Trojaner-Board - Schwarzes Fenster system 32 beim start von windows 7

Malwarebytes Anti-Malware (Test) 1.70.0.1100
www.malwarebytes.org

Datenbank Version: v2013.02.26.06

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
Bina :: BINA-PC [Administrator]

Schutz: Aktiviert

26.02.2013 10:24:41
mbam-log-2013-02-26 (10-24-41).txt

Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 239952
Laufzeit: 2 Minute(n), 32 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 1
C:\ProgramData\IBUpdaterService (PUP.InstallBrain) -> Keine Aktion durchgeführt.

Infizierte Dateien: 2
C:\ProgramData\IBUpdaterService\ibsvc.exe (PUP.InstallBrain) -> Keine Aktion durchgeführt.
C:\ProgramData\IBUpdaterService\repository.xml (PUP.InstallBrain) -> Keine Aktion durchgeführt.

(Ende)

.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.DDS Logfile:

Code:

DDS (Ver_2012-11-20.01)

.

Microsoft Windows 7 Home Premium 

Boot Device: \Device\HarddiskVolume2

Install Date: 30.08.2011 14:24:12

System Uptime: 26.02.2013 13:09:58 (0 hours ago)

.

Motherboard: Packard Bell    |  | EasyNote LM81                  

Processor: AMD Athlon(tm) II P320 Dual-Core Processor | Socket S1G4 | 2100/200mhz

.

==== Disk Partitions =========================

.

C: is FIXED (NTFS) - 285 GiB total, 184,021 GiB free.

D: is CDROM ()

.

==== Disabled Device Manager Items =============

.

Class GUID: 

Description: Ethernet-Controller

Device ID: PCI\VEN_14E4&DEV_1692&SUBSYS_033D1025&REV_01\206A8AFFFE2D8D5100

Manufacturer: 

Name: Ethernet-Controller

PNP Device ID: PCI\VEN_14E4&DEV_1692&SUBSYS_033D1025&REV_01\206A8AFFFE2D8D5100

Service: 

.

==== System Restore Points ===================

.

RP261: 21.02.2013 14:35:36 - DirectX wurde installiert

RP263: 25.02.2013 19:27:13 - Windows Defender Checkpoint

RP264: 26.02.2013 09:53:37 - Windows Update

.

==== Installed Programs ======================

.

ACR version 0.001

Adobe Flash Player 11 ActiveX

Adobe Reader 9.1 MUI

Advertising Center

Agatha Christie - Death on the Nile

Alcor Micro USB Card Reader

AMD USB Filter Driver

Apple Application Support

Apple Mobile Device Support

Apple Software Update

ATI Catalyst Install Manager

Audacity 2.0

Backup Manager Basic

Battlefield Vietnam(TM)

Bejeweled 2 Deluxe

Bonjour

Build-a-lot 2

Catalyst Control Center - Branding

Catalyst Control Center Core Implementation

Catalyst Control Center Graphics Full Existing

Catalyst Control Center Graphics Full New

Catalyst Control Center Graphics Light

Catalyst Control Center Graphics Previews Common

Catalyst Control Center InstallProxy

Catalyst Control Center Localization All

ccc-core-static

ccc-utility64

CCC Help Chinese Standard

CCC Help Chinese Traditional

CCC Help Czech

CCC Help Danish

CCC Help Dutch

CCC Help English

CCC Help Finnish

CCC Help French

CCC Help German

CCC Help Greek

CCC Help Hungarian

CCC Help Italian

CCC Help Japanese

CCC Help Korean

CCC Help Norwegian

CCC Help Polish

CCC Help Portuguese

CCC Help Russian

CCC Help Spanish

CCC Help Swedish

CCC Help Thai

CCC Help Turkish

CCleaner

Chuzzle Deluxe

Collab

DC Universe Online Live

Diner Dash 2 Restaurant Rescue

DivX-Setup

Driver: Parallel Lines

DriverTuner 3.1.0.0

Farm Frenzy

FATE

Final Drive Nitro

FL Studio 5

Free YouTube to MP3 Converter version 3.12.0.128

Google Chrome

Google Earth

Google Update Helper

Identity Card

ImagXpress

Insaniquarium Deluxe

iTunes

Java Auto Updater

Java(TM) 6 Update 31

Jewel Quest Solitaire 2

John Deere Drive Green

Junk Mail filter update

Launch Manager

Malwarebytes Anti-Malware Version 1.70.0.1100

Microsoft .NET Framework 4 Client Profile

Microsoft .NET Framework 4 Client Profile DEU Language Pack

Microsoft Application Error Reporting

Microsoft Choice Guard

Microsoft Games for Windows - LIVE Redistributable

Microsoft Games for Windows Marketplace

Microsoft Silverlight

Microsoft SQL Server 2005 Compact Edition [ENU]

Microsoft Visual C++ 2005 Redistributable

Microsoft Visual C++ 2005 Redistributable (x64)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161

Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161

Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219

Microsoft WSE 3.0 Runtime

MSVCRT

MSVCRT Redists

MSXML 4.0 SP2 (KB954430)

MSXML 4.0 SP2 (KB973688)

Need For Speed™ World

Nero 9 Essentials

Nero ControlCenter

Nero DiscSpeed

Nero DiscSpeed Help

Nero DriveSpeed

Nero DriveSpeed Help

Nero Express Help

Nero InfoTool

Nero InfoTool Help

Nero Installer

Nero Online Upgrade

Nero StartSmart

Nero StartSmart Help

Nero StartSmart OEM

NeroExpress

neroxml

NVIDIA GAME System Software 2.8.1

NVIDIA PhysX

OF Dragon Rising

OpenOffice.org 3.3

Packard Bell Games

Packard Bell InfoCentre

Packard Bell MyBackup

Packard Bell Power Management

Packard Bell Recovery Management

Packard Bell Registration

Packard Bell ScreenSaver

Packard Bell Social Networks

Packard Bell Updater

Penguins!

Plants vs. Zombies

Polar Bowler

Polar Golfer

Ravensburger tiptoi

Realtek High Definition Audio Driver

SAMSUNG USB Driver for Mobile Phones

Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368v2)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2656405)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2686827)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2729449)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2737019)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2742595)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2789642)

Security Update for Microsoft .NET Framework 4 Client Profile DEU Language Pack (KB2478663)

Security Update for Microsoft .NET Framework 4 Client Profile DEU Language Pack (KB2518870)

Skype™ 5.10

Spybot - Search & Destroy

SUPERAntiSpyware

swMSM

Synaptics Pointing Device Driver

Unity Web Player

Update for Microsoft .NET Framework 4 Client Profile (KB2468871)

Update for Microsoft .NET Framework 4 Client Profile (KB2533523)

Update for Microsoft .NET Framework 4 Client Profile (KB2600217)

VC80CRTRedist - 8.0.50727.6195

Vegas Pro 10.0

Video Web Camera

Virtual Villagers 4 - The Tree of Life

VirtualDJ Home FREE

Welcome Center

Windows Live-Uploadtool

Windows Live Call

Windows Live Communications Platform

Windows Live Essentials

Windows Live Fotogalerie

Windows Live ID Sign-in Assistant

Windows Live Mail

Windows Live Movie Maker

Windows Live Sync

Windows Live Writer

WinRAR 4.01 (64-Bit)

Zuma's Revenge

Zuma Deluxe

.

==== End Of File ===========================
 

DDS Logfile:
 

        Code:


        
DDS (Ver_2012-11-20.01) - NTFS_AMD64 

Internet Explorer: 9.0.8112.16464

Run by Bina at 13:17:07 on 2013-02-26

Microsoft Windows 7 Home Premium   6.1.7601.1.1252.49.1031.18.3838.2092 [GMT 1:00]

.

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

============== Running Processes ===============

.

C:\Windows\system32\lsm.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\svchost.exe -k RPCSS

C:\Windows\system32\atiesrxx.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\svchost.exe -k NetworkService

C:\Windows\system32\atieclxx.exe

C:\Windows\System32\spoolsv.exe

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE

C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Program Files (x86)\Launch Manager\dsiwmis.exe

C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerSvc.exe

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\Program Files (x86)\Packard Bell\Registration\GREGsvc.exe

C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe

C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe

C:\Windows\system32\svchost.exe -k imgsvc

C:\Program Files\Packard Bell\Packard Bell Updater\UpdaterService.exe

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

C:\Windows\system32\SearchIndexer.exe

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe

C:\Windows\system32\taskhost.exe

C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

C:\Windows\PLFSetI.exe

C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerTray.exe

C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe

C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe

C:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE

C:\Program Files (x86)\ACR\AutoClubRev\web\acrlauncher.exe

C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe

C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin

C:\Program Files (x86)\Launch Manager\LManager.exe

C:\Program Files (x86)\Video Web Camera\traybar.exe

C:\Program Files (x86)\iTunes\iTunesHelper.exe

C:\Program Files\Synaptics\SynTP\SynTPHelper.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe

C:\Program Files (x86)\Launch Manager\LMworker.exe

C:\Windows\system32\wbem\unsecapp.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerEvent.exe

C:\Windows\System32\svchost.exe -k LocalServicePeerNet

C:\Program Files\Windows Media Player\wmpnetwk.exe

C:\Windows\sysWOW64\wbem\wmiprvse.exe

C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe

C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe

C:\Windows\system32\sppsvc.exe

C:\Windows\System32\svchost.exe -k secsvcs

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\Windows\servicing\TrustedInstaller.exe

C:\Windows\system32\taskhost.exe

C:\Windows\system32\SearchProtocolHost.exe

C:\Windows\system32\SearchFilterHost.exe

C:\Windows\System32\cscript.exe

.

============== Pseudo HJT Report ===============

.

uStart Page = hxxp://www.facebook.com/

uDefault_Page_URL = hxxp://packardbell.msn.com

mStart Page = hxxp://packardbell.msn.com

mDefault_Page_URL = hxxp://packardbell.msn.com

uProxyOverride = 127.0.0.1:9421;<local>

mWinlogon: Userinit = userinit.exe,

BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - c:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

BHO: DivX Plus Web Player HTML5 <video>: {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll

BHO: Java(tm) Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll

BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

BHO: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll

BHO: DVDVideoSoft WebPageAdjuster Class: {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - C:\Program Files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll

uRun: [SpybotSD TeaTimer] C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe

uRun: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe

uRun: [GoogleChromeAutoLaunch_FC3C7AFF6FA05DEB76F42E512273B035] "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --no-startup-window

mRun: [BackupManagerTray] "C:\Program Files (x86)\NewTech Infosystems\Packard Bell MyBackup\BackupManagerTray.exe" -h -k                                                                                                                                                                           

mRun: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun

mRun: [LManager] C:\Program Files (x86)\Launch Manager\LManager.exe

mRun: [Camera Assistant Software] "C:\Program Files (x86)\Video Web Camera\traybar.exe"

mRun: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"

mRun: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"

StartupFolder: C:\Users\Bina\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\ACRLAU~1.LNK - C:\Program Files (x86)\ACR\AutoClubRev\web\acrlauncher.exe

StartupFolder: C:\Users\Bina\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\OPENOF~1.LNK - C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe

mPolicies-Explorer: NoActiveDesktop = dword:1

mPolicies-Explorer: NoActiveDesktopChanges = dword:1

mPolicies-System: ConsentPromptBehaviorAdmin = dword:5

mPolicies-System: ConsentPromptBehaviorUser = dword:3

mPolicies-System: EnableUIADesktopToggle = dword:0

IE: Free YouTube Download - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\freeytvdownloader.htm

IE: Free YouTube to MP3 Converter - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\freeytmp3downloader.htm

IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll

IE: {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - C:\Program Files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll

.

INFO: HKCU has more than 50 listed domains.

If you wish to scan all of them, select the 'Force scan all domains' option.

.

DPF: {784797A8-342D-4072-9486-03C8D0F2F0A1} - hxxp://www.battlefieldheroes.com/static/updater/BFHUpdater_5.0.127.0.cab

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab

TCP: NameServer = 192.168.178.1

TCP: Interfaces\{1CFB4298-42DF-4E9A-893C-8592B1FF10EE} : DHCPNameServer = 192.168.178.1

TCP: Interfaces\{1CFB4298-42DF-4E9A-893C-8592B1FF10EE}\142736F627D2249363442303 : DHCPNameServer = 192.168.2.1

TCP: Interfaces\{1CFB4298-42DF-4E9A-893C-8592B1FF10EE}\142736F627D2345493333373 : DHCPNameServer = 192.168.2.1

TCP: Interfaces\{1CFB4298-42DF-4E9A-893C-8592B1FF10EE}\37C6166796B6 : DHCPNameServer = 192.168.0.1

TCP: Interfaces\{1CFB4298-42DF-4E9A-893C-8592B1FF10EE}\46C696E6B6 : DHCPNameServer = 192.168.0.1

TCP: Interfaces\{1CFB4298-42DF-4E9A-893C-8592B1FF10EE}\64259445A51224F6870264F6E60275C414E40273131323 : DHCPNameServer = 192.168.178.1

Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll

SSODL: WebCheck - <orphaned>

mASetup: {8A69D345-D564-463c-AFF1-A69D9E530F96} - "C:\Program Files (x86)\Google\Chrome\Application\25.0.1364.97\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --multi-install --chrome

x64-mStart Page = hxxp://packardbell.msn.com

x64-mDefault_Page_URL = hxxp://packardbell.msn.com

x64-BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

x64-BHO: DVDVideoSoft WebPageAdjuster Class: {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - C:\Program Files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns64.dll

x64-Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s

x64-Run: [SynTPEnh] C:\Program Files (x86)\Synaptics\SynTP\SynTPEnh.exe

x64-Run: [PLFSetI] C:\Windows\PLFSetI.exe

x64-Run: [Acer ePower Management] C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerTray.exe

x64-Run: [AmIcoSinglun64] C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe

x64-IE: {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - C:\Program Files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns64.dll

x64-Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - <orphaned>

x64-SSODL: WebCheck - <orphaned>

.

============= SERVICES / DRIVERS ===============

.

R1 SASDIFSV;SASDIFSV;C:\Program Files\SUPERAntiSpyware\sasdifsv64.sys [2011-7-22 14928]

R1 SASKUTIL;SASKUTIL;C:\Program Files\SUPERAntiSpyware\saskutil64.sys [2011-7-12 12368]

R2 !SASCORE;SAS Core Service;C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE [2011-8-12 140672]

R2 AMD External Events Utility;AMD External Events Utility;C:\Windows\System32\atiesrxx.exe [2011-2-13 202752]

R2 DsiWMIService;Dritek WMI Service;C:\Program Files (x86)\Launch Manager\dsiwmis.exe [2011-2-13 321104]

R2 ePowerSvc;Acer ePower Service;C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerSvc.exe [2011-2-13 868896]

R2 GREGService;GREGService;C:\Program Files (x86)\Packard Bell\Registration\GREGsvc.exe [2010-1-8 23584]

R2 MBAMScheduler;MBAMScheduler;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [2013-2-26 398184]

R2 MBAMService;MBAMService;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2013-2-26 682344]

R2 Updater Service;Updater Service;C:\Program Files\Packard Bell\Packard Bell Updater\UpdaterService.exe [2010-9-9 243232]

R3 MBAMProtector;MBAMProtector;C:\Windows\System32\drivers\mbam.sys [2013-2-26 24176]

R3 usbfilter;AMD USB Filter Driver;C:\Windows\System32\drivers\usbfilter.sys [2011-2-13 38456]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]

S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]

S2 SkypeUpdate;Skype Updater;C:\Program Files (x86)\Skype\Updater\Updater.exe [2012-7-13 160944]

S3 AmUStor;AM USB Stroage Driver;C:\Windows\System32\drivers\AmUStor.sys [2010-6-10 40448]

S3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);C:\Windows\System32\drivers\ssudbus.sys [2012-2-15 99384]

S3 dgderdrv;dgderdrv;C:\Windows\System32\drivers\dgderdrv.sys [2010-9-6 20552]

S3 ssadbus;SAMSUNG Android USB Composite Device driver (WDM);C:\Windows\System32\drivers\ssadbus.sys [2011-8-30 125416]

S3 ssadmdfl;SAMSUNG Android USB Modem (Filter);C:\Windows\System32\drivers\ssadmdfl.sys [2011-8-30 16872]

S3 ssadmdm;SAMSUNG Android USB Modem Drivers;C:\Windows\System32\drivers\ssadmdm.sys [2011-8-30 159208]

S3 ssudmdm;SAMSUNG  Mobile USB Modem Drivers (DEVGURU Ver.);C:\Windows\System32\drivers\ssudmdm.sys [2012-2-15 203320]

S3 TFsExDisk;TFsExDisk;C:\Windows\System32\drivers\TFsExDisk.sys [2011-8-30 16392]

S3 TsUsbFlt;TsUsbFlt;C:\Windows\System32\drivers\TsUsbFlt.sys [2012-6-28 59392]

S3 USBAAPL64;Apple Mobile USB Driver;C:\Windows\System32\drivers\usbaapl64.sys [2012-9-28 53760]

S4 NTI IScheduleSvc;NTI IScheduleSvc;C:\Program Files (x86)\NewTech Infosystems\Packard Bell MyBackup\IScheduleSvc.exe [2010-6-28 255744]

.

=============== Created Last 30 ================

.

2013-02-26 09:15:19        --------        d-----w-        C:\Users\Bina\AppData\Roaming\Malwarebytes

2013-02-26 09:14:57        --------        d-----w-        C:\ProgramData\Malwarebytes

2013-02-26 09:14:55        24176        ----a-w-        C:\Windows\System32\drivers\mbam.sys

2013-02-26 09:14:55        --------        d-----w-        C:\Program Files (x86)\Malwarebytes' Anti-Malware

2013-02-26 09:14:04        --------        d-----w-        C:\Users\Bina\AppData\Local\Programs

2013-02-26 08:54:31        9162192        ----a-w-        C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{47222A83-F977-4FDB-A039-A5D50648EE6A}\mpengine.dll

2013-02-21 14:54:58        --------        d-----w-        C:\Users\Bina\AppData\Local\CrashRpt

2013-02-21 13:34:05        --------        d-----w-        C:\Program Files (x86)\ACR

2013-02-14 08:53:16        996352        ----a-w-        C:\Program Files\Common Files\Microsoft Shared\VGX\VGX.dll

2013-02-14 08:53:16        768000        ----a-w-        C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\VGX.dll

2013-02-13 07:01:59        5553512        ----a-w-        C:\Windows\System32\ntoskrnl.exe

2013-02-13 07:01:58        3967848        ----a-w-        C:\Windows\SysWow64\ntkrnlpa.exe

2013-02-13 07:01:58        3913064        ----a-w-        C:\Windows\SysWow64\ntoskrnl.exe

2013-02-13 07:01:48        3153408        ----a-w-        C:\Windows\System32\win32k.sys

2013-02-13 07:01:46        7680        ----a-w-        C:\Windows\SysWow64\instnm.exe

2013-02-13 07:01:46        5120        ----a-w-        C:\Windows\SysWow64\wow32.dll

2013-02-13 07:01:46        25600        ----a-w-        C:\Windows\SysWow64\setup16.exe

2013-02-13 07:01:46        215040        ----a-w-        C:\Windows\System32\winsrv.dll

2013-02-13 07:01:46        2048        ----a-w-        C:\Windows\SysWow64\user.exe

2013-02-13 07:01:46        14336        ----a-w-        C:\Windows\SysWow64\ntvdm64.dll

2013-02-13 07:01:43        288088        ----a-w-        C:\Windows\System32\drivers\FWPKCLNT.SYS

2013-02-13 07:01:43        1913192        ----a-w-        C:\Windows\System32\drivers\tcpip.sys

2013-02-10 23:24:49        --------        d-----w-        C:\Program Files (x86)\VirtualDJ

2013-02-10 21:50:37        --------        d-----w-        C:\Program Files (x86)\DVDVideoSoft

2013-02-10 21:50:37        --------        d-----w-        C:\Program Files (x86)\Common Files\DVDVideoSoft

2013-02-06 15:40:26        79        ----a-w-        C:\ProgramData\UnhJWFY.bat

2013-02-06 15:40:26        153        ----a-w-        C:\ProgramData\UnhJWFY.reg

.

==================== Find3M  ====================

.

2013-02-10 08:57:22        74096        ----a-w-        C:\Windows\SysWow64\FlashPlayerCPLApp.cpl

2013-02-10 08:57:22        697712        ----a-w-        C:\Windows\SysWow64\FlashPlayerApp.exe

2013-01-17 00:28:58        273840        ------w-        C:\Windows\System32\MpSigStub.exe

2013-01-09 01:19:09        2312704        ----a-w-        C:\Windows\System32\jscript9.dll

2013-01-09 01:12:03        1392128        ----a-w-        C:\Windows\System32\wininet.dll

2013-01-09 01:11:06        1494528        ----a-w-        C:\Windows\System32\inetcpl.cpl

2013-01-09 01:07:51        173056        ----a-w-        C:\Windows\System32\ieUnatt.exe

2013-01-09 01:07:47        599040        ----a-w-        C:\Windows\System32\vbscript.dll

2013-01-09 01:04:42        2382848        ----a-w-        C:\Windows\System32\mshtml.tlb

2013-01-08 22:11:21        1800704        ----a-w-        C:\Windows\SysWow64\jscript9.dll

2013-01-08 22:03:20        1129472        ----a-w-        C:\Windows\SysWow64\wininet.dll

2013-01-08 22:03:12        1427968        ----a-w-        C:\Windows\SysWow64\inetcpl.cpl

2013-01-08 21:59:02        142848        ----a-w-        C:\Windows\SysWow64\ieUnatt.exe

2013-01-08 21:58:29        420864        ----a-w-        C:\Windows\SysWow64\vbscript.dll

2013-01-08 21:56:23        2382848        ----a-w-        C:\Windows\SysWow64\mshtml.tlb

2013-01-04 04:43:21        44032        ----a-w-        C:\Windows\apppatch\acwow64.dll

2012-12-16 17:11:22        46080        ----a-w-        C:\Windows\System32\atmlib.dll

2012-12-16 14:45:03        367616        ----a-w-        C:\Windows\System32\atmfd.dll

2012-12-16 14:13:28        295424        ----a-w-        C:\Windows\SysWow64\atmfd.dll

2012-12-16 14:13:20        34304        ----a-w-        C:\Windows\SysWow64\atmlib.dll

2012-12-13 12:46:49        281120        ----a-w-        C:\Windows\SysWow64\PnkBstrB.xtr

2012-12-13 12:44:35        282512        ----a-w-        C:\Windows\SysWow64\PnkBstrB.ex0

2012-12-07 13:20:16        441856        ----a-w-        C:\Windows\System32\Wpc.dll

2012-12-07 13:15:31        2746368        ----a-w-        C:\Windows\System32\gameux.dll

2012-12-07 12:26:17        308736        ----a-w-        C:\Windows\SysWow64\Wpc.dll

2012-12-07 12:20:43        2576384        ----a-w-        C:\Windows\SysWow64\gameux.dll

2012-12-07 11:20:04        30720        ----a-w-        C:\Windows\System32\usk.rs

2012-12-07 11:20:03        43520        ----a-w-        C:\Windows\System32\csrr.rs

2012-12-07 11:20:03        23552        ----a-w-        C:\Windows\System32\oflc.rs

2012-12-07 11:20:01        45568        ----a-w-        C:\Windows\System32\oflc-nz.rs

2012-12-07 11:20:01        44544        ----a-w-        C:\Windows\System32\pegibbfc.rs

2012-12-07 11:20:01        20480        ----a-w-        C:\Windows\System32\pegi-fi.rs

2012-12-07 11:20:00        20480        ----a-w-        C:\Windows\System32\pegi-pt.rs

2012-12-07 11:19:59        20480        ----a-w-        C:\Windows\System32\pegi.rs

2012-12-07 11:19:58        46592        ----a-w-        C:\Windows\System32\fpb.rs

2012-12-07 11:19:57        40960        ----a-w-        C:\Windows\System32\cob-au.rs

2012-12-07 11:19:57        21504        ----a-w-        C:\Windows\System32\grb.rs

2012-12-07 11:19:57        15360        ----a-w-        C:\Windows\System32\djctq.rs

2012-12-07 11:19:56        55296        ----a-w-        C:\Windows\System32\cero.rs

2012-12-07 11:19:55        51712        ----a-w-        C:\Windows\System32\esrb.rs

2012-11-30 05:45:35        362496        ----a-w-        C:\Windows\System32\wow64win.dll

2012-11-30 05:45:35        243200        ----a-w-        C:\Windows\System32\wow64.dll

2012-11-30 05:45:35        13312        ----a-w-        C:\Windows\System32\wow64cpu.dll

2012-11-30 05:43:12        16384        ----a-w-        C:\Windows\System32\ntvdm64.dll

2012-11-30 05:41:07        424448        ----a-w-        C:\Windows\System32\KernelBase.dll

2012-11-30 04:53:59        274944        ----a-w-        C:\Windows\SysWow64\KernelBase.dll

2012-11-30 03:23:48        338432        ----a-w-        C:\Windows\System32\conhost.exe

2012-11-30 02:38:59        6144        ---ha-w-        C:\Windows\SysWow64\api-ms-win-security-base-l1-1-0.dll

2012-11-30 02:38:59        4608        ---ha-w-        C:\Windows\SysWow64\api-ms-win-core-threadpool-l1-1-0.dll

2012-11-30 02:38:59        3584        ---ha-w-        C:\Windows\SysWow64\api-ms-win-core-xstate-l1-1-0.dll

2012-11-30 02:38:59        3072        ---ha-w-        C:\Windows\SysWow64\api-ms-win-core-util-l1-1-0.dll

.

============= FINISH: 13:17:50,82 ===============

--- --- ---
--- --- ---

Code:

DDS (Ver_2012-11-20.01) - NTFS_AMD64 

Internet Explorer: 9.0.8112.16464

Run by Bina at 13:17:07 on 2013-02-26

Microsoft Windows 7 Home Premium   6.1.7601.1.1252.49.1031.18.3838.2092 [GMT 1:00]

.

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

============== Running Processes ===============

.

C:\Windows\system32\lsm.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\svchost.exe -k RPCSS

C:\Windows\system32\atiesrxx.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\svchost.exe -k NetworkService

C:\Windows\system32\atieclxx.exe

C:\Windows\System32\spoolsv.exe

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE

C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Program Files (x86)\Launch Manager\dsiwmis.exe

C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerSvc.exe

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\Program Files (x86)\Packard Bell\Registration\GREGsvc.exe

C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe

C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe

C:\Windows\system32\svchost.exe -k imgsvc

C:\Program Files\Packard Bell\Packard Bell Updater\UpdaterService.exe

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

C:\Windows\system32\SearchIndexer.exe

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe

C:\Windows\system32\taskhost.exe

C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

C:\Windows\PLFSetI.exe

C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerTray.exe

C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe

C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe

C:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE

C:\Program Files (x86)\ACR\AutoClubRev\web\acrlauncher.exe

C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe

C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin

C:\Program Files (x86)\Launch Manager\LManager.exe

C:\Program Files (x86)\Video Web Camera\traybar.exe

C:\Program Files (x86)\iTunes\iTunesHelper.exe

C:\Program Files\Synaptics\SynTP\SynTPHelper.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe

C:\Program Files (x86)\Launch Manager\LMworker.exe

C:\Windows\system32\wbem\unsecapp.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerEvent.exe

C:\Windows\System32\svchost.exe -k LocalServicePeerNet

C:\Program Files\Windows Media Player\wmpnetwk.exe

C:\Windows\sysWOW64\wbem\wmiprvse.exe

C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe

C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe

C:\Windows\system32\sppsvc.exe

C:\Windows\System32\svchost.exe -k secsvcs

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\Windows\servicing\TrustedInstaller.exe

C:\Windows\system32\taskhost.exe

C:\Windows\system32\SearchProtocolHost.exe

C:\Windows\system32\SearchFilterHost.exe

C:\Windows\System32\cscript.exe

.

============== Pseudo HJT Report ===============

.

uStart Page = hxxp://www.facebook.com/

uDefault_Page_URL = hxxp://packardbell.msn.com

mStart Page = hxxp://packardbell.msn.com

mDefault_Page_URL = hxxp://packardbell.msn.com

uProxyOverride = 127.0.0.1:9421;<local>

mWinlogon: Userinit = userinit.exe,

BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - c:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

BHO: DivX Plus Web Player HTML5 <video>: {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll

BHO: Java(tm) Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll

BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

BHO: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll

BHO: DVDVideoSoft WebPageAdjuster Class: {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - C:\Program Files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll

uRun: [SpybotSD TeaTimer] C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe

uRun: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe

uRun: [GoogleChromeAutoLaunch_FC3C7AFF6FA05DEB76F42E512273B035] "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --no-startup-window

mRun: [BackupManagerTray] "C:\Program Files (x86)\NewTech Infosystems\Packard Bell MyBackup\BackupManagerTray.exe" -h -k                                                                                                                                                                           

mRun: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun

mRun: [LManager] C:\Program Files (x86)\Launch Manager\LManager.exe

mRun: [Camera Assistant Software] "C:\Program Files (x86)\Video Web Camera\traybar.exe"

mRun: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"

mRun: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"

StartupFolder: C:\Users\Bina\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\ACRLAU~1.LNK - C:\Program Files (x86)\ACR\AutoClubRev\web\acrlauncher.exe

StartupFolder: C:\Users\Bina\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\OPENOF~1.LNK - C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe

mPolicies-Explorer: NoActiveDesktop = dword:1

mPolicies-Explorer: NoActiveDesktopChanges = dword:1

mPolicies-System: ConsentPromptBehaviorAdmin = dword:5

mPolicies-System: ConsentPromptBehaviorUser = dword:3

mPolicies-System: EnableUIADesktopToggle = dword:0

IE: Free YouTube Download - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\freeytvdownloader.htm

IE: Free YouTube to MP3 Converter - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\freeytmp3downloader.htm

IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll

IE: {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - C:\Program Files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll

.

INFO: HKCU has more than 50 listed domains.

If you wish to scan all of them, select the 'Force scan all domains' option.

.

DPF: {784797A8-342D-4072-9486-03C8D0F2F0A1} - hxxp://www.battlefieldheroes.com/static/updater/BFHUpdater_5.0.127.0.cab

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab

TCP: NameServer = 192.168.178.1

TCP: Interfaces\{1CFB4298-42DF-4E9A-893C-8592B1FF10EE} : DHCPNameServer = 192.168.178.1

TCP: Interfaces\{1CFB4298-42DF-4E9A-893C-8592B1FF10EE}\142736F627D2249363442303 : DHCPNameServer = 192.168.2.1

TCP: Interfaces\{1CFB4298-42DF-4E9A-893C-8592B1FF10EE}\142736F627D2345493333373 : DHCPNameServer = 192.168.2.1

TCP: Interfaces\{1CFB4298-42DF-4E9A-893C-8592B1FF10EE}\37C6166796B6 : DHCPNameServer = 192.168.0.1

TCP: Interfaces\{1CFB4298-42DF-4E9A-893C-8592B1FF10EE}\46C696E6B6 : DHCPNameServer = 192.168.0.1

TCP: Interfaces\{1CFB4298-42DF-4E9A-893C-8592B1FF10EE}\64259445A51224F6870264F6E60275C414E40273131323 : DHCPNameServer = 192.168.178.1

Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll

SSODL: WebCheck - <orphaned>

mASetup: {8A69D345-D564-463c-AFF1-A69D9E530F96} - "C:\Program Files (x86)\Google\Chrome\Application\25.0.1364.97\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --multi-install --chrome

x64-mStart Page = hxxp://packardbell.msn.com

x64-mDefault_Page_URL = hxxp://packardbell.msn.com

x64-BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

x64-BHO: DVDVideoSoft WebPageAdjuster Class: {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - C:\Program Files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns64.dll

x64-Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s

x64-Run: [SynTPEnh] C:\Program Files (x86)\Synaptics\SynTP\SynTPEnh.exe

x64-Run: [PLFSetI] C:\Windows\PLFSetI.exe

x64-Run: [Acer ePower Management] C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerTray.exe

x64-Run: [AmIcoSinglun64] C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe

x64-IE: {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - C:\Program Files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns64.dll

x64-Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - <orphaned>

x64-SSODL: WebCheck - <orphaned>

.

============= SERVICES / DRIVERS ===============

.

R1 SASDIFSV;SASDIFSV;C:\Program Files\SUPERAntiSpyware\sasdifsv64.sys [2011-7-22 14928]

R1 SASKUTIL;SASKUTIL;C:\Program Files\SUPERAntiSpyware\saskutil64.sys [2011-7-12 12368]

R2 !SASCORE;SAS Core Service;C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE [2011-8-12 140672]

R2 AMD External Events Utility;AMD External Events Utility;C:\Windows\System32\atiesrxx.exe [2011-2-13 202752]

R2 DsiWMIService;Dritek WMI Service;C:\Program Files (x86)\Launch Manager\dsiwmis.exe [2011-2-13 321104]

R2 ePowerSvc;Acer ePower Service;C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerSvc.exe [2011-2-13 868896]

R2 GREGService;GREGService;C:\Program Files (x86)\Packard Bell\Registration\GREGsvc.exe [2010-1-8 23584]

R2 MBAMScheduler;MBAMScheduler;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [2013-2-26 398184]

R2 MBAMService;MBAMService;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2013-2-26 682344]

R2 Updater Service;Updater Service;C:\Program Files\Packard Bell\Packard Bell Updater\UpdaterService.exe [2010-9-9 243232]

R3 MBAMProtector;MBAMProtector;C:\Windows\System32\drivers\mbam.sys [2013-2-26 24176]

R3 usbfilter;AMD USB Filter Driver;C:\Windows\System32\drivers\usbfilter.sys [2011-2-13 38456]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]

S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]

S2 SkypeUpdate;Skype Updater;C:\Program Files (x86)\Skype\Updater\Updater.exe [2012-7-13 160944]

S3 AmUStor;AM USB Stroage Driver;C:\Windows\System32\drivers\AmUStor.sys [2010-6-10 40448]

S3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);C:\Windows\System32\drivers\ssudbus.sys [2012-2-15 99384]

S3 dgderdrv;dgderdrv;C:\Windows\System32\drivers\dgderdrv.sys [2010-9-6 20552]

S3 ssadbus;SAMSUNG Android USB Composite Device driver (WDM);C:\Windows\System32\drivers\ssadbus.sys [2011-8-30 125416]

S3 ssadmdfl;SAMSUNG Android USB Modem (Filter);C:\Windows\System32\drivers\ssadmdfl.sys [2011-8-30 16872]

S3 ssadmdm;SAMSUNG Android USB Modem Drivers;C:\Windows\System32\drivers\ssadmdm.sys [2011-8-30 159208]

S3 ssudmdm;SAMSUNG  Mobile USB Modem Drivers (DEVGURU Ver.);C:\Windows\System32\drivers\ssudmdm.sys [2012-2-15 203320]

S3 TFsExDisk;TFsExDisk;C:\Windows\System32\drivers\TFsExDisk.sys [2011-8-30 16392]

S3 TsUsbFlt;TsUsbFlt;C:\Windows\System32\drivers\TsUsbFlt.sys [2012-6-28 59392]

S3 USBAAPL64;Apple Mobile USB Driver;C:\Windows\System32\drivers\usbaapl64.sys [2012-9-28 53760]

S4 NTI IScheduleSvc;NTI IScheduleSvc;C:\Program Files (x86)\NewTech Infosystems\Packard Bell MyBackup\IScheduleSvc.exe [2010-6-28 255744]

.

=============== Created Last 30 ================

.

2013-02-26 09:15:19        --------        d-----w-        C:\Users\Bina\AppData\Roaming\Malwarebytes

2013-02-26 09:14:57        --------        d-----w-        C:\ProgramData\Malwarebytes

2013-02-26 09:14:55        24176        ----a-w-        C:\Windows\System32\drivers\mbam.sys

2013-02-26 09:14:55        --------        d-----w-        C:\Program Files (x86)\Malwarebytes' Anti-Malware

2013-02-26 09:14:04        --------        d-----w-        C:\Users\Bina\AppData\Local\Programs

2013-02-26 08:54:31        9162192        ----a-w-        C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{47222A83-F977-4FDB-A039-A5D50648EE6A}\mpengine.dll

2013-02-21 14:54:58        --------        d-----w-        C:\Users\Bina\AppData\Local\CrashRpt

2013-02-21 13:34:05        --------        d-----w-        C:\Program Files (x86)\ACR

2013-02-14 08:53:16        996352        ----a-w-        C:\Program Files\Common Files\Microsoft Shared\VGX\VGX.dll

2013-02-14 08:53:16        768000        ----a-w-        C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\VGX.dll

2013-02-13 07:01:59        5553512        ----a-w-        C:\Windows\System32\ntoskrnl.exe

2013-02-13 07:01:58        3967848        ----a-w-        C:\Windows\SysWow64\ntkrnlpa.exe

2013-02-13 07:01:58        3913064        ----a-w-        C:\Windows\SysWow64\ntoskrnl.exe

2013-02-13 07:01:48        3153408        ----a-w-        C:\Windows\System32\win32k.sys

2013-02-13 07:01:46        7680        ----a-w-        C:\Windows\SysWow64\instnm.exe

2013-02-13 07:01:46        5120        ----a-w-        C:\Windows\SysWow64\wow32.dll

2013-02-13 07:01:46        25600        ----a-w-        C:\Windows\SysWow64\setup16.exe

2013-02-13 07:01:46        215040        ----a-w-        C:\Windows\System32\winsrv.dll

2013-02-13 07:01:46        2048        ----a-w-        C:\Windows\SysWow64\user.exe

2013-02-13 07:01:46        14336        ----a-w-        C:\Windows\SysWow64\ntvdm64.dll

2013-02-13 07:01:43        288088        ----a-w-        C:\Windows\System32\drivers\FWPKCLNT.SYS

2013-02-13 07:01:43        1913192        ----a-w-        C:\Windows\System32\drivers\tcpip.sys

2013-02-10 23:24:49        --------        d-----w-        C:\Program Files (x86)\VirtualDJ

2013-02-10 21:50:37        --------        d-----w-        C:\Program Files (x86)\DVDVideoSoft

2013-02-10 21:50:37        --------        d-----w-        C:\Program Files (x86)\Common Files\DVDVideoSoft

2013-02-06 15:40:26        79        ----a-w-        C:\ProgramData\UnhJWFY.bat

2013-02-06 15:40:26        153        ----a-w-        C:\ProgramData\UnhJWFY.reg

.

==================== Find3M  ====================

.

2013-02-10 08:57:22        74096        ----a-w-        C:\Windows\SysWow64\FlashPlayerCPLApp.cpl

2013-02-10 08:57:22        697712        ----a-w-        C:\Windows\SysWow64\FlashPlayerApp.exe

2013-01-17 00:28:58        273840        ------w-        C:\Windows\System32\MpSigStub.exe

2013-01-09 01:19:09        2312704        ----a-w-        C:\Windows\System32\jscript9.dll

2013-01-09 01:12:03        1392128        ----a-w-        C:\Windows\System32\wininet.dll

2013-01-09 01:11:06        1494528        ----a-w-        C:\Windows\System32\inetcpl.cpl

2013-01-09 01:07:51        173056        ----a-w-        C:\Windows\System32\ieUnatt.exe

2013-01-09 01:07:47        599040        ----a-w-        C:\Windows\System32\vbscript.dll

2013-01-09 01:04:42        2382848        ----a-w-        C:\Windows\System32\mshtml.tlb

2013-01-08 22:11:21        1800704        ----a-w-        C:\Windows\SysWow64\jscript9.dll

2013-01-08 22:03:20        1129472        ----a-w-        C:\Windows\SysWow64\wininet.dll

2013-01-08 22:03:12        1427968        ----a-w-        C:\Windows\SysWow64\inetcpl.cpl

2013-01-08 21:59:02        142848        ----a-w-        C:\Windows\SysWow64\ieUnatt.exe

2013-01-08 21:58:29        420864        ----a-w-        C:\Windows\SysWow64\vbscript.dll

2013-01-08 21:56:23        2382848        ----a-w-        C:\Windows\SysWow64\mshtml.tlb

2013-01-04 04:43:21        44032        ----a-w-        C:\Windows\apppatch\acwow64.dll

2012-12-16 17:11:22        46080        ----a-w-        C:\Windows\System32\atmlib.dll

2012-12-16 14:45:03        367616        ----a-w-        C:\Windows\System32\atmfd.dll

2012-12-16 14:13:28        295424        ----a-w-        C:\Windows\SysWow64\atmfd.dll

2012-12-16 14:13:20        34304        ----a-w-        C:\Windows\SysWow64\atmlib.dll

2012-12-13 12:46:49        281120        ----a-w-        C:\Windows\SysWow64\PnkBstrB.xtr

2012-12-13 12:44:35        282512        ----a-w-        C:\Windows\SysWow64\PnkBstrB.ex0

2012-12-07 13:20:16        441856        ----a-w-        C:\Windows\System32\Wpc.dll

2012-12-07 13:15:31        2746368        ----a-w-        C:\Windows\System32\gameux.dll

2012-12-07 12:26:17        308736        ----a-w-        C:\Windows\SysWow64\Wpc.dll

2012-12-07 12:20:43        2576384        ----a-w-        C:\Windows\SysWow64\gameux.dll

2012-12-07 11:20:04        30720        ----a-w-        C:\Windows\System32\usk.rs

2012-12-07 11:20:03        43520        ----a-w-        C:\Windows\System32\csrr.rs

2012-12-07 11:20:03        23552        ----a-w-        C:\Windows\System32\oflc.rs

2012-12-07 11:20:01        45568        ----a-w-        C:\Windows\System32\oflc-nz.rs

2012-12-07 11:20:01        44544        ----a-w-        C:\Windows\System32\pegibbfc.rs

2012-12-07 11:20:01        20480        ----a-w-        C:\Windows\System32\pegi-fi.rs

2012-12-07 11:20:00        20480        ----a-w-        C:\Windows\System32\pegi-pt.rs

2012-12-07 11:19:59        20480        ----a-w-        C:\Windows\System32\pegi.rs

2012-12-07 11:19:58        46592        ----a-w-        C:\Windows\System32\fpb.rs

2012-12-07 11:19:57        40960        ----a-w-        C:\Windows\System32\cob-au.rs

2012-12-07 11:19:57        21504        ----a-w-        C:\Windows\System32\grb.rs

2012-12-07 11:19:57        15360        ----a-w-        C:\Windows\System32\djctq.rs

2012-12-07 11:19:56        55296        ----a-w-        C:\Windows\System32\cero.rs

2012-12-07 11:19:55        51712        ----a-w-        C:\Windows\System32\esrb.rs

2012-11-30 05:45:35        362496        ----a-w-        C:\Windows\System32\wow64win.dll

2012-11-30 05:45:35        243200        ----a-w-        C:\Windows\System32\wow64.dll

2012-11-30 05:45:35        13312        ----a-w-        C:\Windows\System32\wow64cpu.dll

2012-11-30 05:43:12        16384        ----a-w-        C:\Windows\System32\ntvdm64.dll

2012-11-30 05:41:07        424448        ----a-w-        C:\Windows\System32\KernelBase.dll

2012-11-30 04:53:59        274944        ----a-w-        C:\Windows\SysWow64\KernelBase.dll

2012-11-30 03:23:48        338432        ----a-w-        C:\Windows\System32\conhost.exe

2012-11-30 02:38:59        6144        ---ha-w-        C:\Windows\SysWow64\api-ms-win-security-base-l1-1-0.dll

2012-11-30 02:38:59        4608        ---ha-w-        C:\Windows\SysWow64\api-ms-win-core-threadpool-l1-1-0.dll

2012-11-30 02:38:59        3584        ---ha-w-        C:\Windows\SysWow64\api-ms-win-core-xstate-l1-1-0.dll

2012-11-30 02:38:59        3072        ---ha-w-        C:\Windows\SysWow64\api-ms-win-core-util-l1-1-0.dll

.

============= FINISH: 13:17:50,82 ===============

Code:

# AdwCleaner v2.113 - Datei am 26/02/2013 um 15:10:01 erstellt

# Aktualisiert am 23/02/2013 von Xplode

# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)

# Benutzer : Bina - BINA-PC

# Bootmodus : Normal

# Ausgeführt unter : C:\Users\Bina\Desktop\adwcleaner.exe

# Option [Löschen]
 
 

**** [Dienste] ****
 
 

***** [Dateien / Ordner] *****
 

Ordner Gelöscht : C:\Program Files (x86)\file scout

Ordner Gelöscht : C:\ProgramData\IBUpdaterService

Ordner Gelöscht : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Media Finder

Ordner Gelöscht : C:\ProgramData\Tarma Installer

Ordner Gelöscht : C:\Users\Bina\AppData\Local\Conduit

Ordner Gelöscht : C:\Users\Bina\AppData\LocalLow\boost_interprocess

Ordner Gelöscht : C:\Users\Bina\AppData\LocalLow\Conduit

Ordner Gelöscht : C:\Users\Bina\AppData\LocalLow\PriceGong

Ordner Gelöscht : C:\Users\Bina\AppData\Roaming\dvdvideosoftiehelpers

Ordner Gelöscht : C:\Users\Bina\AppData\Roaming\Media Finder

Ordner Gelöscht : C:\Users\Bina\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\gencrawler@some.com

Ordner Gelöscht : C:\Users\Bina\AppData\Roaming\OpenCandy

Ordner Gelöscht : C:\Users\krizz\AppData\LocalLow\boost_interprocess
 

***** [Registrierungsdatenbank] *****
 

Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\Conduit

Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\ConduitSearchScopes

Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\PriceGong

Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\SmartBar

Schlüssel Gelöscht : HKCU\Software\MediaFinder

Schlüssel Gelöscht : HKCU\Software\Softonic

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Applications\ilividsetupv1.exe

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\MF

Schlüssel Gelöscht : HKLM\Software\Conduit

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{2EECD738-5844-4A99-B4B6-146BF802613B}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{97F2FF5B-260C-4CCF-834A-2DDA4E29E39E}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{98889811-442D-49DD-99D7-DC866BE87DBC}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\facemoods_RASAPI32

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\facemoods_RASMANCS

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{80922EE0-8A76-46AE-95D5-BD3C3FE0708D}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{826D7151-8D99-434B-8540-082B8C2AE556}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{10DE7085-6A1E-4D41-A7BF-9AF93E351401}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{1AD27395-1659-4DFF-A319-2CFA243861A5}

Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}

Schlüssel Gelöscht : HKLM\SOFTWARE\Tarma Installer
 

***** [Internet Browser] *****
 

-\\ Internet Explorer v9.0.8112.16464
 

[OK] Die Registrierungsdatenbank ist sauber.
 

-\\ Google Chrome v25.0.1364.97
 

Datei : C:\Users\Bina\AppData\Local\Google\Chrome\User Data\Default\Preferences
 

[OK] Die Datei ist sauber.
 

Datei : C:\Users\krizz\AppData\Local\Google\Chrome\User Data\Default\Preferences
 

[OK] Die Datei ist sauber.
 

*************************
 

AdwCleaner[R1].txt - [3541 octets] - [26/02/2013 15:09:32]

AdwCleaner[S1].txt - [3478 octets] - [26/02/2013 15:10:01]
 

########## EOF - C:\AdwCleaner[S1].txt - [3538 octets] ##########

Code:

ComboFix 13-02-26.01 - Bina 26.02.2013  16:26:20.1.2 - x64

Microsoft Windows 7 Home Premium   6.1.7601.1.1252.49.1031.18.3838.2057 [GMT 1:00]

ausgeführt von:: c:\users\Bina\Downloads\ComboFix.exe

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

c:\$recycle.bin\S-1-5-21-2174489219-974603214-2956640213-1004\$623235fd9acb63d37cd05f847f298693\@

c:\$recycle.bin\S-1-5-21-2174489219-974603214-2956640213-1004\$623235fd9acb63d37cd05f847f298693\L\00000004.@

c:\$recycle.bin\S-1-5-21-2174489219-974603214-2956640213-1004\$623235fd9acb63d37cd05f847f298693\U\00000004.@

c:\$recycle.bin\S-1-5-21-2174489219-974603214-2956640213-1004\$623235fd9acb63d37cd05f847f298693\U\00000008.@

c:\$recycle.bin\S-1-5-21-2174489219-974603214-2956640213-1004\$623235fd9acb63d37cd05f847f298693\U\000000cb.@

c:\$recycle.bin\S-1-5-21-2174489219-974603214-2956640213-1004\$623235fd9acb63d37cd05f847f298693\U\80000000.@

c:\$recycle.bin\S-1-5-21-2174489219-974603214-2956640213-1004\$623235fd9acb63d37cd05f847f298693\U\80000064.@

C:\install.exe

c:\programdata\piz_0ef.pad

c:\programdata\UnhJWFY.pad

c:\users\Bina\AppData\Roaming\AcroIEHelpe.txt

c:\users\Bina\AppData\Roaming\srvblck2.tmp

c:\users\Public\sdelevURL.tmp

c:\windows\iun6002.exe

c:\windows\wininit.ini

.

.

(((((((((((((((((((((((   Dateien erstellt von 2013-01-26 bis 2013-02-26  ))))))))))))))))))))))))))))))

.

.

2013-02-26 15:34 . 2013-02-26 15:34        --------        d-----w-        c:\users\Default\AppData\Local\temp

2013-02-26 15:28 . 2013-02-26 15:28        76232        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{47222A83-F977-4FDB-A039-A5D50648EE6A}\offreg.dll

2013-02-26 09:15 . 2013-02-26 09:15        --------        d-----w-        c:\users\Bina\AppData\Roaming\Malwarebytes

2013-02-26 09:14 . 2013-02-26 09:14        --------        d-----w-        c:\programdata\Malwarebytes

2013-02-26 09:14 . 2013-02-26 09:15        --------        d-----w-        c:\program files (x86)\Malwarebytes' Anti-Malware

2013-02-26 09:14 . 2012-12-14 15:49        24176        ----a-w-        c:\windows\system32\drivers\mbam.sys

2013-02-26 09:14 . 2013-02-26 09:14        --------        d-----w-        c:\users\Bina\AppData\Local\Programs

2013-02-26 08:54 . 2013-02-08 00:28        9162192        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{47222A83-F977-4FDB-A039-A5D50648EE6A}\mpengine.dll

2013-02-21 14:54 . 2013-02-21 14:54        --------        d-----w-        c:\users\Bina\AppData\Local\CrashRpt

2013-02-21 13:34 . 2013-02-21 13:34        --------        d-----w-        c:\program files (x86)\ACR

2013-02-14 08:53 . 2013-01-09 01:10        996352        ----a-w-        c:\program files\Common Files\Microsoft Shared\VGX\VGX.dll

2013-02-14 08:53 . 2013-01-08 22:01        768000        ----a-w-        c:\program files (x86)\Common Files\Microsoft Shared\VGX\VGX.dll

2013-02-13 07:01 . 2013-01-05 05:53        5553512        ----a-w-        c:\windows\system32\ntoskrnl.exe

2013-02-13 07:01 . 2013-01-05 05:00        3967848        ----a-w-        c:\windows\SysWow64\ntkrnlpa.exe

2013-02-13 07:01 . 2013-01-05 05:00        3913064        ----a-w-        c:\windows\SysWow64\ntoskrnl.exe

2013-02-13 07:01 . 2013-01-04 03:26        3153408        ----a-w-        c:\windows\system32\win32k.sys

2013-02-13 07:01 . 2013-01-04 05:46        215040        ----a-w-        c:\windows\system32\winsrv.dll

2013-02-13 07:01 . 2013-01-04 04:51        5120        ----a-w-        c:\windows\SysWow64\wow32.dll

2013-02-13 07:01 . 2013-01-04 02:47        25600        ----a-w-        c:\windows\SysWow64\setup16.exe

2013-02-13 07:01 . 2013-01-04 02:47        7680        ----a-w-        c:\windows\SysWow64\instnm.exe

2013-02-13 07:01 . 2013-01-04 02:47        2048        ----a-w-        c:\windows\SysWow64\user.exe

2013-02-13 07:01 . 2013-01-04 02:47        14336        ----a-w-        c:\windows\SysWow64\ntvdm64.dll

2013-02-13 07:01 . 2013-01-03 06:00        1913192        ----a-w-        c:\windows\system32\drivers\tcpip.sys

2013-02-13 07:01 . 2013-01-03 06:00        288088        ----a-w-        c:\windows\system32\drivers\FWPKCLNT.SYS

2013-02-10 23:24 . 2013-02-10 23:24        --------        d-----w-        c:\program files (x86)\VirtualDJ

2013-02-10 21:50 . 2013-02-10 21:50        --------        d-----w-        c:\program files (x86)\DVDVideoSoft

2013-02-10 21:50 . 2013-02-10 21:50        --------        d-----w-        c:\program files (x86)\Common Files\DVDVideoSoft

2013-02-07 15:25 . 2013-02-07 15:25        --------        d-----w-        c:\users\krizz

2013-02-06 15:40 . 2013-02-06 15:40        79        ----a-w-        c:\programdata\UnhJWFY.bat

2013-02-06 15:40 . 2013-02-06 15:40        3199        ----a-w-        c:\programdata\UnhJWFY.js

2013-02-06 15:40 . 2013-02-06 15:40        153        ----a-w-        c:\programdata\UnhJWFY.reg

.

.

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2013-02-14 08:57 . 2012-06-28 18:26        70004024        ----a-w-        c:\windows\system32\MRT.exe

2013-02-10 21:28 . 2009-08-18 11:49        564632        ----a-w-        c:\programdata\Microsoft\IdentityCRL\production\wlidui.dll

2013-02-10 21:28 . 2009-08-18 10:24        19696        ----a-w-        c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll

2013-02-10 08:57 . 2012-10-16 19:24        697712        ----a-w-        c:\windows\SysWow64\FlashPlayerApp.exe

2013-02-10 08:57 . 2011-09-06 19:42        74096        ----a-w-        c:\windows\SysWow64\FlashPlayerCPLApp.cpl

2013-01-17 00:28 . 2011-08-30 12:37        273840        ------w-        c:\windows\system32\MpSigStub.exe

2013-01-04 04:43 . 2013-02-13 07:01        44032        ----a-w-        c:\windows\apppatch\acwow64.dll

2012-12-16 17:11 . 2012-12-21 12:41        46080        ----a-w-        c:\windows\system32\atmlib.dll

2012-12-16 14:45 . 2012-12-21 12:41        367616        ----a-w-        c:\windows\system32\atmfd.dll

2012-12-16 14:13 . 2012-12-21 12:41        295424        ----a-w-        c:\windows\SysWow64\atmfd.dll

2012-12-16 14:13 . 2012-12-21 12:41        34304        ----a-w-        c:\windows\SysWow64\atmlib.dll

2012-12-13 12:46 . 2012-06-25 19:00        281120        ----a-w-        c:\windows\SysWow64\PnkBstrB.xtr

2012-12-13 12:44 . 2011-10-31 18:26        282512        ----a-w-        c:\windows\SysWow64\PnkBstrB.ex0

2012-12-07 13:20 . 2013-01-10 15:29        441856        ----a-w-        c:\windows\system32\Wpc.dll

2012-12-07 13:15 . 2013-01-10 15:29        2746368        ----a-w-        c:\windows\system32\gameux.dll

2012-12-07 12:26 . 2013-01-10 15:29        308736        ----a-w-        c:\windows\SysWow64\Wpc.dll

2012-12-07 12:20 . 2013-01-10 15:29        2576384        ----a-w-        c:\windows\SysWow64\gameux.dll

2012-12-07 11:20 . 2013-01-10 15:29        30720        ----a-w-        c:\windows\system32\usk.rs

2012-12-07 11:20 . 2013-01-10 15:29        43520        ----a-w-        c:\windows\system32\csrr.rs

2012-12-07 11:20 . 2013-01-10 15:29        23552        ----a-w-        c:\windows\system32\oflc.rs

2012-12-07 11:20 . 2013-01-10 15:29        45568        ----a-w-        c:\windows\system32\oflc-nz.rs

2012-12-07 11:20 . 2013-01-10 15:29        44544        ----a-w-        c:\windows\system32\pegibbfc.rs

2012-12-07 11:20 . 2013-01-10 15:29        20480        ----a-w-        c:\windows\system32\pegi-fi.rs

2012-12-07 11:20 . 2013-01-10 15:29        20480        ----a-w-        c:\windows\system32\pegi-pt.rs

2012-12-07 11:19 . 2013-01-10 15:29        20480        ----a-w-        c:\windows\system32\pegi.rs

2012-12-07 11:19 . 2013-01-10 15:29        46592        ----a-w-        c:\windows\system32\fpb.rs

2012-12-07 11:19 . 2013-01-10 15:29        40960        ----a-w-        c:\windows\system32\cob-au.rs

2012-12-07 11:19 . 2013-01-10 15:29        21504        ----a-w-        c:\windows\system32\grb.rs

2012-12-07 11:19 . 2013-01-10 15:29        15360        ----a-w-        c:\windows\system32\djctq.rs

2012-12-07 11:19 . 2013-01-10 15:29        55296        ----a-w-        c:\windows\system32\cero.rs

2012-12-07 11:19 . 2013-01-10 15:29        51712        ----a-w-        c:\windows\system32\esrb.rs

2012-12-07 10:46 . 2013-01-10 15:29        43520        ----a-w-        c:\windows\SysWow64\csrr.rs

2012-12-07 10:46 . 2013-01-10 15:29        30720        ----a-w-        c:\windows\SysWow64\usk.rs

2012-12-07 10:46 . 2013-01-10 15:29        45568        ----a-w-        c:\windows\SysWow64\oflc-nz.rs

2012-12-07 10:46 . 2013-01-10 15:29        44544        ----a-w-        c:\windows\SysWow64\pegibbfc.rs

2012-12-07 10:46 . 2013-01-10 15:29        20480        ----a-w-        c:\windows\SysWow64\pegi-pt.rs

2012-12-07 10:46 . 2013-01-10 15:29        23552        ----a-w-        c:\windows\SysWow64\oflc.rs

2012-12-07 10:46 . 2013-01-10 15:29        20480        ----a-w-        c:\windows\SysWow64\pegi-fi.rs

2012-12-07 10:46 . 2013-01-10 15:29        46592        ----a-w-        c:\windows\SysWow64\fpb.rs

2012-12-07 10:46 . 2013-01-10 15:29        20480        ----a-w-        c:\windows\SysWow64\pegi.rs

2012-12-07 10:46 . 2013-01-10 15:29        21504        ----a-w-        c:\windows\SysWow64\grb.rs

2012-12-07 10:46 . 2013-01-10 15:29        40960        ----a-w-        c:\windows\SysWow64\cob-au.rs

2012-12-07 10:46 . 2013-01-10 15:29        15360        ----a-w-        c:\windows\SysWow64\djctq.rs

2012-12-07 10:46 . 2013-01-10 15:29        55296        ----a-w-        c:\windows\SysWow64\cero.rs

2012-12-07 10:46 . 2013-01-10 15:29        51712        ----a-w-        c:\windows\SysWow64\esrb.rs

2012-11-30 05:45 . 2013-01-10 15:28        362496        ----a-w-        c:\windows\system32\wow64win.dll

2012-11-30 05:45 . 2013-01-10 15:28        243200        ----a-w-        c:\windows\system32\wow64.dll

2012-11-30 05:45 . 2013-01-10 15:28        13312        ----a-w-        c:\windows\system32\wow64cpu.dll

2012-11-30 05:43 . 2013-01-10 15:28        16384        ----a-w-        c:\windows\system32\ntvdm64.dll

2012-11-30 05:41 . 2013-01-10 15:28        424448        ----a-w-        c:\windows\system32\KernelBase.dll

2012-11-30 05:41 . 2013-01-10 15:28        1161216        ----a-w-        c:\windows\system32\kernel32.dll

2012-11-30 05:38 . 2013-01-10 15:28        6144        ---ha-w-        c:\windows\system32\api-ms-win-security-base-l1-1-0.dll

2012-11-30 05:38 . 2013-01-10 15:28        4608        ---ha-w-        c:\windows\system32\api-ms-win-core-threadpool-l1-1-0.dll

2012-11-30 05:38 . 2013-01-10 15:28        4608        ---ha-w-        c:\windows\system32\api-ms-win-core-processthreads-l1-1-0.dll

2012-11-30 05:38 . 2013-01-10 15:28        4096        ---ha-w-        c:\windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll

2012-11-30 05:38 . 2013-01-10 15:28        4096        ---ha-w-        c:\windows\system32\api-ms-win-core-synch-l1-1-0.dll

2012-11-30 05:38 . 2013-01-10 15:28        3584        ---ha-w-        c:\windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll

2012-11-30 05:38 . 2013-01-10 15:28        3584        ---ha-w-        c:\windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll

2012-11-30 05:38 . 2013-01-10 15:28        3584        ---ha-w-        c:\windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll

2012-11-30 05:38 . 2013-01-10 15:28        3584        ---ha-w-        c:\windows\system32\api-ms-win-core-misc-l1-1-0.dll

2012-11-30 05:38 . 2013-01-10 15:28        3072        ---ha-w-        c:\windows\system32\api-ms-win-core-xstate-l1-1-0.dll

2012-11-30 05:38 . 2013-01-10 15:28        3072        ---ha-w-        c:\windows\system32\api-ms-win-core-util-l1-1-0.dll

2012-11-30 05:38 . 2013-01-10 15:28        3072        ---ha-w-        c:\windows\system32\api-ms-win-core-string-l1-1-0.dll

2012-11-30 05:38 . 2013-01-10 15:28        3072        ---ha-w-        c:\windows\system32\api-ms-win-core-profile-l1-1-0.dll

2012-11-30 05:38 . 2013-01-10 15:28        5120        ---ha-w-        c:\windows\system32\api-ms-win-core-file-l1-1-0.dll

2012-11-30 05:38 . 2013-01-10 15:28        4096        ---ha-w-        c:\windows\system32\api-ms-win-core-localregistry-l1-1-0.dll

2012-11-30 05:38 . 2013-01-10 15:28        4096        ---ha-w-        c:\windows\system32\api-ms-win-core-localization-l1-1-0.dll

2012-11-30 05:38 . 2013-01-10 15:28        3584        ---ha-w-        c:\windows\system32\api-ms-win-core-memory-l1-1-0.dll

2012-11-30 05:38 . 2013-01-10 15:28        3584        ---ha-w-        c:\windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll

2012-11-30 05:38 . 2013-01-10 15:28        3584        ---ha-w-        c:\windows\system32\api-ms-win-core-heap-l1-1-0.dll

2012-11-30 05:38 . 2013-01-10 15:28        3072        ---ha-w-        c:\windows\system32\api-ms-win-core-io-l1-1-0.dll

2012-11-30 05:38 . 2013-01-10 15:28        3072        ---ha-w-        c:\windows\system32\api-ms-win-core-interlocked-l1-1-0.dll

2012-11-30 05:38 . 2013-01-10 15:28        3072        ---ha-w-        c:\windows\system32\api-ms-win-core-handle-l1-1-0.dll

2012-11-30 05:38 . 2013-01-10 15:28        3072        ---ha-w-        c:\windows\system32\api-ms-win-core-fibers-l1-1-0.dll

2012-11-30 05:38 . 2013-01-10 15:28        3072        ---ha-w-        c:\windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll

2012-11-30 05:38 . 2013-01-10 15:28        3072        ---ha-w-        c:\windows\system32\api-ms-win-core-delayload-l1-1-0.dll

2012-11-30 05:38 . 2013-01-10 15:28        3072        ---ha-w-        c:\windows\system32\api-ms-win-core-debug-l1-1-0.dll

2012-11-30 05:38 . 2013-01-10 15:28        3072        ---ha-w-        c:\windows\system32\api-ms-win-core-datetime-l1-1-0.dll

2012-11-30 05:38 . 2013-01-10 15:28        3072        ---ha-w-        c:\windows\system32\api-ms-win-core-console-l1-1-0.dll

2012-11-30 04:53 . 2013-01-10 15:28        274944        ----a-w-        c:\windows\SysWow64\KernelBase.dll

2012-11-30 04:45 . 2013-01-10 15:28        4608        ---ha-w-        c:\windows\SysWow64\api-ms-win-core-processthreads-l1-1-0.dll

2012-11-30 04:45 . 2013-01-10 15:28        4096        ---ha-w-        c:\windows\SysWow64\api-ms-win-core-sysinfo-l1-1-0.dll

2012-11-30 04:45 . 2013-01-10 15:28        4096        ---ha-w-        c:\windows\SysWow64\api-ms-win-core-synch-l1-1-0.dll

2012-11-30 04:45 . 2013-01-10 15:28        4096        ---ha-w-        c:\windows\SysWow64\api-ms-win-core-misc-l1-1-0.dll

2012-11-30 04:45 . 2013-01-10 15:28        4096        ---ha-w-        c:\windows\SysWow64\api-ms-win-core-localregistry-l1-1-0.dll

2012-11-30 04:45 . 2013-01-10 15:28        4096        ---ha-w-        c:\windows\SysWow64\api-ms-win-core-localization-l1-1-0.dll

2012-11-30 04:45 . 2013-01-10 15:28        3584        ---ha-w-        c:\windows\SysWow64\api-ms-win-core-processenvironment-l1-1-0.dll

2012-11-30 04:45 . 2013-01-10 15:28        3584        ---ha-w-        c:\windows\SysWow64\api-ms-win-core-namedpipe-l1-1-0.dll

2012-11-30 04:45 . 2013-01-10 15:28        3584        ---ha-w-        c:\windows\SysWow64\api-ms-win-core-memory-l1-1-0.dll

2012-11-30 04:45 . 2013-01-10 15:28        3584        ---ha-w-        c:\windows\SysWow64\api-ms-win-core-libraryloader-l1-1-0.dll

2012-11-30 04:45 . 2013-01-10 15:28        3584        ---ha-w-        c:\windows\SysWow64\api-ms-win-core-interlocked-l1-1-0.dll

2012-11-30 04:45 . 2013-01-10 15:28        3584        ---ha-w-        c:\windows\SysWow64\api-ms-win-core-heap-l1-1-0.dll

2012-11-30 04:45 . 2013-01-10 15:28        3072        ---ha-w-        c:\windows\SysWow64\api-ms-win-core-string-l1-1-0.dll

2012-11-30 04:45 . 2013-01-10 15:28        3072        ---ha-w-        c:\windows\SysWow64\api-ms-win-core-rtlsupport-l1-1-0.dll

2012-11-30 04:45 . 2013-01-10 15:28        3072        ---ha-w-        c:\windows\SysWow64\api-ms-win-core-profile-l1-1-0.dll

2012-11-30 04:45 . 2013-01-10 15:28        3072        ---ha-w-        c:\windows\SysWow64\api-ms-win-core-io-l1-1-0.dll

2012-11-30 04:45 . 2013-01-10 15:28        5120        ---ha-w-        c:\windows\SysWow64\api-ms-win-core-file-l1-1-0.dll

2012-11-30 04:45 . 2013-01-10 15:28        3072        ---ha-w-        c:\windows\SysWow64\api-ms-win-core-handle-l1-1-0.dll

2012-11-30 04:45 . 2013-01-10 15:28        3072        ---ha-w-        c:\windows\SysWow64\api-ms-win-core-fibers-l1-1-0.dll

2012-11-30 04:45 . 2013-01-10 15:28        3072        ---ha-w-        c:\windows\SysWow64\api-ms-win-core-errorhandling-l1-1-0.dll

.

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}]

2013-01-28 14:49        281760        ----a-w-        c:\program files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"GoogleChromeAutoLaunch_FC3C7AFF6FA05DEB76F42E512273B035"="c:\program files (x86)\Google\Chrome\Application\chrome.exe" [2013-02-21 1274320]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

"BackupManagerTray"="c:\program files (x86)\NewTech Infosystems\Packard Bell MyBackup\BackupManagerTray.exe" [2010-06-28 263936]

"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2010-04-26 102400]

"LManager"="c:\program files (x86)\Launch Manager\LManager.exe" [2010-08-11 975952]

"Camera Assistant Software"="c:\program files (x86)\Video Web Camera\traybar.exe" [2010-12-22 600688]

"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-11-28 59280]

"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2012-12-12 152544]

.

c:\users\Bina\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

ACR Launcher.lnk - c:\program files (x86)\ACR\AutoClubRev\web\acrlauncher.exe [2013-2-21 50688]

OpenOffice.org 3.3.lnk - c:\program files (x86)\OpenOffice.org 3\program\quickstart.exe [2010-12-13 1198592]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 5 (0x5)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]

"aux"=wdmaud.drv

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\run-]

"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"

"DivXUpdate"="c:\program files (x86)\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW

"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe"

.

R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]

R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2012-07-13 160944]

R3 AmUStor;AM USB Stroage Driver;c:\windows\system32\drivers\AmUStor.SYS [2010-06-10 40448]

R3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudbus.sys [2012-02-15 99384]

R3 dgderdrv;dgderdrv;c:\windows\system32\drivers\dgderdrv.sys [2010-09-06 20552]

R3 EagleX64;EagleX64;c:\windows\system32\drivers\EagleX64.sys [x]

R3 k57nd60a;Broadcom NetLink (TM) Gigabit Ethernet - NDIS 6.0;c:\windows\system32\DRIVERS\k57nd60a.sys [x]

R3 ssadbus;SAMSUNG Android USB Composite Device driver (WDM);c:\windows\system32\DRIVERS\ssadbus.sys [2010-07-20 125416]

R3 ssadmdfl;SAMSUNG Android USB Modem (Filter);c:\windows\system32\DRIVERS\ssadmdfl.sys [2010-07-20 16872]

R3 ssadmdm;SAMSUNG Android USB Modem Drivers;c:\windows\system32\DRIVERS\ssadmdm.sys [2010-07-20 159208]

R3 ssudmdm;SAMSUNG  Mobile USB Modem Drivers (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudmdm.sys [2012-02-15 203320]

R3 TFsExDisk;TFsExDisk;c:\windows\System32\Drivers\TFsExDisk.sys [2010-09-06 16392]

R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 59392]

R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [2012-09-28 53760]

R4 NTI IScheduleSvc;NTI IScheduleSvc;c:\program files (x86)\NewTech Infosystems\Packard Bell MyBackup\IScheduleSvc.exe [2010-06-28 255744]

S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2010-04-27 202752]

S2 DsiWMIService;Dritek WMI Service;c:\program files (x86)\Launch Manager\dsiwmis.exe [2010-08-11 321104]

S2 ePowerSvc;Acer ePower Service;c:\program files\Packard Bell\Packard Bell Power Management\ePowerSvc.exe [2010-06-11 868896]

S2 GREGService;GREGService;c:\program files (x86)\Packard Bell\Registration\GREGsvc.exe [2010-01-08 23584]

S2 MBAMScheduler;MBAMScheduler;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [2012-12-14 398184]

S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-12-14 682344]

S2 Updater Service;Updater Service;c:\program files\Packard Bell\Packard Bell Updater\UpdaterService.exe [2010-01-28 243232]

S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2012-12-14 24176]

S3 usbfilter;AMD USB Filter Driver;c:\windows\system32\DRIVERS\usbfilter.sys [2009-12-22 38456]

.

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]

2013-02-23 12:22        1629648        ----a-w-        c:\program files (x86)\Google\Chrome\Application\25.0.1364.97\Installer\chrmstp.exe

.

Inhalt des "geplante Tasks" Ordners

.

2013-02-26 c:\windows\Tasks\Adobe Flash Player Updater.job

- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-10-16 08:57]

.

2013-02-26 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-02-28 21:28]

.

2013-02-26 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-02-28 21:28]

.

.

--------- X64 Entries -----------

.

.

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}]

2013-01-28 14:49        342176        ----a-w-        c:\program files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns64.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2010-07-29 11101800]

"PLFSetI"="c:\windows\PLFSetI.exe" [2010-06-10 206208]

"Acer ePower Management"="c:\program files\Packard Bell\Packard Bell Power Management\ePowerTray.exe" [2010-06-11 861216]

"AmIcoSinglun64"="c:\program files (x86)\AmIcoSingLun\AmIcoSinglun64.exe" [2010-06-10 324608]

.

------- Zusätzlicher Suchlauf -------

.

uStart Page = hxxp://www.facebook.com/

uLocal Page = c:\windows\system32\blank.htm

mDefault_Page_URL = hxxp://packardbell.msn.com

mStart Page = hxxp://packardbell.msn.com

mLocal Page = c:\windows\SysWOW64\blank.htm

uInternet Settings,ProxyOverride = 127.0.0.1:9421;<local>

IE: Free YouTube Download - c:\program files (x86)\Common Files\DVDVideoSoft\plugins\freeytvdownloader.htm

IE: Free YouTube to MP3 Converter - c:\program files (x86)\Common Files\DVDVideoSoft\plugins\freeytmp3downloader.htm

IE: {{EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - c:\program files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll

Trusted Zone: clonewarsadventures.com

Trusted Zone: freerealms.com

Trusted Zone: soe.com

Trusted Zone: sony.com

TCP: DhcpNameServer = 192.168.178.1

.

- - - - Entfernte verwaiste Registrierungseinträge - - - -

.

Toolbar-Locked - (no file)

SafeBoot-69630825.sys

Toolbar-Locked - (no file)

WebBrowser-{C840E246-6B95-475E-9BD7-CAA1C7ECA9F2} - (no file)

HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe

.

.

.

--------------------- Gesperrte Registrierungsschluessel ---------------------

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_5_502_149_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]

@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_5_502_149_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="IFlashBroker5"

.

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_5_502_149_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_5_502_149_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Shockwave Flash Object"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_5_502_149.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]

@="0"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]

@="ShockwaveFlash.ShockwaveFlash.11"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_5_502_149.ocx, 1"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="ShockwaveFlash.ShockwaveFlash"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Macromedia Flash Factory Object"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_5_502_149.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]

@="FlashFactory.FlashFactory.1"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_5_502_149.ocx, 1"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="FlashFactory.FlashFactory"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="IFlashBroker5"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\system\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\system\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\system\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\system\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\system\ControlSet002\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

Zeit der Fertigstellung: 2013-02-26  16:37:08

ComboFix-quarantined-files.txt  2013-02-26 15:37

.

Vor Suchlauf: 15 Verzeichnis(se), 198.276.308.992 Bytes frei

Nach Suchlauf: 20 Verzeichnis(se), 197.743.902.720 Bytes frei

.

- - End Of File - - BCC931B05D6E02EDEB82C686FB2CF8C1