| ferropolis | 02.02.2014 14:13 |
Code:
Rkill 2.6.5 by Lawrence Abrams (Grinler)
hxxp://www.bleepingcomputer.com/
Copyright 2008-2014 BleepingComputer.com
More Information about Rkill can be found at this link:
hxxp://www.bleepingcomputer.com/forums/topic308364.html
Program started at: 02/02/2014 01:51:01 PM in x64 mode.
Windows Version: Windows 7 Home Premium Service Pack 1
Checking for Windows services to stop:
* No malware services found to stop.
Checking for processes to terminate:
* C:\Windows\DAODx.exe (PID: 1984) [WD-HEUR]
* C:\Windows\SysWOW64\nlssrv32.exe (PID: 2216) [WD-HEUR]
2 proccesses terminated!
Checking Registry for malware related settings:
* System Policy Removed: DisableCMD [HKCU]
Backup Registry file created at:
D:\Eigene Datein\Desktop\rkill\rkill-02-02-2014-01-51-05.reg
Resetting .EXE, .COM, & .BAT associations in the Windows Registry.
* HKLM\Software\Classes\exefile\shell\open\command\\IsolatedCommand was changed. It was reset to "%1" %*!
* HKLM\Software\Classes\exefile\shell\runas\command\\IsolatedCommand was changed. It was reset to "%1" %*!
Performing miscellaneous checks:
* No issues found.
Checking Windows Service Integrity:
* No issues found.
Searching for Missing Digital Signatures:
* No issues found.
Checking HOSTS File:
* Cannot edit the HOSTS file.
* Permissions could not be fixed. Use Hosts-perm.bat to fix permissions: hxxp://www.bleepingcomputer.com/download/hosts-permbat/
Program finished at: 02/02/2014 01:51:15 PM
Execution time: 0 hours(s), 0 minute(s), and 14 seconds(s)
Code:
ComboFix 14-02-01.01 - ferropolis 02.02.2014 14:04:42.2.6 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.49.1031.18.16382.13206 [GMT 1:00]
ausgeführt von:: d:\eigene datein\Desktop\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Neuer Wiederherstellungspunkt wurde erstellt
.
ADS - Windows: deleted 0 bytes in 1 streams.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\FERROP~1\AppData\Local\Temp\_MEI33322\_ctypes.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI33322\_elementtree.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI33322\_hashlib.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI33322\_multiprocessing.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI33322\_socket.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI33322\_ssl.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI33322\pyexpat.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI33322\pysqlite2._sqlite.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI33322\python27.dll
c:\users\FERROP~1\AppData\Local\Temp\_MEI33322\pythoncom27.dll
c:\users\FERROP~1\AppData\Local\Temp\_MEI33322\PyWinTypes27.dll
c:\users\FERROP~1\AppData\Local\Temp\_MEI33322\select.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI33322\unicodedata.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI33322\win32api.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI33322\win32com.shell.shell.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI33322\win32crypt.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI33322\win32event.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI33322\win32file.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI33322\win32inet.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI33322\win32pdh.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI33322\win32pipe.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI33322\win32process.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI33322\win32profile.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI33322\win32security.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI33322\win32ts.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI33322\windows._lib_cacheinvalidation.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI33322\wx._controls_.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI33322\wx._core_.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI33322\wx._gdi_.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI33322\wx._html2.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI33322\wx._misc_.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI33322\wx._windows_.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI33322\wx._wizard.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI33322\wxbase294u_net_vc90.dll
c:\users\FERROP~1\AppData\Local\Temp\_MEI33322\wxbase294u_vc90.dll
c:\users\FERROP~1\AppData\Local\Temp\_MEI33322\wxmsw294u_adv_vc90.dll
c:\users\FERROP~1\AppData\Local\Temp\_MEI33322\wxmsw294u_core_vc90.dll
c:\users\FERROP~1\AppData\Local\Temp\_MEI33322\wxmsw294u_html_vc90.dll
c:\users\FERROP~1\AppData\Local\Temp\_MEI33322\wxmsw294u_webview_vc90.dll
c:\users\ferropolis\AppData\Local\Temp\_MEI33322\_ctypes.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI33322\_elementtree.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI33322\_hashlib.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI33322\_multiprocessing.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI33322\_socket.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI33322\_ssl.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI33322\pyexpat.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI33322\pysqlite2._sqlite.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI33322\python27.dll
c:\users\ferropolis\AppData\Local\Temp\_MEI33322\pythoncom27.dll
c:\users\ferropolis\AppData\Local\Temp\_MEI33322\PyWinTypes27.dll
c:\users\ferropolis\AppData\Local\Temp\_MEI33322\select.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI33322\unicodedata.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI33322\win32api.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI33322\win32com.shell.shell.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI33322\win32crypt.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI33322\win32event.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI33322\win32file.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI33322\win32inet.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI33322\win32pdh.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI33322\win32pipe.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI33322\win32process.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI33322\win32profile.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI33322\win32security.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI33322\win32ts.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI33322\windows._lib_cacheinvalidation.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI33322\wx._controls_.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI33322\wx._core_.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI33322\wx._gdi_.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI33322\wx._html2.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI33322\wx._misc_.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI33322\wx._windows_.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI33322\wx._wizard.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI33322\wxbase294u_net_vc90.dll
c:\users\ferropolis\AppData\Local\Temp\_MEI33322\wxbase294u_vc90.dll
c:\users\ferropolis\AppData\Local\Temp\_MEI33322\wxmsw294u_adv_vc90.dll
c:\users\ferropolis\AppData\Local\Temp\_MEI33322\wxmsw294u_core_vc90.dll
c:\users\ferropolis\AppData\Local\Temp\_MEI33322\wxmsw294u_html_vc90.dll
c:\users\ferropolis\AppData\Local\Temp\_MEI33322\wxmsw294u_webview_vc90.dll
.
---- Vorheriger Suchlauf -------
.
c:\users\FERROP~1\AppData\Local\Temp\_MEI21122\_ctypes.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI21122\_elementtree.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI21122\_hashlib.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI21122\_multiprocessing.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI21122\_socket.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI21122\_ssl.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI21122\pyexpat.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI21122\pysqlite2._sqlite.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI21122\python27.dll
c:\users\FERROP~1\AppData\Local\Temp\_MEI21122\pythoncom27.dll
c:\users\FERROP~1\AppData\Local\Temp\_MEI21122\PyWinTypes27.dll
c:\users\FERROP~1\AppData\Local\Temp\_MEI21122\select.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI21122\unicodedata.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI21122\win32api.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI21122\win32com.shell.shell.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI21122\win32crypt.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI21122\win32event.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI21122\win32file.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI21122\win32inet.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI21122\win32pdh.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI21122\win32pipe.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI21122\win32process.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI21122\win32profile.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI21122\win32security.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI21122\win32ts.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI21122\windows._lib_cacheinvalidation.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI21122\wx._controls_.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI21122\wx._core_.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI21122\wx._gdi_.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI21122\wx._html2.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI21122\wx._misc_.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI21122\wx._windows_.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI21122\wx._wizard.pyd
c:\users\FERROP~1\AppData\Local\Temp\_MEI21122\wxbase294u_net_vc90.dll
c:\users\FERROP~1\AppData\Local\Temp\_MEI21122\wxbase294u_vc90.dll
c:\users\FERROP~1\AppData\Local\Temp\_MEI21122\wxmsw294u_adv_vc90.dll
c:\users\FERROP~1\AppData\Local\Temp\_MEI21122\wxmsw294u_core_vc90.dll
c:\users\FERROP~1\AppData\Local\Temp\_MEI21122\wxmsw294u_html_vc90.dll
c:\users\FERROP~1\AppData\Local\Temp\_MEI21122\wxmsw294u_webview_vc90.dll
c:\users\ferropolis\AppData\Local\Temp\_MEI21122\_ctypes.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI21122\_elementtree.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI21122\_hashlib.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI21122\_multiprocessing.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI21122\_socket.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI21122\_ssl.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI21122\pyexpat.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI21122\pysqlite2._sqlite.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI21122\python27.dll
c:\users\ferropolis\AppData\Local\Temp\_MEI21122\pythoncom27.dll
c:\users\ferropolis\AppData\Local\Temp\_MEI21122\PyWinTypes27.dll
c:\users\ferropolis\AppData\Local\Temp\_MEI21122\select.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI21122\unicodedata.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI21122\win32api.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI21122\win32com.shell.shell.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI21122\win32crypt.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI21122\win32event.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI21122\win32file.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI21122\win32inet.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI21122\win32pdh.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI21122\win32pipe.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI21122\win32process.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI21122\win32profile.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI21122\win32security.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI21122\win32ts.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI21122\windows._lib_cacheinvalidation.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI21122\wx._controls_.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI21122\wx._core_.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI21122\wx._gdi_.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI21122\wx._html2.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI21122\wx._misc_.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI21122\wx._windows_.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI21122\wx._wizard.pyd
c:\users\ferropolis\AppData\Local\Temp\_MEI21122\wxbase294u_net_vc90.dll
c:\users\ferropolis\AppData\Local\Temp\_MEI21122\wxbase294u_vc90.dll
c:\users\ferropolis\AppData\Local\Temp\_MEI21122\wxmsw294u_adv_vc90.dll
c:\users\ferropolis\AppData\Local\Temp\_MEI21122\wxmsw294u_core_vc90.dll
c:\users\ferropolis\AppData\Local\Temp\_MEI21122\wxmsw294u_html_vc90.dll
c:\users\ferropolis\AppData\Local\Temp\_MEI21122\wxmsw294u_webview_vc90.dll
c:\windows\AutoRun.ini
c:\windows\IsUn0407.exe
c:\windows\iun6002.exe
c:\windows\SysWow64\tmp2240.tmp
c:\windows\SysWow64\tmp2260.tmp
.
.
((((((((((((((((((((((( Dateien erstellt von 2014-01-02 bis 2014-02-02 ))))))))))))))))))))))))))))))
.
.
2014-02-02 13:08 . 2014-02-02 13:08 -------- d-----w- c:\users\Default\AppData\Local\temp
2014-01-31 17:48 . 2014-02-01 14:51 -------- dc----w- C:\FRST
2014-01-31 16:52 . 2013-12-04 03:28 10315576 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{29ED0093-F58D-4D5C-A212-B0D7A91E95F9}\mpengine.dll
2014-01-22 19:02 . 2014-01-22 19:02 -------- d-----w- c:\users\ferropolis\AppData\Local\Blizzard Entertainment
2014-01-15 17:41 . 2013-11-27 01:41 343040 ----a-w- c:\windows\system32\drivers\usbhub.sys
2014-01-15 17:41 . 2013-11-27 01:41 99840 ----a-w- c:\windows\system32\drivers\usbccgp.sys
2014-01-15 17:41 . 2013-11-27 01:41 53248 ----a-w- c:\windows\system32\drivers\usbehci.sys
2014-01-15 17:41 . 2013-11-27 01:41 325120 ----a-w- c:\windows\system32\drivers\usbport.sys
2014-01-15 17:41 . 2013-11-27 01:41 25600 ----a-w- c:\windows\system32\drivers\usbohci.sys
2014-01-15 17:41 . 2013-11-27 01:41 30720 ----a-w- c:\windows\system32\drivers\usbuhci.sys
2014-01-15 17:41 . 2013-11-27 01:41 7808 ----a-w- c:\windows\system32\drivers\usbd.sys
2014-01-15 17:41 . 2013-11-26 11:40 376768 ----a-w- c:\windows\system32\drivers\netio.sys
2014-01-15 17:41 . 2013-11-26 10:32 3156480 ----a-w- c:\windows\system32\win32k.sys
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-01-31 16:49 . 2012-05-20 17:02 692616 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2014-01-31 16:49 . 2012-03-11 08:38 71048 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2014-01-15 19:29 . 2010-10-17 08:59 86054176 ----a-w- c:\windows\system32\MRT.exe
2014-01-12 13:42 . 2010-10-05 17:24 214392 ----a-w- c:\windows\SysWow64\PnkBstrB.exe
2014-01-06 19:04 . 2010-10-05 17:24 214392 ----a-w- c:\windows\SysWow64\PnkBstrB.ex0
2013-12-21 15:20 . 2010-10-05 17:24 76888 ----a-w- c:\windows\SysWow64\PnkBstrA.exe
2013-12-19 17:01 . 2013-08-08 19:50 84720 ----a-w- c:\windows\system32\drivers\avnetflt.sys
2013-12-19 17:01 . 2013-08-08 19:49 131576 ----a-w- c:\windows\system32\drivers\avipbb.sys
2013-12-19 17:01 . 2013-08-08 19:49 108440 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2013-12-18 05:13 . 2010-09-30 19:33 270496 ------w- c:\windows\system32\MpSigStub.exe
2013-12-10 02:13 . 2013-12-22 13:52 982232 ----a-w- c:\windows\SysWow64\nvspcap.dll
2013-12-10 02:13 . 2013-12-22 13:52 1100248 ----a-w- c:\windows\system32\nvspcap64.dll
2013-12-05 08:42 . 2013-12-22 13:53 39200 ----a-w- c:\windows\system32\drivers\nvvad64v.sys
2013-12-05 08:42 . 2013-12-22 13:53 32544 ----a-w- c:\windows\SysWow64\nvaudcap32v.dll
2013-12-05 08:42 . 2013-12-22 13:50 35104 ----a-w- c:\windows\system32\nvaudcap64v.dll
2013-12-04 09:43 . 2013-12-04 09:43 940032 ----a-w- c:\windows\system32\MsSpellCheckingFacility.exe
2013-12-04 09:43 . 2013-12-04 09:43 194048 ----a-w- c:\windows\SysWow64\elshyph.dll
2013-12-04 09:43 . 2013-12-04 09:43 71680 ----a-w- c:\windows\SysWow64\RegisterIEPKEYs.exe
2013-12-04 09:43 . 2013-12-04 09:43 645120 ----a-w- c:\windows\SysWow64\jsIntl.dll
2013-12-04 09:43 . 2013-12-04 09:43 62464 ----a-w- c:\windows\SysWow64\tdc.ocx
2013-12-04 09:43 . 2013-12-04 09:43 61952 ----a-w- c:\windows\SysWow64\iesetup.dll
2013-12-04 09:43 . 2013-12-04 09:43 34816 ----a-w- c:\windows\SysWow64\JavaScriptCollectionAgent.dll
2013-12-04 09:43 . 2013-12-04 09:43 337408 ----a-w- c:\windows\SysWow64\html.iec
2013-12-04 09:43 . 2013-12-04 09:43 24576 ----a-w- c:\windows\SysWow64\licmgr10.dll
2013-12-04 09:43 . 2013-12-04 09:43 235008 ----a-w- c:\windows\system32\elshyph.dll
2013-12-04 09:43 . 2013-12-04 09:43 182272 ----a-w- c:\windows\SysWow64\msls31.dll
2013-12-04 09:43 . 2013-12-04 09:43 942592 ----a-w- c:\windows\system32\jsIntl.dll
2013-12-04 09:43 . 2013-12-04 09:43 90112 ----a-w- c:\windows\system32\SetIEInstalledDate.exe
2013-12-04 09:43 . 2013-12-04 09:43 86016 ----a-w- c:\windows\SysWow64\iesysprep.dll
2013-12-04 09:43 . 2013-12-04 09:43 86016 ----a-w- c:\windows\system32\RegisterIEPKEYs.exe
2013-12-04 09:43 . 2013-12-04 09:43 81408 ----a-w- c:\windows\system32\icardie.dll
2013-12-04 09:43 . 2013-12-04 09:43 77312 ----a-w- c:\windows\system32\tdc.ocx
2013-12-04 09:43 . 2013-12-04 09:43 74240 ----a-w- c:\windows\SysWow64\SetIEInstalledDate.exe
2013-12-04 09:43 . 2013-12-04 09:43 61952 ----a-w- c:\windows\SysWow64\MshtmlDac.dll
2013-12-04 09:43 . 2013-12-04 09:43 616104 ----a-w- c:\windows\system32\ieapfltr.dat
2013-12-04 09:43 . 2013-12-04 09:43 52224 ----a-w- c:\windows\system32\msfeedsbs.dll
2013-12-04 09:43 . 2013-12-04 09:43 51200 ----a-w- c:\windows\SysWow64\ieetwproxystub.dll
2013-12-04 09:43 . 2013-12-04 09:43 48640 ----a-w- c:\windows\SysWow64\mshtmler.dll
2013-12-04 09:43 . 2013-12-04 09:43 48640 ----a-w- c:\windows\system32\mshtmler.dll
2013-12-04 09:43 . 2013-12-04 09:43 454656 ----a-w- c:\windows\SysWow64\vbscript.dll
2013-12-04 09:43 . 2013-12-04 09:43 453120 ----a-w- c:\windows\system32\dxtmsft.dll
2013-12-04 09:43 . 2013-12-04 09:43 413696 ----a-w- c:\windows\system32\html.iec
2013-12-04 09:43 . 2013-12-04 09:43 40448 ----a-w- c:\windows\system32\JavaScriptCollectionAgent.dll
2013-12-04 09:43 . 2013-12-04 09:43 36352 ----a-w- c:\windows\SysWow64\imgutil.dll
2013-12-04 09:43 . 2013-12-04 09:43 296960 ----a-w- c:\windows\system32\dxtrans.dll
2013-12-04 09:43 . 2013-12-04 09:43 263376 ----a-w- c:\windows\system32\iedkcs32.dll
2013-12-04 09:43 . 2013-12-04 09:43 247808 ----a-w- c:\windows\system32\msls31.dll
2013-12-04 09:43 . 2013-12-04 09:43 235520 ----a-w- c:\windows\system32\url.dll
2013-12-04 09:43 . 2013-12-04 09:43 195584 ----a-w- c:\windows\system32\msrating.dll
2013-12-04 09:43 . 2013-12-04 09:43 151552 ----a-w- c:\windows\SysWow64\iexpress.exe
2013-12-04 09:43 . 2013-12-04 09:43 139264 ----a-w- c:\windows\SysWow64\wextract.exe
2013-12-04 09:43 . 2013-12-04 09:43 13312 ----a-w- c:\windows\SysWow64\mshta.exe
2013-12-04 09:43 . 2013-12-04 09:43 13312 ----a-w- c:\windows\system32\msfeedssync.exe
2013-12-04 09:43 . 2013-12-04 09:43 131072 ----a-w- c:\windows\system32\IEAdvpack.dll
2013-12-04 09:43 . 2013-12-04 09:43 1228800 ----a-w- c:\windows\system32\mshtmlmedia.dll
2013-12-04 09:43 . 2013-12-04 09:43 112128 ----a-w- c:\windows\SysWow64\ieUnatt.exe
2013-12-04 09:43 . 2013-12-04 09:43 111616 ----a-w- c:\windows\SysWow64\IEAdvpack.dll
2013-12-04 09:43 . 2013-12-04 09:43 105984 ----a-w- c:\windows\system32\iesysprep.dll
2013-12-04 09:43 . 2013-12-04 09:43 1051136 ----a-w- c:\windows\SysWow64\mshtmlmedia.dll
2013-12-04 09:43 . 2013-12-04 09:43 84992 ----a-w- c:\windows\system32\mshtmled.dll
2013-12-04 09:43 . 2013-12-04 09:43 83968 ----a-w- c:\windows\system32\MshtmlDac.dll
2013-12-04 09:43 . 2013-12-04 09:43 774144 ----a-w- c:\windows\system32\jscript.dll
2013-12-04 09:43 . 2013-12-04 09:43 626176 ----a-w- c:\windows\system32\msfeeds.dll
2013-12-04 09:43 . 2013-12-04 09:43 62464 ----a-w- c:\windows\system32\pngfilt.dll
2013-12-04 09:43 . 2013-12-04 09:43 548352 ----a-w- c:\windows\system32\vbscript.dll
2013-12-04 09:43 . 2013-12-04 09:43 48128 ----a-w- c:\windows\system32\imgutil.dll
2013-12-04 09:43 . 2013-12-04 09:43 30208 ----a-w- c:\windows\system32\licmgr10.dll
2013-12-04 09:43 . 2013-12-04 09:43 243200 ----a-w- c:\windows\system32\webcheck.dll
2013-12-04 09:43 . 2013-12-04 09:43 167424 ----a-w- c:\windows\system32\iexpress.exe
2013-12-04 09:43 . 2013-12-04 09:43 147968 ----a-w- c:\windows\system32\occache.dll
2013-12-04 09:43 . 2013-12-04 09:43 143872 ----a-w- c:\windows\system32\wextract.exe
2013-12-04 09:43 . 2013-12-04 09:43 13824 ----a-w- c:\windows\system32\mshta.exe
2013-12-04 09:43 . 2013-12-04 09:43 135680 ----a-w- c:\windows\system32\iepeers.dll
2013-12-04 09:43 . 2013-12-04 09:43 101376 ----a-w- c:\windows\system32\inseng.dll
2013-11-26 18:15 . 2013-08-08 19:49 28600 ----a-w- c:\windows\system32\drivers\avkmgr.sys
2013-11-26 11:54 . 2013-12-12 16:33 23183360 ----a-w- c:\windows\system32\mshtml.dll
2013-11-26 10:19 . 2013-12-12 16:33 2724864 ----a-w- c:\windows\system32\mshtml.tlb
2013-11-26 10:18 . 2013-12-12 16:33 4096 ----a-w- c:\windows\system32\ieetwcollectorres.dll
2013-11-26 09:48 . 2013-12-12 16:33 66048 ----a-w- c:\windows\system32\iesetup.dll
2013-11-26 09:46 . 2013-12-12 16:33 48640 ----a-w- c:\windows\system32\ieetwproxystub.dll
2013-11-26 09:41 . 2013-12-12 16:33 2764288 ----a-w- c:\windows\system32\iertutil.dll
2013-11-26 09:29 . 2013-12-12 16:33 53760 ----a-w- c:\windows\system32\jsproxy.dll
2013-11-26 09:27 . 2013-12-12 16:33 33792 ----a-w- c:\windows\system32\iernonce.dll
2013-11-26 09:23 . 2013-12-12 16:33 2724864 ----a-w- c:\windows\SysWow64\mshtml.tlb
2013-11-26 09:21 . 2013-12-12 16:33 574976 ----a-w- c:\windows\system32\ieui.dll
2013-11-26 09:18 . 2013-12-12 16:33 139264 ----a-w- c:\windows\system32\ieUnatt.exe
2013-11-26 09:18 . 2013-12-12 16:33 111616 ----a-w- c:\windows\system32\ieetwcollector.exe
2013-11-26 09:16 . 2013-12-12 16:33 708608 ----a-w- c:\windows\system32\jscript9diag.dll
2013-11-26 08:57 . 2013-12-12 16:33 218624 ----a-w- c:\windows\system32\ie4uinit.exe
2013-11-26 08:35 . 2013-12-12 16:33 5769216 ----a-w- c:\windows\system32\jscript9.dll
2013-11-26 08:28 . 2013-12-12 16:33 553472 ----a-w- c:\windows\SysWow64\jscript9diag.dll
2013-11-26 08:16 . 2013-12-12 16:33 4243968 ----a-w- c:\windows\SysWow64\jscript9.dll
2013-11-26 08:02 . 2013-12-12 16:33 1995264 ----a-w- c:\windows\system32\inetcpl.cpl
2013-11-26 07:48 . 2013-12-12 16:33 12996608 ----a-w- c:\windows\system32\ieframe.dll
2013-11-26 07:32 . 2013-12-12 16:33 1928192 ----a-w- c:\windows\SysWow64\inetcpl.cpl
2013-11-26 07:07 . 2013-12-12 16:33 2334208 ----a-w- c:\windows\system32\wininet.dll
2013-11-26 06:40 . 2013-12-12 16:33 1395200 ----a-w- c:\windows\system32\urlmon.dll
2013-11-26 06:34 . 2013-12-12 16:33 817664 ----a-w- c:\windows\system32\ieapfltr.dll
2013-11-26 06:33 . 2013-12-12 16:33 1820160 ----a-w- c:\windows\SysWow64\wininet.dll
2013-11-23 18:26 . 2013-12-12 15:44 417792 ----a-w- c:\windows\SysWow64\WMPhoto.dll
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive1]
@="{F241C880-6982-4CE5-8CF7-7085BA96DA5A}"
[HKEY_CLASSES_ROOT\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}]
2012-12-11 16:41 220632 ----a-w- c:\users\ferropolis\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\SkyDriveShell.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive2]
@="{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}"
[HKEY_CLASSES_ROOT\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}]
2012-12-11 16:41 220632 ----a-w- c:\users\ferropolis\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\SkyDriveShell.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive3]
@="{BBACC218-34EA-4666-9D7A-C78F2274A524}"
[HKEY_CLASSES_ROOT\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}]
2012-12-11 16:41 220632 ----a-w- c:\users\ferropolis\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\SkyDriveShell.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1475584]
"GoogleDriveSync"="c:\program files (x86)\Google\Drive\googledrivesync.exe" [2013-12-06 20203904]
"TomTomHOME.exe"="d:\program files (x86)\TomTom HOME 2\TomTomHOMERunner.exe" [2013-07-02 248208]
"Skype"="d:\programme\skype\Phone\Skype.exe" [2013-11-14 20584608]
"iCloudServices"="c:\program files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe" [2013-11-20 59720]
"ApplePhotoStreams"="c:\program files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe" [2013-11-20 59720]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2013-04-21 59720]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2013-12-19 684600]
"Reader Application Helper"="d:\program files (x86)\Sony\ReaderDesktop\appHelper\ReaderAppHelper.exe" [2013-06-25 899400]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2013-05-01 421888]
"iTunesHelper"="d:\programme\itunes\iTunesHelper.exe" [2013-11-01 152392]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"EnableLinkedConnections"= 1 (0x1)
"EnableLUA"= 0 (0x0)
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\run-]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe"
.
R0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys;c:\windows\SYSNATIVE\Drivers\sptd.sys [x]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 NAUpdate;Nero Update;c:\program files (x86)\Nero\Update\NASvc.exe;c:\program files (x86)\Nero\Update\NASvc.exe [x]
R3 Creative ALchemy AL6 Licensing Service;Creative ALchemy AL6 Licensing Service;c:\program files (x86)\Common Files\Creative Labs Shared\Service\AL6Licensing.exe;c:\program files (x86)\Common Files\Creative Labs Shared\Service\AL6Licensing.exe [x]
R3 Creative Audio Engine Licensing Service;Creative Audio Engine Licensing Service;c:\program files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe;c:\program files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [x]
R3 FMS;Flash Media Server (FMS);d:\programme\adobe flash media server4\FMSMaster.exe;d:\programme\adobe flash media server4\FMSMaster.exe [x]
R3 FMSAdmin;Flash Media Administration Server;d:\programme\adobe flash media server4\FMSAdmin.exe;d:\programme\adobe flash media server4\FMSAdmin.exe [x]
R3 FMSHttpd;FMSHttpd;d:\programme\adobe flash media server4\Apache2.2\bin\httpd.exe;d:\programme\adobe flash media server4\Apache2.2\bin\httpd.exe [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 LADF_BakerCOnly;BakerC Filter Driver;c:\windows\system32\DRIVERS\ladfBakerCamd64.sys;c:\windows\SYSNATIVE\DRIVERS\ladfBakerCamd64.sys [x]
R3 LADF_BakerROnly;BakerR Filter Driver;c:\windows\system32\DRIVERS\ladfBakerRamd64.sys;c:\windows\SYSNATIVE\DRIVERS\ladfBakerRamd64.sys [x]
R3 ose64;Office 64 Source Engine;c:\program files\Common Files\Microsoft Shared\Source Engine\OSE.EXE;c:\program files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]
R3 SwitchBoard;SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [x]
R3 tapoas;TAP-Win32 Adapter OAS;c:\windows\system32\DRIVERS\tapoas.sys;c:\windows\SYSNATIVE\DRIVERS\tapoas.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys;c:\windows\SYSNATIVE\Drivers\usbaapl64.sys [x]
R3 WSDScan;WSD-Scanunterstützung durch UMB;c:\windows\system32\drivers\WSDScan.sys;c:\windows\SYSNATIVE\drivers\WSDScan.sys [x]
R4 AntiVirWebService;Avira Browser-Schutz;c:\program files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE;c:\program files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [x]
S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys;c:\windows\SYSNATIVE\Drivers\PxHlpa64.sys [x]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys;c:\windows\SYSNATIVE\DRIVERS\avkmgr.sys [x]
S2 ABBYY.Licensing.FineReader.Sprint.9.0;ABBYY FineReader 9.0 Sprint Licensing Service;c:\program files (x86)\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe;c:\program files (x86)\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe [x]
S2 AntiVirSchedulerService;Avira Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [x]
S2 DevoloNetworkService;devolo Network Service;d:\programme\devolo\dlan\devolonetsvc.exe;d:\programme\devolo\dlan\devolonetsvc.exe [x]
S2 nlsX86cc;Nalpeiron Licensing Service;c:\windows\SysWOW64\nlssrv32.exe;c:\windows\SysWOW64\nlssrv32.exe [x]
S2 NPF_devolo;NetGroup Packet Filter Driver (devolo);c:\windows\sysWOW64\drivers\npf_devolo.sys;c:\windows\sysWOW64\drivers\npf_devolo.sys [x]
S2 NvNetworkService;NVIDIA Network Service;c:\program files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe;c:\program files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [x]
S2 NvStreamSvc;NVIDIA Streamer Service;c:\program files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe;c:\program files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [x]
S2 SkypeUpdate;Skype Updater;d:\programme\skype\Updater\Updater.exe;d:\programme\skype\Updater\Updater.exe [x]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [x]
S2 TomTomHOMEService;TomTomHOMEService;d:\program files (x86)\TomTom HOME 2\TomTomHOMEService.exe;d:\program files (x86)\TomTom HOME 2\TomTomHOMEService.exe [x]
S2 UsbClientService;UsbClientService;d:\program files (x86)\Synology\Assistant\UsbClientService.exe;d:\program files (x86)\Synology\Assistant\UsbClientService.exe [x]
S3 busenum;Synology Virtual USB Hub;c:\windows\system32\DRIVERS\busenum.sys;c:\windows\SYSNATIVE\DRIVERS\busenum.sys [x]
S3 LADF_CaptureOnly;LADF Capture Filter Driver;c:\windows\system32\DRIVERS\ladfGSCamd64.sys;c:\windows\SYSNATIVE\DRIVERS\ladfGSCamd64.sys [x]
S3 LADF_RenderOnly;LADF Render Filter Driver;c:\windows\system32\DRIVERS\ladfGSRamd64.sys;c:\windows\SYSNATIVE\DRIVERS\ladfGSRamd64.sys [x]
S3 LGBusEnum;Logitech GamePanel Virtual Bus Enumerator Driver;c:\windows\system32\drivers\LGBusEnum.sys;c:\windows\SYSNATIVE\drivers\LGBusEnum.sys [x]
S3 LGPBTDD;LGPBTDD.sys Display Driver;c:\windows\system32\Drivers\LGPBTDD.sys;c:\windows\SYSNATIVE\Drivers\LGPBTDD.sys [x]
S3 LGVirHid;Logitech Gamepanel Virtual HID Device Driver;c:\windows\system32\drivers\LGVirHid.sys;c:\windows\SYSNATIVE\drivers\LGVirHid.sys [x]
S3 nusb3hub;NEC Electronics USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\nusb3hub.sys;c:\windows\SYSNATIVE\DRIVERS\nusb3hub.sys [x]
S3 nusb3xhc;NEC Electronics USB 3.0 Host Controller Driver;c:\windows\system32\DRIVERS\nusb3xhc.sys;c:\windows\SYSNATIVE\DRIVERS\nusb3xhc.sys [x]
S3 nvvad_WaveExtensible;NVIDIA Virtual Audio Device (Wave Extensible) (WDM);c:\windows\system32\drivers\nvvad64v.sys;c:\windows\SYSNATIVE\drivers\nvvad64v.sys [x]
S3 usbfilter;AMD USB Filter Driver;c:\windows\system32\DRIVERS\usbfilter.sys;c:\windows\SYSNATIVE\DRIVERS\usbfilter.sys [x]
S3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:\windows\system32\drivers\viahduaa.sys;c:\windows\SYSNATIVE\drivers\viahduaa.sys [x]
S3 VMfilt;VMfilt;c:\windows\system32\drivers\VMfilt64.sys;c:\windows\SYSNATIVE\drivers\VMfilt64.sys [x]
S3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x64.sys;c:\windows\SYSNATIVE\DRIVERS\yk62x64.sys [x]
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{2D46B6DC-2207-486B-B523-A557E6D54B47}]
start [BU]
.
Inhalt des "geplante Tasks" Ordners
.
2014-02-02 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-05-20 16:49]
.
2014-02-02 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-06-10 14:52]
.
2014-02-02 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-06-10 14:52]
.
2013-02-20 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-398553616-2761322092-620628992-1000Core1ce0f818ac57e9.job
- c:\users\ferropolis\AppData\Local\Google\Update\GoogleUpdate.exe [2010-09-30 19:33]
.
2013-12-14 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-398553616-2761322092-620628992-1000Core1cef8d292a9344c.job
- c:\users\ferropolis\AppData\Local\Google\Update\GoogleUpdate.exe [2010-09-30 19:33]
.
2014-02-01 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-398553616-2761322092-620628992-1000UA.job
- c:\users\ferropolis\AppData\Local\Google\Update\GoogleUpdate.exe [2010-09-30 19:33]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive1]
@="{F241C880-6982-4CE5-8CF7-7085BA96DA5A}"
[HKEY_CLASSES_ROOT\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}]
2012-12-11 16:41 244696 ----a-w- c:\users\ferropolis\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64\SkyDriveShell64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive2]
@="{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}"
[HKEY_CLASSES_ROOT\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}]
2012-12-11 16:41 244696 ----a-w- c:\users\ferropolis\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64\SkyDriveShell64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive3]
@="{BBACC218-34EA-4666-9D7A-C78F2274A524}"
[HKEY_CLASSES_ROOT\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}]
2012-12-11 16:41 244696 ----a-w- c:\users\ferropolis\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64\SkyDriveShell64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveBlacklistedOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42}]
2013-12-06 14:47 778704 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedEditOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}"
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}]
2013-12-06 14:47 778704 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedEditOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}"
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}]
2013-12-06 14:47 778704 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedViewOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43}]
2013-12-06 14:47 778704 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSyncedOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}]
2013-12-06 14:47 778704 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSyncingOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41}]
2013-12-06 14:47 778704 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"EvtMgr6"="d:\programme\SetPoint_6.20\SetPointP\SetPoint.exe" [2010-10-28 1680976]
"Launch LCore"="c:\program files\Logitech Gaming Software\LCore.exe" [2012-07-24 6900024]
"Start WingMan Profiler"="c:\program files\Logitech\Gaming Software\LWEMon.exe" [2010-06-14 190536]
"AdobeAAMUpdater-1.0"="c:\program files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2013-03-21 472992]
"BCSSync"="d:\programme\Office2010\Office14\BCSSync.exe" [2012-11-05 108144]
"Nvtmru"="c:\program files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe" [2013-11-14 1028384]
"ShadowPlay"="c:\windows\system32\nvspcap64.dll" [2013-12-10 1100248]
"NvBackend"="c:\program files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe" [2013-12-10 2279712]
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.google.de/
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyServer = 183.111.12.21:8080
uInternet Settings,ProxyOverride = *.local
IE: An OneNote s&enden - c:\progra~1\MICROS~2\Office14\ONBttnIE.dll/105
IE: An vorhandene PDF-Datei anfügen - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
IE: In Adobe PDF konvertieren - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
IE: Linkziel an vorhandene PDF-Datei anhängen - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Linkziel in Adobe PDF konvertieren - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Nach Microsoft E&xcel exportieren - c:\progra~1\MICROS~2\Office14\EXCEL.EXE/3000
IE: Nach Microsoft E&xel exportieren - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000
LSP: c:\program files (x86)\Avira\AntiVir Desktop\avsda.dll
TCP: Interfaces\{10777BA5-7817-49D6-9F75-1629D2C966D1}: NameServer = 192.168.2.1
FF - ProfilePath - c:\users\ferropolis\AppData\Roaming\Mozilla\Firefox\Profiles\ha6b3hbv.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - www.google.de
FF - prefs.js: keyword.URL - hxxp://search.babylon.com/?AF=100476&babsrc=adbartrp&mntrId=40ea805a00000000000020cf30214935&q=
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files (x86)\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} - c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} - c:\program files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}
FF - Ext: Firebug: firebug@software.joehewitt.com - %profile%\extensions\firebug@software.joehewitt.com
FF - Ext: Adobe Contribute Toolbar: {01A8CA0A-4C96-465b-A49B-65C46FAD54F9} - d:\programme\Photoshop_CS5\Adobe Contribute CS5\Plugins\FirefoxPlugin\{01A8CA0A-4C96-465b-A49B-65C46FAD54F9}
FF - Ext: Adobe Acrobat - Create PDF: web2pdfextension@web2pdf.adobedotcom - d:\programme\adobe acrobat X Pro\Acrobat\Browser\WCFirefoxExtn
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Wow6432Node-HKLM-Run-<NO NAME> - (no file)
AddRemove-ANNO 1602 Königs-Edition - c:\windows\IsUn0407.exe
AddRemove-Battlelog Web Plugins - c:\program files (x86)\Battlelog Web Plugins\uninstall.exe
AddRemove-DesertCombat - c:\windows\iun6002.exe
AddRemove-{8A1EBF29-7CF8-471E-B90B-95FF36AC8248} - c:\programdata\{89E2929F-C967-49CB-9FE3-FD86B97312FE}\simplify3_setup.exe
AddRemove-{8A551628-20DB-4A9C-A172-572689456C44} - c:\programdata\{5D041186-ED95-4AA8-B0C6-2378CD198955}\MAX!_Setup.exe
AddRemove-{9E82D1DB-3AFB-4D18-A221-081F1B4B4789} - c:\programdata\{54AE07EB-BBE5-4429-9DF3-C156DB112B54}\denoise5_setup.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\Approved Extensions]
@Denied: (2) (LocalSystem)
"{517BDDE4-E3A7-4570-B21E-2B52B6139FC7}"=hex:51,66,7a,6c,4c,1d,38,12,8a,de,68,
55,95,ad,1e,00,cd,08,68,12,b3,4d,db,d3
"{47833539-D0C5-4125-9FA8-0819E2EAAC93}"=hex:51,66,7a,6c,4c,1d,38,12,57,36,90,
43,f7,9e,4b,04,e0,be,4b,59,e7,b4,e8,87
"{074C1DC5-9320-4A9A-947D-C042949C6216}"=hex:51,66,7a,6c,4c,1d,38,12,ab,1e,5f,
03,12,dd,f4,0f,eb,6b,83,02,91,c2,26,02
"{18DF081C-E8AD-4283-A596-FA578C2EBDC3}"=hex:51,66,7a,6c,4c,1d,38,12,72,0b,cc,
1c,9f,a6,ed,07,da,80,b9,17,89,70,f9,d7
"{72853161-30C5-4D22-B7F9-0BBC1D38A37E}"=hex:51,66,7a,6c,4c,1d,38,12,0f,32,96,
76,f7,7e,4c,08,c8,ef,48,fc,18,66,e7,6a
"{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}"=hex:51,66,7a,6c,4c,1d,38,12,d5,94,07,
72,c2,98,42,03,c9,fd,97,9a,f4,87,69,57
"{9030D464-4C02-4ABF-8ECC-5164760863C6}"=hex:51,66,7a,6c,4c,1d,38,12,0a,d7,23,
94,30,02,d1,0f,f1,da,12,24,73,56,27,d2
"{AE7CD045-E861-484F-8273-0445EE161910}"=hex:51,66,7a,6c,4c,1d,38,12,2b,d3,6f,
aa,53,a6,21,0d,fd,65,47,05,eb,48,5d,04
"{B4F3A835-0E21-4959-BA22-42B3008E02FF}"=hex:51,66,7a,6c,4c,1d,38,12,5b,ab,e0,
b0,13,40,37,0c,c5,34,01,f3,05,d0,46,eb
"{DBC80044-A445-435B-BC74-9C25C1C588A9}"=hex:51,66,7a,6c,4c,1d,38,12,2a,03,db,
df,77,ea,35,06,c3,62,df,65,c4,9b,cc,bd
"{F4971EE7-DAA0-4053-9964-665D8EE6A077}"=hex:51,66,7a,6c,4c,1d,38,12,89,1d,84,
f0,92,94,3d,05,e6,72,25,1d,8b,b8,e4,63
"{2A541AE1-5BF6-4665-A8A3-CFA9672E4291}"=hex:51,66,7a,6c,4c,1d,38,12,8f,19,47,
2e,c4,15,0b,03,d7,b5,8c,e9,62,70,06,85
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration]
@Denied: (2) (LocalSystem)
"Timestamp"=hex:ef,d3,d8,ba,fc,cb,ce,01
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (LocalSystem)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,7d,ef,43,95,70,72,a7,4e,ae,86,a2,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,7d,ef,43,95,70,72,a7,4e,ae,86,a2,\
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_9_900_170_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_9_900_170_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{BEB3C0C7-B648-4257-96D9-B5D024816E27}\Version*Version]
"Version"=hex:06,8f,a0,81,4f,8b,e0,7c,e8,d4,d1,6c,df,3f,fb,d9,df,cc,87,2b,13,
59,b2,ff,4f,df,79,6d,c0,84,8e,58,84,ef,2d,fd,1b,d3,3d,40,c4,76,0e,ca,1c,3a,\
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_9_900_170_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_9_900_170_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_9_900_170.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_9_900_170.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_9_900_170.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_9_900_170.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Minnetonka Audio Software\SurCode Dolby Digital Premiere\Version*Version]
"Version"=hex:06,8f,a0,81,4f,8b,e0,7c,e8,d4,d1,6c,df,3f,fb,d9,df,cc,87,2b,13,
59,b2,ff,4f,df,79,6d,c0,84,8e,58,3d,91,0b,90,2c,a3,e6,b5,c4,76,0e,ca,1c,3a,\
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\program files (x86)\Creative\Shared Files\CTAudSvc.exe
c:\program files (x86)\Avira\AntiVir Desktop\avguard.exe
c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files (x86)\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\windows\DAODx.exe
c:\windows\SysWOW64\PnkBstrA.exe
c:\program files\Logitech Gaming Software\Applets\LCDMedia.exe
c:\program files (x86)\Common Files\Sony Shared\Fsk\SonySCSIHelperService.exe
c:\program files (x86)\Common Files\Apple\Internet Services\APSDaemon.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2014-02-02 14:11:49 - PC wurde neu gestartet
ComboFix-quarantined-files.txt 2014-02-02 13:11
.
Vor Suchlauf: 8.394.231.808 Bytes frei
Nach Suchlauf: 8.384.692.224 Bytes frei
.
- - End Of File - - 5BBBEC82AFDA9C70969C80E63ACDB7C5
A36C5E4F47E84449FF07ED3517B43A31
|
So funktioniert es:
Malwarebytes Anti-Malware 
AdwCleaner auf deinen Desktop.
SecurityCheck und:
