| momorossi | 08.07.2013 21:16 |
and here we go : Code:
ComboFix 13-07-08.02 - pe130296 08.07.2013 20:27:33.1.4 - x64
Microsoft Windows 7 Enterprise 6.1.7601.1.1252.1.1033.18.8058.5307 [GMT 2:00]
Running from: c:\users\pe130296\Desktop\ComboFix.exe
AV: McAfee VirusScan Enterprise *Disabled/Updated* {86355677-4064-3EA7-ABB3-1B136EB04637}
FW: McAfee Host Intrusion Prevention Firewall *Enabled* {BE0ED752-0A0B-3FFF-80EC-B2269063014C}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Created a new restore point
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\data
c:\data\mödling.pst
c:\data\mail\archive.pst
c:\users\pe130296\AppData\Local\assembly\tmp
c:\users\pe130296\AppData\Roaming\7 9
c:\users\pe130296\AppData\Roaming\7 9\_ctypes.pyd
c:\users\pe130296\AppData\Roaming\7 9\_hashlib.pyd
c:\users\pe130296\AppData\Roaming\7 9\_socket.pyd
c:\users\pe130296\AppData\Roaming\7 9\_ssl.pyd
c:\users\pe130296\AppData\Roaming\7 9\bat.bat
c:\users\pe130296\AppData\Roaming\7 9\boost_python-vc90-mt-1_39.dll
c:\users\pe130296\AppData\Roaming\7 9\bt.lnk
c:\users\pe130296\AppData\Roaming\7 9\bz2.pyd
c:\users\pe130296\AppData\Roaming\7 9\j.exe
c:\users\pe130296\AppData\Roaming\7 9\library.zip
c:\users\pe130296\AppData\Roaming\7 9\msvcp90.dll
c:\users\pe130296\AppData\Roaming\7 9\numpy.core._dotblas.pyd
c:\users\pe130296\AppData\Roaming\7 9\numpy.core._sort.pyd
c:\users\pe130296\AppData\Roaming\7 9\numpy.core.multiarray.pyd
c:\users\pe130296\AppData\Roaming\7 9\numpy.core.scalarmath.pyd
c:\users\pe130296\AppData\Roaming\7 9\numpy.core.umath.pyd
c:\users\pe130296\AppData\Roaming\7 9\numpy.fft.fftpack_lite.pyd
c:\users\pe130296\AppData\Roaming\7 9\numpy.lib._compiled_base.pyd
c:\users\pe130296\AppData\Roaming\7 9\numpy.linalg.lapack_lite.pyd
c:\users\pe130296\AppData\Roaming\7 9\numpy.random.mtrand.pyd
c:\users\pe130296\AppData\Roaming\7 9\phatk.cl
c:\users\pe130296\AppData\Roaming\7 9\pyopencl._cl.pyd
c:\users\pe130296\AppData\Roaming\7 9\python26.dll
c:\users\pe130296\AppData\Roaming\7 9\select.pyd
c:\users\pe130296\AppData\Roaming\7 9\settings.txt
c:\users\pe130296\AppData\Roaming\7 9\svchost.exe
c:\users\pe130296\AppData\Roaming\7 9\unicodedata.pyd
c:\users\pe130296\AppData\Roaming\7 9\w9xpopen.exe
c:\users\pe130296\AppData\Roaming\Local
c:\windows\SafeBoot.scr
.
.
((((((((((((((((((((((((( Files Created from 2013-06-08 to 2013-07-08 )))))))))))))))))))))))))))))))
.
.
2013-07-08 18:31 . 2013-07-08 18:31 -------- d-----w- c:\users\Default\AppData\Local\temp
2013-07-08 18:31 . 2013-07-08 18:31 -------- d-----w- c:\users\Administrator\AppData\Local\temp
2013-07-08 06:56 . 2013-07-08 06:56 -------- d-----w- c:\windows\system32\%LOCALAPPDATA%
2013-07-06 14:13 . 2013-07-06 14:13 -------- d-----w- C:\FRST
2013-07-06 13:28 . 2013-07-08 09:25 6352 ----a-w- c:\windows\system32\PerfStringBackup.TMP
2013-07-06 11:24 . 2013-07-06 11:24 -------- d-----w- c:\windows\system32\%appdata%
2013-06-26 17:11 . 2013-06-26 17:15 -------- d-----w- c:\users\pe130296\AppData\Roaming\Skype
2013-06-26 17:11 . 2013-06-26 17:11 -------- d-----w- c:\program files (x86)\Common Files\Skype
2013-06-26 17:11 . 2013-06-26 17:11 -------- d-----r- c:\program files (x86)\Skype
2013-06-26 17:11 . 2013-06-26 17:11 -------- d-----w- c:\programdata\Skype
2013-06-26 17:05 . 2013-06-26 17:05 -------- d-----w- c:\program files (x86)\Microsoft LifeCam
2013-06-26 17:05 . 2013-06-26 17:05 -------- d-----w- c:\program files\Microsoft LifeCam
2013-06-12 07:21 . 2010-01-26 17:56 40328 ----a-w- c:\windows\SysWow64\HIPIS0e011b5.dll
2013-06-12 07:21 . 2010-01-26 17:44 47080 ----a-w- c:\windows\system32\HIPIS0e011b5.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-05-08 23:57 . 2012-05-15 14:01 140992 ----a-w- c:\windows\SysWow64\KevlarSigs.dll
2013-05-02 17:13 . 2013-05-02 17:13 2892 ----a-w- c:\windows\SysWow64\audcon.sys
2013-04-25 09:16 . 2013-04-25 09:16 61440 ----a-r- c:\users\pe130296\AppData\Roaming\Microsoft\Installer\{11953C65-BB4E-4CA4-B0F0-2600A4B20040}\ARPPRODUCTICON.exe
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{F586CB96-7091-42ec-9829-F5D5CE65AFC1}]
2013-04-05 16:19 1220880 ----a-w- c:\program files (x86)\DIAL GmbH\DIALux\Dialux.BHO.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HP Photosmart 7520 series (NET)"="c:\program files\HP\HP Photosmart 7520 series\Bin\ScanToPCActivationApp.exe" [2012-10-17 2573416]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"COEMsgDisplay"="c:\program files (x86)\Hewlett-Packard\PC COE\COEMsgDisplay.exe" [2007-04-11 26624]
"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-09-07 37296]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-03-30 937920]
"BCSSync"="c:\program files (x86)\Microsoft Office\Office14\BCSSync.exe" [2010-03-13 91520]
"GetITIcon"="c:\program files (x86)\Hewlett-Packard\GetITIcon\GetITShell.exe" [2011-08-30 861696]
"McAfee Host Intrusion Prevention Tray"="c:\program files (x86)\McAfee\Host Intrusion Prevention\FireTray.exe" [2010-06-15 979104]
"IDA"="c:\program files (x86)\Hewlett-Packard\PC COE\IDA.EXE" [2011-04-02 176128]
"IAStorIcon"="c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIconLaunch.exe" [2012-02-29 56088]
"QLBController"="c:\program files (x86)\Hewlett-Packard\HP Hotkey Support\QLBController.exe" [2012-04-04 322432]
"HPConnectionManager"="c:\program files (x86)\Hewlett-Packard\HP Connection Manager\HPCMDelayStart.exe" [2012-04-26 184704]
"eepc_SmartClient"="c:\program files (x86)\SmartClient\Smart.exe" [2013-01-31 115200]
"ShStatEXE"="c:\program files (x86)\McAfee\VirusScan Enterprise\SHSTAT.EXE" [2011-08-31 124224]
"SafeBootTrayManager"="c:\program files (x86)\SafeBoot Tray Manager\SbTrayManager.exe" [2009-08-19 69632]
"SafeBootTokenWatcher"="c:\program files (x86)\McAfee\Endpoint Encryption for PC\SbTokWatch.exe" [2011-09-15 172092]
"McAfeeUpdaterUI"="c:\program files (x86)\McAfee\Common Framework\udaterui.exe" [2012-11-27 333416]
"Adobe Acrobat Speed Launcher"="c:\program files (x86)\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe" [2008-06-12 37232]
"Acrobat Assistant 8.0"="c:\program files (x86)\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe" [2008-06-11 640376]
"Nikon Message Center 2"="c:\program files (x86)\Nikon\Nikon Message Center 2\NkMC2.exe" [2011-10-30 571392]
"PlantronicsURE.exe"="c:\program files (x86)\Plantronics\PlantronicsURE\PlantronicsURE.exe" [2013-02-28 625040]
"PlantronicsBatteryStatus.exe"="c:\program files (x86)\Plantronics\PlantronicsURE\PlantronicsBatteryStatus.exe" [2013-02-28 356752]
"HP Software Update"="c:\program files (x86)\Hp\HP Software Update\HPWuSchd2.exe" [2011-10-28 49208]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2013-01-28 59720]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2013-02-20 152392]
"Communicator"="c:\program files (x86)\Microsoft Lync\communicator.exe" [2012-09-28 12105344]
"AgentUiRunKey"="c:\program files (x86)\PC Backup\Agent.exe" [2012-11-28 299856]
"BambooCore"="c:\program files (x86)\Bamboo Dock\BambooCore.exe" [2012-10-16 646744]
"LifeCam"="c:\program files (x86)\Microsoft LifeCam\LifeExp.exe" [2010-05-20 119152]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
ActivClient Agent.lnk - c:\program files\ActivIdentity\ActivClient\acsagent.exe [2009-6-3 164904]
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2012-2-1 1380128]
WinZip Quick Pick.lnk - c:\program files\WinZip\WZQKPICK32.EXE [2012-4-4 603536]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 4 (0x4)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"dontdisplaylockeduserid"= 1 (0x1)
"LogonType"= 0 (0x0)
"HideFastUserSwitching"= 1 (0x1)
"ReportControllerMissing"= 0 (0x0)
"DisableNT4Policy"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"HideSCAHealth"= 1 (0x1)
"NoWebServices"= 1 (0x1)
"NoPublishingWizard"= 1 (0x1)
"NoAutorun"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Notification Packages REG_MULTI_SZ sbnp scecli c:\program files\WIDCOMM\Bluetooth Software\BtwProximityCP.dll
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\McAfeeEngineService]
@="Service"
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 enterceptAgent;McAfee Host Intrusion Prevention Service;c:\program files (x86)\McAfee\Host Intrusion Prevention\FireSvc.exe;c:\program files (x86)\McAfee\Host Intrusion Prevention\FireSvc.exe [x]
R2 McAfeeEngineService;McAfee Engine Service;c:\program files (x86)\McAfee\VirusScan Enterprise\x64\EngineServer.exe;c:\program files (x86)\McAfee\VirusScan Enterprise\x64\EngineServer.exe [x]
R2 SafeBootClientManager;SafeBoot Client Manager;c:\program files (x86)\McAfee\Endpoint Encryption for PC\SbClientManager.exe;c:\program files (x86)\McAfee\Endpoint Encryption for PC\SbClientManager.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R3 DialComService;DIAL Communication Service;c:\program files (x86)\DIAL GmbH\DIAL Communication Framework\DialComService.exe;c:\program files (x86)\DIAL GmbH\DIAL Communication Framework\DialComService.exe [x]
R3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys;c:\windows\SYSNATIVE\drivers\dmvsc.sys [x]
R3 Firehk;McAfee NDIS Intermediate Filter;c:\windows\system32\DRIVERS\firehk.sys;c:\windows\SYSNATIVE\DRIVERS\firehk.sys [x]
R3 hidkmdf;KMDF Driver;c:\windows\system32\DRIVERS\hidkmdf.sys;c:\windows\SYSNATIVE\DRIVERS\hidkmdf.sys [x]
R3 LV_Tracker;LV_Tracker;c:\windows\system32\DRIVERS\LV_Tracker64.sys;c:\windows\SYSNATIVE\DRIVERS\LV_Tracker64.sys [x]
R3 mferkdet;McAfee Inc. mferkdet;c:\windows\system32\drivers\mferkdet.sys;c:\windows\SYSNATIVE\drivers\mferkdet.sys [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]
R3 SmbDrvAMDASF;SmbDrvAMDASF;c:\windows\system32\drivers\Smb_driver_AMDASF.sys;c:\windows\SYSNATIVE\drivers\Smb_driver_AMDASF.sys [x]
R3 SmbDrvIntel;SmbDrvIntel;c:\windows\system32\drivers\Smb_driver_Intel.sys;c:\windows\SYSNATIVE\drivers\Smb_driver_Intel.sys [x]
R3 Synth3dVsc;Microsoft Virtual 3D Video Transport Driver;c:\windows\system32\drivers\Synth3dVsc.sys;c:\windows\SYSNATIVE\drivers\Synth3dVsc.sys [x]
R3 terminpt;Microsoft Remote Desktop Input Driver;c:\windows\system32\drivers\terminpt.sys;c:\windows\SYSNATIVE\drivers\terminpt.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
R3 tsusbhub;Remote Deskotop USB Hub;c:\windows\system32\drivers\tsusbhub.sys;c:\windows\SYSNATIVE\drivers\tsusbhub.sys [x]
R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys;c:\windows\SYSNATIVE\drivers\rdvgkmd.sys [x]
R3 WacHidRouter;Wacom Hid Router;c:\windows\system32\DRIVERS\wachidrouter.sys;c:\windows\SYSNATIVE\DRIVERS\wachidrouter.sys [x]
R3 wacmoumonitor;Wacom Mode Helper;c:\windows\system32\DRIVERS\wacmoumonitor.sys;c:\windows\SYSNATIVE\DRIVERS\wacmoumonitor.sys [x]
R3 wacomrouterfilter;Wacom Router Filter Driver;c:\windows\system32\DRIVERS\wacomrouterfilter.sys;c:\windows\SYSNATIVE\DRIVERS\wacomrouterfilter.sys [x]
R4 PdiService;Portrait Displays SDK Service;c:\program files (x86)\Common Files\Portrait Displays\Drivers\pdisrvc.exe;c:\program files (x86)\Common Files\Portrait Displays\Drivers\pdisrvc.exe [x]
S0 iusb3hcs;Intel(R) USB 3.0 Host Controller Switch Driver;c:\windows\system32\drivers\iusb3hcs.sys;c:\windows\SYSNATIVE\drivers\iusb3hcs.sys [x]
S0 mfewfpk;McAfee Inc. mfewfpk;c:\windows\system32\drivers\mfewfpk.sys;c:\windows\SYSNATIVE\drivers\mfewfpk.sys [x]
S0 SafeBoot;SafeBoot; [x]
S0 SBAlg;SBAlg; [x]
S0 SbFsLock;SbFsLock; [x]
S1 RsvLock;RsvLock; [x]
S1 SbFlop;SbFlop; [x]
S1 SbRegFlt;SbRegFlt; [x]
S2 ac.sharedstore;ActivIdentity Shared Store Service;c:\program files\Common Files\ActivIdentity\ac.sharedstore.exe;c:\program files\Common Files\ActivIdentity\ac.sharedstore.exe [x]
S2 AgentService;AgentService;c:\program files (x86)\PC Backup\AgentService.exe;c:\program files (x86)\PC Backup\AgentService.exe [x]
S2 FIMPasswordReset;Forefront Identity Manager Password Reset Client Service;c:\program files\Microsoft Forefront Identity Manager\2010\Password Reset Client Service\PwdMgmtProxy.exe;c:\program files\Microsoft Forefront Identity Manager\2010\Password Reset Client Service\PwdMgmtProxy.exe [x]
S2 hips;McAfee HIPSCore Service;c:\program files (x86)\McAfee\Host Intrusion Prevention\HIPSCore\x64\HIPSvc.exe;c:\program files (x86)\McAfee\Host Intrusion Prevention\HIPSCore\x64\HIPSvc.exe [x]
S2 HP Power Assistant Service;HP Power Assistant Service;c:\program files\Hewlett-Packard\HP Power Assistant\HPPA_Service.exe;c:\program files\Hewlett-Packard\HP Power Assistant\HPPA_Service.exe [x]
S2 hpHotkeyMonitor;hpHotkeyMonitor;c:\program files (x86)\Hewlett-Packard\HP Hotkey Support\HPHotkeyMonitor.exe;c:\program files (x86)\Hewlett-Packard\HP Hotkey Support\HPHotkeyMonitor.exe [x]
S2 hpsrv;HP Service;c:\windows\system32\Hpservice.exe;c:\windows\SYSNATIVE\Hpservice.exe [x]
S2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [x]
S2 McAfee SiteAdvisor Enterprise Service;McAfee SiteAdvisor Enterprise Service;c:\program files (x86)\McAfee\SiteAdvisor Enterprise\McSACore.exe;c:\program files (x86)\McAfee\SiteAdvisor Enterprise\McSACore.exe [x]
S2 mfevtp;McAfee Validation Trust Protection Service;c:\windows\system32\mfevtps.exe;c:\windows\SYSNATIVE\mfevtps.exe [x]
S2 PSI_SVC_2_x64;Protexis Licensing V2 x64;c:\program files\Common Files\Protexis\License Service\PsiService_2.exe;c:\program files\Common Files\Protexis\License Service\PsiService_2.exe [x]
S2 radexecd;HPCA Notify Daemon;c:\program files (x86)\Hewlett-Packard\PC COE 3\OV CMS\radexecd.exe;c:\program files (x86)\Hewlett-Packard\PC COE 3\OV CMS\radexecd.exe [x]
S2 radsched;HPCA Scheduler Daemon;c:\program files (x86)\Hewlett-Packard\PC COE 3\OV CMS\radsched.exe;c:\program files (x86)\Hewlett-Packard\PC COE 3\OV CMS\radsched.exe [x]
S2 Radstgms;HPCA MSI Redirector;c:\program files (x86)\Hewlett-Packard\PC COE 3\OV CMS\Radstgms.exe;c:\program files (x86)\Hewlett-Packard\PC COE 3\OV CMS\Radstgms.exe [x]
S2 svctimehpc;Timing Service;c:\program files (x86)\Products\Time Service\svctimehpc.exe;c:\program files (x86)\Products\Time Service\svctimehpc.exe [x]
S2 TabletServicePen;TabletServicePen;c:\windows\system32\Pen_Tablet.exe;c:\windows\SYSNATIVE\Pen_Tablet.exe [x]
S2 vcsFPService;Validity VCS Fingerprint Service;c:\windows\system32\vcsFPService.exe;c:\windows\SYSNATIVE\vcsFPService.exe [x]
S2 WTabletServiceCon;Wacom Consumer Service;c:\program files\Tablet\Pen\WTabletServiceCon.exe;c:\program files\Tablet\Pen\WTabletServiceCon.exe [x]
S3 bcbtums;Bluetooth RAM Firmware Download USB Filter;c:\windows\system32\drivers\bcbtums.sys;c:\windows\SYSNATIVE\drivers\bcbtums.sys [x]
S3 btwampfl;btwampfl Bluetooth filter driver;c:\windows\system32\drivers\btwampfl.sys;c:\windows\SYSNATIVE\drivers\btwampfl.sys [x]
S3 BTWDPAN;Bluetooth Personal Area Network;c:\windows\system32\DRIVERS\btwdpan.sys;c:\windows\SYSNATIVE\DRIVERS\btwdpan.sys [x]
S3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys;c:\windows\SYSNATIVE\DRIVERS\btwl2cap.sys [x]
S3 FirehkMP;FirehkMP;c:\windows\system32\DRIVERS\firehk.sys;c:\windows\SYSNATIVE\DRIVERS\firehk.sys [x]
S3 HIPK;McAfee Inc. HIPK;c:\windows\system32\drivers\HIPK.sys;c:\windows\SYSNATIVE\drivers\HIPK.sys [x]
S3 HIPPSK;McAfee Inc. HIPPSK;c:\windows\system32\drivers\HIPPSK.sys;c:\windows\SYSNATIVE\drivers\HIPPSK.sys [x]
S3 HIPQK;McAfee Inc. HIPQK;c:\windows\system32\drivers\HIPQK.sys;c:\windows\SYSNATIVE\drivers\HIPQK.sys [x]
S3 hpCMSrv;HP Connection Manager 4 Service;c:\program files (x86)\Hewlett-Packard\HP Connection Manager\hpCMSrv.exe;c:\program files (x86)\Hewlett-Packard\HP Connection Manager\hpCMSrv.exe [x]
S3 IntcDAud;Intel(R) Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys;c:\windows\SYSNATIVE\DRIVERS\IntcDAud.sys [x]
S3 iusb3hub;Intel(R) USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\iusb3hub.sys;c:\windows\SYSNATIVE\DRIVERS\iusb3hub.sys [x]
S3 iusb3xhc;Intel(R) USB 3.0 eXtensible Host Controller Driver;c:\windows\system32\DRIVERS\iusb3xhc.sys;c:\windows\SYSNATIVE\DRIVERS\iusb3xhc.sys [x]
S3 JMCR;JMCR;c:\windows\system32\DRIVERS\jmcr.sys;c:\windows\SYSNATIVE\DRIVERS\jmcr.sys [x]
S3 johci;JMicron 1394 Filter Driver;c:\windows\system32\DRIVERS\johci.sys;c:\windows\SYSNATIVE\DRIVERS\johci.sys [x]
S3 Mandiant_Tools;Mandiant_Tools;c:\programdata\Application Data\Time Service\mktools.sys;c:\programdata\Application Data\Time Service\mktools.sys [x]
S3 RadiaMsi;RadiaMsi;c:\windows\system32\DRIVERS\radiamsi.sys;c:\windows\SYSNATIVE\DRIVERS\radiamsi.sys [x]
.
.
--- Other Services/Drivers In Memory ---
.
*NewlyCreated* - 19010735
*NewlyCreated* - MANDIANT_TOOLS
*Deregistered* - 19010735
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{86E45973-5352-439F-A115-2E8EE4D40140}]
2012-05-15 13:16 188416 ----a-w- c:\program files (x86)\Common Files\Hewlett-Packard\ActSet\HpActSet.exe
.
Contents of the 'Scheduled Tasks' folder
.
2013-07-08 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-04-26 08:32]
.
2013-07-08 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-04-26 08:32]
.
2013-07-08 c:\windows\Tasks\IDA{07A2D605-F561-11D1-BEE5-AC785AC8CD4E}000.job
- c:\windows\system32\rundll32.exe [2009-07-13 01:14]
.
2013-07-08 c:\windows\Tasks\IDA{07A2D605-F561-11D1-BEE5-AC785AC8CD4E}001.job
- c:\windows\system32\rundll32.exe [2009-07-13 01:14]
.
2013-07-08 c:\windows\Tasks\IDA{24AB88C9-D233-48EF-9EC5-79D902043D09}000.job
- c:\windows\system32\rundll32.exe [2009-07-13 01:14]
.
2013-07-08 c:\windows\Tasks\IDA{5B940D5F-0A3F-11D2-95B5-080009DC8202}000.job
- c:\windows\system32\rundll32.exe [2009-07-13 01:14]
.
2013-07-08 c:\windows\Tasks\IDA{5B940D5F-0A3F-11D2-95B5-080009DC8202}001.job
- c:\program files (x86)\Hewlett-Packard\PC COE\coetl32.exe [2007-06-24 05:27]
.
2013-07-08 c:\windows\Tasks\IDA{96A23EF4-3F38-4839-B12A-860409AC2861}000.job
- c:\windows\system32\rundll32.exe [2009-07-13 01:14]
.
2013-07-08 c:\windows\Tasks\IDA{E1B2A4DD-AE06-4B97-9B55-8E8F1348E7FB}000.job
- c:\windows\system32\rundll32.exe [2009-07-13 01:14]
.
2013-07-08 c:\windows\Tasks\Maint.job
- c:\program files (x86)\Hewlett-Packard\PC COE\IDASnapIn2.exe [2010-10-28 14:35]
.
2013-07-08 c:\windows\Tasks\pcpm-collector.job
- c:\program files (x86)\Hewlett-Packard\PC COE\IDASnapIn2.exe [2010-10-28 14:35]
.
2013-07-08 c:\windows\Tasks\pcpm-consolidator.job
- c:\program files (x86)\Hewlett-Packard\PC COE\IDASnapIn2.exe [2010-10-28 14:35]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"acevents"="c:\program files\ActivIdentity\ActivClient\acevents.exe" [2009-06-03 196648]
"accrdsub"="c:\program files\ActivIdentity\ActivClient\accrdsub.exe" [2009-06-03 483880]
"PasswordRegistration"="c:\windows\system32\MsPwdRegistration.exe" [2010-08-18 31080]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2012-04-30 170264]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2012-04-30 398616]
"Persistence"="c:\windows\system32\igfxpers.exe" [2012-04-30 439064]
"SysTrayApp"="c:\program files\IDT\WDM\sttray64.exe" [2012-04-15 1425408]
"HPPowerAssistant"="c:\program files\Hewlett-Packard\HP Power Assistant\DelayedAppStarter.exe" [2012-03-14 15232]
"HPRAService"="c:\program files\RA2HP\HPRAService.exe" [2012-12-18 139776]
"VX3000"="c:\windows\vVX3000.exe" [2010-05-20 762736]
.
------- Supplementary Scan -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://intranet.hp.com/Country/Austria/Pages/index.aspx
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: Append to existing PDF - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert link target to Adobe PDF - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert link target to existing PDF - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Convert to Adobe PDF - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~1\Office14\EXCEL.EXE/3000
IE: Se&nd to OneNote - c:\progra~2\MICROS~1\Office14\ONBttnIE.dll/105
Trusted Zone: basenotes.net\www
Trusted Zone: compaq.com
Trusted Zone: compaq.com.ar
Trusted Zone: compaq.com.br
Trusted Zone: compaq.com.co
Trusted Zone: compaq.com.mx
Trusted Zone: compaq.com.sg
Trusted Zone: compaq.com.ve
Trusted Zone: cpqcorp.net
Trusted Zone: dcu.org
Trusted Zone: eds.com
Trusted Zone: hp.com
Trusted Zone: hpqcorp.net
Trusted Zone: sharefile.com\hp
TCP: DhcpNameServer = 195.202.138.3 195.202.128.3 62.40.128.2
.
- - - - ORPHANS REMOVED - - - -
.
Toolbar-Locked - (no file)
Wow6432Node-HKLM-Run-<NO NAME> - (no file)
c:\users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\create_shortcut.lnk - c:\users\pe130296\create_shortcut.vbs
c:\users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\reg_off2k7.lnk - c:\users\pe130296\reg_off2k7.vbs
c:\users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\create_shortcut.lnk - c:\users\pe130296\create_shortcut.vbs
c:\users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\reg_off2k7.lnk - c:\users\pe130296\reg_off2k7.vbs
Toolbar-Locked - (no file)
HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe
.
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10zc_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10zc_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10zc.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10zc.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10zc.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10zc.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\McAfee]
"SymbolicLinkValue"=hex(6):5c,00,52,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,6f,00,66,00,\
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Network Associates]
"SymbolicLinkValue"=hex(6):5c,00,52,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,6f,00,66,00,\
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
@Denied: (A) (Everyone)
"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
"Key"="ActionsPane3"
"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Nico Mak Computing\WinZip]
"SymbolicLinkValue"=hex(6):5c,00,52,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,6f,00,66,00,\
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Completion time: 2013-07-08 20:33:59
ComboFix-quarantined-files.txt 2013-07-08 18:33
.
Pre-Run: 362.707.161.088 bytes free
Post-Run: 362.946.236.416 bytes free
.
- - End Of File - - 7490804260309120001DFDE7B8B9DEF6
D41D8CD98F00B204E9800998ECF8427E
|
+ R Taste und schreibe notepad in das Ausführen Fenster.
TDSSKiller.exe und speichere diese Datei auf dem Desktop
WARNUNG an die MITLESER: