Combofix Logfile: Code:
ComboFix 11-07-29.03 - Daniel 30.07.2011 20:57:26.1.4 - x64
Microsoft® Windows Vista™ Home Basic 6.0.6002.2.1252.49.1031.18.4094.3089 [GMT 2:00]
ausgeführt von:: c:\users\Daniel\Desktop\ComboFix.exe
Benutzte Befehlsschalter :: c:\users\Daniel\Desktop\CFScript.txt
AV: AntiVir Desktop *Disabled/Outdated* {090F9C29-64CE-6C6F-379C-5901B49A85B7}
SP: AntiVir Desktop *Disabled/Outdated* {B26E7DCD-42F4-63E1-0D2C-6273CF1DCF0A}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
FILE ::
"c:\users\Daniel\AppData\Local\Temp\003C165.tmp"
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\D56B0E274A3E46C9B5C1D93D580C099C.TMP
c:\windows\D56B0E274A3E46C9B5C1D93D580C099C.TMP\WiseCustomCalla.dll
.
.
((((((((((((((((((((((((((((((((((((((( Treiber/Dienste )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_X6VA003
-------\Service_X6va003
.
.
((((((((((((((((((((((( Dateien erstellt von 2011-06-28 bis 2011-07-30 ))))))))))))))))))))))))))))))
.
.
2011-07-30 19:13 . 2011-07-30 19:40 -------- d-----w- c:\users\Daniel\AppData\Local\temp
2011-07-29 10:23 . 2011-07-13 04:53 8578896 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{B4B6112D-F508-4208-8561-377304656A8F}\mpengine.dll
2011-07-29 08:46 . 2011-07-29 08:46 -------- d-----w- C:\_OTL
2011-07-26 11:46 . 2011-07-26 11:46 -------- d-----w- c:\program files (x86)\ESET
2011-07-25 11:01 . 2011-07-25 11:01 -------- d-----w- c:\users\Daniel\AppData\Roaming\Malwarebytes
2011-07-25 11:01 . 2011-07-06 17:52 41272 ----a-w- c:\windows\SysWow64\drivers\mbamswissarmy.sys
2011-07-25 11:01 . 2011-07-25 11:01 -------- d-----w- c:\programdata\Malwarebytes
2011-07-25 11:01 . 2011-07-25 11:01 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
2011-07-25 11:01 . 2011-07-06 17:52 25912 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-07-13 16:53 . 2011-06-02 13:50 2764288 ----a-w- c:\windows\system32\win32k.sys
2011-07-13 16:53 . 2011-04-20 16:03 451072 ----a-w- c:\windows\system32\winsrv.dll
2011-07-13 16:53 . 2011-04-20 15:58 85504 ----a-w- c:\windows\system32\csrsrv.dll
2011-07-08 12:16 . 2011-07-08 12:16 -------- d-----w- c:\users\Daniel\AppData\Local\Focus Home Interactive
2011-07-02 11:10 . 2011-07-02 11:10 -------- d-----w- c:\users\Daniel\AppData\Roaming\InstallShield Installation Information
2011-07-01 09:45 . 2011-07-01 09:45 -------- d-----w- c:\users\Daniel\AppData\Local\CrashRpt
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-07-26 20:58 . 2010-11-29 20:23 88288 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2011-07-26 20:58 . 2010-11-29 20:23 123784 ----a-w- c:\windows\system32\drivers\avipbb.sys
2011-06-30 19:15 . 2010-12-26 16:19 215128 ----a-w- c:\windows\SysWow64\PnkBstrB.xtr
2011-06-30 19:15 . 2010-12-26 16:10 215128 ----a-w- c:\windows\SysWow64\PnkBstrB.exe
2011-06-24 17:38 . 2010-12-26 16:10 280768 ----a-w- c:\windows\SysWow64\PnkBstrB.ex0
2011-06-14 19:28 . 2010-12-26 16:10 75136 ----a-w- c:\windows\SysWow64\PnkBstrA.exe
2011-06-09 18:26 . 2010-12-26 16:10 669184 ----a-w- c:\windows\SysWow64\Pbsvc.exe
2011-05-26 16:59 . 2010-11-30 14:20 122904 ----a-w- c:\windows\system32\OpenAL32.dll
2011-05-26 16:59 . 2010-11-30 14:20 109080 ----a-w- c:\windows\SysWow64\OpenAL32.dll
2011-05-24 17:14 . 2010-10-13 23:36 270720 ------w- c:\windows\system32\MpSigStub.exe
2011-05-10 16:19 . 2011-05-10 16:19 5440000 ----a-w- c:\windows\system32\atiumd64.dll
2011-05-10 16:19 . 2011-05-10 16:19 4161536 ----a-w- c:\windows\SysWow64\atidxx32.dll
2011-05-10 16:19 . 2011-05-10 16:19 366080 ----a-w- c:\windows\system32\atiadlxx.dll
2011-05-10 16:19 . 2011-05-10 16:19 306176 ----a-w- c:\windows\system32\drivers\atikmpag.sys
2011-05-10 16:19 . 2011-05-10 16:19 59392 ----a-w- c:\windows\system32\atiedu64.dll
2011-05-10 16:19 . 2011-05-10 16:19 44032 ----a-w- c:\windows\SysWow64\aticalcl.dll
2011-05-10 16:19 . 2011-05-10 16:19 16384 ----a-w- c:\windows\system32\atimuixx.dll
2011-05-10 16:19 . 2011-05-10 16:19 14848 ----a-w- c:\windows\system32\atig6pxx.dll
2011-05-10 16:19 . 2011-05-10 16:19 6389760 ----a-w- c:\windows\SysWow64\aticaldd.dll
2011-05-10 16:19 . 2011-05-10 16:19 44544 ----a-w- c:\windows\system32\aticalcl64.dll
2011-05-10 16:19 . 2011-05-10 16:19 423424 ----a-w- c:\windows\system32\atipdl64.dll
2011-05-10 16:19 . 2011-01-02 18:39 38912 ----a-w- c:\windows\system32\atiu9p64.dll
2011-05-10 16:19 . 2011-05-10 16:19 480256 ----a-w- c:\windows\system32\atieclxx.exe
2011-05-10 16:19 . 2011-01-02 18:57 29184 ----a-w- c:\windows\SysWow64\atiu9pag.dll
2011-05-10 16:19 . 2011-05-10 16:19 51200 ----a-w- c:\windows\system32\aticalrt64.dll
2011-05-10 16:19 . 2011-05-10 16:19 795648 ----a-w- c:\windows\system32\aticfx64.dll
2011-05-10 16:19 . 2011-05-10 16:19 4286464 ----a-w- c:\windows\SysWow64\atiumdag.dll
2011-05-10 16:19 . 2011-05-10 16:19 7768064 ----a-w- c:\windows\system32\aticaldd64.dll
2011-05-10 16:19 . 2011-05-10 16:19 676864 ----a-w- c:\windows\SysWow64\aticfx32.dll
2011-05-10 16:19 . 2011-05-10 16:19 4951552 ----a-w- c:\windows\system32\atidxx64.dll
2011-05-10 16:19 . 2011-05-10 16:19 32768 ----a-w- c:\windows\SysWow64\atigktxx.dll
2011-05-10 16:19 . 2011-05-10 16:19 31232 ----a-w- c:\windows\SysWow64\atiuxpag.dll
2011-05-10 16:19 . 2011-05-10 16:19 46080 ----a-w- c:\windows\SysWow64\aticalrt.dll
2011-05-10 16:19 . 2011-05-10 16:18 22900736 ----a-w- c:\windows\system32\atio6axx.dll
2011-05-10 16:19 . 2011-05-10 16:19 356352 ----a-w- c:\windows\SysWow64\atipdlxx.dll
2011-05-10 16:19 . 2011-05-10 16:18 9319936 ----a-w- c:\windows\system32\drivers\atikmdag.sys
2011-05-10 16:19 . 2011-05-10 16:19 1222656 ----a-w- c:\windows\system32\atiumd6v.dll
2011-05-10 16:19 . 2011-05-10 16:19 39936 ----a-w- c:\windows\system32\atig6txx.dll
2011-05-10 16:19 . 2011-05-10 16:19 203776 ----a-w- c:\windows\system32\atiesrxx.exe
2011-05-10 16:19 . 2011-05-10 16:19 462848 ----a-w- c:\windows\system32\ATIDEMGX.dll
2011-05-10 16:19 . 2011-05-10 16:19 262144 ----a-w- c:\windows\SysWow64\atiadlxy.dll
2011-05-10 16:19 . 2011-05-10 16:19 12800 ----a-w- c:\windows\SysWow64\atiglpxx.dll
2011-05-10 16:19 . 2011-05-10 16:19 12800 ----a-w- c:\windows\system32\atiglpxx.dll
2011-05-10 16:19 . 2011-05-10 16:18 17693184 ----a-w- c:\windows\SysWow64\atioglxx.dll
2011-05-10 16:18 . 2011-05-10 16:18 40960 ----a-w- c:\windows\system32\atiuxp64.dll
2011-05-10 16:18 . 2011-05-10 16:18 151552 ----a-w- c:\windows\system32\atiapfxx.exe
2011-05-10 16:18 . 2011-05-10 16:18 3868672 ----a-w- c:\windows\system32\atiumd6a.dll
2011-05-10 16:18 . 2011-01-02 18:57 58880 ----a-w- c:\windows\system32\coinst.dll
2011-05-10 16:18 . 2011-05-10 16:18 53760 ----a-w- c:\windows\system32\atimpc64.dll
2011-05-10 16:18 . 2011-05-10 16:18 53760 ----a-w- c:\windows\system32\amdpcom64.dll
2011-05-10 16:18 . 2011-05-10 16:18 4056576 ----a-w- c:\windows\SysWow64\atiumdva.dll
2011-05-10 16:18 . 2011-05-10 16:18 52736 ----a-w- c:\windows\SysWow64\atimpc32.dll
2011-05-10 16:18 . 2011-05-10 16:18 52736 ----a-w- c:\windows\SysWow64\amdpcom32.dll
2011-05-10 16:18 . 2011-01-02 18:56 45056 ----a-w- c:\windows\system32\atitmp64.dll
2011-05-10 16:18 . 2011-05-10 16:18 278528 ----a-w- c:\windows\SysWow64\Oemdspif.dll
2011-05-10 16:18 . 2011-05-10 16:18 1923584 ----a-w- c:\windows\SysWow64\atiumdmv.dll
2011-05-10 16:18 . 2011-05-10 16:18 53248 ----a-w- c:\windows\system32\drivers\ati2erec.dll
2011-05-10 16:18 . 2011-05-10 16:18 43520 ----a-w- c:\windows\SysWow64\ati2edxx.dll
2011-05-10 16:18 . 2011-05-10 16:18 120320 ----a-w- c:\windows\system32\atitmm64.dll
2011-05-02 17:16 . 2011-06-15 20:29 739328 ----a-w- c:\windows\SysWow64\inetcomm.dll
2011-05-02 17:13 . 2011-06-15 20:29 975360 ----a-w- c:\windows\system32\inetcomm.dll
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{64182481-4F71-486b-A045-B233BD0DA8FC}]
c:\program files (x86)\facemoods.com\facemoods\1.4.17.7\bh\facemoods.dll [BU]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]
"{DB4E9724-F518-4dfd-9C7C-78B52103CAB9}"= "c:\program files (x86)\facemoods.com\facemoods\1.4.17.7\facemoodsTlbr.dll" [BU]
.
[HKEY_CLASSES_ROOT\clsid\{db4e9724-f518-4dfd-9c7c-78b52103cab9}]
[HKEY_CLASSES_ROOT\facemoods.dskBnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}]
[HKEY_CLASSES_ROOT\facemoods.dskBnd]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Wisdom-soft AutoScreenRecorder 3.1 Free"="0" [X]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"Adobe Reader Speed Launcher"="d:\programme\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-09-23 35760]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-20 932288]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
"ATICustomerCare"="c:\program files (x86)\ATI\ATICustomerCare\ATICustomerCare.exe" [2010-05-04 311296]
"avgnt"="d:\programme\Avira\AntiVir Desktop\avgnt.exe" [2010-08-02 281768]
"LogMeIn Hamachi Ui"="e:\programme\LogMeIn Hamachi\hamachi-2-ui.exe" [2011-05-25 1951112]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2011-04-19 336384]
"Malwarebytes' Anti-Malware"="c:\program files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" [2011-07-06 449584]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R3 SpeedBoosterSvc;appsmaker SpeedBooster 2.0 Service;c:\program files (x86)\Common Files\OptimalSuite Common\BoostService.exe [2010-11-23 2318192]
R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework64\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 1020768]
S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [x]
S2 acedrv11;acedrv11;c:\windows\system32\drivers\acedrv11.sys [x]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x]
S2 AMOptimalDiskService;appsmaker OptimalDisk Service;c:\program files (x86)\Common Files\OptimalSuite Common\AMDSrv.exe [2010-11-23 5216624]
S2 AntiVirSchedulerService;Avira AntiVir Planer;d:\programme\Avira\AntiVir Desktop\sched.exe [2011-04-28 136360]
S2 Hamachi2Svc;LogMeIn Hamachi 2.0 Tunneling Engine;e:\programme\LogMeIn Hamachi\hamachi-2.exe [2011-05-25 2275720]
S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2011-07-06 366640]
S2 pgsql-8.3;PostgreSQL Database Server 8.3;e:\programme\PostgreSQL\8.3\bin\pg_ctl.exe [2009-12-10 65536]
S2 TeamViewer6;TeamViewer 6;c:\program files (x86)\TeamViewer\Version6\TeamViewer_Service.exe [2011-03-01 2296696]
S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [x]
S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [x]
S3 AtiHDAudioService;ATI Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdLH6.sys [x]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [x]
.
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2010-10-05 11474024]
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://start.facemoods.com/?a=ddrnw
mLocal Page = %SystemRoot%\system32\blank.htm
IE: Free YouTube Download - c:\users\Daniel\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm
IE: Free YouTube to Mp3 Converter - c:\users\Daniel\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm
Trusted Zone: everestpoker.com\account
TCP: DhcpNameServer = 192.168.178.1
CLSID: {603d3801-bd81-11d0-a3a5-00c04fd706ec} - %SystemRoot%\SysWow64\browseui.dll
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\S-1-5-21-2383699699-257912313-3487588874-1000\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:98,dc,6a,19,cd,09,a7,dd,76,31,f6,e3,f8,59,05,a5,e2,65,9b,b7,e3,30,41,
71,83,6d,6f,b8,22,f9,92,5c,69,f5,22,a7,b8,a2,a7,8a,bb,ea,ce,93,7a,02,50,63,\
"??"=hex:24,a1,70,a1,e6,7a,c1,55,14,51,57,83,f7,9b,e1,ef
.
[HKEY_USERS\S-1-5-21-2383699699-257912313-3487588874-1000\Software\SecuROM\License information*]
"datasecu"=hex:9e,20,fa,0d,28,f1,c7,8f,82,65,9a,42,6e,7d,8b,39,7d,ea,f3,84,2d,
65,80,e5,c6,d3,98,80,3a,1a,6b,cb,78,77,f7,59,23,de,f3,8e,3b,5c,fe,a1,be,23,\
"rkeysecu"=hex:7d,40,10,cb,c7,39,e0,67,0a,69,a8,47,07,da,5b,5c
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10k_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10k_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10k.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10k.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10k.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10k.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{D27CDB6B-AE6D-11CF-96B8-444553540000}]
@Denied: (A 2) (Everyone)
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{D27CDB6B-AE6D-11CF-96B8-444553540000}\1.0]
@="Shockwave Flash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{FAB3E735-69C7-453B-A446-B6823C6DF1C9}]
@Denied: (A 2) (Everyone)
@=""
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{FAB3E735-69C7-453B-A446-B6823C6DF1C9}\1.0]
@="FlashBroker"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\RNG*]
"Seed"=hex:49,31,f4,88,04,28,01,14,c5,ca,fa,5f,f5,cf,66,6e,1f,6c,42,48,3b,1d,
bb,84,6e,c3,98,a3,07,68,b8,a1,8e,3f,71,ca,a8,53,6d,af,a8,e5,29,51,a3,e5,99,\
"Seed"=hex:49,31,f4,88,04,28,01,14,c5,ca,fa,5f,f5,cf,66,6e,1f,6c,42,48,3b,1d,
bb,84,6e,c3,98,a3,07,68,b8,a1,8e,3f,71,ca,a8,53,6d,af,a8,e5,29,51,a3,e5,99,\
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes]
"SymbolicLinkValue"=hex(6):5c,00,52,00,45,00,47,00,49,00,53,00,54,00,52,00,59,
00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,4f,00,46,00,\
.
------------------------ Weitere laufende Prozesse ------------------------
.
d:\programme\Avira\AntiVir Desktop\avguard.exe
c:\windows\SysWOW64\PnkBstrA.exe
e:\programme\PostgreSQL\8.3\bin\postgres.exe
e:\programme\PostgreSQL\8.3\bin\postgres.exe
e:\programme\PostgreSQL\8.3\bin\postgres.exe
e:\programme\PostgreSQL\8.3\bin\postgres.exe
e:\programme\PostgreSQL\8.3\bin\postgres.exe
e:\programme\PostgreSQL\8.3\bin\postgres.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2011-07-30 21:44:35 - PC wurde neu gestartet
ComboFix-quarantined-files.txt 2011-07-30 19:44
ComboFix2.txt 2011-07-30 17:29
.
Vor Suchlauf: 16 Verzeichnis(se), 13.259.726.848 Bytes frei
Nach Suchlauf: 17 Verzeichnis(se), 12.817.211.392 Bytes frei
.
- - End Of File - - 270A57590C33D91CB911F57DBF0AC78F
--- --- --- |
