ComboFix 11-06-10.09 - Tamox 11.06.2011 8:13.3.2 - x64 Microsoft Windows 7 Ultimate 6.1.7600.0.1252.49.1031.18.4095.2427 [GMT 2:00] ausgeführt von:: c:\users\Tamox\Desktop\cofi.exe AV: avast! Internet Security *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C} FW: avast! Internet Security *Disabled* {131692B0-0864-D491-4E21-3A3A1D8BBB47} SP: avast! Internet Security *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681} SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . . ((((((((((((((((((((((( Dateien erstellt von 2011-05-11 bis 2011-06-11 )))))))))))))))))))))))))))))) . . 2011-06-11 06:26 . 2011-06-11 06:26 -------- d-----w- c:\users\Default\AppData\Local\temp 2011-06-11 05:15 . 2011-06-11 05:30 -------- d-----w- C:\Combo-Fix 2011-06-11 04:50 . 2011-06-11 04:50 -------- d-----w- c:\users\Tamox\AppData\Local\{1ADAB03A-BBCD-4447-AE8E-0150E31C21F4} 2011-06-10 15:10 . 2011-05-09 22:00 8718160 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{983EBC47-C7A2-4016-BECD-FFB8E260C5E1}\mpengine.dll 2011-06-10 15:06 . 2011-06-10 15:06 -------- d-----w- c:\users\Tamox\AppData\Local\{1B785AFA-7042-4997-A740-10CE218A1B8B} 2011-06-09 15:52 . 2011-06-09 15:53 -------- d-----w- c:\users\Tamox\AppData\Local\{917A7BD7-D743-4968-B1DD-F0BCCA118F88} 2011-06-08 23:28 . 2011-06-08 23:28 22 --sha-w- c:\windows\Sys3390 SettingsCollection.bin 2011-06-08 23:28 . 2011-06-08 23:28 22 --sha-w- c:\users\Tamox\AppData\Roaming\Sys6925.Config Collection.sys 2011-06-08 23:28 . 2011-06-08 23:45 -------- d-----w- c:\program files (x86)\jv16 PowerTools 2010 2011-06-08 23:23 . 2011-06-08 23:23 -------- d-----w- c:\program files (x86)\FlashFXP 4 2011-06-08 22:53 . 2011-06-09 01:42 -------- d-----w- C:\sfzone_profile 2011-06-08 22:43 . 2011-02-23 13:57 280408 ----a-w- c:\windows\system32\drivers\aswSP.sys 2011-06-08 22:43 . 2011-02-23 13:54 22360 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys 2011-06-08 22:43 . 2011-02-23 13:57 127320 ----a-w- c:\windows\system32\drivers\aswFW.sys 2011-06-08 22:43 . 2011-02-23 13:56 253784 ----a-w- c:\windows\system32\drivers\aswNdis2.sys 2011-06-08 22:43 . 2011-02-23 13:55 31064 ----a-w- c:\windows\system32\drivers\aswRdr.sys 2011-06-08 22:43 . 2011-02-23 13:55 53592 ----a-w- c:\windows\system32\drivers\aswTdi.sys 2011-06-08 22:42 . 2011-02-23 13:57 505176 ----a-w- c:\windows\system32\drivers\aswSnx.sys 2011-06-08 22:42 . 2011-02-23 13:55 64344 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys 2011-06-08 22:42 . 2011-02-23 14:04 238968 ----a-w- c:\windows\system32\aswBoot.exe 2011-06-08 22:42 . 2011-02-23 12:34 12368 ----a-w- c:\windows\system32\drivers\aswNdis.sys 2011-06-08 22:42 . 2011-02-23 14:04 40648 ----a-w- c:\windows\avastSS.scr 2011-06-08 22:42 . 2011-02-23 14:04 190016 ----a-w- c:\windows\SysWow64\aswBoot.exe 2011-06-08 22:42 . 2011-06-08 22:42 -------- d-----w- c:\programdata\AVAST Software 2011-06-08 22:42 . 2011-06-08 22:42 -------- d-----w- c:\program files\AVAST Software 2011-06-08 21:33 . 2011-06-08 21:33 -------- d-----w- c:\programdata\Simply Super Software 2011-06-08 20:36 . 2011-06-08 23:11 -------- d-----w- c:\program files (x86)\Trojan Remover 2011-06-08 19:15 . 2011-05-29 07:11 39984 ----a-w- c:\windows\SysWow64\drivers\mbamswissarmy.sys 2011-06-08 19:15 . 2011-06-08 19:15 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware 2011-06-08 18:42 . 2011-06-08 18:42 -------- d-----w- c:\users\Tamox\AppData\Local\{B3563941-E545-474C-AEF4-219C7697D8F8} 2011-06-08 06:26 . 2011-06-08 06:26 -------- d-----w- c:\windows\SysWow64\wbem\en-US 2011-06-08 06:26 . 2011-06-08 06:26 -------- d-----w- c:\windows\system32\wbem\en-US 2011-06-08 05:35 . 2011-06-08 05:36 -------- d-----w- c:\users\Tamox\AppData\Local\{06EA3A80-F797-4AEE-88E4-9A22D0B9305A} 2011-06-07 17:14 . 2011-06-07 17:14 -------- d-----w- c:\users\Tamox\AppData\Local\{675A5E10-CB07-4F69-9642-F3A986FA8E35} 2011-06-06 16:33 . 2011-06-06 16:34 -------- d-----w- c:\program files\iTunes 2011-06-06 16:33 . 2011-06-06 16:34 -------- d-----w- c:\program files (x86)\iTunes 2011-06-06 16:33 . 2011-06-06 16:33 -------- d-----w- c:\program files\iPod 2011-06-06 16:31 . 2011-06-06 16:31 -------- d-----w- c:\program files\Bonjour 2011-06-06 16:31 . 2011-06-06 16:31 -------- d-----w- c:\program files (x86)\Bonjour 2011-06-06 16:27 . 2011-06-06 16:27 -------- d-----w- c:\program files (x86)\Safari 2011-06-06 15:58 . 2011-06-06 15:59 -------- d-----w- c:\users\Tamox\AppData\Local\{032C56BC-2FBC-42ED-A7B3-C4815C8AA9DB} 2011-06-05 19:16 . 2011-06-05 19:16 -------- d-----w- c:\users\Tamox\AppData\Local\{FBEAEEA0-919C-43E7-8AD2-D97A8963A344} 2011-06-04 16:02 . 2011-06-04 16:02 -------- d-----w- c:\users\Tamox\AppData\Local\{32E9494D-F0AA-408D-901F-18C8173D802E} 2011-06-04 04:01 . 2011-06-04 04:02 -------- d-----w- c:\users\Tamox\AppData\Local\{E78D7B8C-9D73-4D69-895B-C4872122C83D} 2011-06-03 16:01 . 2011-06-03 16:01 -------- d-----w- c:\users\Tamox\AppData\Local\{B2688BED-7EB0-4497-8EAD-A6C1E0D2A6C4} 2011-06-02 15:22 . 2011-06-02 15:24 -------- d-----w- c:\users\Tamox\AppData\Local\{16D3D112-96EA-465D-901D-BD138644B05F} 2011-06-01 15:26 . 2011-06-01 15:26 -------- d-----w- c:\users\Tamox\AppData\Local\{6B9CD5CE-AB8F-4CAD-B7AE-CF9E22B6235A} 2011-05-31 16:46 . 2011-05-31 16:46 -------- d-----w- c:\users\Tamox\AppData\Local\{B80D0E0E-A3C3-44F7-B4E1-7B9A026B0610} 2011-05-30 22:04 . 2011-05-30 22:04 -------- d-----w- c:\users\Tamox\AppData\Local\{7492F721-938C-46AD-84D0-E13626DAA654} 2011-05-30 09:56 . 2011-05-30 09:56 -------- d-----w- c:\program files (x86)\SlySoft 2011-05-30 09:03 . 2011-05-30 09:04 -------- d-----w- c:\users\Tamox\AppData\Local\{4297E01D-843F-42E3-BF0F-926454EB90A1} 2011-05-29 17:42 . 2011-05-29 17:42 -------- d-----w- c:\users\Tamox\AppData\Local\{E34D486B-7DA5-4C7B-B82A-1C13811B06D3} 2011-05-28 08:39 . 2011-05-28 20:40 -------- d-----w- c:\users\Tamox\AppData\Local\{9504AD22-D1E9-47EB-9D6D-A11E8ED97803} 2011-05-27 16:05 . 2011-05-27 16:05 -------- d-----w- c:\program files (x86)\YouTube Downloader 2011-05-27 13:55 . 2011-05-27 13:56 -------- d-----w- c:\users\Tamox\AppData\Local\{2D1EF79F-24EB-457D-8FE2-91319EF18450} 2011-05-26 12:10 . 2011-05-26 12:11 -------- d-----w- c:\users\Tamox\AppData\Local\{4C985DC2-6161-4C34-B8DB-D504690898B3} 2011-05-25 12:14 . 2011-04-22 20:18 27008 ----a-w- c:\windows\system32\drivers\Diskdump.sys 2011-05-25 12:10 . 2011-05-25 12:10 -------- d-----w- c:\users\Tamox\AppData\Local\{4F63DD91-9699-490B-B62E-7302A0E9DDE3} 2011-05-24 17:21 . 2011-05-24 17:21 -------- d-----w- c:\users\Tamox\AppData\Local\{18CB0150-084C-462A-B7DB-E9BAE6D584A9} 2011-05-24 15:02 . 2011-04-09 06:58 142336 ----a-w- c:\windows\system32\poqexec.exe 2011-05-24 15:02 . 2011-04-09 05:56 123904 ----a-w- c:\windows\SysWow64\poqexec.exe 2011-05-24 14:58 . 2011-05-24 14:58 404640 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl 2011-05-24 05:21 . 2011-05-24 05:21 -------- d-----w- c:\users\Tamox\AppData\Local\{3E623728-654A-46D3-80FA-464C1264C64F} 2011-05-23 15:41 . 2011-05-23 15:41 -------- d-----w- c:\users\Tamox\AppData\Local\{86BF1BB9-8F79-4175-997A-DD649419AF7E} 2011-05-22 09:21 . 2011-05-22 09:21 -------- d-----w- c:\users\Tamox\AppData\Local\{704B5014-9F97-4F05-AC8A-9EE10CFC7760} 2011-05-21 10:09 . 2011-05-21 10:09 -------- d-----w- c:\users\Tamox\AppData\Local\{2AB559B0-B056-4E24-BC66-A96688F926E5} 2011-05-20 10:23 . 2011-05-20 10:23 -------- d-----w- c:\users\Tamox\AppData\Local\{81EA3D74-A526-4D8E-9861-D794FEC0D48D} 2011-05-19 11:49 . 2011-05-19 11:49 -------- d-----w- c:\users\Tamox\AppData\Local\{C79902C9-9784-40F0-9018-514EA14AB70F} 2011-05-18 11:15 . 2011-05-18 11:15 -------- d-----w- c:\users\Tamox\AppData\Local\{5736A17D-013C-46E6-8C28-89CF98391DEB} 2011-05-17 09:08 . 2011-05-17 09:08 -------- d-----w- c:\users\Tamox\AppData\Local\{FA3E0DC5-BFE2-4079-AF8E-3A394F31F16E} 2011-05-16 07:46 . 2011-05-16 07:46 -------- d-----w- c:\users\Tamox\AppData\Local\{5BE1AF97-E42A-488D-A6D1-D13B68002658} 2011-05-14 09:01 . 2011-05-14 09:01 -------- d-----w- c:\users\Tamox\AppData\Local\{A0C9BD11-E3F4-485D-A3E2-E91DC6FA3F1D} 2011-05-13 10:20 . 2011-05-13 10:20 -------- d-----w- c:\users\Tamox\AppData\Local\{112C2D78-A532-462F-9567-A189D52A1F8A} 2011-05-12 12:25 . 2011-05-12 12:25 -------- d-----w- c:\users\Tamox\AppData\Local\{56379F58-E27C-4641-9248-DB2BE4B8570D} . . . (((((((((((((((((((((((((((((((((((( Find3M Bericht )))))))))))))))))))))))))))))))))))))))))))))))))))))) . 2011-05-29 07:11 . 2011-02-20 09:02 25912 ----a-w- c:\windows\system32\drivers\mbam.sys 2011-04-25 00:08 . 2011-04-25 00:08 3106656 ----a-w- c:\windows\system32\AutoPartNt.exe 2011-04-13 22:40 . 2011-04-13 22:40 4284416 ----a-w- c:\windows\SysWow64\GPhotos.scr 2011-04-09 06:45 . 2011-05-11 10:22 5509504 ----a-w- c:\windows\system32\ntoskrnl.exe 2011-04-09 06:13 . 2011-05-11 10:22 3957632 ----a-w- c:\windows\SysWow64\ntkrnlpa.exe 2011-04-09 06:13 . 2011-05-11 10:22 3901824 ----a-w- c:\windows\SysWow64\ntoskrnl.exe 2011-04-06 14:26 . 2011-04-06 14:26 96544 ----a-w- c:\windows\system32\dnssd.dll 2011-04-06 14:26 . 2011-04-06 14:26 69408 ----a-w- c:\windows\system32\jdns_sd.dll 2011-04-06 14:26 . 2011-04-06 14:26 237856 ----a-w- c:\windows\system32\dnssdX.dll 2011-04-06 14:26 . 2011-04-06 14:26 119584 ----a-w- c:\windows\system32\dns-sd.exe 2011-04-06 14:20 . 2011-04-06 14:20 91424 ----a-w- c:\windows\SysWow64\dnssd.dll 2011-04-06 14:20 . 2011-04-06 14:20 75040 ----a-w- c:\windows\SysWow64\jdns_sd.dll 2011-04-06 14:20 . 2011-04-06 14:20 197920 ----a-w- c:\windows\SysWow64\dnssdX.dll 2011-04-06 14:20 . 2011-04-06 14:20 107808 ----a-w- c:\windows\SysWow64\dns-sd.exe 2011-03-29 07:08 . 2011-03-07 03:08 80896 ----a-w- c:\windows\SysWow64\ff_vfw.dll 2011-03-21 20:01 . 2011-02-20 09:13 82816 ----a-w- c:\users\Tamox\AppData\Roaming\pcouffin.sys 2011-03-18 11:46 . 2011-03-18 11:46 203144 ----a-w- c:\windows\SysWow64\ftd2xx.dll 2011-03-18 11:46 . 2011-03-18 11:46 74376 ----a-w- c:\windows\system32\drivers\ftdibus.sys 2011-03-18 11:46 . 2011-03-18 11:46 237960 ----a-w- c:\windows\system32\ftd2xx.dll 2011-03-18 11:46 . 2011-03-18 11:46 65416 ----a-w- c:\windows\system32\ftcserco.dll 2011-03-18 11:46 . 2011-03-18 11:46 108936 ----a-w- c:\windows\system32\ftbusui.dll 2011-03-18 11:46 . 2011-03-18 11:46 214920 ----a-w- c:\windows\system32\FTLang.dll 2011-03-18 11:46 . 2011-03-18 11:46 85384 ----a-w- c:\windows\system32\drivers\ftser2k.sys 2011-03-18 11:46 . 2011-03-18 11:46 55176 ----a-w- c:\windows\system32\ftserui2.dll . . (((((((((((((((((((((((((((( Autostartpunkte der Registrierung )))))))))))))))))))))))))))))))))))))))) . . *Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. REGEDIT4 . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "msnmsgr"="c:\program files (x86)\Windows Live\Messenger\msnmsgr.exe" [2010-11-10 4240760] "Rainlendar2"="c:\program files (x86)\Rainlendar2\Rainlendar2.exe" [2011-02-04 2346496] "uTorrent"="c:\program files (x86)\uTorrent\uTorrent.exe" [2011-03-19 396152] . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "Malwarebytes' Anti-Malware"="c:\program files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" [2011-05-29 449584] "avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2011-02-23 3451496] . c:\users\Tamox\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ Erinnerung.lnk - c:\program files (x86)\Erinnerung\erinnerung.exe [2011-2-25 135168] . c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ HP Digital Imaging Monitor.lnk - c:\program files (x86)\HP\Digital Imaging\bin\hpqtra08.exe [2009-9-20 270336] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 0 (0x0) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableLUA"= 0 (0x0) "EnableUIADesktopToggle"= 0 (0x0) "EnableLinkedConnections"= 1 (0x1) . [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager] BootExecute REG_MULTI_SZ autocheck autochk *\0OODBS . [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\run-] "vmware-tray"="c:\program files (x86)\VMware\VMware Workstation\vmware-tray.exe" "Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" "TrueImageMonitor.exe"="c:\program files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe" "SAOB Monitor"=c:\program files (x86)\Acronis\OnlineBackupStandalone\TrueImageMonitor.exe "Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" "iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" "CloneCDTray"="c:\program files (x86)\SlySoft\CloneCD\CloneCDTray.exe" /s "AppleSyncNotifier"=c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe "hpqSRMon"=c:\program files (x86)\HP\Digital Imaging\bin\hpqSRMon.exe . R2 ATE_PROCMON;ATE_PROCMON;c:\program files (x86)\Anti Trojan Elite\ATEPMon.sys [x] R2 avast! Firewall;avast! Firewall;c:\program files\AVAST Software\Avast\afwServ.exe [2011-02-23 121000] R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384] R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576] R3 androidusb;ADB Interface Driver;c:\windows\system32\Drivers\androidusb.sys [x] R3 INFUSB;INFUSB;c:\windows\system32\drivers\infusb_wlh_x64.sys [x] R3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files\Microsoft Office\Office14\GROOVE.EXE [2010-03-25 51456888] R3 ose64;Office 64 Source Engine;c:\program files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2010-01-09 174440] R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4925184] R3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL6.SYS [x] R3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV6.SYS [x] R3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT6.SYS [x] R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [x] R3 WatAdminSvc;Windows-Aktivierungstechnologieservice;c:\windows\system32\Wat\WatAdminSvc.exe [x] S0 aswNdis;avast! Firewall NDIS Filter Service;c:\windows\system32\DRIVERS\aswNdis.sys [x] S0 aswNdis2;avast! Firewall Core Firewall Service; [x] S0 tdrpman273;Acronis Try&Decide and Restore Points filter (build 273);c:\windows\system32\DRIVERS\tdrpm273.sys [x] S1 aswFW;avast! TDI Firewall driver; [x] S1 aswSnx;aswSnx; [x] S1 aswSP;aswSP; [x] S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x] S2 afcdpsrv;Acronis Nonstop Backup service;c:\program files (x86)\Common Files\Acronis\CDP\afcdpsrv.exe [2011-02-20 3975088] S2 aswFsBlk;aswFsBlk; [x] S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [x] S2 AWUS036H;AWUS036H;c:\program files (x86)\ALFA\AWUS036H Wireless LAN Utility\RtlService.exe [2009-06-30 40960] S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2011-05-29 366640] S2 OODefragAgent;O&O Defrag;c:\program files\OO Software\Defrag\oodag.exe [2010-08-24 3013448] S2 OS Selector;Acronis OS Selector activator;c:\program files (x86)\Acronis\DiskDirector\OSS\reinstall_svc.exe [2010-05-25 2139400] S2 TeamViewer6;TeamViewer 6;c:\program files (x86)\TeamViewer\Version6\TeamViewer_Service.exe [2011-03-01 2296696] S2 TuneUp.UtilitiesSvc;TuneUp Utilities Service;c:\program files (x86)\TuneUp Utilities 2011\TuneUpUtilitiesService64.exe [2010-10-26 1974080] S2 vmci;VMware vmci;c:\windows\system32\drivers\vmci.sys [x] S2 VMUSBArbService;VMware USB Arbitration Service;c:\program files (x86)\Common Files\VMware\USB\vmware-usbarbitrator.exe [2009-10-22 563760] S3 afcdp;afcdp;c:\windows\system32\DRIVERS\afcdp.sys [x] S3 CAXHWAZL;CAXHWAZL;c:\windows\system32\DRIVERS\CAXHWAZL.sys [x] S3 enecir;ENE CIR Receiver;c:\windows\system32\DRIVERS\enecir.sys [x] S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [x] S3 RTL8187;Realtek RTL8187 Wireless 802.11b/g 54Mbps USB 2.0 Network Adapter;c:\windows\system32\DRIVERS\RTL8187.sys [x] S3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;c:\program files (x86)\TuneUp Utilities 2011\TuneUpUtilitiesDriver64.sys [2010-10-07 11856] . . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost] hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc . Inhalt des "geplante Tasks" Ordners . 2011-06-11 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3572513325-1199987832-3120796489-1001Core.job - c:\users\Tamox\AppData\Local\Google\Update\GoogleUpdate.exe [2011-03-01 16:43] . 2011-06-11 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3572513325-1199987832-3120796489-1001UA.job - c:\users\Tamox\AppData\Local\Google\Update\GoogleUpdate.exe [2011-03-01 16:43] . . --------- x86-64 ----------- . . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast] @="{472083B0-C522-11CF-8763-00608CC02F24}" [HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}] 2011-02-23 14:04 134384 ----a-w- c:\program files\AVAST Software\Avast\ashShA64.dll . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SynTPStart"="c:\program files\Synaptics\SynTP\SynTPStart.exe" [2007-09-07 120320] "RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2011-02-24 11780712] . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "LoadAppInit_DLLs"=0x0 . HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs UxTuneUp . ------- Zusätzlicher Suchlauf ------- . uLocal Page = c:\windows\system32\blank.htm uStart Page = hxxp://www.google.de/ mLocal Page = c:\windows\SysWOW64\blank.htm uInternet Settings,ProxyOverride = *.local IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200 IE: An OneNote s&enden - c:\progra~1\MICROS~2\Office14\ONBttnIE.dll/105 IE: Nach Microsoft E&xcel exportieren - c:\progra~1\MICROS~2\Office14\EXCEL.EXE/3000 LSP: c:\program files (x86)\VMware\VMware Workstation\vsocklib.dll TCP: DhcpNameServer = 192.168.1.1 FF - ProfilePath - c:\users\Tamox\AppData\Roaming\Mozilla\Firefox\Profiles\uwhqne1t.default\ FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=ConduitEngine&SearchSource=3&q={searchTerms} FF - prefs.js: browser.search.selectedEngine - Google FF - prefs.js: browser.startup.homepage - hxxp://www.dark-sat-world.com/forum.php|http://www.cs-pirates.cc/forum.php|http://www.dragoncard.info/|http://bittorrentfiles.org/browse.php|http://www.boerse.bz/|http://premiere-cs.to/forum.php|http://vpscp1-md.spenelli.com:5353/login.php|http://www.sat-crew.info/wbb2/index.php|http://www.benm.at/|http://www.cccamforum.info/forum.php|http://www.navitotal.com/forums-de/index.php|http://www.s-b-m.host-tec.net/wbb2/index.php?sid=|http://geronimosden.com/index.php|http://www.cccamforum.com/forums/forumdisplay.php?f=6|http://www.dsbc.scorpion-team.to|http://www.8a8f8.com/ubbthreads.php/topics/1/secondstages#Post1|https://www.paypal.com/de/cgi-bin/webscr?cmd=_login-run|http://mail.genxxl.com/mail/|http://www.i-have-a-dreambox.com/wbb2/index.php|http://www.box-pirates.to/index.php|http://streamboard.gmc.to/wbb2/index.php|http://www.eurocardsharing.com/usercp.php|http://www.ascofun.cc/index.php|http://www.cardsharing.ws/cardsharing/private.php|http://www.digital-eliteboard.com/|http://www.satpalast.com/index.php|http://www.leecher.to/|http://www.postbank.de/|http://www.cw-share.com/forum.php|http://www.card-share.biz/|http://www.dreambox.info/dreamboxdb/|http://www.grenzgaenger-forum.de/forum/steuern-b2.0/|http://forum.thiazi.net/|https://www.dyndns.com/account/services/hosts/|http://www.inj-x.com/eshop/index.php|http://www.sat-ulc.eu/index.php?s=2aefd51d63c5e18ac681c1c8f61294b4&|http://cp.heihachi.net/cart.php?gid=10|http://www.sky.de/web/cms/de/stdlogout.jsp;jsessionid=BF006032F4A613D82069293F30ACB259.p-ng-tc3h11#|http://www.ebay.de/|http://www.volksbank-krp.de/|http://phoenix-tracker.ath.cx/browse.php|http://www.autoscout24.de/Home.aspx|https://login.i.daimler.com/internet/login?TYPE=33554432&REALMOID=06-90ad4bc0-0b7a-1058-8668-83ce79670cb3&GUID=&SMAUTHREASON=0&METHOD=GET&SMAGENTNAME=uRYLDKfFlXhBjNBAtzXavlWEpsiPMeCxBTymGXbvnrHVXqAKzh4oTU1sPa75nNGj&TARGET=$SM$https%3a%2f%2flogin.i.daimler.com%2feportal%2fportal%2f FF - prefs.js: keyword.URL - hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=2.0.0.4&q= FF - prefs.js: network.proxy.http_port - 80 FF - prefs.js: network.proxy.type - 0 FF - user.js: network.http.max-persistent-connections-per-server - 4 FF - user.js: nglayout.initialpaint.delay - 600 FF - user.js: content.notify.interval - 600000 FF - user.js: content.max.tokenizing.time - 1800000 FF - user.js: content.switch.threshold - 600000 FF - user.js: yahoo.homepage.dontask - true FF - user.js: network.proxy.type - 0 FF - user.js: network.proxy.http - user_pref(network.proxy.http_port,); FF - user.js: network.proxy.no_proxies_on - . - - - - Entfernte verwaiste Registrierungseinträge - - - - . WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file) AddRemove-Adobe Shockwave Player - c:\windows\system32\Adobe\Shockwave 11\uninstaller.exe AddRemove-INFUSBX86X64&104F&0001 - c:\windows\system32\Silabs\DriverUninstaller.exe USBXpress\INFUSBX86X64&104F&0001 . . . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\StarWindServiceAE] "ImagePath"="hex(2):25,50,72,6f,67,72,61,6d,20,46,69,6c,65,73,20,28,78,38,36,29,25,5c,41,6c,63,6f,68,6f,6c,20,53,6f,66,74,5c,41,6c,63,6f,68,6f,6c,20,31,32,30,5c,53,74,61,72,57,69,6e,64,5c,53,74,61,72,57,69,6e,64,53,65,72,76,69,63,65,41,45,2e,65,78,65,00" . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\services\StarWindServiceAE] "ImagePath"="hex(2):25,50,72,6f,67,72,61,6d,20,46,69,6c,65,73,20,28,78,38,36,29,25,5c,41,6c,63,6f,68,6f,6c,20,53,6f,66,74,5c,41,6c,63,6f,68,6f,6c,20,31,32,30,5c,53,74,61,72,57,69,6e,64,5c,53,74,61,72,57,69,6e,64,53,65,72,76,69,63,65,41,45,2e,65,78,65,00" . --------------------- Gesperrte Registrierungsschluessel --------------------- . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10c.exe,-101" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\LocalServer32] @="c:\\Windows\\SysWow64\\Macromed\\Flash\\FlashUtil10c.exe" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Shockwave Flash Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10c.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus] @="0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID] @="ShockwaveFlash.ShockwaveFlash.10" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10c.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="ShockwaveFlash.ShockwaveFlash" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Macromedia Flash Factory Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10c.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID] @="FlashFactory.FlashFactory.1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10c.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="FlashFactory.FlashFactory" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}] @Denied: (A 2) (Everyone) @="IFlashBroker3" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\System*] "OODEFRAG14.00.00.01PROFESSIONAL"="87AEBE6388D5041FF4735C885CEDF903D0A0F89AF2A7A32351F337992289CC635BEC07662B29AFB352655B31EF07CD7CB0BC25F67707952DF610A81444ECDECCE70A99DE74F2AF2416358FD6BAED56F23B6FC3E49F78D4B46B5F21A7183E12FC10FDA9D46A47EBD52F359F235E5EFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74C5D575E7D6A3B98089DB7CE019D40AA5C9DB7CE019D40AA5CA6171C11EC38DE3D9048CACAE3820C0D8FA920ACAD15BD15192C17A7829F0DB9BE1A5F8D42630E4505364331EA1CED0D64AA76794772A54D2FF6B00D6BF9FE9F2D7B9A900BBC69FC990F0D6E17DD9F4F6FA41AB0AC471B937A02E86D5BE3578FC485683F2E746710CC00C2D29069DCBC1017317D7E52767C603C966B85E0ABE51238E7D6936EFB43EBB871D4952294A3798158AEEE1DC5FD9A19FE4FB338C8E37315313739524FC11D6F1B8D7A326DB7366B9B38466F4B74B70F5F84BFF4ABAB9A25C965AF8E3C98565AB5BB24863E8EA2DC01AEDE577B9E9797E79B1D65864710F4B10B1E50523863B8AC408C5195236FE4FE4E28A801217232BCC7CC9EC0A3AD92D775BB0ED47664C9DC22428632D2221500F6A6F8B7815062746169F6F48F22122214D7FE3C0D4E52988A68DF09E0918262296FA1322D0F2D9C641E88F041F00BE9FCD11F3398E69A26C834D9C2F2ECC6F98EAFC1B671601FB5712B33B7CE6F997BE79EAE9A9B4BEFBE4CEF363C14337F0D6F253ABC04CB45324A661A00B64A5D18B3C933847AEA2390AC7A7A85B2B84F58BCA4B273FAA8327A58B525B359FEF975DEEE72B8FE0A88BE24C66FE3A0A85B8A091414BBD1A67DEAA7967EF17860963C10C07AB2D7BEF8DD0FD9A0CD957E4B4409708DABE6C6C1D3671A160DBF165F8810821AA2147751F8714DE1722A8ACF9F1B47918C7FDE1DF86C639E0BBA1A83EB4B0F666BAA71F00E6ED147B1DEF119A5BBBBD45BC21933912E2A0FA658BB376CD252B6A4F4423D8DD227A91F93AD5D568E8752C93BF1294A473C22CE6E1DB281DACF289A30D09F600BA6A682118A55A4DAF2C73E583CAA44F9F958263535AF1A3D9A1ACB7C5884DDA8371F5B7FA8BFF68ADF3851EE9DE51329567483494F6E1676DC326C616A5BD5625838D66FFD5D28ADBF68D1B4900EBCDB597CF0A98934C9A7D356E347699A89129D5ADBD2527409F69AE3BF45E1D93F3FA13D2CBBD647FE95D0B3CD7A0DB8AFB4AC3402FEC2CEDA3C8A77D02033038A22DC4528C7FE73F2A9B93BF82EE1B471EC3EB696AE40B9D5F841B7EE2AFA498279D0E58C7B1B8856EF0620E877C70D6C01229519000F85234D00F738A8836E7D5C55B932E41BDA4E1AC4DAD6CEF048B3D9BA4B3E77C80A63F99ED37DC868B9C987D619A87A4140747B9628AC92666E" . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\PCW\Security] @Denied: (Full) (Everyone) . Zeit der Fertigstellung: 2011-06-11 08:50:51 ComboFix-quarantined-files.txt 2011-06-11 06:50 . Vor Suchlauf: 14 Verzeichnis(se), 38.603.390.976 Bytes frei Nach Suchlauf: 22 Verzeichnis(se), 38.450.073.600 Bytes frei . - - End Of File - - 2497D5E23FC22F5CA311E582D7F2B476