ComboFix 14-01-27.02 - Thor Gunnar 28.01.2014 19:08:58.1.4 - x64 Microsoft Windows 7 Home Premium 6.1.7601.1.1252.47.1044.18.4010.2259 [GMT 1:00] Kjører fra: c:\users\Thor Gunnar\Downloads\ComboFix.exe AV: Microsoft Security Essentials *Disabled/Updated* {641105E6-77ED-3F35-A304-765193BCB75F} SP: Microsoft Security Essentials *Disabled/Updated* {DF70E402-51D7-30BB-99B4-4D23E83BFDE2} SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . . ((((((((((((((((((((((((((((((((((((((( Andre slettinger ))))))))))))))))))))))))))))))))))))))))))))))))) . . c:\users\Thor Gunnar\AppData\Roaming\Microsoft\Windows\Recent\Lenovo Telephony Start Now.url c:\windows\s.bat . . ((((((((((((((((((((((((((( Filer Opprettet Fra 2013-12-28 til 2014-01-28 ))))))))))))))))))))))))))))))))) . . 2014-01-28 18:18 . 2014-01-28 18:18 -------- d-----w- c:\users\Default\AppData\Local\temp 2014-01-28 18:18 . 2014-01-28 18:18 -------- d-----w- c:\users\Ann Kristin\AppData\Local\temp 2014-01-28 17:49 . 2014-01-28 17:49 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware 2014-01-28 17:49 . 2013-04-04 13:50 25928 ----a-w- c:\windows\system32\drivers\mbam.sys 2014-01-28 17:37 . 2013-12-03 18:28 10315576 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{540E42A6-D5B5-4F17-A041-08C831086D31}\mpengine.dll 2014-01-26 19:56 . 2013-12-27 11:23 965000 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\NISBackup\gapaengine.dll 2014-01-26 19:56 . 2013-12-27 11:23 965000 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{92F0568D-0093-48B1-B2B0-14C1009B3ED4}\gapaengine.dll 2014-01-26 19:56 . 2013-12-03 18:28 10315576 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll 2014-01-21 07:17 . 2013-12-18 20:09 96168 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll 2014-01-19 18:07 . 2013-11-26 10:32 3156480 ----a-w- c:\windows\system32\win32k.sys 2014-01-19 18:07 . 2013-11-27 01:41 343040 ----a-w- c:\windows\system32\drivers\usbhub.sys 2014-01-19 18:07 . 2013-11-27 01:41 99840 ----a-w- c:\windows\system32\drivers\usbccgp.sys 2014-01-19 18:07 . 2013-11-27 01:41 53248 ----a-w- c:\windows\system32\drivers\usbehci.sys 2014-01-19 18:07 . 2013-11-27 01:41 325120 ----a-w- c:\windows\system32\drivers\usbport.sys 2014-01-19 18:07 . 2013-11-27 01:41 25600 ----a-w- c:\windows\system32\drivers\usbohci.sys 2014-01-19 18:07 . 2013-11-27 01:41 30720 ----a-w- c:\windows\system32\drivers\usbuhci.sys 2014-01-19 18:07 . 2013-11-27 01:41 7808 ----a-w- c:\windows\system32\drivers\usbd.sys 2014-01-19 18:07 . 2013-11-26 11:40 376768 ----a-w- c:\windows\system32\drivers\netio.sys 2014-01-10 17:25 . 2014-01-10 18:25 -------- d-----w- c:\users\Ann Kristin\AppData\Roaming\Skype . . . (((((((((((((((((((((((((((((((((((((((( Find3M Rapport )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2014-01-19 18:09 . 2012-03-30 21:48 86054176 ----a-w- c:\windows\system32\MRT.exe 2014-01-19 07:33 . 2010-11-21 03:27 270496 ------w- c:\windows\system32\MpSigStub.exe 2013-12-10 22:45 . 2012-06-25 09:07 692616 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe 2013-12-10 22:45 . 2012-03-20 18:40 71048 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl 2013-12-04 03:28 . 2013-12-27 10:08 10315576 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{81B5AFC9-C595-4321-A8DE-F747486070F5}\mpengine.dll 2013-11-26 11:54 . 2013-12-12 21:27 23183360 ----a-w- c:\windows\system32\mshtml.dll 2013-11-26 10:19 . 2013-12-12 21:27 2724864 ----a-w- c:\windows\system32\mshtml.tlb 2013-11-26 10:18 . 2013-12-12 21:27 4096 ----a-w- c:\windows\system32\ieetwcollectorres.dll 2013-11-26 09:48 . 2013-12-12 21:27 66048 ----a-w- c:\windows\system32\iesetup.dll 2013-11-26 09:46 . 2013-12-12 21:27 48640 ----a-w- c:\windows\system32\ieetwproxystub.dll 2013-11-26 09:41 . 2013-12-12 21:27 2764288 ----a-w- c:\windows\system32\iertutil.dll 2013-11-26 09:29 . 2013-12-12 21:27 53760 ----a-w- c:\windows\system32\jsproxy.dll 2013-11-26 09:27 . 2013-12-12 21:27 33792 ----a-w- c:\windows\system32\iernonce.dll 2013-11-26 09:23 . 2013-12-12 21:27 2724864 ----a-w- c:\windows\SysWow64\mshtml.tlb 2013-11-26 09:21 . 2013-12-12 21:27 574976 ----a-w- c:\windows\system32\ieui.dll 2013-11-26 09:18 . 2013-12-12 21:27 139264 ----a-w- c:\windows\system32\ieUnatt.exe 2013-11-26 09:18 . 2013-12-12 21:27 111616 ----a-w- c:\windows\system32\ieetwcollector.exe 2013-11-26 09:16 . 2013-12-12 21:27 708608 ----a-w- c:\windows\system32\jscript9diag.dll 2013-11-26 08:57 . 2013-12-12 21:27 218624 ----a-w- c:\windows\system32\ie4uinit.exe 2013-11-26 08:35 . 2013-12-12 21:27 5769216 ----a-w- c:\windows\system32\jscript9.dll 2013-11-26 08:28 . 2013-12-12 21:27 553472 ----a-w- c:\windows\SysWow64\jscript9diag.dll 2013-11-26 08:16 . 2013-12-12 21:27 4243968 ----a-w- c:\windows\SysWow64\jscript9.dll 2013-11-26 08:02 . 2013-12-12 21:27 1995264 ----a-w- c:\windows\system32\inetcpl.cpl 2013-11-26 07:48 . 2013-12-12 21:27 12996608 ----a-w- c:\windows\system32\ieframe.dll 2013-11-26 07:32 . 2013-12-12 21:27 1928192 ----a-w- c:\windows\SysWow64\inetcpl.cpl 2013-11-26 07:07 . 2013-12-12 21:27 2334208 ----a-w- c:\windows\system32\wininet.dll 2013-11-26 06:40 . 2013-12-12 21:27 1395200 ----a-w- c:\windows\system32\urlmon.dll 2013-11-26 06:34 . 2013-12-12 21:27 817664 ----a-w- c:\windows\system32\ieapfltr.dll 2013-11-26 06:33 . 2013-12-12 21:27 1820160 ----a-w- c:\windows\SysWow64\wininet.dll 2013-11-23 18:26 . 2013-12-12 21:09 417792 ----a-w- c:\windows\SysWow64\WMPhoto.dll 2013-11-23 17:47 . 2013-12-12 21:09 465920 ----a-w- c:\windows\system32\WMPhoto.dll 2013-11-19 21:55 . 2013-11-19 21:55 940032 ----a-w- c:\windows\system32\MsSpellCheckingFacility.exe 2013-11-19 21:55 . 2013-11-19 21:55 194048 ----a-w- c:\windows\SysWow64\elshyph.dll 2013-11-19 21:55 . 2013-11-19 21:55 71680 ----a-w- c:\windows\SysWow64\RegisterIEPKEYs.exe 2013-11-19 21:55 . 2013-11-19 21:55 645120 ----a-w- c:\windows\SysWow64\jsIntl.dll 2013-11-19 21:55 . 2013-11-19 21:55 62464 ----a-w- c:\windows\SysWow64\tdc.ocx 2013-11-19 21:55 . 2013-11-19 21:55 61952 ----a-w- c:\windows\SysWow64\iesetup.dll 2013-11-19 21:55 . 2013-11-19 21:55 454656 ----a-w- c:\windows\SysWow64\vbscript.dll 2013-11-19 21:55 . 2013-11-19 21:55 34816 ----a-w- c:\windows\SysWow64\JavaScriptCollectionAgent.dll 2013-11-19 21:55 . 2013-11-19 21:55 337408 ----a-w- c:\windows\SysWow64\html.iec 2013-11-19 21:55 . 2013-11-19 21:55 24576 ----a-w- c:\windows\SysWow64\licmgr10.dll 2013-11-19 21:55 . 2013-11-19 21:55 235008 ----a-w- c:\windows\system32\elshyph.dll 2013-11-19 21:55 . 2013-11-19 21:55 182272 ----a-w- c:\windows\SysWow64\msls31.dll 2013-11-19 21:55 . 2013-11-19 21:55 151552 ----a-w- c:\windows\SysWow64\iexpress.exe 2013-11-19 21:55 . 2013-11-19 21:55 139264 ----a-w- c:\windows\SysWow64\wextract.exe 2013-11-19 21:55 . 2013-11-19 21:55 112128 ----a-w- c:\windows\SysWow64\ieUnatt.exe 2013-11-19 21:55 . 2013-11-19 21:55 1051136 ----a-w- c:\windows\SysWow64\mshtmlmedia.dll 2013-11-19 21:55 . 2013-11-19 21:55 86016 ----a-w- c:\windows\SysWow64\iesysprep.dll 2013-11-19 21:55 . 2013-11-19 21:55 74240 ----a-w- c:\windows\SysWow64\SetIEInstalledDate.exe 2013-11-19 21:55 . 2013-11-19 21:55 61952 ----a-w- c:\windows\SysWow64\MshtmlDac.dll 2013-11-19 21:55 . 2013-11-19 21:55 51200 ----a-w- c:\windows\SysWow64\ieetwproxystub.dll 2013-11-19 21:55 . 2013-11-19 21:55 48640 ----a-w- c:\windows\SysWow64\mshtmler.dll 2013-11-19 21:55 . 2013-11-19 21:55 36352 ----a-w- c:\windows\SysWow64\imgutil.dll 2013-11-19 21:55 . 2013-11-19 21:55 13312 ----a-w- c:\windows\SysWow64\mshta.exe 2013-11-19 21:55 . 2013-11-19 21:55 111616 ----a-w- c:\windows\SysWow64\IEAdvpack.dll 2013-11-19 21:55 . 2013-11-19 21:55 942592 ----a-w- c:\windows\system32\jsIntl.dll 2013-11-19 21:55 . 2013-11-19 21:55 90112 ----a-w- c:\windows\system32\SetIEInstalledDate.exe 2013-11-19 21:55 . 2013-11-19 21:55 86016 ----a-w- c:\windows\system32\RegisterIEPKEYs.exe 2013-11-19 21:55 . 2013-11-19 21:55 84992 ----a-w- c:\windows\system32\mshtmled.dll 2013-11-19 21:55 . 2013-11-19 21:55 83968 ----a-w- c:\windows\system32\MshtmlDac.dll 2013-11-19 21:55 . 2013-11-19 21:55 81408 ----a-w- c:\windows\system32\icardie.dll 2013-11-19 21:55 . 2013-11-19 21:55 774144 ----a-w- c:\windows\system32\jscript.dll 2013-11-19 21:55 . 2013-11-19 21:55 77312 ----a-w- c:\windows\system32\tdc.ocx 2013-11-19 21:55 . 2013-11-19 21:55 626176 ----a-w- c:\windows\system32\msfeeds.dll 2013-11-19 21:55 . 2013-11-19 21:55 62464 ----a-w- c:\windows\system32\pngfilt.dll 2013-11-19 21:55 . 2013-11-19 21:55 616104 ----a-w- c:\windows\system32\ieapfltr.dat 2013-11-19 21:55 . 2013-11-19 21:55 548352 ----a-w- c:\windows\system32\vbscript.dll 2013-11-19 21:55 . 2013-11-19 21:55 52224 ----a-w- c:\windows\system32\msfeedsbs.dll 2013-11-19 21:55 . 2013-11-19 21:55 48640 ----a-w- c:\windows\system32\mshtmler.dll 2013-11-19 21:55 . 2013-11-19 21:55 453120 ----a-w- c:\windows\system32\dxtmsft.dll 2013-11-19 21:55 . 2013-11-19 21:55 413696 ----a-w- c:\windows\system32\html.iec 2013-11-19 21:55 . 2013-11-19 21:55 40448 ----a-w- c:\windows\system32\JavaScriptCollectionAgent.dll 2013-11-19 21:55 . 2013-11-19 21:55 30208 ----a-w- c:\windows\system32\licmgr10.dll 2013-11-19 21:55 . 2013-11-19 21:55 296960 ----a-w- c:\windows\system32\dxtrans.dll 2013-11-19 21:55 . 2013-11-19 21:55 263376 ----a-w- c:\windows\system32\iedkcs32.dll 2013-11-19 21:55 . 2013-11-19 21:55 247808 ----a-w- c:\windows\system32\msls31.dll 2013-11-19 21:55 . 2013-11-19 21:55 243200 ----a-w- c:\windows\system32\webcheck.dll 2013-11-19 21:55 . 2013-11-19 21:55 235520 ----a-w- c:\windows\system32\url.dll 2013-11-19 21:55 . 2013-11-19 21:55 195584 ----a-w- c:\windows\system32\msrating.dll 2013-11-19 21:55 . 2013-11-19 21:55 167424 ----a-w- c:\windows\system32\iexpress.exe 2013-11-19 21:55 . 2013-11-19 21:55 147968 ----a-w- c:\windows\system32\occache.dll 2013-11-19 21:55 . 2013-11-19 21:55 143872 ----a-w- c:\windows\system32\wextract.exe 2013-11-19 21:55 . 2013-11-19 21:55 13824 ----a-w- c:\windows\system32\mshta.exe 2013-11-19 21:55 . 2013-11-19 21:55 13312 ----a-w- c:\windows\system32\msfeedssync.exe 2013-11-19 21:55 . 2013-11-19 21:55 131072 ----a-w- c:\windows\system32\IEAdvpack.dll 2013-11-19 21:55 . 2013-11-19 21:55 1228800 ----a-w- c:\windows\system32\mshtmlmedia.dll 2013-11-19 21:55 . 2013-11-19 21:55 105984 ----a-w- c:\windows\system32\iesysprep.dll 2013-11-19 21:55 . 2013-11-19 21:55 101376 ----a-w- c:\windows\system32\inseng.dll 2013-11-19 21:55 . 2013-11-19 21:55 48128 ----a-w- c:\windows\system32\imgutil.dll 2013-11-19 21:55 . 2013-11-19 21:55 135680 ----a-w- c:\windows\system32\iepeers.dll 2013-11-12 02:23 . 2013-12-12 21:09 2048 ----a-w- c:\windows\system32\tzres.dll 2013-11-12 02:07 . 2013-12-12 21:09 2048 ----a-w- c:\windows\SysWow64\tzres.dll . . (((((((((((((((((((((((((((((((( Oppstartspunkter I Registeret ))))))))))))))))))))))))))))))))))))))))))))) . . *Merk* tomme oppføringer & gyldige standardoppføringer vises ikke REGEDIT4 . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Spotify Web Helper"="c:\users\Thor Gunnar\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe" [2013-06-22 1104384] "Spotify"="c:\users\Thor Gunnar\AppData\Roaming\Spotify\Spotify.exe" [2013-06-22 4643328] "iCloudServices"="c:\program files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe" [2013-09-14 59720] "ApplePhotoStreams"="c:\program files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe" [2013-09-15 59720] . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "331BigDog"="c:\program files (x86)\USB Camera\VM331_STI.EXE" [2010-01-15 536576] "PLTSR"="c:\program files (x86)\EgisTec Port Locker\EgisPLTSR.exe" [2010-10-22 364400] "YouCam Mirage"="c:\program files (x86)\Lenovo\YouCam\YCMMirage.exe" [2010-12-24 136488] "YouCam Tray"="c:\program files (x86)\Lenovo\YouCam\YouCam.exe" [2010-12-24 224352] "EgisTecPMMUpdate"="c:\program files (x86)\EgisTec IPS\PmmUpdate.exe" [2010-03-10 407920] "EgisUpdate"="c:\program files (x86)\EgisTec IPS\EgisUpdate.exe" [2010-03-10 201584] "UpdateP2GShortCut"="c:\program files (x86)\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe" [2010-07-26 222504] "UpdatePRCShortCut"="c:\program files\Lenovo\OneKey App\OneKey Recovery\MUITransfer\MUIStartMenu.exe" [2009-05-13 222504] "BCSSync"="c:\program files (x86)\Microsoft Office\Office14\BCSSync.exe" [2012-11-05 89184] "APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2013-04-21 59720] "QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2013-05-01 421888] "Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-11-21 959904] "SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2013-07-02 254336] "iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2013-11-01 152392] . c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ Bluetooth.lnk - c:\program files\Lenovo\Bluetooth Software\BTTray.exe [2011-2-15 1136928] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 5 (0x5) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableUIADesktopToggle"= 0 (0x0) . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS] @="" . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc] @="Service" . R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x] R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x] R3 esgiguard;esgiguard;c:\program files\Enigma Software Group\SpyHunter\esgiguard.sys;c:\program files\Enigma Software Group\SpyHunter\esgiguard.sys [x] R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x] R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys;c:\windows\SYSNATIVE\DRIVERS\NisDrvWFP.sys [x] R3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\NisSrv.exe;c:\program files\Microsoft Security Client\NisSrv.exe [x] R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x] R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x] R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys;c:\windows\SYSNATIVE\Drivers\usbaapl64.sys [x] R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x] R3 wsvd;wsvd;c:\windows\system32\DRIVERS\wsvd.sys;c:\windows\SYSNATIVE\DRIVERS\wsvd.sys [x] R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe;c:\program files\Windows Live\Mesh\wlcrasvc.exe [x] S0 bdisk;COMODO Disk Raw Access Filter;c:\windows\system32\drivers\bdisk.sys;c:\windows\SYSNATIVE\drivers\bdisk.sys [x] S0 CBUfs;CBUfs;c:\windows\system32\drivers\CBUFS.sys;c:\windows\SYSNATIVE\drivers\CBUFS.sys [x] S0 cbvd;COMODO Encrypted Virtual Disk;c:\windows\system32\DRIVERS\cbvd.sys;c:\windows\SYSNATIVE\DRIVERS\cbvd.sys [x] S0 fbfmon;fbfmon;c:\windows\system32\drivers\fbfmon.sys;c:\windows\SYSNATIVE\drivers\fbfmon.sys [x] S0 LHDmgr;LHDmgr;c:\windows\System32\DRIVERS\LhdX64.sys;c:\windows\SYSNATIVE\DRIVERS\LhdX64.sys [x] S0 reparse;reparse;c:\windows\system32\DRIVERS\cbreparse.sys;c:\windows\SYSNATIVE\DRIVERS\cbreparse.sys [x] S1 BPntDrv;BPntDrv;c:\windows\system32\drivers\BPntDrv.sys;c:\windows\SYSNATIVE\drivers\BPntDrv.sys [x] S1 EgisTecFF;EgisTecFF;c:\windows\system32\DRIVERS\EgisTecFF.sys;c:\windows\SYSNATIVE\DRIVERS\EgisTecFF.sys [x] S2 COSService.exe;COMODO Online Storage Service;c:\program files\COMODO\COMMON\COSService.exe;c:\program files\COMODO\COMMON\COSService.exe [x] S2 EgisTec Service Help;EgisTec Service Help;c:\program files (x86)\EgisTec Port Locker\Egishlpsvc.exe;c:\program files (x86)\EgisTec Port Locker\Egishlpsvc.exe [x] S2 Jotta VSS Service;Jotta VSS Service;c:\program files\Jotta\vss\jVSS.exe;c:\program files\Jotta\vss\jVSS.exe [x] S2 SynchronizationService.exe;COMODO BackUp Service;c:\program files\COMODO\COMMON\SynchronizationService.exe;c:\program files\COMODO\COMMON\SynchronizationService.exe [x] S2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [x] S3 ACPIVPC;Lenovo Virtual Power Controller Driver;c:\windows\system32\DRIVERS\AcpiVpc.sys;c:\windows\SYSNATIVE\DRIVERS\AcpiVpc.sys [x] S3 BTWAMPFL;BTWAMPFL;c:\windows\system32\DRIVERS\btwampfl.sys;c:\windows\SYSNATIVE\DRIVERS\btwampfl.sys [x] S3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys;c:\windows\SYSNATIVE\DRIVERS\btwl2cap.sys [x] S3 clwvd;CyberLink WebCam Virtual Driver;c:\windows\system32\DRIVERS\clwvd.sys;c:\windows\SYSNATIVE\DRIVERS\clwvd.sys [x] S3 IntcDAud;Intel(R) Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys;c:\windows\SYSNATIVE\DRIVERS\IntcDAud.sys [x] S3 RSUSBVSTOR;RtsUVStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUVStor.sys;c:\windows\SYSNATIVE\Drivers\RtsUVStor.sys [x] S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x] S3 vdbus;Virtual Disk Bus Enumerator;c:\windows\system32\DRIVERS\vdbus.sys;c:\windows\SYSNATIVE\DRIVERS\vdbus.sys [x] S3 vm331avs;Digital Camera 1;c:\windows\system32\Drivers\vm331avs.sys;c:\windows\SYSNATIVE\Drivers\vm331avs.sys [x] S3 vmuvcflt;Vimicro USB Camera Filter;c:\windows\system32\Drivers\vmuvcflt.sys;c:\windows\SYSNATIVE\Drivers\vmuvcflt.sys [x] . . --- Andre tjenester/drivere lastet i minnet --- . *NewlyCreated* - WS2IFSL . Innholdet i mappen 'Scheduled Tasks' (planlagte oppgaver) . 2014-01-28 c:\windows\Tasks\Adobe Flash Player Updater.job - c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-06-25 22:45] . 2014-01-28 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-01-20 05:08] . 2014-01-28 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-01-20 05:08] . 2014-01-26 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4147670576-661414251-2377785915-1000Core.job - c:\users\Thor Gunnar\AppData\Local\Google\Update\GoogleUpdate.exe [2012-03-26 17:59] . 2014-01-28 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4147670576-661414251-2377785915-1000UA.job - c:\users\Thor Gunnar\AppData\Local\Google\Update\GoogleUpdate.exe [2012-03-26 17:59] . . --------- X64 Entries ----------- . . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ JottaExt1] @="{648B08C1-8BB1-46e1-8F8A-64EF3F28D417}" [HKEY_CLASSES_ROOT\CLSID\{648B08C1-8BB1-46e1-8F8A-64EF3F28D417}] 2013-11-04 17:57 333280 ----a-w- c:\program files\Jotta\jottaext64.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ JottaExt2] @="{648B08C2-8BB1-46e1-8F8A-64EF3F28D417}" [HKEY_CLASSES_ROOT\CLSID\{648B08C2-8BB1-46e1-8F8A-64EF3F28D417}] 2013-11-04 17:57 333280 ----a-w- c:\program files\Jotta\jottaext64.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ JottaExt3] @="{648B08C3-8BB1-46e1-8F8A-64EF3F28D417}" [HKEY_CLASSES_ROOT\CLSID\{648B08C3-8BB1-46e1-8F8A-64EF3F28D417}] 2013-11-04 17:57 333280 ----a-w- c:\program files\Jotta\jottaext64.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\COSDriveIconOverlay] @="{5FDACB62-6B7B-4116-9403-C5E0D3852A57}" [HKEY_CLASSES_ROOT\CLSID\{5FDACB62-6B7B-4116-9403-C5E0D3852A57}] 2012-05-29 11:16 5437128 ----a-w- c:\program files\COMODO\COMMON\ShellExtension.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\COSSyncItemInSyncIconOverlay] @="{68F287EF-DA6D-4595-AF52-90FF6CE52AFE}" [HKEY_CLASSES_ROOT\CLSID\{68F287EF-DA6D-4595-AF52-90FF6CE52AFE}] 2012-05-29 11:16 5437128 ----a-w- c:\program files\COMODO\COMMON\ShellExtension.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\COSSyncItemModifiedIconOverlay] @="{AE67D273-7253-4236-B55E-D40055B305D6}" [HKEY_CLASSES_ROOT\CLSID\{AE67D273-7253-4236-B55E-D40055B305D6}] 2012-05-29 11:16 5437128 ----a-w- c:\program files\COMODO\COMMON\ShellExtension.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\COSSyncItemNewIconOverlay] @="{022F23E9-DA0F-4A86-A728-CAF6150C0B63}" [HKEY_CLASSES_ROOT\CLSID\{022F23E9-DA0F-4A86-A728-CAF6150C0B63}] 2012-05-29 11:16 5437128 ----a-w- c:\program files\COMODO\COMMON\ShellExtension.dll . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2011-01-04 11772520] "Energy Management"="c:\program files (x86)\Lenovo\Energy Management\Energy Management.exe" [2012-01-20 9769888] "EnergyUtility"="c:\program files (x86)\Lenovo\Energy Management\Utility.exe" [2012-01-20 5908928] "Lenovo EE Boot Optimizer"="c:\program files (x86)\Lenovo\Boot Optimizer\PopWnd.exe" [2012-01-20 114688] "IgfxTray"="c:\windows\system32\igfxtray.exe" [2012-02-14 170264] "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2012-02-14 398616] "Persistence"="c:\windows\system32\igfxpers.exe" [2012-02-14 440600] "Logitech Download Assistant"="c:\windows\System32\LogiLDA.dll" [2012-09-20 1832760] "MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2013-10-23 1266912] . ------- Tilleggsskanning ------- . uStart Page = hxxp://www.startsiden.no/ uLocal Page = c:\windows\system32\blank.htm mLocal Page = c:\windows\SysWOW64\blank.htm uSearchAssistant = hxxp://www.google.com IE: E&ksporter til Microsoft Excel - c:\progra~2\MICROS~1\Office14\EXCEL.EXE/3000 IE: Se&nd til OneNote - c:\progra~2\MICROS~1\Office14\ONBttnIE.dll/105 IE: Send bilde til &Bluetooth-enhet... - c:\program files\Lenovo\Bluetooth Software\btsendto_ie_ctx.htm IE: Send side til &Bluetooth-enhet... - c:\program files\Lenovo\Bluetooth Software\btsendto_ie.htm TCP: DhcpNameServer = 192.168.0.1 DPF: Garmin Communicator Plug-In - hxxps://static.garmincdn.com/gcp/ie/4.0.3.0/GarminAxControl_32.CAB FF - ProfilePath - c:\users\Thor Gunnar\AppData\Roaming\Mozilla\Firefox\Profiles\svyg65yw.default\ FF - prefs.js: browser.startup.homepage - hxxp://feed.snapdo.com/?publisher=SoftPublisherYB&dpid=SoftpublisherYB&co=NO&userid=a25b49ea-8391-b43d-b21f-e56f36ac1169&searchtype=hp&installDate=25/12/2013 FF - prefs.js: keyword.URL - hxxp://feed.snapdo.com/?publisher=SoftPublisherYB&dpid=SoftpublisherYB&co=NO&userid=a25b49ea-8391-b43d-b21f-e56f36ac1169&searchtype=ds&installDate=25/12/2013&q= . - - - - TOMME PEKERE FJERNET - - - - . Toolbar-Locked - (no file) Wow6432Node-HKCU-Run-MobileDocuments - c:\program files (x86)\Common Files\Apple\Internet Services\ubd.exe Wow6432Node-HKLM-Run-mobilegeni daemon - c:\program files (x86)\Mobogenie\DaemonProcess.exe HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start Toolbar-Locked - (no file) ShellIconOverlayIdentifiers-{FB314ED9-A251-47B7-93E1-CDD82E34AF8B} - (no file) ShellIconOverlayIdentifiers-{FB314EDA-A251-47B7-93E1-CDD82E34AF8B} - (no file) ShellIconOverlayIdentifiers-{FB314EDB-A251-47B7-93E1-CDD82E34AF8B} - (no file) ShellIconOverlayIdentifiers-{FB314EDC-A251-47B7-93E1-CDD82E34AF8B} - (no file) HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe . . . --------------------- LÅSTE REGISTERNØKLER --------------------- . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\windows\\system32\\Macromed\\Flash\\FlashUtil64_11_9_900_170_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32] @="c:\\windows\\system32\\Macromed\\Flash\\FlashUtil64_11_9_900_170_ActiveX.exe" . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="IFlashBroker5" . [HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_9_900_170_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32] @="c:\\windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_9_900_170_ActiveX.exe" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Shockwave Flash Object" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_9_900_170.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus] @="0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID] @="ShockwaveFlash.ShockwaveFlash.11" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_9_900_170.ocx, 1" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="ShockwaveFlash.ShockwaveFlash" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Macromedia Flash Factory Object" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_9_900_170.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID] @="FlashFactory.FlashFactory.1" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_9_900_170.ocx, 1" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="FlashFactory.FlashFactory" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="IFlashBroker5" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\software\McAfee] "SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79, 00,5c,00,6d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,6f,00,66,00,\ . [HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}] @Denied: (A) (Everyone) "Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}" . [HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane3] @Denied: (A) (Everyone) . [HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0] "Key"="ActionsPane3" "Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd" . [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . ------------------------ Andre Kjørende Prosesser ------------------------ . c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe c:\program files (x86)\Google\Update\1.3.22.3\GoogleCrashHandler.exe c:\program files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe . ************************************************************************** . Tidspunkt ferdig: 2014-01-28 19:30:50 - maskinen ble startet på nytt ComboFix-quarantined-files.txt 2014-01-28 18:30 . Pre-Run: 369 172 918 272 byte ledig Post-Run: 371 226 849 280 byte ledig . - - End Of File - - 152EFB9DDA957DDD053C9A7923E43303