Zurück   Trojaner-Board > Malware entfernen > Log-Analyse und Auswertung

Log-Analyse und Auswertung: Win32/Spy.Banker.WBU Trojaner

Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.

Antwort
Alt 22.03.2012, 12:27   #1
NuriTakuru
 
Win32/Spy.Banker.WBU Trojaner - Standard

Win32/Spy.Banker.WBU Trojaner



Guten Tag zusammen
ich bräuchte ganz dringend Hilfe, da ich angesichts der laufenden Abiturprüfungen auf den PC gewissermaßen angewiesen bin.
Heute morgen meldete ESET NOD32 bei dir den oben genannten Trojaner und konnte diesen nicht löschen. Der Laptop dreht total durch, es lässt sich immer wieder nichts eintippen (weiß nicht wie ich es beschreiben soll).
Könntet ihr mir da behilflich sein? Wäre sehr sehr nett.
Mit freundlichen Grüßen, Nuri

PS: wer lesen kann, ist klar im Vorteil >_> Tut mir leid, werde gleich die notwendigen Sachen hinzufügen

Alt 22.03.2012, 13:42   #2
NuriTakuru
 
Win32/Spy.Banker.WBU Trojaner - Standard

Win32/Spy.Banker.WBU Trojaner



Hier die fehlenden Logs
Freue mich sehr über eine Antwort
__________________


Alt 22.03.2012, 14:59   #3
markusg
/// Malware-holic
 
Win32/Spy.Banker.WBU Trojaner - Standard

Win32/Spy.Banker.WBU Trojaner



hi
nutzt du den pc für onlinebanking, einkäufe, sonstige zahlungsabwicklungen oder ähnlich wichtiges, wie berufliches.
__________________
__________________

Alt 22.03.2012, 15:23   #4
NuriTakuru
 
Win32/Spy.Banker.WBU Trojaner - Standard

Win32/Spy.Banker.WBU Trojaner



Von diesen PC aus wurde nur ein mal vor ein paar Wochen ein Online-Einkauf getätigt durch PaySafe-System.
Den PC nutze ich freizeitlich

Alt 22.03.2012, 16:01   #5
markusg
/// Malware-holic
 
Win32/Spy.Banker.WBU Trojaner - Standard

Win32/Spy.Banker.WBU Trojaner



also, wenn du jemals wieder irgendwelche zahlungsabwicklungen über das system machen willst, ist folgendes nötig:
der pc muss neu aufgesetzt und dann abgesichert werden
1. Datenrettung:2. Formatieren, Windows neuinstallieren:3. PC absichern: http://www.trojaner-board.de/96344-a...-rechners.html
4. alle Passwörter ändern!
5. nach PC Absicherung, die gesicherten Daten prüfen und falls sauber: zurückspielen.
6. werde ich dann noch was zum absichern von Onlinebanking mit Chip Card Reader + Star Money sagen.

__________________
-Verdächtige mails bitte an uns zur Analyse weiterleiten:
markusg.trojaner-board@web.de
Weiterleiten
Anleitung:
http://markusg.trojaner-board.de
Mails bitte vorerst nach obiger Anleitung an
markusg.trojaner-board@web.de
Weiterleiten
Wenn Ihr uns unterstützen möchtet

Alt 22.03.2012, 16:16   #6
NuriTakuru
 
Win32/Spy.Banker.WBU Trojaner - Standard

Win32/Spy.Banker.WBU Trojaner



Ich bin nicht so an weiteren Zahlungsabwicklungen interessiert. Besteht durch den Trojaner nur bei diesen eine Gefahr?
Denn der PC ist schrott, und ich hoffe dass er innerhalb von den nächsten 1-2 Monaten auf dem Schrottplatz landet.
Danke für die aufsführliche Information!

Alt 22.03.2012, 16:23   #7
markusg
/// Malware-holic
 
Win32/Spy.Banker.WBU Trojaner - Standard

Win32/Spy.Banker.WBU Trojaner



Combofix darf ausschließlich ausgeführt werden, wenn dies von einem Team Mitglied angewiesen wurde!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich
ziehen und eine Bereinigung der Infektion noch erschweren.

Bitte downloade dir Combofix.exe und speichere es unbedingt auf deinem Desktop.
  • Besuche folgende Seite für Downloadlinks und Anweisungen für dieses
    Tool

    Ein Leitfaden und Tutorium zur Nutzung von ComboFix
  • Hinweis:
    Gehe sicher das all deine Anti Virus und Anti Malware Programme abgeschalten sind, damit diese Combofix nicht bei der Arbeit stören.
  • Poste bitte die C:\Combofix.txt in deiner nächsten Antwort.
__________________
-Verdächtige mails bitte an uns zur Analyse weiterleiten:
markusg.trojaner-board@web.de
Weiterleiten
Anleitung:
http://markusg.trojaner-board.de
Mails bitte vorerst nach obiger Anleitung an
markusg.trojaner-board@web.de
Weiterleiten
Wenn Ihr uns unterstützen möchtet

Alt 22.03.2012, 17:45   #8
NuriTakuru
 
Win32/Spy.Banker.WBU Trojaner - Standard

Win32/Spy.Banker.WBU Trojaner



Hier die Log-Datei
Angehängte Dateien
Dateityp: txt ComboFix.txt (13,7 KB, 173x aufgerufen)

Alt 22.03.2012, 18:35   #9
markusg
/// Malware-holic
 
Win32/Spy.Banker.WBU Trojaner - Standard

Win32/Spy.Banker.WBU Trojaner



wo ist das Malwarebytes log, instaliert ist das programm auf jeden fall.
wenn es logs gibt, malwarebytes öffnen, logdateien, bericht(e) posten.
__________________
-Verdächtige mails bitte an uns zur Analyse weiterleiten:
markusg.trojaner-board@web.de
Weiterleiten
Anleitung:
http://markusg.trojaner-board.de
Mails bitte vorerst nach obiger Anleitung an
markusg.trojaner-board@web.de
Weiterleiten
Wenn Ihr uns unterstützen möchtet

Alt 22.03.2012, 18:48   #10
NuriTakuru
 
Win32/Spy.Banker.WBU Trojaner - Standard

Win32/Spy.Banker.WBU Trojaner



hier sind die logs
Angehängte Dateien
Dateityp: txt mbam-log-2012-03-22 (14-56-33).txt (2,9 KB, 168x aufgerufen)

Alt 22.03.2012, 18:53   #11
markusg
/// Malware-holic
 
Win32/Spy.Banker.WBU Trojaner - Standard

Win32/Spy.Banker.WBU Trojaner



danke.
Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop
  • Starte bitte die
    OTL.exe
    .
    Vista und Win7 User mit Rechtsklick "als Administrator starten"
  • Kopiere nun den Inhalt in die
    Textbox.
Code:
ATTFilter
activex
netsvcs
msconfig
%SYSTEMDRIVE%\*.
%PROGRAMFILES%\*.exe
%LOCALAPPDATA%\*.exe
%systemroot%\*. /mp /s
/md5start
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
explorer.exe
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\system32\*.dll /lockedfiles
%USERPROFILE%\*.*
%USERPROFILE%\Local Settings\Temp\*.exe
%USERPROFILE%\Local Settings\Temp\*.dll
%USERPROFILE%\Application Data\*.exe
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems|Windows /rs
CREATERESTOREPOINT
         
  • Schliesse bitte nun alle Programme. (Wichtig)
  • Klicke nun bitte auf den Quick Scan Button.
  • Kopiere
    nun den Inhalt aus OTL.txt und Extra.txt hier in Deinen Thread
__________________
-Verdächtige mails bitte an uns zur Analyse weiterleiten:
markusg.trojaner-board@web.de
Weiterleiten
Anleitung:
http://markusg.trojaner-board.de
Mails bitte vorerst nach obiger Anleitung an
markusg.trojaner-board@web.de
Weiterleiten
Wenn Ihr uns unterstützen möchtet

Alt 24.03.2012, 11:48   #12
NuriTakuru
 
Win32/Spy.Banker.WBU Trojaner - Standard

Win32/Spy.Banker.WBU Trojaner



Code:
ATTFilter
OTL logfile created on: 24.03.2012 12:21:55 - Run 1
OTL by OldTimer - Version 3.2.39.2     Folder = C:\Users\Sony\Desktop
 Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7601.17514)
Locale: 00000419 | Country: Россия | Language: RUS | Date Format: dd.MM.yyyy
 
764,87 Mb Total Physical Memory | 332,09 Mb Available Physical Memory | 43,42% Memory free
1,25 Gb Paging File | 0,40 Gb Available in Paging File | 31,92% Paging File free
Paging file location(s): e:\pagefile.sys 512 1024 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 78,07 Gb Total Space | 27,94 Gb Free Space | 35,78% Space Free | Partition Type: NTFS
Drive E: | 70,97 Gb Total Space | 39,55 Gb Free Space | 55,73% Space Free | Partition Type: NTFS
 
Computer Name: C615 | User Name: Sony | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.03.24 12:20:22 | 000,593,920 | ---- | M] (OldTimer Tools) -- C:\Users\Sony\Desktop\OTL.exe
PRC - [2012.03.13 05:37:52 | 003,331,872 | ---- | M] (Akamai Technologies, Inc) -- C:\Users\Sony\AppData\Local\Akamai\netsession_win.exe
PRC - [2012.01.13 14:53:18 | 000,652,360 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
PRC - [2012.01.13 14:53:18 | 000,460,872 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
PRC - [2011.08.23 20:20:18 | 000,887,976 | ---- | M] (Ask) -- C:\Program Files\Ask.com\Updater\Updater.exe
PRC - [2011.07.29 00:08:12 | 001,259,376 | ---- | M] () -- C:\Program Files\DivX\DivX Update\DivXUpdate.exe
PRC - [2011.06.24 05:22:20 | 000,271,360 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\conhost.exe
PRC - [2011.06.01 13:44:54 | 002,337,144 | ---- | M] (TeamViewer GmbH) -- C:\Program Files\TeamViewer\Version6\TeamViewer_Service.exe
PRC - [2011.02.25 06:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2010.11.21 10:49:24 | 000,247,608 | ---- | M] () -- C:\Program Files\ICQ6Toolbar\ICQ Service.exe
PRC - [2010.11.20 13:17:47 | 000,049,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe
PRC - [2010.04.07 18:08:52 | 000,810,120 | ---- | M] (ESET) -- C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
PRC - [2010.04.07 18:08:30 | 002,145,000 | ---- | M] (ESET) -- C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
PRC - [2010.02.19 14:00:24 | 000,148,744 | ---- | M] (COMODO) -- C:\Program Files\COMODO\COMODO livePCsupport\CLPSLS.exe
PRC - [2009.12.23 22:34:20 | 000,370,688 | ---- | M] (StarWind Software) -- C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
PRC - [2009.12.03 20:28:08 | 000,026,112 | ---- | M] (LSI Corporation) -- C:\Program Files\LSI SoftModem\agrsmsvc.exe
PRC - [2009.08.17 23:36:36 | 000,348,160 | ---- | M] (AMD) -- C:\Windows\System32\atieclxx.exe
PRC - [2009.08.17 23:36:08 | 000,176,128 | ---- | M] (AMD) -- C:\Windows\System32\atiesrxx.exe
PRC - [2009.01.26 12:31:16 | 002,144,088 | ---- | M] (Safer Networking Limited) -- C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
PRC - [2009.01.26 12:31:10 | 001,153,368 | ---- | M] (Safer Networking Ltd.) -- C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2011.07.29 00:09:42 | 000,096,112 | ---- | M] () -- C:\Program Files\DivX\DivX Update\DivXUpdateCheck.dll
MOD - [2011.07.29 00:08:12 | 001,259,376 | ---- | M] () -- C:\Program Files\DivX\DivX Update\DivXUpdate.exe
 
 
========== Win32 Services (SafeList) ==========
 
SRV - File not found [Auto | Running] -- C:\Program Files\Spybot -- (SBSDWSCService)
SRV - [2012.03.10 19:36:28 | 001,343,400 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\Wat\WatAdminSvc.exe -- (WatAdminSvc)
SRV - [2012.03.08 19:09:27 | 003,340,064 | ---- | M] () [Auto | Running] -- C:/Program Files/Common Files/Akamai/netsession_win_7de0ed9.dll -- (Akamai)
SRV - [2012.02.15 13:30:18 | 000,158,856 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2012.01.13 14:53:18 | 000,652,360 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2011.06.01 13:44:54 | 002,337,144 | ---- | M] (TeamViewer GmbH) [Auto | Running] -- C:\Program Files\TeamViewer\Version6\TeamViewer_Service.exe -- (TeamViewer6)
SRV - [2010.11.21 10:49:24 | 000,247,608 | ---- | M] () [Auto | Running] -- C:\Program Files\ICQ6Toolbar\ICQ Service.exe -- (ICQ Service)
SRV - [2010.04.07 18:13:20 | 000,033,560 | ---- | M] (ESET) [On_Demand | Stopped] -- C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe -- (EhttpSrv)
SRV - [2010.04.07 18:08:52 | 000,810,120 | ---- | M] (ESET) [Auto | Running] -- C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe -- (ekrn)
SRV - [2010.02.19 14:00:24 | 000,148,744 | ---- | M] (COMODO) [Auto | Running] -- C:\Program Files\COMODO\COMODO livePCsupport\CLPSLS.exe -- (CLPSLS)
SRV - [2009.12.23 22:34:20 | 000,370,688 | ---- | M] (StarWind Software) [Auto | Running] -- C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe -- (StarWindServiceAE)
SRV - [2009.12.16 18:26:00 | 003,453,712 | ---- | M] (INCA Internet Co., Ltd.) [On_Demand | Stopped] -- C:\Windows\System32\GameMon.des -- (npggsvc)
SRV - [2009.12.03 20:28:08 | 000,026,112 | ---- | M] (LSI Corporation) [Auto | Running] -- C:\Program Files\LSI SoftModem\agrsmsvc.exe -- (AgereModemAudio)
SRV - [2009.08.17 23:36:08 | 000,176,128 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\System32\atiesrxx.exe -- (AMD External Events Utility)
SRV - [2009.07.14 02:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc)
SRV - [2009.07.14 02:16:12 | 001,004,544 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\PeerDistSvc.dll -- (PeerDistSvc)
SRV - [2009.07.14 02:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\mpsvc.dll -- (WinDefend)
SRV - [2007.05.31 08:21:24 | 000,379,784 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\WindowsMobile\wcescomm.dll -- (WcesComm)
SRV - [2007.05.31 08:21:18 | 000,183,688 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\WindowsMobile\rapimgr.dll -- (RapiMgr)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | On_Demand | Stopped] -- System32\drivers\rdvgkmd.sys -- (VGPU)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\drivers\tsusbhub.sys -- (tsusbhub)
DRV - File not found [Kernel | On_Demand | Stopped] -- System32\drivers\synth3dvsc.sys -- (Synth3dVsc)
DRV - File not found [Kernel | Disabled | Stopped] -- C:\Windows\\SystemRoot\System32\Drivers\sptd.sys -- (sptd)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\EagleXNt.sys -- (EagleXNt)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\EagleNT.sys -- (EagleNT)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Users\Sony\AppData\Local\Temp\catchme.sys -- (catchme)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Users\Sony\AppData\Local\Temp\ALSysIO.sys -- (ALSysIO)
DRV - [2011.12.10 15:24:06 | 000,020,464 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\System32\drivers\mbam.sys -- (MBAMProtector)
DRV - [2011.05.18 08:09:04 | 000,040,320 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\dc3d.sys -- (dc3d) MS Hardware Device Detection Driver (USB)
DRV - [2010.11.20 13:30:15 | 000,175,360 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\vmbus.sys -- (vmbus)
DRV - [2010.11.20 13:30:15 | 000,040,704 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\vmstorfl.sys -- (storflt)
DRV - [2010.11.20 13:30:15 | 000,028,032 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\storvsc.sys -- (storvsc)
DRV - [2010.11.20 11:24:41 | 000,052,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV - [2010.11.20 11:21:14 | 000,015,872 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\rdpvideominiport.sys -- (RdpVideoMiniport)
DRV - [2010.11.20 11:06:36 | 000,117,760 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rmcast.sys -- (RMCAST)
DRV - [2010.11.20 10:59:44 | 000,035,968 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\winusb.sys -- (WinUsb)
DRV - [2010.11.20 10:14:45 | 000,017,920 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\VMBusHID.sys -- (VMBusHID)
DRV - [2010.11.20 10:14:41 | 000,005,632 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\vms3cap.sys -- (s3cap)
DRV - [2010.11.09 14:35:30 | 000,021,992 | ---- | M] (CPUID) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\cpuz135_x32.sys -- (cpuz135)
DRV - [2010.04.07 18:09:52 | 000,096,896 | ---- | M] (ESET) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\epfwwfpr.sys -- (epfwwfpr)
DRV - [2010.04.07 18:08:36 | 000,114,984 | ---- | M] (ESET) [Kernel | System | Running] -- C:\Windows\System32\drivers\ehdrv.sys -- (ehdrv)
DRV - [2010.04.07 18:05:14 | 000,134,024 | ---- | M] (ESET) [File_System | Auto | Running] -- C:\Windows\System32\drivers\eamonm.sys -- (eamonm)
DRV - [2010.01.26 17:38:06 | 001,163,328 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\AGRSM.sys -- (AgereSoftModem)
DRV - [2009.11.16 17:33:38 | 000,050,704 | ---- | M] (CACE Technologies, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\npf.sys -- (npf)
DRV - [2009.09.28 08:22:00 | 000,315,392 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\yk62x86.sys -- (yukonw7)
DRV - [2009.08.18 00:48:06 | 004,994,560 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\atikmdag.sys -- (atikmdag)
DRV - [2009.07.14 01:18:07 | 000,017,920 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\WSDPrint.sys -- (WSDPrintDevice)
DRV - [2009.07.14 00:52:10 | 000,014,336 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\vwifimp.sys -- (vwifimp)
DRV - [2009.07.02 09:40:34 | 001,765,168 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\snp2uvc.sys -- (SNP2UVC) USB2.0 PC Camera (SNP2UVC)
DRV - [2008.01.14 11:06:32 | 000,021,632 | ---- | M] (ManyCam LLC.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\ManyCam.sys -- (ManyCam)
DRV - [2007.06.29 13:47:34 | 000,034,304 | ---- | M] (AMD, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\AmdLLD.sys -- (AmdLLD)
DRV - [2004.12.30 22:43:08 | 000,004,682 | ---- | M] (INCA Internet Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\npptNT2.sys -- (NPPTNT2)
DRV - [2004.04.10 08:42:36 | 000,002,944 | ---- | M] (cansoft@livewiredev.com) [Kernel | System | Running] -- C:\Windows\System32\mbmiodrvr.sys -- (mbmiodrvr)
DRV - [2002.07.17 16:20:32 | 000,084,832 | ---- | M] (Adaptec) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ASPI32.SYS -- (ASPI)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\..\URLSearchHook:  - No CLSID value found
IE - HKLM\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll (ICQ)
IE - HKLM\..\SearchScopes,DefaultScope = {A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\..\SearchScopes\{A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE}: "URL" = hxxp://search.qip.ru/?query={searchTerms}
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://search.qip.ru
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = www.7wolf.net
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = ru
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 77 66 E0 71 CF FF CA 01  [binary data]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://search.qip.ru/ie
IE - HKCU\..\URLSearchHook:  - No CLSID value found
IE - HKCU\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll (ICQ)
IE - HKCU\..\URLSearchHook: {A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE} - C:\Users\Sony\AppData\Roaming\Microsoft\Internet Explorer\qipsearchbar.dll (qip.ru)
IE - HKCU\..\SearchScopes,DefaultScope = {A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKCU\..\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}: "URL" = hxxp://search.icq.com/search/results.php?q={searchTerms}&ch_id=osd
IE - HKCU\..\SearchScopes\{A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE}: "URL" = hxxp://search.qip.ru/?query={searchTerms}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local;<local>
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: "ICQ Search"
FF - prefs.js..browser.search.defaulturl: "hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.3.1&q="
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.startup.homepage: "about:blank"
FF - prefs.js..extensions.enabledItems: {AB2CE124-6272-4b12-94A9-7303C7397BD1}:5.0.0.6778
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: QipCounter@qip.ru:1.0
FF - prefs.js..extensions.enabledItems: {32a1fd71-835e-4b11-8e54-886fda0b4c89}:1.1
FF - prefs.js..extensions.enabledItems: {19503e42-ca3c-4c27-b1e2-9cdb2170ee34}:1.2.1.23
FF - prefs.js..extensions.enabledItems: {ef4e370e-d9f0-4e00-b93e-a4f274cfdd5a}:1.3
FF - prefs.js..extensions.enabledItems: {7b13ec3e-999a-4b70-b9cb-2617b8323822}:2.7.1.3
FF - prefs.js..extensions.enabledItems: {DB9127A2-3381-41ec-82B3-1B6ED4C6F29A}:1.0
FF - prefs.js..extensions.enabledItems: {23fcfd51-4958-4f00-80a3-ae97e717ed8b}:2.1.1.94
FF - prefs.js..extensions.enabledItems: {6904342A-8307-11DF-A508-4AE2DFD72085}:2.1.1.94
FF - prefs.js..extensions.enabledItems: {3e0e7d2a-070f-4a47-b019-91fe5385ba79}:3.1.1
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0025-ABCDEFFEDCBA}:6.0.25
FF - prefs.js..extensions.enabledItems: {07b2a769-ed19-4483-87ce-c643914c81bb}:3.0.0.91
FF - prefs.js..keyword.URL: "hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.3.1&q="
FF - user.js - File not found
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.0.50401.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpWinExt,version=5.0: C:\Program Files\MSN Toolbar\Platform\5.0.1449.0\npwinext.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=1.0.5: C:\Program Files\VideoLAN\VLC\npvlc.dll (the VideoLAN Team)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\Sony\AppData\Local\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\Sony\AppData\Local\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@unity3d.com/UnityPlayer,version=1.0: C:\Users\Sony\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\msntoolbar@msn.com: C:\Program Files\MSN Toolbar\Platform\5.0.1449.0\Firefox [2011.01.31 19:38:03 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{27182e60-b5f3-411c-b545-b44205977502}: C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\firefoxextension\SearchHelperExtension\ [2011.01.31 19:38:09 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2012.03.03 09:28:45 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 11.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.03.19 12:53:56 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 11.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011.08.19 23:18:37 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 3.0.4\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2010.05.30 10:05:51 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 3.0.4\extensions\\Plugins: C:\Program Files\Mozilla Thunderbird\plugins [2010.09.27 16:50:07 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\eplgTb@eset.com: C:\Program Files\ESET\ESET NOD32 Antivirus\Mozilla Thunderbird [2010.05.30 10:11:49 | 000,000,000 | ---D | M]
 
[2010.05.30 10:08:09 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Sony\AppData\Roaming\mozilla\Extensions
[2010.05.30 10:08:09 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Sony\AppData\Roaming\mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
[2012.03.22 19:08:12 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Sony\AppData\Roaming\mozilla\Firefox\Profiles\4mddjnpc.default\extensions
[2011.03.13 19:50:48 | 000,000,000 | ---D | M] (Vista-aero) -- C:\Users\Sony\AppData\Roaming\mozilla\Firefox\Profiles\4mddjnpc.default\extensions\{07b2a769-ed19-4483-87ce-c643914c81bb}
[2011.06.05 12:08:38 | 000,000,000 | ---D | M] (Google Toolbar for Firefox) -- C:\Users\Sony\AppData\Roaming\mozilla\Firefox\Profiles\4mddjnpc.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}
[2010.10.14 15:09:41 | 000,000,000 | ---D | M] (QipAuthorizer) -- C:\Users\Sony\AppData\Roaming\mozilla\Firefox\Profiles\4mddjnpc.default\extensions\{32a1fd71-835e-4b11-8e54-886fda0b4c89}
[2012.03.10 17:13:53 | 000,000,000 | ---D | M] (AddThis) -- C:\Users\Sony\AppData\Roaming\mozilla\Firefox\Profiles\4mddjnpc.default\extensions\{3e0e7d2a-070f-4a47-b019-91fe5385ba79}
[2012.03.07 13:41:47 | 000,000,000 | ---D | M] (Zynga Community Toolbar) -- C:\Users\Sony\AppData\Roaming\mozilla\Firefox\Profiles\4mddjnpc.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}
[2012.01.07 17:53:03 | 000,000,000 | ---D | M] ("ICQ Toolbar") -- C:\Users\Sony\AppData\Roaming\mozilla\Firefox\Profiles\4mddjnpc.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}
[2011.12.26 12:22:52 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Users\Sony\AppData\Roaming\mozilla\Firefox\Profiles\4mddjnpc.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2010.10.08 19:18:19 | 000,000,000 | ---D | M] (flashget3 Extension) -- C:\Users\Sony\AppData\Roaming\mozilla\Firefox\Profiles\4mddjnpc.default\extensions\{DB9127A2-3381-41ec-82B3-1B6ED4C6F29A}
[2012.01.10 18:58:34 | 000,000,000 | ---D | M] (Perapera Japanese) -- C:\Users\Sony\AppData\Roaming\mozilla\Firefox\Profiles\4mddjnpc.default\extensions\peraperakun@gmail.com
[2011.05.31 17:18:46 | 000,000,000 | ---D | M] (Rikaichan Japanese-German Dictionary File) -- C:\Users\Sony\AppData\Roaming\mozilla\Firefox\Profiles\4mddjnpc.default\extensions\rikaichan-jpde@polarcloud.com
[2011.05.31 17:25:39 | 000,000,000 | ---D | M] (Rikaichan Japanese-Russian Dictionary File) -- C:\Users\Sony\AppData\Roaming\mozilla\Firefox\Profiles\4mddjnpc.default\extensions\rikaichan-jpru@polarcloud.com
[2011.09.25 13:05:33 | 000,000,000 | ---D | M] (Ask Toolbar) -- C:\Users\Sony\AppData\Roaming\mozilla\Firefox\Profiles\4mddjnpc.default\extensions\toolbar@ask.com
[2011.03.13 19:50:48 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Sony\AppData\Roaming\mozilla\Firefox\Profiles\4mddjnpc.default\extensions\{07b2a769-ed19-4483-87ce-c643914c81bb}\chrome\mozapps\extensions
[2012.03.22 19:57:40 | 000,000,950 | ---- | M] () -- C:\Users\Sony\AppData\Roaming\Mozilla\Firefox\Profiles\4mddjnpc.default\searchplugins\icqplugin-1.xml
[2011.03.30 14:14:34 | 000,001,042 | ---- | M] () -- C:\Users\Sony\AppData\Roaming\Mozilla\Firefox\Profiles\4mddjnpc.default\searchplugins\icqplugin.xml
[2011.03.08 22:04:00 | 000,001,533 | ---- | M] () -- C:\Users\Sony\AppData\Roaming\Mozilla\Firefox\Profiles\4mddjnpc.default\searchplugins\mailru---.xml
[2011.07.31 11:28:44 | 000,002,062 | ---- | M] () -- C:\Users\Sony\AppData\Roaming\Mozilla\Firefox\Profiles\4mddjnpc.default\searchplugins\qip-search.xml
[2012.01.07 22:29:43 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\mozilla firefox\extensions
[2012.03.06 11:11:04 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Program Files\mozilla firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
() (No name found) -- C:\USERS\SONY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4MDDJNPC.DEFAULT\EXTENSIONS\{53A03D43-5363-4669-8190-99061B2DEBA5}.XPI
() (No name found) -- C:\USERS\SONY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4MDDJNPC.DEFAULT\EXTENSIONS\{9D6218B8-03C7-4B91-AA43-680B305DD35C}.XPI
() (No name found) -- C:\USERS\SONY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4MDDJNPC.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}.XPI
() (No name found) -- C:\USERS\SONY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4MDDJNPC.DEFAULT\EXTENSIONS\{DDC359D1-844A-42A7-9AA1-88A850A938A8}.XPI
() (No name found) -- C:\USERS\SONY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4MDDJNPC.DEFAULT\EXTENSIONS\ICH@MALTEGOETZ.DE.XPI
() (No name found) -- C:\USERS\SONY\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\4MDDJNPC.DEFAULT\EXTENSIONS\SCILORSGROOVEUNLOCKER@SCILOR.COM.XPI
[2012.03.19 12:53:54 | 000,097,208 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2011.10.03 05:06:04 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
[2007.02.04 22:02:56 | 001,642,496 | ---- | M] (LizardTech) -- C:\Program Files\mozilla firefox\plugins\npdjvu.dll
[2010.06.26 08:53:33 | 000,075,208 | ---- | M] (Foxit Software Company) -- C:\Program Files\mozilla firefox\plugins\npFoxitReaderPlugin.dll
[2011.07.11 22:48:12 | 000,012,800 | ---- | M] (Nullsoft, Inc.) -- C:\Program Files\mozilla firefox\plugins\npwachk.dll
[2012.02.15 14:47:26 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012.02.15 14:47:26 | 000,002,040 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\twitter.xml
 
========== Chrome  ==========
 
CHR - default_search_provider: ICQ Search (Enabled)
CHR - default_search_provider: search_url = hxxp://search.icq.com/search/results.php?ch_id=osd&q={searchTerms}&icid=chrome
CHR - default_search_provider: suggest_url = 
CHR - plugin: Shockwave Flash (Enabled) = C:\Users\Sony\AppData\Local\Google\Chrome\Application\17.0.963.56\gcswf32.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\system32\Macromed\Flash\NPSWF32.dll
CHR - plugin: Java Deployment Toolkit 6.0.200.2 (Enabled) = C:\Program Files\Java\jre6\bin\new_plugin\npdeployJava1.dll
CHR - plugin: Java(TM) Platform SE 6 U20 (Enabled) = C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll
CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files\Microsoft Silverlight\4.0.50401.0\npctrl.dll
CHR - plugin: DivX Web Player (Enabled) = C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\Sony\AppData\Local\Google\Chrome\Application\17.0.963.56\pdf.dll
CHR - plugin: Google Gears 0.5.33.0 (Enabled) = C:\Users\Sony\AppData\Local\Google\Chrome\Application\17.0.963.56\gears.dll
CHR - plugin: LizardTech DjVu (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npdjvu.dll
CHR - plugin: Foxit Reader Plugin for Mozilla (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npFoxitReaderPlugin.dll
CHR - plugin: Windows Genuine Advantage (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npLegitCheckPlugin.dll
CHR - plugin: DivX VOD Helper Plug-in (Enabled) = C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll
CHR - plugin: Bing Bar (Enabled) = C:\Program Files\MSN Toolbar\Platform\5.0.1449.0\npwinext.dll
CHR - plugin: VLC Multimedia Plug-in (Enabled) = C:\Program Files\VideoLAN\VLC\npvlc.dll
CHR - plugin: Windows Live? Photo Gallery (Enabled) = C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll
CHR - plugin: Google Update (Enabled) = C:\Users\Sony\AppData\Local\Google\Update\1.3.21.53\npGoogleUpdate3.dll
CHR - plugin: Default Plug-in (Enabled) = default_plugin
CHR - Extension: AT_ScottDraves = C:\Users\Sony\AppData\Local\Google\Chrome\User Data\Default\Extensions\lefeecbpfmnmdoajflbekahgnbcjihcc\2_0\
CHR - Extension: Skype Click to Call = C:\Users\Sony\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\5.6.0.8442_0\
CHR - Extension: ICQ Sparberater = C:\Users\Sony\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmpllndkedbnmonoomepeeglghdelffo\1.2.662_0\
CHR - Extension: DivX Plus Web Player HTML5 \u003Cvideo\u003E = C:\Users\Sony\AppData\Local\Google\Chrome\User Data\Default\Extensions\nneajnkjbffgblleaoojgaacokifdkhm\2.1.1.94_0\
CHR - Extension: DivX Plus Web Player HTML5 \u003Cvideo\u003E = C:\Users\Sony\AppData\Local\Google\Chrome\User Data\Default\Extensions\nneajnkjbffgblleaoojgaacokifdkhm\2.1.2.145_0\
 
O1 HOSTS File: ([2012.03.22 18:31:49 | 000,000,027 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O2 - BHO: (FG2CatchUrl) - {1F364306-AA45-47B5-9F9D-39A8B94E7EF1} - C:\Program Files\FlashGet Network\FlashGet universal\ComDlls\bhoCATCH.dll (FlashGet)
O2 - BHO: (DivX Plus Web Player HTML5 <video>) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (QIPBHO Class) - {A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE} - C:\Users\Sony\AppData\Roaming\Microsoft\Internet Explorer\qipsearchbar.dll (qip.ru)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
O2 - BHO: (ICQ Sparberater) - {FE163F11-1919-4257-A280-FF5AF8DAEECB} - C:\Program Files\icq\Internet Explorer\icq.dll (solute gmbh)
O3 - HKLM\..\Toolbar: (ICQToolBar) - {855F3B16-6D32-4FE6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll (ICQ)
O3 - HKLM\..\Toolbar: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKCU\..\Toolbar\WebBrowser: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
O4 - HKLM..\Run: [Adobe Photo Downloader] C:\Program Files\Adobe\Adobe Photoshop Lightroom 1.4\apdproxy.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [amd_dc_opt] C:\Program Files\AMD\Dual-Core Optimizer\amd_dc_opt.exe (AMD)
O4 - HKLM..\Run: [ApnUpdater] C:\Program Files\Ask.com\Updater\Updater.exe (Ask)
O4 - HKLM..\Run: [DivXUpdate] C:\Program Files\DivX\DivX Update\DivXUpdate.exe ()
O4 - HKLM..\Run: [egui] C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe (ESET)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe (Nullsoft, Inc.)
O4 - HKCU..\Run: [Akamai NetSession Interface] C:\Users\Sony\AppData\Local\Akamai\netsession_win.exe (Akamai Technologies, Inc)
O4 - HKCU..\Run: [Pando Media Booster] C:\Program Files\Pando Networks\Media Booster\PMB.exe ()
O4 - HKCU..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer Networking Limited)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: &Download All by FlashGet - C:\Program Files\FlashGet Network\FlashGet universal\ComDlls\Bhoall.htm ()
O8 - Extra context menu item: &Download by FlashGet - C:\Program Files\FlashGet Network\FlashGet universal\ComDlls\Bholink.htm ()
O9 - Extra Button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation)
O9 - Extra Button: ICQ7.6 - {7644E42D-B096-457F-8B5B-901238FC81AE} - C:\Program Files\ICQ7.6\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ7.6 - {7644E42D-B096-457F-8B5B-901238FC81AE} - C:\Program Files\ICQ7.6\ICQ.exe (ICQ, LLC.)
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O15 - HKCU\..Trusted Domains: kuaiche.com ([software] http in Trusted sites)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 8.8.8.8 8.8.4.4
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{C009EB24-A416-4597-88B2-A4462D2ED65E}: DhcpNameServer = 8.8.8.8 8.8.4.4
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009.06.10 22:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {1BCE665D-8EB9-D184-A322-7E944FD2364A} - .NET Framework
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {47B3BDBB-F2AE-4B55-95C8-921C25DB3B76} - .NET Framework
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
 
NetSvcs: FastUserSwitchingCompatibility -  File not found
NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation)
NetSvcs: Nla -  File not found
NetSvcs: Ntmssvc -  File not found
NetSvcs: NWCWorkstation -  File not found
NetSvcs: Nwsapagent -  File not found
NetSvcs: SRService -  File not found
NetSvcs: WmdmPmSp -  File not found
NetSvcs: LogonHours -  File not found
NetSvcs: PCAudit -  File not found
NetSvcs: helpsvc -  File not found
NetSvcs: uploadmgr -  File not found
 
MsConfig - StartUpReg: SunJavaUpdateSched - hkey= - key= - C:\Program Files\Common Files\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)
MsConfig - State: "bootini" - 0
MsConfig - State: "services" - 2
MsConfig - State: "startup" - 2
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.03.24 12:19:54 | 000,593,920 | ---- | C] (OldTimer Tools) -- C:\Users\Sony\Desktop\OTL.exe
[2012.03.22 18:42:39 | 000,000,000 | ---D | C] -- C:\Windows\temp
[2012.03.22 18:41:13 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
[2012.03.22 18:17:58 | 000,000,000 | ---D | C] -- C:\Users\Sony\AppData\Local\temp
[2012.03.22 18:02:22 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
[2012.03.22 18:02:22 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
[2012.03.22 18:02:22 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
[2012.03.22 18:02:09 | 000,000,000 | ---D | C] -- C:\Windows\ERDNT
[2012.03.22 18:02:02 | 000,000,000 | ---D | C] -- C:\Qoobox
[2012.03.22 17:54:01 | 000,000,000 | ---D | C] -- C:\Users\Sony\Desktop\148377-Kuroshitsuji_v05_c20-23_Beach Asylum_+_Cels(2)
[2012.03.22 12:32:40 | 000,000,000 | ---D | C] -- C:\Users\Sony\AppData\Roaming\Malwarebytes
[2012.03.22 12:32:29 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012.03.22 12:32:24 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012.03.22 12:32:20 | 000,020,464 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2012.03.22 12:32:19 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2012.03.21 19:06:35 | 000,000,000 | ---D | C] -- C:\Users\Sony\Desktop\Kuroshitsuji v06 c24-27 [Cels + Shiru Shitsuji]
[2012.03.20 11:04:32 | 000,000,000 | ---D | C] -- C:\Users\Sony\AppData\Roaming\UAs
[2012.03.20 11:03:20 | 000,000,000 | ---D | C] -- C:\Users\Sony\AppData\Roaming\xmldm
[2012.03.20 11:03:19 | 000,000,000 | ---D | C] -- C:\Users\Sony\AppData\Roaming\kock
[2012.03.12 20:17:43 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Photoshop Lightroom 1.4
[2012.03.12 20:08:28 | 000,000,000 | ---D | C] -- C:\Users\Sony\LuminanceHDR
[2012.03.12 20:07:30 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Luminance HDR
[2012.03.12 20:07:16 | 000,000,000 | ---D | C] -- C:\Program Files\Luminance HDR
[2012.03.10 19:36:30 | 000,000,000 | ---D | C] -- C:\Windows\System32\Wat
[2012.03.08 19:10:03 | 000,000,000 | ---D | C] -- C:\Users\Sony\AppData\Local\Akamai
[2012.03.06 11:10:08 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
[2012.03.06 11:10:06 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Skype
[2012.03.04 14:46:45 | 000,000,000 | ---D | C] -- C:\Users\Sony\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maxis
[2012.03.04 14:46:45 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maxis
[2012.03.04 14:43:04 | 000,000,000 | ---D | C] -- C:\Games
[2012.03.04 13:44:35 | 000,000,000 | ---D | C] -- C:\Users\Sony\AppData\Roaming\uTorrent
[2012.03.04 13:09:51 | 000,000,000 | ---D | C] -- C:\Users\Sony\Desktop\THE.SIMS.MAKIN.MAGIC.EXPANSION-DEViANCE
[2012.03.04 12:15:37 | 000,000,000 | -H-D | C] -- C:\ProgramData\{7F472822-69B3-480D-82F0-D9D083366FDC}
[2012.03.04 12:15:18 | 000,000,000 | ---D | C] -- C:\Users\Sony\AppData\Local\PackageAware
[2012.03.03 18:05:09 | 000,000,000 | R--D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Norton Security Scan
[2012.03.03 18:05:09 | 000,000,000 | ---D | C] -- C:\Windows\System32\drivers\NSS
[2012.03.03 18:05:09 | 000,000,000 | ---D | C] -- C:\Program Files\Norton Security Scan
[2012.03.03 18:05:09 | 000,000,000 | ---D | C] -- C:\Windows\System32\drivers\NSS\0305010.00A
[2012.03.03 18:04:58 | 000,000,000 | ---D | C] -- C:\Program Files\NortonInstaller
[2012.03.03 09:35:57 | 000,000,000 | ---D | C] -- C:\Users\Sony\AppData\Local\DDMSettings
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012.03.24 12:20:22 | 000,593,920 | ---- | M] (OldTimer Tools) -- C:\Users\Sony\Desktop\OTL.exe
[2012.03.24 12:07:07 | 000,000,974 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1911362935-2293373697-3760620681-1000UA.job
[2012.03.24 11:39:02 | 000,017,168 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.03.24 11:39:02 | 000,017,168 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.03.24 11:29:16 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.03.24 11:29:05 | 601,513,984 | -HS- | M] () -- C:\hiberfil.sys
[2012.03.22 18:31:49 | 000,000,027 | ---- | M] () -- C:\Windows\System32\drivers\etc\hosts
[2012.03.22 17:44:20 | 050,055,303 | ---- | M] () -- C:\Users\Sony\Desktop\animeshare.su_Bakuman_09(JPN).rmvb
[2012.03.22 13:39:13 | 000,000,204 | ---- | M] () -- C:\Users\Sony\defogger_reenable
[2012.03.22 12:36:39 | 049,534,837 | ---- | M] () -- C:\Users\Sony\Desktop\animeshare.su_Bakuman_08(JPN).rmvb
[2012.03.22 12:32:30 | 000,001,071 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.03.22 11:42:35 | 053,415,114 | ---- | M] () -- C:\Users\Sony\Desktop\animeshare.su_Bakuman_07(JPN).rmvb
[2012.03.20 12:17:24 | 000,000,114 | ---- | M] () -- C:\Users\Sony\AppData\Roaming\urhtps.dat
[2012.03.19 13:05:46 | 000,000,922 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1911362935-2293373697-3760620681-1000Core.job
[2012.03.18 10:42:25 | 000,000,438 | -H-- | M] () -- C:\Windows\tasks\Norton Security Scan for Sony.job
[2012.03.15 14:17:22 | 001,921,328 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2012.03.13 15:36:57 | 000,008,995 | ---- | M] () -- C:\Users\Sony\Desktop\fc73c59d.png
[2012.03.12 17:03:34 | 000,684,144 | ---- | M] () -- C:\Windows\System32\perfh019.dat
[2012.03.12 17:03:34 | 000,643,836 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2012.03.12 17:03:34 | 000,616,008 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2012.03.12 17:03:34 | 000,132,680 | ---- | M] () -- C:\Windows\System32\perfc019.dat
[2012.03.12 17:03:34 | 000,129,540 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2012.03.12 17:03:34 | 000,106,388 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2012.03.04 14:46:46 | 000,001,541 | ---- | M] () -- C:\Users\Sony\Desktop\The Sims 1024x768.lnk
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012.03.22 18:02:22 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe
[2012.03.22 18:02:22 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe
[2012.03.22 18:02:22 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2012.03.22 18:02:22 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2012.03.22 18:02:22 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2012.03.22 17:19:58 | 050,055,303 | ---- | C] () -- C:\Users\Sony\Desktop\animeshare.su_Bakuman_09(JPN).rmvb
[2012.03.22 13:38:22 | 000,000,204 | ---- | C] () -- C:\Users\Sony\defogger_reenable
[2012.03.22 12:33:43 | 049,534,837 | ---- | C] () -- C:\Users\Sony\Desktop\animeshare.su_Bakuman_08(JPN).rmvb
[2012.03.22 12:32:30 | 000,001,071 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.03.22 11:39:48 | 053,415,114 | ---- | C] () -- C:\Users\Sony\Desktop\animeshare.su_Bakuman_07(JPN).rmvb
[2012.03.20 12:17:03 | 000,000,114 | ---- | C] () -- C:\Users\Sony\AppData\Roaming\urhtps.dat
[2012.03.13 15:36:55 | 000,008,995 | ---- | C] () -- C:\Users\Sony\Desktop\fc73c59d.png
[2012.03.12 20:53:03 | 000,002,067 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Photoshop Lightroom 2.6.lnk
[2012.03.04 14:46:46 | 000,001,541 | ---- | C] () -- C:\Users\Sony\Desktop\The Sims 1024x768.lnk
[2012.03.03 18:05:28 | 000,000,438 | -H-- | C] () -- C:\Windows\tasks\Norton Security Scan for Sony.job
[2012.03.03 18:05:09 | 000,000,172 | ---- | C] () -- C:\Windows\System32\drivers\NSS\0305010.00A\isolate.ini
[2012.01.02 02:11:11 | 000,000,130 | ---- | C] () -- C:\Users\Sony\AppData\Roaming\ap-ucp.ser
[2011.10.01 10:42:38 | 000,080,896 | ---- | C] () -- C:\Windows\System32\RDVGHelper.exe
[2011.10.01 10:36:18 | 000,066,048 | ---- | C] () -- C:\Windows\System32\PrintBrmUi.exe
[2010.10.08 14:16:42 | 000,003,528 | ---- | C] () -- C:\Windows\System32\secushr.dat
[2010.10.08 14:13:56 | 000,000,025 | ---- | C] () -- C:\Windows\libem.INI
[2010.05.31 13:55:34 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2010.05.30 10:57:24 | 000,256,560 | ---- | C] ( ) -- C:\Windows\System32\rsnp2uvc.dll
[2010.05.30 10:57:23 | 001,765,168 | ---- | C] () -- C:\Windows\System32\drivers\snp2uvc.sys
[2010.05.30 10:57:23 | 000,027,184 | ---- | C] () -- C:\Windows\snuvcdsm.exe
[2010.05.30 10:57:23 | 000,015,497 | ---- | C] () -- C:\Windows\snp2uvc.ini
[2010.05.30 10:57:22 | 000,203,312 | ---- | C] ( ) -- C:\Windows\System32\csnp2uvc.dll
[2010.05.30 10:57:22 | 000,034,480 | ---- | C] () -- C:\Windows\System32\drivers\sncduvc.sys
[2010.05.30 10:36:13 | 000,643,836 | ---- | C] () -- C:\Windows\System32\perfh007.dat
[2010.05.30 10:36:13 | 000,295,922 | ---- | C] () -- C:\Windows\System32\perfi007.dat
[2010.05.30 10:36:13 | 000,129,540 | ---- | C] () -- C:\Windows\System32\perfc007.dat
[2010.05.30 10:36:13 | 000,038,104 | ---- | C] () -- C:\Windows\System32\perfd007.dat
[2010.05.30 09:32:50 | 000,006,656 | ---- | C] () -- C:\Windows\System32\bcmwlrc.dll
[2010.05.30 05:48:48 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin
 
========== LOP Check ==========
 
[2011.11.28 08:46:52 | 000,000,000 | ---D | M] -- C:\Users\Sony\AppData\Roaming\AIMP
[2011.07.22 18:34:45 | 000,000,000 | ---D | M] -- C:\Users\Sony\AppData\Roaming\Audacity
[2012.03.12 23:02:11 | 000,000,000 | ---D | M] -- C:\Users\Sony\AppData\Roaming\BITS
[2010.07.09 21:10:08 | 000,000,000 | ---D | M] -- C:\Users\Sony\AppData\Roaming\Broken Rules
[2010.12.28 15:32:35 | 000,000,000 | ---D | M] -- C:\Users\Sony\AppData\Roaming\Canneverbe Limited
[2010.12.28 12:12:48 | 000,000,000 | ---D | M] -- C:\Users\Sony\AppData\Roaming\Canon
[2011.03.08 23:06:00 | 000,000,000 | ---D | M] -- C:\Users\Sony\AppData\Roaming\DAEMON Tools Lite
[2010.07.09 19:31:16 | 000,000,000 | ---D | M] -- C:\Users\Sony\AppData\Roaming\DAEMON Tools Pro
[2011.03.13 18:54:19 | 000,000,000 | ---D | M] -- C:\Users\Sony\AppData\Roaming\Darq Software
[2010.11.01 17:34:33 | 000,000,000 | ---D | M] -- C:\Users\Sony\AppData\Roaming\DocClockGame
[2011.05.08 15:00:43 | 000,000,000 | ---D | M] -- C:\Users\Sony\AppData\Roaming\Downloaded Installations
[2010.10.08 14:12:19 | 000,000,000 | ---D | M] -- C:\Users\Sony\AppData\Roaming\FlashGet
[2010.10.08 14:12:00 | 000,000,000 | ---D | M] -- C:\Users\Sony\AppData\Roaming\FlashGetBHO
[2011.02.17 18:13:58 | 000,000,000 | ---D | M] -- C:\Users\Sony\AppData\Roaming\Foxit Software
[2012.03.24 01:05:49 | 000,000,000 | ---D | M] -- C:\Users\Sony\AppData\Roaming\ICQ
[2010.09.27 20:09:20 | 000,000,000 | ---D | M] -- C:\Users\Sony\AppData\Roaming\Installer
[2012.03.20 11:03:19 | 000,000,000 | ---D | M] -- C:\Users\Sony\AppData\Roaming\kock
[2011.11.08 17:30:06 | 000,000,000 | ---D | M] -- C:\Users\Sony\AppData\Roaming\ManyCam
[2010.05.30 12:25:46 | 000,000,000 | ---D | M] -- C:\Users\Sony\AppData\Roaming\OpenOffice.org
[2010.05.31 13:22:19 | 000,000,000 | ---D | M] -- C:\Users\Sony\AppData\Roaming\QIP
[2012.01.23 16:13:24 | 000,000,000 | ---D | M] -- C:\Users\Sony\AppData\Roaming\Rovio
[2011.10.26 17:11:45 | 000,000,000 | ---D | M] -- C:\Users\Sony\AppData\Roaming\savedata
[2011.05.29 13:11:50 | 000,000,000 | ---D | M] -- C:\Users\Sony\AppData\Roaming\Smart PC Solutions
[2010.11.24 22:47:49 | 000,000,000 | ---D | M] -- C:\Users\Sony\AppData\Roaming\Softplicity
[2010.06.17 16:03:51 | 000,000,000 | ---D | M] -- C:\Users\Sony\AppData\Roaming\TeamViewer
[2010.05.30 10:08:09 | 000,000,000 | ---D | M] -- C:\Users\Sony\AppData\Roaming\Thunderbird
[2012.01.07 17:53:03 | 000,000,000 | ---D | M] -- C:\Users\Sony\AppData\Roaming\TS3Client
[2012.03.20 12:17:04 | 000,000,000 | ---D | M] -- C:\Users\Sony\AppData\Roaming\UAs
[2011.09.05 23:56:33 | 000,000,000 | ---D | M] -- C:\Users\Sony\AppData\Roaming\Unity
[2012.03.14 23:35:38 | 000,000,000 | ---D | M] -- C:\Users\Sony\AppData\Roaming\uTorrent
[2012.03.20 12:17:04 | 000,000,000 | ---D | M] -- C:\Users\Sony\AppData\Roaming\xmldm
[2012.03.06 08:44:59 | 000,032,508 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
< %SYSTEMDRIVE%\*. >
[2012.03.22 18:41:13 | 000,000,000 | -HSD | M] -- C:\$RECYCLE.BIN
[2012.01.02 10:05:25 | 000,000,000 | ---D | M] -- C:\Boot
[2009.07.14 05:53:55 | 000,000,000 | -HSD | M] -- C:\Documents and Settings
[2011.03.08 16:35:15 | 000,000,000 | ---D | M] -- C:\found.000
[2012.03.04 14:43:04 | 000,000,000 | ---D | M] -- C:\Games
[2010.10.10 17:18:42 | 000,000,000 | ---D | M] -- C:\gPotato.eu
[2009.07.14 03:37:05 | 000,000,000 | ---D | M] -- C:\PerfLogs
[2010.10.17 14:48:21 | 000,000,000 | ---D | M] -- C:\profiles
[2012.03.22 12:32:19 | 000,000,000 | R--D | M] -- C:\Program Files
[2012.03.22 12:32:24 | 000,000,000 | ---D | M] -- C:\ProgramData
[2012.03.22 18:42:46 | 000,000,000 | ---D | M] -- C:\Qoobox
[2010.05.30 05:52:54 | 000,000,000 | ---D | M] -- C:\Recovery
[2012.02.04 17:49:32 | 000,000,000 | ---D | M] -- C:\Screenshots
[2010.09.13 20:21:00 | 000,000,000 | ---D | M] -- C:\SWSetup
[2012.03.24 12:26:17 | 000,000,000 | -HSD | M] -- C:\System Volume Information
[2010.11.19 17:37:07 | 000,000,000 | ---D | M] -- C:\TheUnderGarden_Install
[2010.05.30 05:53:04 | 000,000,000 | R--D | M] -- C:\Users
[2012.03.22 18:42:39 | 000,000,000 | ---D | M] -- C:\Windows
 
< %PROGRAMFILES%\*.exe >
 
< %LOCALAPPDATA%\*.exe >
 
< %systemroot%\*. /mp /s >
 
< MD5 for: AGP440.SYS  >
[2009.07.14 02:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\ERDNT\cache\AGP440.sys
[2009.07.14 02:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\System32\drivers\AGP440.sys
[2009.07.14 02:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_x86_neutral_a97a2a0d0fbc6696\AGP440.sys
[2009.07.14 02:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.1.7600.16385_none_b9e9435f20046eeb\AGP440.sys
[2009.07.14 02:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.1.7601.17514_none_bc1a57271cf2f285\AGP440.sys
 
< MD5 for: ATAPI.SYS  >
[2009.07.14 02:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\ERDNT\cache\atapi.sys
[2009.07.14 02:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\System32\drivers\atapi.sys
[2009.07.14 02:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_x86_neutral_fab873f3e8a3315c\atapi.sys
[2009.07.14 02:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.1.7600.16385_none_dd0e7e3d82dd640d\atapi.sys
[2009.07.14 02:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.1.7601.17514_none_df3f92057fcbe7a7\atapi.sys
 
< MD5 for: CNGAUDIT.DLL  >
[2009.07.14 02:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\ERDNT\cache\cngaudit.dll
[2009.07.14 02:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\System32\cngaudit.dll
[2009.07.14 02:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll
 
< MD5 for: EXPLORER.EXE  >
[2011.02.26 06:19:21 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=0FB9C74046656D1579A64660AD67B746 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_54149f9ef14031fc\explorer.exe
[2009.07.14 02:14:20 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=15BC38A7492BEFE831966ADB477CF76F -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_518afd35db100430\explorer.exe
[2011.02.26 06:51:13 | 002,614,784 | ---- | M] (Microsoft Corporation) MD5=255CF508D7CFB10E0794D6AC93280BD8 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20910_none_525b5180f3f95373\explorer.exe
[2009.10.31 06:45:39 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=2626FC9755BE22F805D3CFA0CE3EE727 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_51a66d6ddafc2ed1\explorer.exe
[2011.02.26 06:33:07 | 002,614,784 | ---- | M] (Microsoft Corporation) MD5=2AF58D15EDC06EC6FDACCE1F19482BBF -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16768_none_51a3a583dafd0cef\explorer.exe
[2010.11.20 13:17:09 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=40D777B7A95E00593EB1568C68514493 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_53bc10fdd7fe87ca\explorer.exe
[2011.02.25 06:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E -- C:\Windows\ERDNT\cache\explorer.exe
[2011.02.25 06:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E -- C:\Windows\explorer.exe
[2011.02.25 06:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_5389023fd8245f84\explorer.exe
[2009.08.03 06:49:47 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=9FF6C4C91A3711C0A3B18F87B08B518D -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_526619d4f3f142e6\explorer.exe
[2009.08.03 06:35:50 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=B95EEB0F4E5EFBF1038A35B3351CF047 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_51e07e31dad00878\explorer.exe
[2009.10.31 07:00:51 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=C76153C7ECA00FA852BB0C193378F917 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_52283b2af41f3691\explorer.exe
 
< MD5 for: IASTORV.SYS  >
[2011.03.11 06:38:51 | 000,332,160 | ---- | M] (Intel Corporation) MD5=5CD5F9A5444E6CDCB0AC89BD62D8B76E -- C:\Windows\System32\drivers\iaStorV.sys
[2011.03.11 06:38:51 | 000,332,160 | ---- | M] (Intel Corporation) MD5=5CD5F9A5444E6CDCB0AC89BD62D8B76E -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_x86_neutral_0bcee2057afcc090\iaStorV.sys
[2011.03.11 06:38:51 | 000,332,160 | ---- | M] (Intel Corporation) MD5=5CD5F9A5444E6CDCB0AC89BD62D8B76E -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7601.17577_none_b0daddb9e6380745\iaStorV.sys
[2011.03.11 06:43:55 | 000,332,160 | ---- | M] (Intel Corporation) MD5=71F1A494FEDF4B33C02C4A6A28D6D9E9 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7600.16778_none_aef580fde910b4b0\iaStorV.sys
[2011.03.11 06:28:00 | 000,332,160 | ---- | M] (Intel Corporation) MD5=778D0E6D7D9EBA0C403BADBAAD41DB20 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7601.21680_none_b152a892ff64119f\iaStorV.sys
[2009.07.14 02:20:36 | 000,332,352 | ---- | M] (Intel Corporation) MD5=934AF4D7C5F457B9F0743F4299B77B67 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7600.16385_none_aee7a89be91b9000\iaStorV.sys
[2010.11.20 13:29:54 | 000,332,160 | ---- | M] (Intel Corporation) MD5=A3CAE5D281DB4CFF7CFF8233507EE5AD -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_x86_neutral_668286aa35d55928\iaStorV.sys
[2010.11.20 13:29:54 | 000,332,160 | ---- | M] (Intel Corporation) MD5=A3CAE5D281DB4CFF7CFF8233507EE5AD -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7601.17514_none_b118bc63e60a139a\iaStorV.sys
[2011.03.11 06:52:21 | 000,332,160 | ---- | M] (Intel Corporation) MD5=B9039A34C2F8769490DCC494E2402445 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7600.20921_none_afae2d45020c148b\iaStorV.sys
 
< MD5 for: NETLOGON.DLL  >
[2010.11.20 13:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\ERDNT\cache\netlogon.dll
[2010.11.20 13:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\System32\netlogon.dll
[2010.11.20 13:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_ffbf212e963c0162\netlogon.dll
[2009.07.14 02:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_fd8e0d66994d7dc8\netlogon.dll
 
< MD5 for: NVSTOR.SYS  >
[2011.03.11 06:39:00 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4380E59A170D88C4F1022EFF6719A8A4 -- C:\Windows\System32\drivers\nvstor.sys
[2011.03.11 06:39:00 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4380E59A170D88C4F1022EFF6719A8A4 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_x86_neutral_0276fc3b3ea60d41\nvstor.sys
[2011.03.11 06:39:00 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4380E59A170D88C4F1022EFF6719A8A4 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7601.17577_none_3ba44e691d6eb11d\nvstor.sys
[2011.03.11 06:44:01 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4520B63899E867F354EE012D34E11536 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7600.16778_none_39bef1ad20475e88\nvstor.sys
[2011.03.11 06:28:10 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=66D468654A58594F5F3BA63D5AD5B1AF -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7601.21680_none_3c1c1942369abb77\nvstor.sys
[2011.03.11 06:52:25 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=8A7583A3B58D3EEB28BB26626526BC91 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7600.20921_none_3a779df43942be63\nvstor.sys
[2010.11.20 13:30:06 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=9283C58EBAA2618F93482EB5DABCEC82 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_x86_neutral_dd659ed032d28a14\nvstor.sys
[2010.11.20 13:30:06 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=9283C58EBAA2618F93482EB5DABCEC82 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7601.17514_none_3be22d131d40bd72\nvstor.sys
[2009.07.14 02:20:44 | 000,142,416 | ---- | M] (NVIDIA Corporation) MD5=C99F251A5DE63C6F129CF71933ACED0F -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7600.16385_none_39b1194b205239d8\nvstor.sys
 
< MD5 for: SCECLI.DLL  >
[2009.07.14 02:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_37e4387f3a6f0483\scecli.dll
[2010.11.20 13:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\ERDNT\cache\scecli.dll
[2010.11.20 13:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\System32\scecli.dll
[2010.11.20 13:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_3a154c47375d881d\scecli.dll
 
< MD5 for: USER32.DLL  >
[2009.07.14 02:16:17 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=34B7E222E81FAFA885F0C5F2CFA56861 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_cd0ec264ceb014a3\user32.dll
[2010.11.20 13:21:33 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=F1DD3ACAEE5E6B4BBC69BC6DF75CEF66 -- C:\Windows\ERDNT\cache\user32.dll
[2010.11.20 13:21:33 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=F1DD3ACAEE5E6B4BBC69BC6DF75CEF66 -- C:\Windows\System32\user32.dll
[2010.11.20 13:21:33 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=F1DD3ACAEE5E6B4BBC69BC6DF75CEF66 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_cf3fd62ccb9e983d\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2010.11.20 13:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\ERDNT\cache\userinit.exe
[2010.11.20 13:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\System32\userinit.exe
[2010.11.20 13:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe
[2009.07.14 02:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe
 
< MD5 for: WINLOGON.EXE  >
[2009.10.28 07:17:59 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=37CDB7E72EB66BA85A87CBE37E7F03FD -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_6fc699643622d177\winlogon.exe
[2009.10.28 06:52:08 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=3BABE6767C78FBF5FB8435FEED187F30 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_703394514f56f7c2\winlogon.exe
[2012.01.13 14:53:20 | 000,182,856 | ---- | M] () MD5=63EEC8A8B221AB79045E776E5F592868 -- C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe
[2010.11.20 13:17:54 | 000,286,720 | ---- | M] (Microsoft Corporation) MD5=6D13E1406F50C66E2A95D97F22C47560 -- C:\Windows\ERDNT\cache\winlogon.exe
[2010.11.20 13:17:54 | 000,286,720 | ---- | M] (Microsoft Corporation) MD5=6D13E1406F50C66E2A95D97F22C47560 -- C:\Windows\System32\winlogon.exe
[2010.11.20 13:17:54 | 000,286,720 | ---- | M] (Microsoft Corporation) MD5=6D13E1406F50C66E2A95D97F22C47560 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_71ca6b0233339500\winlogon.exe
[2009.07.14 02:14:45 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=8EC6A4AB12B8F3759E21F8E3A388F2CF -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_6f99573a36451166\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2009.07.14 00:55:02 | 000,016,384 | ---- | M] (Microsoft Corporation) MD5=6DB3276587B853BF886B69528FDB048C -- C:\Windows\System32\drivers\ws2ifsl.sys
[2009.07.14 00:55:02 | 000,016,384 | ---- | M] (Microsoft Corporation) MD5=6DB3276587B853BF886B69528FDB048C -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.1.7600.16385_none_4f5cf6f829213bb2\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
 
< %systemroot%\System32\config\*.sav >
 
< %systemroot%\system32\*.dll /lockedfiles >
 
< %USERPROFILE%\*.* >
[2011.01.08 15:19:26 | 000,002,106 | ---- | M] () -- C:\Users\Sony\.recently-used.xbel
[2011.07.25 22:42:51 | 006,811,108 | ---- | M] () -- C:\Users\Sony\dean lacht.wav
[2012.03.22 13:39:13 | 000,000,204 | ---- | M] () -- C:\Users\Sony\defogger_reenable
[2012.01.04 13:17:08 | 000,524,009 | ---- | M] () -- C:\Users\Sony\IMG_0409.jpg
[2012.01.04 13:16:48 | 000,359,569 | ---- | M] () -- C:\Users\Sony\IMG_0414.jpg
[2012.01.04 13:16:49 | 000,445,690 | ---- | M] () -- C:\Users\Sony\IMG_0415.jpg
[2012.01.04 13:16:57 | 000,422,657 | ---- | M] () -- C:\Users\Sony\IMG_0417.jpg
[2012.01.04 13:16:59 | 000,513,946 | ---- | M] () -- C:\Users\Sony\IMG_0418.jpg
[2012.01.04 13:17:16 | 000,658,845 | ---- | M] () -- C:\Users\Sony\IMG_0424.jpg
[2012.01.04 13:17:08 | 000,681,953 | ---- | M] () -- C:\Users\Sony\IMG_0425.jpg
[2012.01.04 13:17:28 | 000,665,915 | ---- | M] () -- C:\Users\Sony\IMG_0426.jpg
[2011.07.02 22:58:23 | 045,301,804 | ---- | M] () -- C:\Users\Sony\jetzt ist sommer singen.wav
[2012.03.24 12:44:47 | 006,553,600 | -HS- | M] () -- C:\Users\Sony\ntuser.dat
[2012.03.24 12:44:47 | 000,262,144 | -HS- | M] () -- C:\Users\Sony\ntuser.dat.LOG1
[2010.05.30 05:53:06 | 000,000,000 | -HS- | M] () -- C:\Users\Sony\ntuser.dat.LOG2
[2010.12.06 21:25:09 | 000,065,536 | -HS- | M] () -- C:\Users\Sony\ntuser.dat{38b40b46-0174-11e0-9d1a-0027137bde30}.TM.blf
[2010.12.06 21:25:09 | 000,524,288 | -HS- | M] () -- C:\Users\Sony\ntuser.dat{38b40b46-0174-11e0-9d1a-0027137bde30}.TMContainer00000000000000000001.regtrans-ms
[2010.12.06 21:25:09 | 000,524,288 | -HS- | M] () -- C:\Users\Sony\ntuser.dat{38b40b46-0174-11e0-9d1a-0027137bde30}.TMContainer00000000000000000002.regtrans-ms
[2011.01.05 11:28:55 | 000,065,536 | -HS- | M] () -- C:\Users\Sony\ntuser.dat{40bab422-18b4-11e0-b9b9-0027137bde30}.TM.blf
[2011.01.05 11:28:55 | 000,524,288 | -HS- | M] () -- C:\Users\Sony\ntuser.dat{40bab422-18b4-11e0-b9b9-0027137bde30}.TMContainer00000000000000000001.regtrans-ms
[2011.01.05 11:28:55 | 000,524,288 | -HS- | M] () -- C:\Users\Sony\ntuser.dat{40bab422-18b4-11e0-b9b9-0027137bde30}.TMContainer00000000000000000002.regtrans-ms
[2010.09.13 20:10:44 | 000,065,536 | -HS- | M] () -- C:\Users\Sony\ntuser.dat{54eb8b6d-be5b-11df-969c-0027137bde30}.TM.blf
[2010.09.13 20:10:44 | 000,524,288 | -HS- | M] () -- C:\Users\Sony\ntuser.dat{54eb8b6d-be5b-11df-969c-0027137bde30}.TMContainer00000000000000000001.regtrans-ms
[2010.09.13 20:10:44 | 000,524,288 | -HS- | M] () -- C:\Users\Sony\ntuser.dat{54eb8b6d-be5b-11df-969c-0027137bde30}.TMContainer00000000000000000002.regtrans-ms
[2010.06.06 20:58:10 | 000,065,536 | -HS- | M] () -- C:\Users\Sony\ntuser.dat{5c7ef623-719e-11df-a015-0027137bde30}.TM.blf
[2010.06.06 20:58:09 | 000,524,288 | -HS- | M] () -- C:\Users\Sony\ntuser.dat{5c7ef623-719e-11df-a015-0027137bde30}.TMContainer00000000000000000001.regtrans-ms
[2010.06.06 20:58:10 | 000,524,288 | -HS- | M] () -- C:\Users\Sony\ntuser.dat{5c7ef623-719e-11df-a015-0027137bde30}.TMContainer00000000000000000002.regtrans-ms
[2010.05.30 05:54:31 | 000,065,536 | -HS- | M] () -- C:\Users\Sony\NTUSER.DAT{6cced2f1-6e01-11de-8bed-001e0bcd1824}.TM.blf
[2010.05.30 05:54:31 | 000,524,288 | -HS- | M] () -- C:\Users\Sony\NTUSER.DAT{6cced2f1-6e01-11de-8bed-001e0bcd1824}.TMContainer00000000000000000001.regtrans-ms
[2010.05.30 05:54:31 | 000,524,288 | -HS- | M] () -- C:\Users\Sony\NTUSER.DAT{6cced2f1-6e01-11de-8bed-001e0bcd1824}.TMContainer00000000000000000002.regtrans-ms
[2011.03.13 22:56:07 | 000,065,536 | -HS- | M] () -- C:\Users\Sony\ntuser.dat{7c64be2a-4cd0-11e0-999f-0027137bde30}.TM.blf
[2011.03.13 22:56:06 | 000,524,288 | -HS- | M] () -- C:\Users\Sony\ntuser.dat{7c64be2a-4cd0-11e0-999f-0027137bde30}.TMContainer00000000000000000001.regtrans-ms
[2011.03.13 22:56:07 | 000,524,288 | -HS- | M] () -- C:\Users\Sony\ntuser.dat{7c64be2a-4cd0-11e0-999f-0027137bde30}.TMContainer00000000000000000002.regtrans-ms
[2012.01.22 23:54:22 | 000,065,536 | -HS- | M] () -- C:\Users\Sony\ntuser.dat{8205735d-452f-11e1-a420-0027137bde30}.TM.blf
[2012.01.22 23:54:22 | 000,524,288 | -HS- | M] () -- C:\Users\Sony\ntuser.dat{8205735d-452f-11e1-a420-0027137bde30}.TMContainer00000000000000000001.regtrans-ms
[2012.01.22 23:54:22 | 000,524,288 | -HS- | M] () -- C:\Users\Sony\ntuser.dat{8205735d-452f-11e1-a420-0027137bde30}.TMContainer00000000000000000002.regtrans-ms
[2010.05.30 05:53:06 | 000,000,020 | -HS- | M] () -- C:\Users\Sony\ntuser.ini
[2011.03.13 18:54:01 | 000,000,632 | ---- | M] () -- C:\Users\Sony\Sofia-HP - Ярлык.lnk
[2011.07.02 22:45:35 | 018,666,100 | ---- | M] () -- C:\Users\Sony\ts3_recording_11_07_02_23_43_42.wav
[2011.07.02 22:48:53 | 037,080,544 | ---- | M] () -- C:\Users\Sony\ts3_recording_11_07_02_23_45_38.wav
 
< %USERPROFILE%\Local Settings\Temp\*.exe >
 
< %USERPROFILE%\Local Settings\Temp\*.dll >
 
< %USERPROFILE%\Application Data\*.exe >
 
< HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems|Windows /rs >
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Required: DebugWindows [binary data]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Windows: %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,12288,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
 
<           >

< End of report >
         
Code:
ATTFilter
OTL Extras logfile created on: 24.03.2012 12:21:55 - Run 1
OTL by OldTimer - Version 3.2.39.2     Folder = C:\Users\Sony\Desktop
 Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7601.17514)
Locale: 00000419 | Country: Россия | Language: RUS | Date Format: dd.MM.yyyy
 
764,87 Mb Total Physical Memory | 332,09 Mb Available Physical Memory | 43,42% Memory free
1,25 Gb Paging File | 0,40 Gb Available in Paging File | 31,92% Paging File free
Paging file location(s): e:\pagefile.sys 512 1024 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 78,07 Gb Total Space | 27,94 Gb Free Space | 35,78% Space Free | Partition Type: NTFS
Drive E: | 70,97 Gb Total Space | 39,55 Gb Free Space | 55,73% Space Free | Partition Type: NTFS
 
Computer Name: C615 | User Name: Sony | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- Reg Error: Key error.
https [open] -- "C:\Program Files\Google\Chrome\Application\chrome.exe" -- "%1"
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [Digital Photo Professional] -- C:\Program Files\Canon\Digital Photo Professional\DPPViewer.exe /path "%1" (CANON INC.)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Directory [Winamp.Bookmark] -- "C:\Program Files\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft, Inc.)
Directory [Winamp.Enqueue] -- "C:\Program Files\Winamp\winamp.exe" /ADD "%1" (Nullsoft, Inc.)
Directory [Winamp.Play] -- "C:\Program Files\Winamp\winamp.exe" "%1" (Nullsoft, Inc.)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0
"UpdatesDisableNotify" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
========== System Restore Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
========== Authorized Applications List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\FlashGet Network\FlashGet 3\FlashGet3.exe" = C:\Program Files\FlashGet Network\FlashGet 3\FlashGet3.exe:*:Enabled:Flashget3
"C:\Program Files\FlashGet Network\FlashGet universal\FlashGet.exe" = C:\Program Files\FlashGet Network\FlashGet universal\FlashGet.exe:*:Enabled:Flashget2 -- (FLASHGET)
"C:\Program Files\FlashGet Network\FlashGet universal\LiveUpdate.exe" = C:\Program Files\FlashGet Network\FlashGet universal\LiveUpdate.exe:*:Enabled:FGLiveUpdate
"C:\Program Files\FlashGet Network\FlashGet universal\LiveUpdateEx.exe" = C:\Program Files\FlashGet Network\FlashGet universal\LiveUpdateEx.exe:*:Enabled:FGLiveUpdateEx
 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{08234a0d-cf39-4dca-99f0-0c5cb496da81}" = Панель Bing
"{086BADF8-9B1F-4E89-B207-2EDA520972D6}" = Grand Theft Auto San Andreas
"{086D343F-8E78-4AFC-81AC-D6D414AFD8AC}_is1" = Core Temp 1.0 RC3
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{105CFC7C-6992-11D5-BD9D-000102C10FD8}" = Lizardtech DjVu Control
"{168E7302-890A-4138-9109-A225ACAF7AD1}" = Windows Live Photo Common
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{26A24AE4-039D-4CA4-87B4-2F83216020FF}" = Java(TM) 6 Update 29
"{26D2EDD2-AEC6-45C8-979C-C7E15BA72F39}" = ESET NOD32 Antivirus
"{27CC6AB1-E72B-4179-AF1A-EAE507EBAF51}_is1" = ConvertHelper 2.2
"{3336F667-9049-4D46-98B6-4C743EEBC5B1}" = Windows Live Photo Gallery
"{399C37FB-08AF-493B-BFED-20FBD85EDF7F}" = HP Webcam Driver
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{45E7C481-3EF4-4FCB-AF0B-19F70D618F0C}" = Worms 4 Mayhem
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4CBABDFD-49F8-47FD-BE7D-ECDE7270525A}" = Windows Live PIMT Platform
"{4F7177E9-2B54-48B4-AAFD-03FA1F87A542}" = Bing Bar Platform
"{51C7AD07-C3F6-4635-8E8A-231306D810FE}" = Cisco LEAP Module
"{5208FDB2-D561-3FB4-9763-6B10B06745B7}" = Microsoft .NET Framework 4 Client Profile RUS Language Pack
"{5E4B86E5-CD0E-4D3D-BE21-45A30326850A}" = Microsoft Search Enhancement Pack
"{61AD15B2-50DB-4686-A739-14FE180D4429}" = Windows Live ID Sign-in Assistant
"{61C2DEC1-99F6-4215-A3AD-E0B35DFE9674}" = Основные программы для устройства HP Deskjet 3050 J610 series
"{64BF0187-F3D2-498B-99EA-163AF9AE6EC9}" = Cisco EAP-FAST Module
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{693393C7-2706-4942-8E31-E4DE1DC9841A}" = HP ESU for Microsoft Windows 7
"{6986737B-F286-40D1-87AF-938339DCF6AB}" = Windows Live Messenger
"{7020FC34-6E04-4858-924D-354B28CB2402}_is1" = Luminance HDR 2.2.0
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{7465A996-0FCA-4D2D-A52C-F833B0829B5B}" = Windows Live Movie Maker
"{7644E42D-B096-457F-8B5B-901238FC81AE}" = ICQ7.6
"{77F69CA1-E53D-4D77-8BA3-FA07606CC851}" = Фотоальбом Windows Live
"{787D1A33-A97B-4245-87C0-7174609A540C}" = HP Update
"{7E265513-8CDA-4631-B696-F40D983F3B07}_is1" = CDBurnerXP
"{81CB77FF-9789-4337-A46E-185F7876AC40}" = Adobe Photoshop Lightroom 2.6
"{86D4B82A-ABED-442A-BE86-96357B70F4FE}" = Ask Toolbar
"{873E4648-6F6E-47F6-A7B2-A6F8DFABDCE6}" = Windows Live Messenger
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{904CCF62-818D-4675-BC76-D37EB399F917}" = Центр устройств Windows Mobile
"{9240D97C-D575-465E-A681-21C0979EE5DF}" = Angry Birds Seasons
"{92EA4134-10D1-418A-91E1-5A0453131A38}" = Windows Live Movie Maker
"{933B4015-4618-4716-A828-5289FC03165F}" = VC80CRTRedist - 8.0.50727.6195
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{980A182F-E0A2-4A40-94C1-AE0C1235902E}" = Pando Media Booster
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9B89EB0D-68C3-4E5D-A705-CD8D37DABF50}" = VOCALOID Expression DB (Standard)
"{9E48FF52-082C-4CC2-BB67-6E10D09C0431}" = Windows Live UX Platform Language Pack
"{9FD6F1A8-5550-46AF-8509-271DF0E768B5}" = Dual-Core Optimizer
"{A0D08A19-EC76-441B-A264-0E71A8F5ABF8}" = VOCALOID SKIN (Crypton KAITO)
"{A31A5DFC-3439-48FC-99BB-5174168AE471}" = COMODO livePCsupport
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{B0910188-EECB-4747-A929-0C1A190AAB3E}" = Transmute v2.09
"{B113D18C-67B0-4FB7-B329-E89B66194AE6}" = Windows Live Fotogalerie
"{B123B3B1-C2A0-47E7-AAAB-D1E2DBE259CB}" = VOCALOID Editor V1.1.1.0
"{B194272D-1F92-46DF-99EB-8D5CE91CB4EC}" = Adobe AIR
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{B6CF2967-C81E-40C0-9815-C05774FEF120}" = Skype Click to Call
"{B95B1BA9-F887-4B3C-8D3A-CCD4C4675120}" = Microsoft Default Manager
"{C2A471DD-F365-4850-909C-DE718EED8888}" = OpenOffice.org 3.2
"{C2AB7DC4-489E-4BE9-887A-52262FBADBE0}" = Windows Live Photo Common
"{C3592426-531E-4110-911D-BFECE2CE284C}" = osu!
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{D4134B0B-EA9B-4835-A77A-60BEE6277101}" = Lightroom
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{D8DAB025-C2CE-4821-8117-494E95ADA031}" = Windows Live UX Platform Language Pack
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{E3E71D07-CD27-46CB-8448-16D4FB29AA13}" = Microsoft WSE 3.0 Runtime
"{E4E88B54-4777-4659-967A-2EED1E6AFD83}" = Windows Live Movie Maker
"{E7044E25-3038-4A76-9064-344AC038043E}" = Обновление драйверов Центра устройств Windows Mobile
"{E83DC314-C926-4214-AD58-147691D6FE9F}" = Основные компоненты Windows Live
"{EB4DF488-AAEF-406F-A341-CB2AAA315B90}" = Windows Live Messenger
"{ED5776D5-59B4-46B7-AF81-5F2D94D7C640}" = Cisco PEAP Module
"{EE7257A2-39A2-4D2F-9DAC-F9F25B8AE1D8}" = Skype™ 5.8
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F3292D16-6363-4AB8-85AF-75B61544B678}" = VOCALOID Voice DB (Kaito)
"{F7632A9B-661E-4FD9-B1A4-3B86BC99847F}" = HP Deskjet 3050 J610 series Справка
"{F95E4EE0-0C6E-4273-B6B9-91FD6F071D76}" = Windows Live Essentials
"{FAC611DA-E445-4D7A-8311-7389C627FA32}" = VOCALOID VSTi V1.1.1.0
"{FE163F11-1919-4257-A280-FF5AF8DAEECB}" = ICQ Sparberater
"‚fђьЏг‚М–‚‰¤_is1" = ‚fђьЏг‚М–‚‰¤ ver.1.00
"4Musics FLAC to MP3 Converter 5.2_is1" = 4Musics FLAC to MP3 Converter 5.2
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Akamai" = Akamai NetSession Interface
"aTube Catcher" = aTube Catcher
"Audacity 1.3 Beta (Unicode)_is1" = Audacity 1.3.13 (Unicode)
"Broadcom 802.11 Wireless LAN Adapter" = Broadcom 802.11 Wireless LAN Adapter
"Canon MOV Encoder" = Canon MOV Encoder
"CCleaner" = CCleaner
"CPUID CPU-Z_is1" = CPUID CPU-Z 1.58
"DAEMON Tools Lite" = DAEMON Tools Lite
"DietMP3_is1" = DietMP3 4.03.00
"DivX Setup" = DivX-Setup
"DjVu Solo 3.1" = DjVu Solo 3.1
"DPP" = Canon Utilities Digital Photo Professional 3.8
"EA Download Manager" = EA Download Manager
"Easy CD-DA Extractor Free 2010" = Easy CD-DA Extractor Free 2010
"EOS Utility" = Canon Utilities EOS Utility
"FlashGet 2.0" = FlashGet 2.0
"FMCODEC" = FM Screen Capture Codec (Remove Only)
"Foxit Creator" = Foxit Creator
"Foxit Reader" = Foxit Reader
"G-Senjou_no_Maou_Aegis" = G-Senjou no Maou English
"Hetman Uneraser" = Hetman Uneraser 3.1
"ICQToolbar" = ICQ Toolbar
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.60.1.1000
"ManyCam" = ManyCam 2.6.55 (remove only)
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile RUS Language Pack" = Языковой пакет клиентского профиля Microsoft.NET Framework 4 - RUS
"MKV Player_is1" = MKV Player 2.0.1
"Motherboard Monitor 5_is1" = Motherboard Monitor 5
"MovieEditTask" = Canon MovieEdit Task for ZoomBrowser EX
"MozBackup_is1" = MozBackup 1.4.10
"Mozilla Firefox 11.0 (x86 en-US)" = Mozilla Firefox 11.0 (x86 en-US)
"Mozilla Thunderbird (3.0.4)" = Mozilla Thunderbird (3.0.4)
"Neffy" = Neffy 1,3,29,0
"NSS" = Norton Security Scan
"Original Data Security Tools" = Canon Utilities Original Data Security Tools
"PhotoStitch" = Canon Utilities PhotoStitch
"Picture Style Editor" = Canon Utilities Picture Style Editor
"Quick Screenshot Maker 2.1_is1" = Quick Screenshot Maker 2.1
"ScreenMe Engine" = ScreenMe Engine
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"TeamSpeak 3 Client" = TeamSpeak 3 Client
"TeamViewer 6" = TeamViewer 6
"The Sims" = The Sims
"Total Audio Converter_is1" = TotalAudioConverter
"uTorrent" = µTorrent
"VLC media player" = VLC media player 1.0.5
"WAV to MP3 Encoder" = WAV to MP3 Encoder
"WFTK" = Canon Utilities WFT Utility
"Winamp" = Winamp
"WinGimp-2.0_is1" = GIMP 2.6.8
"WinLiveSuite" = Windows Live Essentials
"WinPcapInst" = WinPcap 4.1.1
"WinRAR archiver" = WinRAR archiver
"ZoomBrowser EX" = Canon Utilities ZoomBrowser EX
"ZoomBrowser EX Memory Card Utility" = Canon ZoomBrowser EX Memory Card Utility
 
========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Akamai" = Akamai NetSession Interface
"Google Chrome" = Google Chrome
"QIP 2010" = QIP 2010 10.10.12.4240
"QIP Infium" = QIP Infium 3.0.9044
"UnityWebPlayer" = Unity Web Player
"Winamp Detect" = Winamp Erkennungs-Plug-in
 
========== Last 10 Event Log Errors ==========
 
Error reading Event Logs: The Event Service is not operating properly or the Event Logs are corrupt!
 
< End of report >
         
Seit einiger Zeit haben ich das Problem, schwer zu beschreiben...
Wenn ich etwas zb reposten möchte auf einer Seite, passiert es gleich tausend mal. Wenn ich in einem Chat eine Nachricht senden möchte, wird jeder einzelne Buchstabe einzeln versand. Selbst wenn ich ein Icon in der Desktop-Leiste anklicke sieht es so aus, als ob ich es tausend mal anklicken würde.
Das kommt immer plötzlich und hört auch so plötzlich wieder auf.
Kommt es auch von diesen Trojaner?

Alt 24.03.2012, 15:29   #13
markusg
/// Malware-holic
 
Win32/Spy.Banker.WBU Trojaner - Standard

Win32/Spy.Banker.WBU Trojaner



ich sehe hier auch noch alte infektionen, ich würd das teil neu aufsetzen.
1. Datenrettung:2. Formatieren, Windows neuinstallieren:3. PC absichern: http://www.trojaner-board.de/96344-a...-rechners.html
4. alle Passwörter ändern!
5. nach PC Absicherung, die gesicherten Daten prüfen und falls sauber: zurückspielen.
6. werde ich dann noch was zum absichern von Onlinebanking mit Chip Card Reader + Star Money sagen.
__________________
-Verdächtige mails bitte an uns zur Analyse weiterleiten:
markusg.trojaner-board@web.de
Weiterleiten
Anleitung:
http://markusg.trojaner-board.de
Mails bitte vorerst nach obiger Anleitung an
markusg.trojaner-board@web.de
Weiterleiten
Wenn Ihr uns unterstützen möchtet

Alt 24.03.2012, 17:37   #14
NuriTakuru
 
Win32/Spy.Banker.WBU Trojaner - Standard

Win32/Spy.Banker.WBU Trojaner



Hab im Moment keine Zeit zum neu aufsetzen x_x aber danke.. das werde ich wohl machen müssen.

Habe noch einen Scan mit Spybot-search and destroy durchgeführt, und dieser hat noch mal zwei Infektionen entdeckt.Eins davon heißt Double klick und wurde erfolgreich eliminiert - ich glaube das gehört zu meinem oben genannten Problem mit mehreren Klicks.
Das andere sagt, mir fehlen die Administratorrecht, um es zu nutzen.
Im Anhang der Log dazu.
Code:
ATTFilter
 Search result list ---
W3i.IQ5.fraud: [SBI $467B1F92] Настройки (Ключ реестра, fixing failed)
  HKEY_LOCAL_MACHINE\SOFTWARE\Freeze.com

W3i.IQ5.fraud: [SBI $678078F9] Настройки (Ключ реестра, fixing failed)
  HKEY_LOCAL_MACHINE\SOFTWARE\W3i

DoubleClick: Следы куки (Chrome: Chrome) (Куки, fixed)
         
Vielen Dank für deine Hilfe!

PS: Habe nicht ganz verstanden.. Ist Windows neu installieren ein Muss oder reicht formatieren?

Alt 25.03.2012, 19:14   #15
markusg
/// Malware-holic
 
Win32/Spy.Banker.WBU Trojaner - Standard

Win32/Spy.Banker.WBU Trojaner



naja, wenn du wieder mit dem pc arbeiten willst, muss schon nen betriebssystem drauf... also klar musst du es dann wieder neu instalieren.
__________________
-Verdächtige mails bitte an uns zur Analyse weiterleiten:
markusg.trojaner-board@web.de
Weiterleiten
Anleitung:
http://markusg.trojaner-board.de
Mails bitte vorerst nach obiger Anleitung an
markusg.trojaner-board@web.de
Weiterleiten
Wenn Ihr uns unterstützen möchtet

Antwort

Themen zu Win32/Spy.Banker.WBU Trojaner
beschreiben, bräuchte, dreht, dringend, eintippen, eset, eset nod32, guten, immer wieder, konnte, laptop, laufe, laufenden, melde, morgen, nichts, nod32, tippen, total, troja, trojane, trojaner, win, win32/spy.banker.wbu



Ähnliche Themen: Win32/Spy.Banker.WBU Trojaner


  1. 2 Trojaner eingefangen durch E-Mail-Anhänge // Trojan-Banker.Win32.Agent.ubo und Trojan.Win32.Yakes.ghny
    Log-Analyse und Auswertung - 19.07.2015 (28)
  2. Windows XP, Trojaner, Win32:Banker-KDL
    Plagegeister aller Art und deren Bekämpfung - 17.09.2013 (13)
  3. Viele Trojaner im System: Kitana-134/Win32:Crypt -Buzus -Banker -...
    Plagegeister aller Art und deren Bekämpfung - 28.07.2013 (11)
  4. Virenmeldung: WER\reportqueue\appcrash.... Virus: Win32:Banker-HEP [Trj]
    Plagegeister aller Art und deren Bekämpfung - 11.04.2012 (1)
  5. Arbeitsspeicher: win32/spy banker wbu trojaner
    Plagegeister aller Art und deren Bekämpfung - 22.03.2012 (5)
  6. win32/spy banker wbu trojaner
    Plagegeister aller Art und deren Bekämpfung - 21.03.2012 (1)
  7. Win32/spy.Banker.WBU Trojaner im Arbeitsspeicher
    Plagegeister aller Art und deren Bekämpfung - 05.03.2012 (8)
  8. Win32/Spy.Banker.WBU trojaner im Arbeitsspeicher
    Log-Analyse und Auswertung - 20.01.2012 (8)
  9. Win32.Banker ; W32/AutoRun.blcc
    Log-Analyse und Auswertung - 10.12.2011 (15)
  10. Trojaner Win32/Spy.Banker.WBU Trojaner
    Plagegeister aller Art und deren Bekämpfung - 11.11.2011 (9)
  11. Win32.Banker.fgv von Spybot gelöscht und permamenter Upload
    Log-Analyse und Auswertung - 16.09.2010 (12)
  12. KIS 2010 meldet Win32.Banker.ajgn und Win32.OnLineGame.uaoe
    Log-Analyse und Auswertung - 04.03.2010 (8)
  13. Win32.Banker erkannt HiJackThis Log-File anbei
    Log-Analyse und Auswertung - 11.05.2009 (10)
  14. Win32.Banker.FS.Trojan.Spyagent.DA
    Plagegeister aller Art und deren Bekämpfung - 26.02.2009 (7)
  15. Win32.Banker.FS.Trojan.Spyagent.DA
    Plagegeister aller Art und deren Bekämpfung - 26.02.2009 (12)
  16. Win32.Banker.FS.Trojan.Spay.Agent.DA
    Log-Analyse und Auswertung - 21.02.2009 (5)
  17. Win32.TrojanSpy.Banker help
    Plagegeister aller Art und deren Bekämpfung - 13.07.2007 (4)

Zum Thema Win32/Spy.Banker.WBU Trojaner - Guten Tag zusammen ich bräuchte ganz dringend Hilfe, da ich angesichts der laufenden Abiturprüfungen auf den PC gewissermaßen angewiesen bin. Heute morgen meldete ESET NOD32 bei dir den oben genannten - Win32/Spy.Banker.WBU Trojaner...
Archiv
Du betrachtest: Win32/Spy.Banker.WBU Trojaner auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.