| michel_bo | 28.01.2012 17:30 |
Combofix Logfile: Code:
ComboFix 12-01-28.01 - michel 28.01.2012 17:07:07.2.2 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.49.1031.18.4094.2740 [GMT 1:00]
ausgeführt von:: c:\users\michel\Desktop\ComboFix.exe
Benutzte Befehlsschalter :: c:\users\michel\Desktop\cfscript.txt
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Neuer Wiederherstellungspunkt wurde erstellt
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
.
((((((((((((((((((((((((((((((((((((((( Treiber/Dienste )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_1ed38b5879346219
-------\Service_1ed38b5879346219
.
.
((((((((((((((((((((((( Dateien erstellt von 2011-12-28 bis 2012-01-28 ))))))))))))))))))))))))))))))
.
.
2012-01-28 16:13 . 2012-01-28 16:13 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-01-27 22:25 . 2012-01-27 22:25 -------- d-----w- c:\users\michel\AppData\Roaming\Avira
2012-01-27 22:19 . 2011-12-15 14:00 27760 ----a-w- c:\windows\system32\drivers\avkmgr.sys
2012-01-27 22:19 . 2011-12-15 13:59 97312 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2012-01-27 22:19 . 2011-12-15 13:59 130760 ----a-w- c:\windows\system32\drivers\avipbb.sys
2012-01-27 22:19 . 2012-01-27 22:19 -------- d-----w- c:\programdata\Avira
2012-01-27 16:12 . 2012-01-28 14:19 25160 ----a-w- c:\windows\system32\drivers\hitmanpro36.sys
2012-01-27 16:08 . 2012-01-27 16:11 -------- d-----w- c:\program files\HitmanPro
2012-01-27 16:08 . 2012-01-27 16:14 -------- d-----w- c:\programdata\HitmanPro
2012-01-27 16:07 . 2012-01-27 16:07 -------- d-----w- c:\programdata\Hitman Pro
2012-01-26 19:19 . 2012-01-26 19:19 -------- d-----w- c:\program files (x86)\Avira
2012-01-26 18:59 . 2012-01-26 18:59 -------- d-----w- c:\program files\CCleaner
2012-01-26 18:08 . 2012-01-26 18:08 -------- d-----w- c:\users\michel\AppData\Roaming\Malwarebytes
2012-01-26 18:08 . 2012-01-26 18:08 -------- d-----w- c:\programdata\Malwarebytes
2012-01-26 18:08 . 2012-01-26 18:08 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
2012-01-26 18:08 . 2011-12-10 14:24 23152 ----a-w- c:\windows\system32\drivers\mbam.sys
2012-01-26 17:02 . 2012-01-26 17:03 414368 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2012-01-26 16:04 . 2012-01-26 16:04 -------- d-----w- c:\program files\7-Zip
2012-01-26 15:55 . 2012-01-26 16:05 -------- d-----w- C:\_OTL
2012-01-21 22:32 . 2012-01-21 22:32 626688 ----a-w- c:\program files (x86)\Mozilla Firefox\msvcr80.dll
2012-01-21 22:32 . 2012-01-21 22:32 548864 ----a-w- c:\program files (x86)\Mozilla Firefox\msvcp80.dll
2012-01-21 22:32 . 2012-01-21 22:32 479232 ----a-w- c:\program files (x86)\Mozilla Firefox\msvcm80.dll
2012-01-21 22:32 . 2012-01-21 22:32 43992 ----a-w- c:\program files (x86)\Mozilla Firefox\mozutils.dll
2012-01-17 10:22 . 2011-11-21 11:40 8822856 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{0894C120-62E5-435C-BC89-3D94CA5AAE24}\mpengine.dll
2012-01-17 10:21 . 2011-10-26 05:25 1572864 ----a-w- c:\windows\system32\quartz.dll
2012-01-17 10:21 . 2011-10-26 05:25 366592 ----a-w- c:\windows\system32\qdvd.dll
2012-01-17 10:21 . 2011-10-26 04:32 514560 ----a-w- c:\windows\SysWow64\qdvd.dll
2012-01-17 10:21 . 2011-10-26 04:32 1328128 ----a-w- c:\windows\SysWow64\quartz.dll
2012-01-17 10:21 . 2011-11-17 06:41 1731920 ----a-w- c:\windows\system32\ntdll.dll
2012-01-17 10:21 . 2011-11-17 05:38 1292080 ----a-w- c:\windows\SysWow64\ntdll.dll
2012-01-17 10:20 . 2011-11-19 14:58 77312 ----a-w- c:\windows\system32\packager.dll
2012-01-17 10:20 . 2011-11-19 14:01 67072 ----a-w- c:\windows\SysWow64\packager.dll
2011-12-31 20:27 . 2012-01-26 09:58 -------- d-----w- c:\users\michel\AppData\Roaming\vlc
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-12-12 23:47 . 2011-12-12 23:47 21840 ----a-w- c:\windows\SysWow64\SIntfNT.dll
2011-12-12 23:47 . 2011-12-12 23:47 17212 ----a-w- c:\windows\SysWow64\SIntf32.dll
2011-12-12 23:47 . 2011-12-12 23:47 12067 ----a-w- c:\windows\SysWow64\SIntf16.dll
2011-12-12 21:08 . 2011-12-12 21:08 2829 ----a-w- c:\windows\DIIUnin.pif
2011-12-12 21:08 . 2011-12-12 21:08 102400 ----a-w- c:\windows\DIIUnin.exe
2011-11-24 04:52 . 2011-12-28 19:23 3145216 ----a-w- c:\windows\system32\win32k.sys
2011-11-15 13:29 . 2011-10-24 16:27 270720 ------w- c:\windows\system32\MpSigStub.exe
2011-11-05 05:32 . 2011-12-28 19:24 2048 ----a-w- c:\windows\system32\tzres.dll
2011-11-05 04:26 . 2011-12-28 19:24 2048 ----a-w- c:\windows\SysWow64\tzres.dll
2011-11-04 01:53 . 2011-12-28 19:26 2309120 ----a-w- c:\windows\system32\jscript9.dll
2011-11-04 01:44 . 2011-12-28 19:26 1390080 ----a-w- c:\windows\system32\wininet.dll
2011-11-04 01:44 . 2011-12-28 19:26 1493504 ----a-w- c:\windows\system32\inetcpl.cpl
2011-11-04 01:34 . 2011-12-28 19:26 2382848 ----a-w- c:\windows\system32\mshtml.tlb
2011-11-03 22:47 . 2011-12-28 19:26 1798144 ----a-w- c:\windows\SysWow64\jscript9.dll
2011-11-03 22:40 . 2011-12-28 19:26 1427456 ----a-w- c:\windows\SysWow64\inetcpl.cpl
2011-11-03 22:39 . 2011-12-28 19:26 1127424 ----a-w- c:\windows\SysWow64\wininet.dll
2011-11-03 22:31 . 2011-12-28 19:26 2382848 ----a-w- c:\windows\SysWow64\mshtml.tlb
.
.
((((((((((((((((((((((((((((( SnapShot@2012-01-26_17.48.25 )))))))))))))))))))))))))))))))))))))))))
.
+ 2011-02-19 22:03 . 2011-02-19 22:03 51024 c:\windows\SysWOW64\vcomp100.dll
+ 2011-02-19 22:03 . 2011-02-19 22:03 81744 c:\windows\SysWOW64\mfcm100u.dll
+ 2011-02-19 22:03 . 2011-02-19 22:03 81744 c:\windows\SysWOW64\mfcm100.dll
+ 2011-02-19 22:03 . 2011-02-19 22:03 60752 c:\windows\SysWOW64\mfc100rus.dll
+ 2011-02-19 22:03 . 2011-02-19 22:03 43344 c:\windows\SysWOW64\mfc100kor.dll
+ 2011-02-19 22:03 . 2011-02-19 22:03 43856 c:\windows\SysWOW64\mfc100jpn.dll
+ 2011-02-19 22:03 . 2011-02-19 22:03 62288 c:\windows\SysWOW64\mfc100ita.dll
+ 2011-02-19 22:03 . 2011-02-19 22:03 64336 c:\windows\SysWOW64\mfc100fra.dll
+ 2011-02-19 22:03 . 2011-02-19 22:03 63824 c:\windows\SysWOW64\mfc100esn.dll
+ 2011-02-19 22:03 . 2011-02-19 22:03 55120 c:\windows\SysWOW64\mfc100enu.dll
+ 2011-02-19 22:03 . 2011-02-19 22:03 64336 c:\windows\SysWOW64\mfc100deu.dll
+ 2011-02-19 22:03 . 2011-02-19 22:03 36176 c:\windows\SysWOW64\mfc100cht.dll
+ 2011-02-19 22:03 . 2011-02-19 22:03 36176 c:\windows\SysWOW64\mfc100chs.dll
- 2011-08-25 14:55 . 2012-01-26 17:35 98304 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\DOMStore\index.dat
+ 2011-08-25 14:55 . 2012-01-28 14:59 98304 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\DOMStore\index.dat
+ 2012-01-28 16:14 . 2012-01-28 16:14 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
- 2012-01-26 17:47 . 2012-01-26 17:47 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2012-01-28 16:14 . 2012-01-28 16:14 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
- 2012-01-26 17:47 . 2012-01-26 17:47 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2011-02-18 23:40 . 2011-02-18 23:40 773968 c:\windows\SysWOW64\msvcr100.dll
+ 2011-02-19 22:03 . 2011-02-19 22:03 421200 c:\windows\SysWOW64\msvcp100.dll
+ 2011-02-19 22:03 . 2011-02-19 22:03 138056 c:\windows\SysWOW64\atl100.dll
+ 2009-07-14 05:01 . 2012-01-28 16:13 311732 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
- 2009-07-14 05:01 . 2012-01-26 17:46 311732 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
+ 2011-02-19 22:08 . 2011-02-19 22:08 163840 c:\windows\Installer\1bfaa.msi
+ 2011-02-19 22:03 . 2011-02-19 22:03 4422992 c:\windows\SysWOW64\mfc100u.dll
+ 2011-02-19 22:03 . 2011-02-19 22:03 4397384 c:\windows\SysWOW64\mfc100.dll
- 2009-07-14 04:54 . 2012-01-26 17:35 1343488 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2009-07-14 04:54 . 2012-01-28 14:59 1343488 c:\windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2009-07-14 04:54 . 2012-01-26 17:35 3932160 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2009-07-14 04:54 . 2012-01-28 14:59 3932160 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2011-08-26 17:01 . 2012-01-28 16:13 2004124 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-4052826560-2321842712-3223092188-1000-12288.dat
- 2009-07-14 04:54 . 2012-01-26 17:35 16187392 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2009-07-14 04:54 . 2012-01-28 14:59 16187392 c:\windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2011-08-30 17:30 . 2012-01-28 16:13 11233576 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-18-16384.dat
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"LManager"="c:\program files (x86)\Launch Manager\LManager.exe" [2009-08-18 1157640]
"BackupManagerTray"="c:\program files (x86)\NewTech Infosystems\Packard Bell MyBackup\BackupManagerTray.exe" [2009-08-21 262912]
"VideoWebCamera"="c:\program files (x86)\VideoWebCamera\VideoWebCamera.exe" [2009-07-28 1507448]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2011-12-15 258512]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\yinghay]
c:\windows\system32\config\systemprofile\AppData\Local\yinghay.dll [BU]
.
3;2 HitmanProScheduler;HitmanPro Scheduler;c:\program files\HitmanPro\hmpsched.exe [x]
R1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys [x]
R2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-08-25 135664]
R2 HsfXAudioService;HsfXAudioService;c:\windows\system32\svchost.exe [2009-07-14 27136]
R2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2011-12-24 652872]
R3 BrSerIb;Brother Serial Interface Driver(WDM);c:\windows\system32\DRIVERS\BrSerIb.sys [x]
R3 BrUsbSIb;Brother Serial USB Driver(WDM);c:\windows\system32\DRIVERS\BrUsbSIb.sys [x]
R3 gupdatem;Google Update-Dienst (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-08-25 135664]
R3 hitmanpro35;Hitman Pro 3.5 Support Driver;c:\windows\system32\drivers\hitmanpro36.sys [x]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [x]
R3 NETw5v64;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 64 Bit;c:\windows\system32\DRIVERS\NETw5v64.sys [x]
R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys [x]
R3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL6.SYS [x]
R3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV6.SYS [x]
R3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT6.SYS [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]
S2 AntiVirSchedulerService;Avira Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [2011-12-15 86224]
S2 ePowerSvc;Acer ePower Service;c:\program files\Packard Bell\Packard Bell Power Management\ePowerSvc.exe [2009-08-06 844320]
S2 Greg_Service;GRegService;c:\program files (x86)\Packard Bell\Registration\GregHSRW.exe [2009-06-04 1150496]
S2 NTI IScheduleSvc;NTI IScheduleSvc;c:\program files (x86)\NewTech Infosystems\Packard Bell MyBackup\IScheduleSvc.exe [2009-08-21 62720]
S2 Updater Service;Updater Service;c:\program files\Packard Bell\Packard Bell Updater\UpdaterService.exe [2009-07-04 240160]
S3 k57nd60a;Broadcom NetLink (TM) Gigabit Ethernet - NDIS 6.0;c:\windows\system32\DRIVERS\k57nd60a.sys [x]
S3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda64v.sys [x]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - 1ED38B5879346219
*Deregistered* - 1ed38b5879346219
.
Inhalt des "geplante Tasks" Ordners
.
2012-01-28 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-08-25 15:04]
.
2012-01-28 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-08-25 15:04]
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2009-07-28 7982112]
"Acer ePower Management"="c:\program files\Packard Bell\Packard Bell Power Management\ePowerTray.exe" [2009-08-06 828960]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-07-28 16334880]
"SynTPEnh"="c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe" [BU]
"combofix"="c:\combofix\CF32660.3XE" [2010-11-20 345088]
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://search.us.b00kmarks.com/landing_t.php?guid={9B473226-D4BF-4F6E-AA12-FAA7802E0093}
uLocal Page = c:\windows\system32\blank.htm
uDefault_Search_URL = hxxp://search.us.b00kmarks.com/landing_t.php?guid={9B473226-D4BF-4F6E-AA12-FAA7802E0093}
mStart Page = hxxp://homepage.packardbell.com/rdr.aspx?b=ACPW&l=0407&m=easynote_lj65&r=27360811q015l03h4z195f48l2t452
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_7461B1589E8B4FB7.dll/cmsidewiki.html
TCP: DhcpNameServer = 192.168.1.1
FF - ProfilePath - c:\users\michel\AppData\Roaming\Mozilla\Firefox\Profiles\0vswzgmp.default\
FF - prefs.js: browser.startup.homepage - www.google.de/
FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: content.max.tokenizing.time - 1800000
FF - user.js: content.notify.interval - 600000
FF - user.js: content.switch.threshold - 1000000
FF - user.js: nglayout.initialpaint.delay - 600
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Toolbar-Locked - (no file)
.
.
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\1ed38b5879346219]
"ImagePath"="\SystemRoot\System32\Drivers\1ed38b5879346219.sys"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\Approved Extensions]
@Denied: (2) (LocalSystem)
"{18DF081C-E8AD-4283-A596-FA578C2EBDC3}"=hex:51,66,7a,6c,4c,1d,38,12,72,0b,cc,
1c,9f,a6,ed,07,da,80,b9,17,89,70,f9,d7
"{9030D464-4C02-4ABF-8ECC-5164760863C6}"=hex:51,66,7a,6c,4c,1d,38,12,0a,d7,23,
94,30,02,d1,0f,f1,da,12,24,73,56,27,d2
"{FF059E31-CC5A-4E2E-BF3B-96E929D65503}"=hex:51,66,7a,6c,4c,1d,38,12,5f,9d,16,
fb,68,82,40,0b,c0,2d,d5,a9,2c,88,11,17
"{BDEADE7F-C265-11D0-BCED-00A0C90AB50F}"=hex:51,66,7a,6c,4c,1d,38,12,11,dd,f9,
b9,57,8c,be,54,c3,fb,43,e0,cc,54,f1,1b
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration]
@Denied: (2) (LocalSystem)
"Timestamp"=hex:52,82,c6,a3,82,92,cc,01
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11e_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11e_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\program files (x86)\Avira\AntiVir Desktop\avguard.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2012-01-28 17:24:49 - PC wurde neu gestartet
ComboFix-quarantined-files.txt 2012-01-28 16:24
ComboFix2.txt 2012-01-26 17:57
.
Vor Suchlauf: 14 Verzeichnis(se), 254.217.605.120 Bytes frei
Nach Suchlauf: 15 Verzeichnis(se), 253.578.125.312 Bytes frei
.
- - End Of File - - 31B118F5D1A4D8A4B2FD2E49801C0552
--- --- --- |
