| toby2013 | 19.04.2014 14:20 |
Hallo, Code:
ComboFix 14-04-17.01 - Tobias 19.04.2014 15:05:26.3.4 - x64
Microsoft Windows 7 Home Premium 6.1.7600.0.1252.49.1031.18.3758.2528 [GMT 2:00]
ausgeführt von:: c:\users\Tobias\Desktop\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {4D041356-F94D-285F-8768-AAE50FA36859}
SP: Avira Desktop *Disabled/Updated* {F665F2B2-DF77-27D1-BDD8-9197742422E4}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Neuer Wiederherstellungspunkt wurde erstellt
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\40623880
c:\programdata\44293896
c:\programdata\l_u0_0.pad
c:\users\Tobias\AppData\Roaming\14001.008
c:\users\Tobias\AppData\Roaming\14001.008\chrome.manifest
c:\users\Tobias\AppData\Roaming\14001.008\components\AcroFF.txt
c:\users\Tobias\AppData\Roaming\14001.008\install.rdf
c:\users\Tobias\AppData\Roaming\14001.009
c:\users\Tobias\AppData\Roaming\14001.009\chrome.manifest
c:\users\Tobias\AppData\Roaming\14001.009\components\AcroFF.txt
c:\users\Tobias\AppData\Roaming\14001.009\install.rdf
c:\users\Tobias\AppData\Roaming\14001.010
c:\users\Tobias\AppData\Roaming\14001.010\chrome.manifest
c:\users\Tobias\AppData\Roaming\14001.010\components\AcroFF.txt
c:\users\Tobias\AppData\Roaming\14001.010\install.rdf
c:\users\Tobias\AppData\Roaming\14001.011
c:\users\Tobias\AppData\Roaming\14001.011\chrome.manifest
c:\users\Tobias\AppData\Roaming\14001.011\components\AcroFF.txt
c:\users\Tobias\AppData\Roaming\14001.011\install.rdf
c:\users\Tobias\AppData\Roaming\14001.012
c:\users\Tobias\AppData\Roaming\14001.012\chrome.manifest
c:\users\Tobias\AppData\Roaming\14001.012\components\AcroFF.txt
c:\users\Tobias\AppData\Roaming\14001.012\install.rdf
c:\users\Tobias\AppData\Roaming\14001.013
c:\users\Tobias\AppData\Roaming\14001.013\chrome.manifest
c:\users\Tobias\AppData\Roaming\14001.013\components\AcroFF.txt
c:\users\Tobias\AppData\Roaming\14001.013\install.rdf
c:\users\Tobias\AppData\Roaming\14001.014
c:\users\Tobias\AppData\Roaming\14001.014\chrome.manifest
c:\users\Tobias\AppData\Roaming\14001.014\components\AcroFF.txt
c:\users\Tobias\AppData\Roaming\14001.014\install.rdf
c:\users\Tobias\AppData\Roaming\AcroIEHelpe.txt
c:\users\Tobias\AppData\Roaming\srvblck5.tmp
.
.
((((((((((((((((((((((( Dateien erstellt von 2014-03-19 bis 2014-04-19 ))))))))))))))))))))))))))))))
.
.
2014-04-19 13:15 . 2014-04-19 13:15 -------- d-----w- c:\users\Public\AppData\Local\temp
2014-04-19 13:15 . 2014-04-19 13:15 -------- d-----w- c:\users\Default\AppData\Local\temp
2014-04-18 15:21 . 2014-04-18 15:23 -------- d-----w- C:\FRST
2014-04-16 10:32 . 2014-04-16 10:32 -------- d-----w- c:\program files (x86)\ESET
2014-04-16 10:15 . 2014-04-16 10:15 -------- d-----w- c:\windows\ERUNT
2014-04-16 09:27 . 2010-09-14 06:45 367104 ----a-w- c:\windows\system32\wcncsvc.dll
2014-04-16 09:27 . 2010-09-14 06:07 276992 ----a-w- c:\windows\SysWow64\wcncsvc.dll
2014-04-16 09:16 . 2014-04-16 09:27 -------- d-----w- c:\program files (x86)\VS Revo Group
2014-04-16 08:41 . 2012-07-26 07:46 2560 ----a-w- c:\windows\system32\drivers\de-DE\wdf01000.sys.mui
2014-04-16 08:41 . 2012-07-26 04:55 785512 ----a-w- c:\windows\system32\drivers\Wdf01000.sys
2014-04-16 08:41 . 2012-07-26 04:55 54376 ----a-w- c:\windows\system32\drivers\WdfLdr.sys
2014-04-16 08:41 . 2012-07-26 02:36 9728 ----a-w- c:\windows\system32\Wdfres.dll
2014-04-16 08:29 . 2010-02-23 08:16 294912 ----a-w- c:\windows\system32\browserchoice.exe
2014-04-16 08:03 . 2012-12-16 16:52 46080 ----a-w- c:\windows\system32\atmlib.dll
2014-04-16 08:03 . 2012-12-16 14:40 367616 ----a-w- c:\windows\system32\atmfd.dll
2014-04-16 08:03 . 2012-12-16 14:25 295424 ----a-w- c:\windows\SysWow64\atmfd.dll
2014-04-16 08:03 . 2012-12-16 14:25 34304 ----a-w- c:\windows\SysWow64\atmlib.dll
2014-04-16 08:02 . 2012-07-26 03:08 84992 ----a-w- c:\windows\system32\WUDFSvc.dll
2014-04-16 08:02 . 2012-07-26 03:08 194048 ----a-w- c:\windows\system32\WUDFPlatform.dll
2014-04-16 08:02 . 2012-07-26 02:26 87040 ----a-w- c:\windows\system32\drivers\WUDFPf.sys
2014-04-16 08:02 . 2012-07-26 02:26 198656 ----a-w- c:\windows\system32\drivers\WUDFRd.sys
2014-04-16 08:02 . 2012-07-26 03:08 229888 ----a-w- c:\windows\system32\WUDFHost.exe
2014-04-16 08:02 . 2012-07-26 03:08 744448 ----a-w- c:\windows\system32\WUDFx.dll
2014-04-16 08:02 . 2012-07-26 03:08 45056 ----a-w- c:\windows\system32\WUDFCoinstaller.dll
2014-04-16 07:56 . 2014-04-16 07:58 -------- d-----w- c:\windows\system32\MRT
2014-04-16 07:47 . 2012-03-01 06:54 22896 ----a-w- c:\windows\system32\drivers\fs_rec.sys
2014-04-16 07:47 . 2012-03-01 06:40 80896 ----a-w- c:\windows\system32\imagehlp.dll
2014-04-16 07:47 . 2012-03-01 05:45 158720 ----a-w- c:\windows\SysWow64\imagehlp.dll
2014-04-16 07:47 . 2012-03-01 06:35 5120 ----a-w- c:\windows\system32\wmi.dll
2014-04-16 07:47 . 2012-03-01 05:40 5120 ----a-w- c:\windows\SysWow64\wmi.dll
2014-04-16 07:35 . 2010-03-04 04:40 184832 ----a-w- c:\windows\system32\drivers\usbvideo.sys
2014-04-16 07:35 . 2010-03-04 04:32 243712 ----a-w- c:\windows\system32\drivers\ks.sys
2014-04-16 07:32 . 2012-06-16 05:25 850944 ----a-w- c:\windows\system32\jscript.dll
2014-04-16 07:32 . 2012-06-16 05:25 609792 ----a-w- c:\windows\system32\vbscript.dll
2014-04-16 07:32 . 2012-06-16 04:37 428032 ----a-w- c:\windows\SysWow64\vbscript.dll
2014-04-16 07:31 . 2011-04-29 03:13 461312 ----a-w- c:\windows\system32\drivers\srv.sys
2014-04-16 07:31 . 2011-04-29 03:12 399872 ----a-w- c:\windows\system32\drivers\srv2.sys
2014-04-16 07:31 . 2011-04-29 03:12 161792 ----a-w- c:\windows\system32\drivers\srvnet.sys
2014-04-16 07:31 . 2012-06-09 05:30 14165504 ----a-w- c:\windows\system32\shell32.dll
2014-04-16 07:29 . 2012-12-07 03:45 43520 ----a-w- c:\windows\system32\csrr.rs
2014-04-16 07:28 . 2012-11-09 05:34 2048 ----a-w- c:\windows\system32\tzres.dll
2014-04-16 07:27 . 2011-10-26 05:22 1572864 ----a-w- c:\windows\system32\quartz.dll
2014-04-16 07:21 . 2013-03-02 05:43 9377280 ----a-w- c:\windows\system32\mshtml.dll
2014-04-16 07:18 . 2012-04-07 12:18 3213824 ----a-w- c:\windows\system32\msi.dll
2014-04-16 07:18 . 2012-04-07 11:34 2342400 ----a-w- c:\windows\SysWow64\msi.dll
2014-04-16 07:15 . 2012-09-25 22:39 95744 ----a-w- c:\windows\system32\synceng.dll
2014-04-16 07:15 . 2012-09-25 21:55 78336 ----a-w- c:\windows\SysWow64\synceng.dll
2014-04-16 07:14 . 2012-04-02 05:26 1732096 ----a-w- c:\program files\Windows Journal\NBDoc.DLL
2014-04-16 07:14 . 2012-04-02 05:24 1367552 ----a-w- c:\program files\Common Files\Microsoft Shared\ink\journal.dll
2014-04-16 07:14 . 2012-04-02 04:40 936960 ----a-w- c:\program files (x86)\Common Files\Microsoft Shared\ink\journal.dll
2014-04-16 07:14 . 2012-04-02 05:24 1402880 ----a-w- c:\program files\Windows Journal\JNWDRV.dll
2014-04-16 07:14 . 2012-04-02 05:24 1393664 ----a-w- c:\program files\Windows Journal\JNTFiltr.dll
2014-04-16 07:14 . 2012-06-06 05:50 1425408 ----a-w- c:\program files\Common Files\System\ado\msado15.dll
2014-04-16 07:12 . 2013-03-19 06:19 5497688 ----a-w- c:\windows\system32\ntoskrnl.exe
2014-04-16 07:11 . 2011-11-17 07:14 1739160 ----a-w- c:\windows\system32\ntdll.dll
2014-04-16 07:11 . 2011-11-17 05:41 1292592 ----a-w- c:\windows\SysWow64\ntdll.dll
2014-04-16 07:11 . 2011-08-27 05:40 861184 ----a-w- c:\windows\system32\oleaut32.dll
2014-04-16 07:11 . 2011-08-27 05:40 331776 ----a-w- c:\windows\system32\oleacc.dll
2014-04-16 07:11 . 2011-08-27 04:43 571904 ----a-w- c:\windows\SysWow64\oleaut32.dll
2014-04-16 07:11 . 2011-08-27 04:43 233472 ----a-w- c:\windows\SysWow64\oleacc.dll
2014-04-16 07:11 . 2012-06-02 05:25 182272 ----a-w- c:\windows\system32\cryptsvc.dll
2014-04-16 07:11 . 2012-06-02 05:25 1462784 ----a-w- c:\windows\system32\crypt32.dll
2014-04-16 07:11 . 2012-06-02 05:25 140288 ----a-w- c:\windows\system32\cryptnet.dll
2014-04-16 07:11 . 2012-06-02 04:45 139264 ----a-w- c:\windows\SysWow64\cryptsvc.dll
2014-04-16 07:11 . 2012-06-02 04:45 1157632 ----a-w- c:\windows\SysWow64\crypt32.dll
2014-04-16 07:11 . 2012-06-02 04:45 103936 ----a-w- c:\windows\SysWow64\cryptnet.dll
2014-04-16 07:10 . 2011-11-19 15:07 77312 ----a-w- c:\windows\system32\packager.dll
2014-04-16 07:10 . 2011-11-19 14:06 67072 ----a-w- c:\windows\SysWow64\packager.dll
2014-04-16 06:59 . 2014-04-16 06:59 -------- d-----w- c:\program files\Microsoft Silverlight
2014-04-16 06:59 . 2014-04-16 06:59 -------- d-----w- c:\program files (x86)\Microsoft Silverlight
2014-04-16 06:56 . 2012-02-15 06:27 1031680 ----a-w- c:\windows\system32\rdpcore.dll
2014-04-16 06:56 . 2012-02-15 05:44 826368 ----a-w- c:\windows\SysWow64\rdpcore.dll
2014-04-16 06:56 . 2012-02-15 04:46 23552 ----a-w- c:\windows\system32\drivers\tdtcp.sys
2014-04-16 06:49 . 2012-06-02 22:19 57880 ----a-w- c:\windows\system32\wuauclt.exe
2014-04-16 06:49 . 2012-06-02 22:19 44056 ----a-w- c:\windows\system32\wups2.dll
2014-04-16 06:49 . 2012-06-02 22:15 2622464 ----a-w- c:\windows\system32\wucltux.dll
2014-04-16 06:49 . 2012-06-02 22:19 2428952 ----a-w- c:\windows\system32\wuaueng.dll
2014-04-16 06:48 . 2012-06-02 22:19 38424 ----a-w- c:\windows\system32\wups.dll
2014-04-16 06:48 . 2012-06-02 22:19 701976 ----a-w- c:\windows\system32\wuapi.dll
2014-04-16 06:48 . 2012-06-02 22:15 99840 ----a-w- c:\windows\system32\wudriver.dll
2014-04-16 06:48 . 2012-06-02 13:19 186752 ----a-w- c:\windows\system32\wuwebv.dll
2014-04-16 06:48 . 2012-06-02 13:15 36864 ----a-w- c:\windows\system32\wuapp.exe
2014-04-14 20:12 . 2014-04-14 20:12 110080 ----a-r- c:\users\Tobias\AppData\Roaming\Microsoft\Installer\{1F7E4FF9-D2E5-4258-9AE1-E16E6CB3252A}\IconF7A21AF7.exe
2014-04-14 20:12 . 2014-04-14 20:12 110080 ----a-r- c:\users\Tobias\AppData\Roaming\Microsoft\Installer\{1F7E4FF9-D2E5-4258-9AE1-E16E6CB3252A}\IconD7F16134.exe
2014-04-14 20:12 . 2014-04-14 20:12 110080 ----a-r- c:\users\Tobias\AppData\Roaming\Microsoft\Installer\{1F7E4FF9-D2E5-4258-9AE1-E16E6CB3252A}\Icon1226A4C5.exe
2014-04-14 20:12 . 2014-04-14 20:12 -------- d-----w- C:\sh4ldr
2014-04-14 20:12 . 2014-04-14 20:12 -------- d-----w- c:\program files\Enigma Software Group
2014-04-14 20:12 . 2014-04-14 20:35 -------- d-----w- c:\windows\1F7E4FF9D2E542589AE1E16E6CB3252A.TMP
2014-04-14 20:12 . 2014-04-14 20:12 -------- d-----w- c:\program files (x86)\Common Files\Wise Installation Wizard
2014-04-14 19:56 . 2014-04-16 10:10 -------- d-----w- C:\AdwCleaner
2014-04-14 19:34 . 2014-04-16 09:24 119512 ----a-w- c:\windows\system32\drivers\MBAMSwissArmy.sys
2014-04-14 19:34 . 2014-04-14 19:34 -------- d-----w- c:\program files (x86)\Malwarebytes Anti-Malware
2014-04-14 19:34 . 2014-04-03 07:51 63192 ----a-w- c:\windows\system32\drivers\mwac.sys
2014-04-14 19:34 . 2014-04-03 07:51 88280 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys
2014-04-14 19:34 . 2014-04-03 07:50 25816 ----a-w- c:\windows\system32\drivers\mbam.sys
2014-04-14 12:51 . 2014-04-14 12:51 -------- d-----w- c:\users\Tobias\AppData\Local\com
2014-04-14 12:51 . 2014-04-16 12:11 -------- d-----w- c:\program files (x86)\Uninstaller
2014-03-27 16:59 . 2014-04-04 20:15 -------- d-----w- c:\users\Tobias\AppData\Roaming\TS3Client
2014-03-27 16:58 . 2014-03-27 16:58 -------- d-----w- c:\users\Tobias\AppData\Local\TeamSpeak 3 Client
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-03-11 18:40 . 2012-04-11 17:43 71048 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2014-03-11 18:40 . 2012-04-11 17:43 692616 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2014-02-17 18:40 . 2014-02-17 18:40 27760 ----a-w- c:\windows\system32\drivers\ggsemc.sys
2014-02-17 18:40 . 2014-02-17 18:40 14448 ----a-w- c:\windows\system32\drivers\ggflt.sys
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2014-02-25 689744]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R3 AdobeActiveFileMonitor8.0;Adobe Active File Monitor V8;c:\program files (x86)\Adobe\Elements Organizer 8.0\PhotoshopElementsFileAgent.exe;c:\program files (x86)\Adobe\Elements Organizer 8.0\PhotoshopElementsFileAgent.exe [x]
R3 btwampfl;Bluetooth AMP USB Filter;c:\windows\system32\drivers\btwampfl.sys;c:\windows\SYSNATIVE\drivers\btwampfl.sys [x]
R3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys;c:\windows\SYSNATIVE\DRIVERS\btwl2cap.sys [x]
R3 esgiguard;esgiguard;c:\program files\Enigma Software Group\SpyHunter\esgiguard.sys;c:\program files\Enigma Software Group\SpyHunter\esgiguard.sys [x]
R3 ggflt;SEMC USB Flash Driver Filter;c:\windows\system32\DRIVERS\ggflt.sys;c:\windows\SYSNATIVE\DRIVERS\ggflt.sys [x]
R3 s1029bus;Sony Ericsson Device 1029 driver (WDM);c:\windows\system32\DRIVERS\s1029bus.sys;c:\windows\SYSNATIVE\DRIVERS\s1029bus.sys [x]
R3 s1029mdfl;Sony Ericsson Device 1029 USB WMC Modem Filter;c:\windows\system32\DRIVERS\s1029mdfl.sys;c:\windows\SYSNATIVE\DRIVERS\s1029mdfl.sys [x]
R3 s1029mdm;Sony Ericsson Device 1029 USB WMC Modem Driver;c:\windows\system32\DRIVERS\s1029mdm.sys;c:\windows\SYSNATIVE\DRIVERS\s1029mdm.sys [x]
R3 s1029mgmt;Sony Ericsson Device 1029 USB WMC Device Management Drivers (WDM);c:\windows\system32\DRIVERS\s1029mgmt.sys;c:\windows\SYSNATIVE\DRIVERS\s1029mgmt.sys [x]
R3 s1029nd5;Sony Ericsson Device 1029 USB Ethernet Emulation (NDIS);c:\windows\system32\DRIVERS\s1029nd5.sys;c:\windows\SYSNATIVE\DRIVERS\s1029nd5.sys [x]
R3 s1029obex;Sony Ericsson Device 1029 USB WMC OBEX Interface;c:\windows\system32\DRIVERS\s1029obex.sys;c:\windows\SYSNATIVE\DRIVERS\s1029obex.sys [x]
R3 s1029unic;Sony Ericsson Device 1029 USB Ethernet Emulation (WDM);c:\windows\system32\DRIVERS\s1029unic.sys;c:\windows\SYSNATIVE\DRIVERS\s1029unic.sys [x]
R3 SOHCImp;VAIO Media plus Content Importer;c:\program files (x86)\Common Files\Sony Shared\SOHLib\SOHCImp.exe;c:\program files (x86)\Common Files\Sony Shared\SOHLib\SOHCImp.exe [x]
R3 SOHDms;VAIO Media plus Digital Media Server;c:\program files (x86)\Common Files\Sony Shared\SOHLib\SOHDms.exe;c:\program files (x86)\Common Files\Sony Shared\SOHLib\SOHDms.exe [x]
R3 SOHDs;VAIO Media plus Device Searcher;c:\program files (x86)\Common Files\Sony Shared\SOHLib\SOHDs.exe;c:\program files (x86)\Common Files\Sony Shared\SOHLib\SOHDs.exe [x]
R3 Sony PC Companion;Sony PC Companion;c:\program files (x86)\Sony\Sony PC Companion\PCCService.exe;c:\program files (x86)\Sony\Sony PC Companion\PCCService.exe [x]
R3 SpfService;VAIO Entertainment Common Service;c:\program files\Common Files\Sony Shared\VAIO Entertainment Platform\SPF\SpfService64.exe;c:\program files\Common Files\Sony Shared\VAIO Entertainment Platform\SPF\SpfService64.exe [x]
R3 VCFw;VAIO Content Folder Watcher;c:\program files (x86)\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe;c:\program files (x86)\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe [x]
R3 VcmIAlzMgr;VAIO Content Metadata Intelligent Analyzing Manager;c:\program files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe;c:\program files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe [x]
R3 VcmINSMgr;VAIO Content Metadata Intelligent Network Service Manager;c:\program files\Sony\VCM Intelligent Network Service Manager\VcmINSMgr.exe;c:\program files\Sony\VCM Intelligent Network Service Manager\VcmINSMgr.exe [x]
R3 VcmXmlIfHelper;VAIO Content Metadata XML Interface;c:\program files\Common Files\Sony Shared\VcmXml\VcmXmlIfHelper64.exe;c:\program files\Common Files\Sony Shared\VcmXml\VcmXmlIfHelper64.exe [x]
R4 AntiVirWebService;Avira Browser-Schutz;c:\program files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE;c:\program files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [x]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe;c:\program files\Windows Live\Mesh\wlcrasvc.exe [x]
S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys;c:\windows\SYSNATIVE\Drivers\PxHlpa64.sys [x]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys;c:\windows\SYSNATIVE\DRIVERS\avkmgr.sys [x]
S2 AntiVirSchedulerService;Avira Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [x]
S2 cvhsvc;Client Virtualization Handler;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [x]
S2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [x]
S2 PMBDeviceInfoProvider;PMBDeviceInfoProvider;c:\program files (x86)\Sony\PMB\PMBDeviceInfoProvider.exe;c:\program files (x86)\Sony\PMB\PMBDeviceInfoProvider.exe [x]
S2 rimspci;rimspci;c:\windows\system32\drivers\rimssne64.sys;c:\windows\SYSNATIVE\drivers\rimssne64.sys [x]
S2 risdsnpe;risdsnpe;c:\windows\system32\drivers\risdsne64.sys;c:\windows\SYSNATIVE\drivers\risdsne64.sys [x]
S2 SampleCollector;VAIO Care Performance Service;c:\program files\Sony\VAIO Care\VCPerfService.exe;c:\program files\Sony\VAIO Care\VCPerfService.exe [x]
S2 sftlist;Application Virtualization Client;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe [x]
S2 uCamMonitor;CamMonitor;c:\program files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe;c:\program files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe [x]
S2 UNS;Intel(R) Management & Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [x]
S2 VAIO Power Management;VAIO Power Management;c:\program files\Sony\VAIO Power Management\SPMService.exe;c:\program files\Sony\VAIO Power Management\SPMService.exe [x]
S2 VSNService;VSNService;c:\program files\Sony\VAIO Smart Network\VSNService.exe;c:\program files\Sony\VAIO Smart Network\VSNService.exe [x]
S3 ArcSoftKsUFilter;ArcSoft Magic-I Visual Effect;c:\windows\system32\DRIVERS\ArcSoftKsUFilter.sys;c:\windows\SYSNATIVE\DRIVERS\ArcSoftKsUFilter.sys [x]
S3 HECIx64;Intel(R) Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys;c:\windows\SYSNATIVE\DRIVERS\HECIx64.sys [x]
S3 Impcd;Impcd;c:\windows\system32\drivers\Impcd.sys;c:\windows\SYSNATIVE\drivers\Impcd.sys [x]
S3 IntcDAud;Intel(R) Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys;c:\windows\SYSNATIVE\DRIVERS\IntcDAud.sys [x]
S3 NETw5s64;Intel(R) Wireless WiFi Link der Serie 5000 Adaptertreiber für Windows 7 64-Bit;c:\windows\system32\DRIVERS\NETw5s64.sys;c:\windows\SYSNATIVE\DRIVERS\NETw5s64.sys [x]
S3 SFEP;Sony Firmware Extension Parser;c:\windows\system32\DRIVERS\SFEP.sys;c:\windows\SYSNATIVE\DRIVERS\SFEP.sys [x]
S3 Sftfs;Sftfs;c:\windows\system32\DRIVERS\Sftfslh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftfslh.sys [x]
S3 Sftplay;Sftplay;c:\windows\system32\DRIVERS\Sftplaylh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftplaylh.sys [x]
S3 Sftredir;Sftredir;c:\windows\system32\DRIVERS\Sftredirlh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftredirlh.sys [x]
S3 Sftvol;Sftvol;c:\windows\system32\DRIVERS\Sftvollh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftvollh.sys [x]
S3 sftvsa;Application Virtualization Service Agent;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [x]
S3 VUAgent;VUAgent;c:\program files\Sony\VAIO Update\VUAgent.exe;c:\program files\Sony\VAIO Update\VUAgent.exe [x]
S3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x64.sys;c:\windows\SYSNATIVE\DRIVERS\yk62x64.sys [x]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2014-04-14 06:15 1077576 ----a-w- c:\program files (x86)\Google\Chrome\Application\34.0.1847.116\Installer\chrmstp.exe
.
Inhalt des "geplante Tasks" Ordners
.
2014-04-19 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-11 18:40]
.
2014-04-19 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-03-21 12:10]
.
2014-04-19 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-03-21 12:10]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2010-06-24 161304]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2010-06-24 386584]
"Persistence"="c:\windows\system32\igfxpers.exe" [2010-06-24 413208]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2010-05-31 10775584]
"RtHDVBg"="c:\program files\Realtek\Audio\HDA\RAVBg64.exe" [2010-05-31 2040352]
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.bing.com
mDefault_Search_URL = www.google.com
mDefault_Page_URL = www.google.com
mStart Page = www.google.com
mLocal Page = c:\windows\SysWOW64\blank.htm
mSearch Page = hxxp://www.google.com
uInternet Settings,ProxyOverride = <local>
mCustomizeSearch = www.google.com
mSearchAssistant = www.google.com
LSP: c:\program files (x86)\Avira\AntiVir Desktop\avsda.dll
TCP: DhcpNameServer = 192.168.178.1
FF - ProfilePath - c:\users\Tobias\AppData\Roaming\Mozilla\Firefox\Profiles\zj7k2cf7.default-1397651436204\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/firefox
FF - prefs.js: keyword.URL - hxxp://www.google.com/search?ie=UTF-8&oe=utf-8&q=
FF - ExtSQL: !HIDDEN! 2012-10-01 17:14; {9A207F60-3F1C-4ED0-972D-0A4CDFBFF803}; c:\users\Tobias\AppData\Roaming\14001.014
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
HKLM-Run-Apoint - c:\program files (x86)\Apoint\Apoint.exe
.
.
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\SampleCollector]
"ImagePath"="\"c:\program files\Sony\VAIO Care\VCPerfService.exe\" \"/service\" \"/sstates\" \"/sampleinterval=2000\" \"/procinterval=5\" \"/dllinterval=120\" \"/counter=\Processor(_Total)\% Processor Time:1/counter=\PhysicalDisk(_Total)\Disk Bytes/sec:1\" \"/counter=\Network Interface(*)\Bytes Total/sec:1\" \"/expandcounter=\Processor Information(*)\Processor Frequency:1\" \"/expandcounter=\Processor(*)\% Idle Time:1\" \"/expandcounter=\Processor(*)\% C1 Time:1\" \"/expandcounter=\Processor(*)\% C2 Time:1\" \"/expandcounter=\Processor(*)\% C3 Time:1\" \"/expandcounter=\Processor(*)\% Processor Time:1\" \"/directory=inteldata\""
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\S-1-5-21-743936060-2551989276-117965385-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eml\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLiveMail.Email.1"
.
[HKEY_USERS\S-1-5-21-743936060-2551989276-117965385-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vcf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLiveMail.VCard.1"
.
[HKEY_LOCAL_MACHINE\software\McAfee]
"SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
00,5c,00,6d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,6f,00,66,00,\
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2014-04-19 15:18:39
ComboFix-quarantined-files.txt 2014-04-19 13:18
.
Vor Suchlauf: 18 Verzeichnis(se), 345.614.782.464 Bytes frei
Nach Suchlauf: 19 Verzeichnis(se), 345.967.403.008 Bytes frei
.
- - End Of File - - 623A33CD26C44780059680C0BF47AF00
|
FRST 32-Bit | FRST 64-Bit
Malwarebytes Anti-Malware 
AdwCleaner auf deinen Desktop.
SecurityCheck und:
WARNUNG an die MITLESER: 
