure.show_once - false

.

- - - - Entfernte verwaiste Registrierungseinträge - - - -

.

URLSearchHooks-{64ead72b-ffd4-4e01-aa3a-4c71665d73e4} - (no file)

Toolbar-Locked - (no file)

Wow6432Node-HKCU-Run-AdobeBridge - (no file)

Toolbar-Locked - (no file)

AddRemove-PlanetSide 2 PSG - c:\users\Public\Sony Online Entertainment\Installed Games\PlanetSide 2 PSG\Uninstaller.exe

.

.

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\services\npggsvc]

"ImagePath"="c:\windows\system32\GameMon.des -service"

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\services\PCDSRVC{7368CD8C-6118E123-06020101}_0]

"ImagePath"="\??\c:\users\admini~1\appdata\local\temp\nqtxzf39bo1g\pcdrdiag\bin\pcdsrvc_x64.pkms"

.

--------------------- Gesperrte Registrierungsschluessel ---------------------

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_7_700_224_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]

@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_7_700_224_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="IFlashBroker5"

.

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_7_700_224_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_7_700_224_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Shockwave Flash Object"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]

@="0"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]

@="ShockwaveFlash.ShockwaveFlash.11"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx, 1"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="ShockwaveFlash.ShockwaveFlash"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Macromedia Flash Factory Object"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]

@="FlashFactory.FlashFactory.1"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx, 1"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="FlashFactory.FlashFactory"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="IFlashBroker5"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]

@Denied: (A) (Everyone)

.

[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane3]

@Denied: (A) (Everyone)

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0005\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0006\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

------------------------ Weitere laufende Prozesse ------------------------

.

c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

c:\program files (x86)\Avira\AntiVir Desktop\avguard.exe

c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

c:\program files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe

c:\program files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe

c:\windows\SysWOW64\UAService7.exe

c:\program files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe

.

**************************************************************************

.

Zeit der Fertigstellung: 2013-07-14  14:06:16 - PC wurde neu gestartet

ComboFix-quarantined-files.txt  2013-07-14 12:06

.

Vor Suchlauf: 14 Verzeichnis(se), 326.639.919.104 Bytes frei

Nach Suchlauf: 19 Verzeichnis(se), 326.131.519.488 Bytes frei

.

- - End Of File - - 3C9ED8482DB822A2A5915CF6C50CE78E

A36C5E4F47E84449FF07ED3517B43A31