ComboFix 15-11-30.01 - SatchmoPC 01.12.2015 20:10:56.2.2 - x86
ausgeführt von:: c:\dokumente und einstellungen\SatchmoPC\Eigene Dateien\Downloads\ComboFix.exe
* Neuer Wiederherstellungspunkt wurde erstellt
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\dokume~1\SATCHM~1\LOKALE~1\Temp\avgnt.exe\Avira.OE.ExtApi.dll
c:\dokumente und einstellungen\SatchmoPC\Lokale Einstellungen\Temp\avgnt.exe\Avira.OE.ExtApi.dll
C:\Thumbs.db
c:\winxp\wininit.ini
.
.
((((((((((((((((((((((( Dateien erstellt von 2015-11-01 bis 2015-12-01 ))))))))))))))))))))))))))))))
.
.
2015-12-01 17:35 . 2015-12-01 17:35 -------- d-----w- C:\AdwCleaner
2015-11-28 09:00 . 2009-01-24 15:36 103424 ----a-w- c:\winxp\system32\drivers\qcserxp.sys
2015-11-28 09:00 . 2015-11-28 09:00 -------- d-----w- c:\programme\Spirent Communications
2015-11-21 12:43 . 2015-11-21 12:43 -------- d-----w- c:\dokumente und einstellungen\Administrator.BIE.000\Lokale Einstellungen\Anwendungsdaten\Mozilla
2015-11-21 09:59 . 2015-11-21 09:59 -------- d-----w- c:\dokumente und einstellungen\Administrator.BIE.000\Anwendungsdaten\Avira
2015-11-19 19:44 . 2015-11-19 19:48 -------- d-----w- C:\Best of Helene Fischer
2015-11-19 19:33 . 2015-11-20 19:06 -------- d-----w- c:\dokumente und einstellungen\SatchmoPC\Lokale Einstellungen\Anwendungsdaten\ARworks
2015-11-19 19:33 . 2015-11-19 19:34 -------- d--h--w- c:\dokumente und einstellungen\All Users\Anwendungsdaten\{F85DB747-9498-4432-9694-1D2DEF955232}
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2015-11-19 19:28 . 2012-04-12 16:17 780488 ----a-w- c:\winxp\system32\FlashPlayerApp.exe
2015-11-19 19:28 . 2011-06-16 16:51 142536 ----a-w- c:\winxp\system32\FlashPlayerCPLApp.cpl
2015-09-27 09:35 . 2013-08-08 17:22 108448 ----a-w- c:\winxp\system32\drivers\avgntflt.sys
2008-10-11 13:03 . 2012-10-21 18:13 24576 ----a-w- c:\programme\memtest.exe
2014-02-13 12:20 3057808 --sha-r- c:\winxp\system32\avcodec-lav-55.dll
2014-02-13 12:20 98960 --sha-r- c:\winxp\system32\avfilter-lav-3.dll
2014-02-13 12:20 539280 --sha-r- c:\winxp\system32\avformat-lav-55.dll
2009-09-27 07:39 415744 --sh--w- c:\winxp\system32\avisynth.dll
2014-02-13 12:20 59536 --sha-r- c:\winxp\system32\avresample-lav-1.dll
2005-07-14 10:31 32256 --sh--w- c:\winxp\system32\AVSredirect.dll
2014-02-13 12:20 180368 --sha-r- c:\winxp\system32\avutil-lav-52.dll
2004-02-22 08:11 764416 --sh--w- c:\winxp\system32\devil.dll
2014-02-13 12:20 122512 --sha-r- c:\winxp\system32\HLaudio.dll
2014-02-13 12:20 202384 --sha-r- c:\winxp\system32\HLsplit.dll
2014-02-13 12:20 313520 --sha-r- c:\winxp\system32\HLvideo.dll
2014-02-13 12:20 152720 --sha-r- c:\winxp\system32\IntelQuickSyncDecoder.dll
2014-02-13 12:20 110224 --sha-r- c:\winxp\system32\libbluray.dll
2011-02-11 08:26 112128 --sha-r- c:\winxp\system32\OptimFROG.dll
2014-02-13 12:20 109200 --sha-r- c:\winxp\system32\swscale-lav-2.dll
2012-10-05 17:54 188416 --sha-r- c:\winxp\system32\winDCE32.dll
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpybotSD TeaTimer"="c:\programme\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]
"H/PC Connection Agent"="c:\programme\Microsoft ActiveSync\wcescomm.exe" [2006-11-13 1289000]
"CCleaner Monitoring"="c:\programme\CCleaner\CCleaner.exe" [2015-09-16 6495144]
"WMPNSCFG"="c:\programme\Windows Media Player\WMPNSCFG.exe" [2006-11-03 204288]
"QuickTime Task"="c:\programme\QuickTime\qttask.exe" [2011-10-24 421888]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [2009-01-29 16269312]
"AppleSyncNotifier"="c:\programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2011-10-05 59240]
"APSDaemon"="c:\programme\Gemeinsame Dateien\Apple\Apple Application Support\APSDaemon.exe" [2015-03-20 60712]
"avgnt"="c:\programme\Avira\AntiVir Desktop\avgnt.exe" [2015-09-27 782520]
"Adobe ARM"="c:\programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe" [2014-05-08 959904]
"NvBackend"="c:\programme\NVIDIA Corporation\Update Core\NvBackend.exe" [2015-07-24 2634896]
"HP Software Update"="c:\programme\HP\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]
"hpqSRMon"="c:\programme\HP\Digital Imaging\bin\hpqSRMon.exe" [2007-08-22 80896]
"QuickTime Task"="c:\programme\QuickTime\qttask.exe" [2011-10-24 421888]
"Avira SystrayStartTrigger"="c:\programme\Avira\Launcher\Avira.SystrayStartTrigger.exe" [2015-10-14 66320]
"NvCplDaemon"="c:\winxp\system32\NvCpl.dll" [2013-01-31 15517472]
"NvMediaCenter"="c:\winxp\system32\NvMcTray.dll" [2013-01-31 108832]
"nwiz"="c:\programme\NVIDIA Corporation\nview\nwiz.exe" [2013-01-31 1982312]
"iTunesHelper"="c:\programme\iTunes\iTunesHelper.exe" [2015-09-12 157456]
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck xmnt2002 /bat=c:\winxp\TEMP\PQ_BATCH.PQB /win=c:\winxp /dbg=c:\WINXP\TEMP\PQ_DEBUG.TXT /ver=262144 /prd=PartitionMagic\0autocheck autochk *
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SCT_SKMScan]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SophosVirusRemovalTool]
@="Service"
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BluetoothAuthenticationAgent]
2008-04-14 09:00 110592 ----a-w- c:\winxp\system32\bthprops.cpl
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EaseUS EPM tray]
2015-04-14 07:14 2089056 ----a-w- c:\programme\EaseUS\EaseUS Partition Master 10.5\bin\EpmNews.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\H/PC Connection Agent]
2006-11-13 12:50 1289000 ----a-w- c:\programme\Microsoft ActiveSync\wcescomm.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2015-09-12 03:25 157456 ----a-w- c:\programme\iTunes\iTunesHelper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2011-10-24 13:28 421888 ----a-w- c:\programme\QuickTime\QTTask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Wondershare Helper Compact]
2013-07-25 15:47 1985824 ----a-w- c:\programme\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Wondershare Helper Compact.exe]
2013-07-25 15:47 1985824 ----a-w- c:\programme\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"ERSvc"=2 (0x2)
"BthServ"=3 (0x3)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"iTunesHelper"="c:\programme\iTunes\iTunesHelper.exe"
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"DisableUnicastResponsesToMulticastBroadcast"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Programme\\Messenger\\msmsgs.exe"=
"c:\\Programme\\Bonjour\\mDNSResponder.exe"=
"c:\programme\Microsoft ActiveSync\rapimgr.exe"= c:\programme\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"c:\programme\Microsoft ActiveSync\wcescomm.exe"= c:\programme\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"c:\programme\Microsoft ActiveSync\WCESMgr.exe"= c:\programme\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
"c:\\Programme\\VideoLAN\\VLC\\vlc.exe"=
"c:\\Dokumente und Einstellungen\\All Users\\Anwendungsdaten\\Battle.net\\Agent\\Agent.3323\\Agent.exe"=
"c:\\Programme\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Programme\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Programme\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Programme\\Twonky\\TwonkyServer\\twonkystarter.exe"=
"c:\\Programme\\Twonky\\TwonkyServer\\twonkyserver.exe"=
"c:\\Programme\\Java\\jre1.8.0_40\\bin\\javaw.exe"=
"c:\\Programme\\Nero\\Nero Blu-ray Player\\Blu-rayPlayer.exe"=
"c:\\Programme\\Nero\\Nero 2015\\Nero Burning ROM\\StartNBR.exe"=
"c:\\Programme\\Nero\\KM\\NMDllHost.exe"=
"c:\\Programme\\Nero\\Nero 2015\\Nero Burning ROM\\nero.exe"=
"c:\\Programme\\NVIDIA Corporation\\NetService\\NvNetworkService.exe"=
"c:\\Programme\\Mozilla Firefox\\firefox.exe"=
"c:\\Programme\\iTunes\\iTunes.exe"=
"c:\\Programme\\HTC\\HTC Sync Manager\\HTCSyncManager.exe"=
"c:\\WINXP\\system32\\mmc.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service
"5985:TCP"= 5985:TCP:*:Disabled:Windows-Remoteverwaltung
.
R2 AntiVirMailService;Avira Email-Schutz;c:\programme\Avira\AntiVir Desktop\avmailc.exe [2015-09-27 916968]
R2 AntiVirWebService;Avira Browser-Schutz;c:\programme\Avira\AntiVir Desktop\AVWEBGRD.EXE [2015-09-27 1210512]
R3 DrvAgent32;DrvAgent32;c:\winxp\system32\Drivers\DrvAgent32.sys [2015-02-22 23456]
R3 dtlitescsibus;DAEMON Tools Lite Virtual SCSI Bus;c:\winxp\system32\DRIVERS\dtlitescsibus.sys [2015-03-25 25104]
R3 epmntdrv;epmntdrv;c:\winxp\system32\epmntdrv.sys [2014-11-18 14944]
R3 EuGdiDrv;EuGdiDrv;c:\winxp\system32\EuGdiDrv.sys [2014-11-18 10208]
R3 eusk3usb;SmartKey 3 USB;c:\winxp\system32\Drivers\eusk3usb.sys [2005-07-26 43968]
R3 HTCAND32;HTC Device Driver;c:\winxp\system32\Drivers\ANDROIDUSB.sys [x]
R3 MEMSWEEP2;MEMSWEEP2;c:\winxp\system32\7D.tmp [x]
R3 qcserxp;HTC Diagnostic Port;c:\winxp\system32\DRIVERS\qcserxp.sys [2009-01-24 103424]
R3 RTL8187B;NETGEAR WG111v3 54Mbps Wireless USB 2.0 Adapter Vista Driver;c:\winxp\system32\DRIVERS\wg111v3.sys [x]
R3 SCT_SKMScan;SCT_SKMScan;c:\winxp\system32\drivers\sct_skmscan.sys [2011-03-09 33568]
R3 SophosVirusRemovalTool;Sophos Virus Removal Tool;c:\programme\Sophos\Sophos Virus Removal Tool\SVRTservice.exe [2012-10-24 152640]
S1 avkmgr;avkmgr;c:\winxp\system32\DRIVERS\avkmgr.sys [2015-05-20 37896]
S1 SAVRKBootTasks;Boot Tasks Driver;c:\winxp\system32\SAVRKBootTasks.sys [2009-06-18 18816]
S2 AntiVirSchedulerService;Avira Planer;c:\programme\Avira\AntiVir Desktop\sched.exe [2015-09-27 461672]
S2 Avira.ServiceHost;Avira Service Host;c:\programme\Avira\Launcher\Avira.ServiceHost.exe [2015-10-14 243968]
S2 HTCMonitorService;HTCMonitorService;c:\programme\HTC\HTC Sync Manager\HSMServiceEntry.exe [2013-11-18 87368]
S2 NAUpdate;Nero Update;c:\programme\Nero\Update\NASvc.exe [2014-07-15 786256]
S2 NvNetworkService;NVIDIA Network Service;c:\programme\NVIDIA Corporation\NetService\NvNetworkService.exe [2015-07-24 1871504]
S2 TwonkyProxy;TwonkyProxy;c:\programme\Twonky\TwonkyServer\twonkyproxy.exe [2013-05-23 885576]
S2 TwonkyServer;TwonkyServer;c:\programme\Twonky\TwonkyServer\twonkystarter.exe [2013-05-23 586568]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
Inhalt des "geplante Tasks" Ordners
.
2015-10-26 c:\winxp\Tasks\AppleSoftwareUpdate.job
- c:\programme\Apple Software Update\SoftwareUpdate.exe [2011-06-01 23:26]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.ebay.de/
mStart Page = hxxp://www.istartsurf.com/?type=hp&ts=1427312900&from=smt&uid=ST3250820AS_9QE17VPAXXXX9QE17VPA
LSP: c:\programme\Avira\AntiVir Desktop\avsda.dll
TCP: DhcpNameServer = 192.168.192.1
FF - ProfilePath - c:\dokumente und einstellungen\SatchmoPC\Anwendungsdaten\Mozilla\Firefox\Profiles\vlsw022o.default\
FF - prefs.js: browser.search.selectedEngine - Delta Search
FF - prefs.js: browser.startup.homepage - www.ebay.de
FF - prefs.js: network.proxy.type - 0
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2015-12-01 20:21
Windows 5.1.2600 Service Pack 3 NTFS
.
Scanne versteckte Prozesse...
.
Scanne versteckte Autostarteinträge...
.
Scanne versteckte Dateien...
.
Scan erfolgreich abgeschlossen
versteckte Dateien: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\MEMSWEEP2]
"ImagePath"="\??\c:\winxp\system32\7D.tmp"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\S-1-5-21-1614895754-1500820517-1801674531-1003_Classes\CLSID\{2FC8493A-96D3-486E-81F4-C0BD303C9480}\InprocServer32]
@Denied: (C D 2 3 6) (Everyone)
@Allowed: (Read) (S-1-5-21-1614895754-1500820517-1801674531-1003)
"ThreadingModel"="Apartment"
@="c:\\Dokumente und Einstellungen\\All Users\\Anwendungsdaten\\{F85DB747-9498-4432-9694-1D2DEF955232}\\imagehlp.dll"
.
[HKEY_USERS\S-1-5-21-1614895754-1500820517-1801674531-1003_Classes\Drive\ShellEx\FolderExtensions\{2FC8493A-96D3-486E-81F4-C0BD303C9480}]
@Denied: (C D 2 3 6) (Everyone)
@Allowed: (Read) (S-1-5-21-1614895754-1500820517-1801674531-1003)
"DriveMask"=dword:ffffffff
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{2FC8493A-96D3-486E-81F4-C0BD303C9480}\InprocServer32]
@Denied: (C D 2 3 6) (Everyone)
"ThreadingModel"="Apartment"
@="c:\\Dokumente und Einstellungen\\All Users\\Anwendungsdaten\\{F85DB747-9498-4432-9694-1D2DEF955232}\\imagehlp.dll"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINXP\\system32\\Macromed\\Flash\\FlashUtil32_19_0_0_226_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
@="c:\\WINXP\\system32\\Macromed\\Flash\\FlashUtil32_19_0_0_226_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Drive\shellex\FolderExtensions\{2FC8493A-96D3-486E-81F4-C0BD303C9480}]
@Denied: (C D 2 3 6) (Everyone)
"DriveMask"=dword:ffffffff
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
@Denied: (A 2) (Everyone)
@="IFlashBroker6"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\System*]
"OOSAFEERASE01.00.00.01WINNT2KXP"="7C920ADEB7599737B1396109EB45C2C6C1001EBD2452534FB636042683AE7B19A2E6B0AE78F6ACFAF8C25B4402E68123C09E672141A4F4E98779C3ACDE8AEE39381C1C6B430D1586AD3C57FC952EFB5529BD68A6137C984F087AF377B3A90EEBCF1C38F21DAD41A39086D4D1E970C7B88A58574FB91A980F31689D081CD71A0F72EE84663E49F89F53A6E9A7746D512C6488FC6089A3A536F09ADE236A4328049746122D163A5450A042BC23DF43D5142B1236DF0922425CAA8BEA52A3FC21AFB2F28B7144BA418994A6FEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74C5D575E7D6A3B9808C038D530D6EB3452A2D97226D213B555A6A0AC4980AC79336F32821A0D37D95626CBB746AA8D3318DE75C94D229192A568289A1A2504CFA9AC5D2199D70AA9685F792226B89F6465834B36F4BBA036A0391B969BC8DF01605AC6CB1F85CC640BF372189A6AA81492FDC8466C2DCD096DF042347FF80AFBA4A48E3F9776FCB069027972B6249615437F6D111102992D487902668A03B14D6C491BECCF5E1CA9D1BC94BF72A05DB0BF5303622198863714508355658D8C79D01B95F779C730DE376C8DBEA86DF2A1F3549437C2A39C315207B05C9E8DD273907EE93BAC8E4353326AF367996BD1986FF1F043FE2BE6952EC13B89A7CFC1A70DEF4AC06364E17EFA2918E3E6D2F7B866322AEABF08F5D7F4BB9623D47399F24C7CAACAFB4D9DC872A8908F9A2A6A9B312C184BD6E95CDC9540FB1D606E1FA77847C5CC38210D941A0239FC1D51AD4C4A0DD632F954337B2631E627E6061A8C5F061770BE0EC9B39960AD71C0784CCB5494C4A0401C94036084969CEAD7585AF38361109A16F0EBBC0352E53628560C109684CE25EEA2B420431094D052AAC0C99CA83F390AA4F971BCCB091737DCF6667BFD268AC8FDC265891B54633A645F1D45B6BFEE960B0CC974843DDDD47868E4C1DBC6B4FDCF59D68945D74E26DFCDC982190C6F374C467EA62B15E903C2AE39750E024B3544943D09DC4FA304F817D3EF9FCFD6BB96BD6961315C7E17D91039BE465E5BE8890484E0771ED91110B6DE3A60EAA3491CFE89494E10C33BE1C4DB547D17D4E6D42E3E7EECDA48E209A0B6A534F3B6D913098114F9E1446C7FF5BB02ED988CD45D8B9EE1D8522E604E3AC886B831D83933CC190F75366F7CDEC51B2996093A26DD0A7FA29A83AB45CBDD26484E20B2083C353A17BF291992AE485C3D3BBBFAA71609DC68D7A147A2F15984E81BF1523CED99F32122057827210588C662BC4FF7CA5E58F0F8156AD9B56EBFFA08892C9C0FCAF934A4CD2988EB784AE1574A9A88C354368DA87861250FD354A3418194C7E98B23EB95B72BD7CA91F1BF29562722CAA6E022581B5E0F7B32641E39A447ADCA"
"OOSAFEERASE03.00.00.01MSWINDOWS"="585FED43B1816046F6B9421C489AC2B8F5E06A0AE78AE467D3FB1B0BE1FBD6807882E0196228486010ADD1A18970BD6E743B4FC72449DD482B784EFB69ECBE41EEA93BDE52EA522BC5B6E374F9F95F77B129FEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA9C6AECB7A5D1407C038D530D6EB3452A6A0AC4980AC79335D575E7D6A3B98080E05AE5EF9D673F8BA9412013DE9FCF547EF62A890BE8095C8A9FBAB3F8B8E17B1C5223959CDACE7C379DFB1A46881A087A97D52A98F0F57DF4284AB468780BF27D84CE6D3AB7E9B5B1FA1665E519C79E1AC78A5EC6E57CAD012ACF6D61B97BD4FB9D60BA7DAD2F1051E2BC599B9B3F49851EEED99BAD499BC4D7CA060120990CE1A519795B239DE86C4B2490829CD1B332062C9F2CB297F0DD85C09D8B12F498E5E2E56E30564E96815D43EDF9C97087C58B52C41E798CDEDD1996A38AC088DBC2042E4DB932B2D7B4391465D03DF6B846C32DA4FCE0DEACE08654F7BAF3599CA29C933CB95895ACFBAC957BE411B0A9C8305716DAF144F64FE5518A3D67C3A6CFB628685B61CB13D16C7BBC52F61BCDD773C5E6EAF5C88276DE277B43648D19BCC0F765D15A80D5CA93411BA186F6FA2D64F65ABE83D39D1BE6BF536D0A656158435F12EC313568CF821C8E53C23A28A65939C7F672D13661330EF3723C954DABD213754CA680D6EBF7FA918500169771848EDC9AC4BE2A83ED694C71B85E6B14B7EDC33245644E9E9A84BA3FBB2EC91990C996D2E57042047E868FA1955C222B1E04A2FBEB0A4A798579D5EDA81E9C348E3B1D454356919E954426BF4582D79283F3E32FE6E6717232B61A2FD5F303DB8379C677BEF962395684D35F8CE80C91B7447AA3BA95D6A91A6ACD068DE24F02FD3161975B3A514ED5C8AF7609D2BE7ABBCCB893D22E816A132E8499239BD96A7E9ABDA08D043024B4ACD58DF512FEB2F3D044445B98155C498D475E8490AA9CF0DC0A4EABC32CAB62D3E801C96A234AC79FCD486F733A7A10901BDCA8F28E70A378DF24C10C50EF168589CB0BDB06261DE16B8A7871C4C1097D3110CAE4DD5ECC29A45CC0868AF6F416ADCA93F17D93DB9077144B770CC9FBB87E2F4EFC03944F0C69E8005975758DE99F50AB32844663C55856AFAF6708FD029A9C23F609E0D664786F00CE4F286D1DDA0C8D9498FB47EDFFC9D688B46D6951ADFA32C1B547B2C208A1C477430898902994D92F6EC33F9D66754BB1C219FAD11033D6A76EDF22D2E3872027F06265C2722F8E3BD50248D3FD5FAD1AC1746219798A6D289C1113B1FA3582E54AAD103BE7D9A79BF74FA7A70DCEE305601DA5A8B246B5F00EC24097465A7DE531A3B9B9374FA1EB3D4E1681997047BC0FEA62A1F330C311CCBAC3108972DCFF295BEA6BE5552"
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------
.
- - - - - - - > 'lsass.exe'(792)
c:\programme\Avira\AntiVir Desktop\avsda.dll
.
- - - - - - - > 'explorer.exe'(1388)
c:\programme\NVIDIA Corporation\nview\nview.dll
c:\programme\NVIDIA Corporation\nview\NVWRSDE.DLL
c:\winxp\system32\msi.dll
c:\winxp\system32\webcheck.dll
c:\winxp\system32\wpdshserviceobj.dll
c:\winxp\system32\portabledevicetypes.dll
c:\winxp\system32\portabledeviceapi.dll
c:\programme\Avira\AntiVir Desktop\avsda.dll
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\programme\Avira\AntiVir Desktop\avguard.exe
c:\programme\Gemeinsame Dateien\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\programme\Bonjour\mDNSResponder.exe
c:\programme\CDBurnerXP\NMSAccessU.exe
c:\winxp\system32\nvsvc32.exe
c:\programme\HTC\HTC Sync Manager\HTC Sync\adb.exe
c:\programme\Windows Media Player\WMPNetwk.exe
c:\winxp\RTHDCPL.EXE
c:\winxp\system32\RUNDLL32.EXE
c:\winxp\system32\rundll32.exe
c:\progra~1\MICROS~2\rapimgr.exe
c:\programme\Avira\AntiVir Desktop\avshadow.exe
c:\winxp\system32\wscntfy.exe
c:\programme\iPod\bin\iPodService.exe
c:\winxp\system32\dllhost.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2015-12-01 20:26:11 - PC wurde neu gestartet
ComboFix-quarantined-files.txt 2015-12-01 19:26
ComboFix2.txt 2015-12-01 18:58
.
Vor Suchlauf: 26 Verzeichnis(se), 104.908.926.976 Bytes frei
Nach Suchlauf: 27 Verzeichnis(se), 104.923.246.592 Bytes frei
.
- - End Of File - - 340AC8718D2B51C3B6FA7865589AD6E0
72B8CE41AF0DE751C946802B3ED844B4