Zurück   Trojaner-Board > Malware entfernen > Plagegeister aller Art und deren Bekämpfung
Nach Malwarebites durchlauf Malware.N.Spack gefunden

Nach Malwarebites durchlauf Malware.N.Spack gefunden


Plagegeister aller Art und deren Bekämpfung: Nach Malwarebites durchlauf Malware.N.Spack gefunden

Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen.

Antwort
Alt 23.11.2012, 04:45   #1
t'john
/// Helfer-Team
 
Nach Malwarebites durchlauf Malware.N.Spack gefunden - Standard

Nach Malwarebites durchlauf Malware.N.Spack gefunden


Edit: Falsches Thema
__________________
Mfg, t'john
Das TB unterstützen

Alt 23.11.2012, 23:07   #2
Veantur
 
Nach Malwarebites durchlauf Malware.N.Spack gefunden - Standard

Nach Malwarebites durchlauf Malware.N.Spack gefunden


hi t john

ich denke nicht dass das system schon sauber sein kann
da ich ja vorgestern nur einen schnellscan mit malwarebites gemacht habe und die infizierten objekte nicht gelöscht habe

hab jetzt mal nen neuen vollscan durchgführt


hier die neue log

Malwarebytes Anti-Malware 1.65.1.1000
www.malwarebytes.org

Datenbank Version: v2012.11.20.03

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
S-System :: S-SYSTEM-PC [Administrator]

23.11.2012 07:17:19
mbam-log-2012-11-23 (07-17-19).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|F:\|G:\|H:\|I:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 1324696
Laufzeit: 3 Stunde(n), 26 Minute(n), 13 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 2
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Distant Worlds1.0.6.0 (Adware.Agent) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Entropia Universe (Adware.Agent) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(hier stellt sich mir die frage ob dies überhaupt schädlinge sein können, das ist legale software von zuverlässigen anbietern, kurzes feedback wäre sehr nett (Adware.Agent) )

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 4
C:\Users\S-System\AppData\Local\Temp\wtf31F5.tmp (Malware.NSPack) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\S-System\AppData\Local\Temp\wtf9684.tmp (Malware.NSPack) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Windows\Distant Worlds\uninstall.exe (Adware.Agent) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Windows\Entropia Universe\uninstall.exe (Adware.Agent) -> Erfolgreich gelöscht und in Quarantäne gestellt.

((Adware.Agent) siehe anmerkung oben)

(Ende)


die infizierten objekte sind nuch auch gelöscht worden (hoffe das ist ok, bitte um eine kurzes feedback)

zweiter scan


Malwarebytes Anti-Malware 1.65.1.1000
www.malwarebytes.org

Datenbank Version: v2012.11.20.03

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
S-System :: S-SYSTEM-PC [Administrator]

23.11.2012 18:45:56
mbam-log-2012-11-23 (18-45-56).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|F:\|G:\|H:\|I:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 1324371
Laufzeit: 3 Stunde(n), 17 Minute(n), 49 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)


otl scan
(der log extras wurde diesmal nicht angezeigt)OTL Logfile:
Code:
ATTFilter
OTL logfile created on: 23.11.2012 23:16:05 - Run 3
OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\S-System\Desktop
64bit- Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
4,00 Gb Total Physical Memory | 2,18 Gb Available Physical Memory | 54,45% Memory free
10,00 Gb Paging File | 7,09 Gb Available in Paging File | 70,97% Paging File free
Paging file location(s): c:\pagefile.sys 6142 12284 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 149,52 Gb Total Space | 66,43 Gb Free Space | 44,43% Space Free | Partition Type: NTFS
Drive D: | 24,41 Gb Total Space | 0,78 Gb Free Space | 3,20% Space Free | Partition Type: NTFS
Drive E: | 465,76 Gb Total Space | 59,94 Gb Free Space | 12,87% Space Free | Partition Type: NTFS
Drive F: | 14,65 Gb Total Space | 9,51 Gb Free Space | 64,90% Space Free | Partition Type: NTFS
Drive G: | 90,98 Gb Total Space | 82,98 Gb Free Space | 91,21% Space Free | Partition Type: NTFS
Drive H: | 414,09 Gb Total Space | 63,52 Gb Free Space | 15,34% Space Free | Partition Type: NTFS
Drive I: | 367,91 Gb Total Space | 236,40 Gb Free Space | 64,25% Space Free | Partition Type: NTFS
 
Computer Name: S-SYSTEM-PC | User Name: S-System | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\S-System\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe (Kaspersky Lab ZAO)
PRC - C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe (Malwarebytes Corporation)
PRC - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
PRC - C:\Windows\SysWOW64\PnkBstrA.exe ()
PRC - C:\Program Files (x86)\Winamp\winamp.exe (Nullsoft, Inc.)
PRC - C:\Programme\Autodesk\3ds Max 2012\mentalimages\satellite\raysat_3dsmax2012_64server.exe ()
PRC - C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe (Creative Technology Ltd)
 
 
========== Modules (No Company Name) ==========
 
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\winampa.lng ()
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\winamp.lng ()
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\vis_milk2.lng ()
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\vis_avs.lng ()
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\ml_local.lng ()
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\ml_disc.lng ()
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\ml_pmp.lng ()
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\pmp_wifi.lng ()
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\pmp_ipod.lng ()
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\ombrowser.lng ()
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\ml_plg.lng ()
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\pmp_android.lng ()
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\out_ds.lng ()
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\ml_wire.lng ()
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\ml_online.lng ()
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\ml_playlists.lng ()
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\pmp_usb.lng ()
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\ml_downloads.lng ()
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\ml_history.lng ()
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\ml_devices.lng ()
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\ml_transcode.lng ()
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\vis_nsfs.lng ()
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\out_wave.lng ()
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\ml_autotag.lng ()
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\tagz.lng ()
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\out_disk.lng ()
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\ml_rg.lng ()
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\ml_impex.lng ()
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\ml_bookmarks.lng ()
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\pmp_activesync.lng ()
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\ml_enqplay.lng ()
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\in_wv.lng ()
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\pmp_p4s.lng ()
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\ml_orb.lng ()
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\pmp_njb.lng ()
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\ml_nowplaying.lng ()
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\ml_addons.lng ()
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\playlist.lng ()
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\gen_jumpex.lng ()
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\gen_classicart.lng ()
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\in_mp3.lng ()
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\gen_ff.lng ()
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\gen_ml.lng ()
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\in_midi.lng ()
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\in_mod.lng ()
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\in_wm.lng ()
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\in_cdda.lng ()
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\in_nsv.lng ()
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\gen_skinmanager.lng ()
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\in_vorbis.lng ()
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\gen_hotkeys.lng ()
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\gen_undo.lng ()
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\gen_timerestore.lng ()
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\gen_nopro.lng ()
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\gen_tray.lng ()
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\gen_orgler.lng ()
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\gen_crasher.lng ()
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\in_wav.lng ()
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\in_dshow.lng ()
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\enc_wma.lng ()
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\in_wave.lng ()
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\in_flac.lng ()
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\in_mp4.lng ()
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\in_avi.lng ()
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\in_mkv.lng ()
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\gen_find_on_disk.lng ()
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\in_swf.lng ()
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\in_linein.lng ()
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\in_flv.lng ()
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\burnlib.lng ()
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\dsp_sps.lng ()
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\auth.lng ()
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\enc_fhgaac.lng ()
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\enc_lame.lng ()
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\enc_wav.lng ()
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\enc_vorbis.lng ()
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\enc_flac.lng ()
MOD - C:\Program Files (x86)\Mozilla Firefox\mozjs.dll ()
MOD - C:\Program Files (x86)\Winamp\System\jnetlib.w5s ()
MOD - C:\Program Files (x86)\Winamp\System\jpeg.w5s ()
MOD - C:\Program Files (x86)\Winamp\System\png.w5s ()
MOD - C:\Program Files (x86)\Winamp\System\xml.w5s ()
MOD - C:\Program Files (x86)\Winamp\System\playlist.w5s ()
MOD - C:\Program Files (x86)\Winamp\tataki.dll ()
MOD - C:\Program Files (x86)\Winamp\zlib.dll ()
MOD - C:\Program Files (x86)\Winamp\System\timer.w5s ()
MOD - C:\Program Files (x86)\Winamp\System\tagz.w5s ()
MOD - C:\Program Files (x86)\Winamp\System\gif.w5s ()
MOD - C:\Program Files (x86)\Winamp\System\dlmgr.w5s ()
MOD - C:\Program Files (x86)\Winamp\System\gracenote.w5s ()
MOD - C:\Program Files (x86)\Winamp\System\filereader.w5s ()
MOD - C:\Program Files (x86)\Winamp\System\primo.w5s ()
MOD - C:\Program Files (x86)\Winamp\System\auth.w5s ()
MOD - C:\Program Files (x86)\Winamp\Plugins\pmp_ipod.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\pmp_p4s.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\pmp_wifi.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\pmp_android.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\pmp_usb.dll ()
MOD - C:\Program Files (x86)\Winamp\System\devices.w5s ()
MOD - C:\Program Files (x86)\Winamp\System\albumart.w5s ()
MOD - C:\Program Files (x86)\Winamp\Plugins\pmp_njb.dll ()
MOD - C:\Program Files (x86)\Winamp\System\bmp.w5s ()
MOD - C:\Program Files (x86)\Winamp\Plugins\gen_ff.dll ()
MOD - C:\Program Files (x86)\Winamp\nsutil.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\freeform\wacs\freetype\freetype.wac ()
MOD - C:\Program Files (x86)\Winamp\Plugins\gen_ml.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\in_wm.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\ml_local.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\in_mp3.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\in_vorbis.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\ml_devices.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\ml_pmp.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\ml_disc.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\gen_jumpex.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\in_mod.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\ml_online.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\in_midi.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\in_cdda.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\ml_plg.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\ml_playlists.dll ()
MOD - C:\Program Files (x86)\Winamp\nde.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\in_nsv.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\in_dshow.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\in_avi.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\in_flac.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\ml_impex.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\gen_orgler.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\in_mp4.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\out_ds.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\ml_history.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\in_mkv.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\in_flv.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\ml_rg.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\ml_transcode.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\ml_autotag.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\ml_bookmarks.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\gen_hotkeys.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\gen_tray.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\in_swf.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\out_disk.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\out_wave.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\in_wave.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\in_linein.dll ()
MOD - C:\Program Files (x86)\Winamp\libsndfile.dll ()
MOD - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\QtGui4.dll ()
MOD - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\QtSql4.dll ()
MOD - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\QtScript4.dll ()
MOD - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\QtNetwork4.dll ()
MOD - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\QtCore4.dll ()
MOD - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\QtDeclarative4.dll ()
MOD - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\imageformats\qgif4.dll ()
MOD - C:\Windows\SysWOW64\APOMngr.DLL ()
MOD - C:\Windows\SysWOW64\CmdRtr.DLL ()
 
 
========== Services (SafeList) ==========
 
SRV:64bit: - (AMD External Events Utility) -- C:\Windows\SysNative\atiesrxx.exe (AMD)
SRV:64bit: - (AMD FUEL Service) -- C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe (Advanced Micro Devices, Inc.)
SRV:64bit: - (AppMgmt) -- C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)
SRV - (MozillaMaintenance) -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (AdobeFlashPlayerUpdateSvc) -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (AVP) -- C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe (Kaspersky Lab ZAO)
SRV - (Steam Client Service) -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe (Valve Corporation)
SRV - (MBAMService) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
SRV - (MBAMScheduler) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe (Malwarebytes Corporation)
SRV - (AdobeARMservice) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
SRV - (FLEXnet Licensing Service 64) -- C:\Programme\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe (Flexera Software, Inc.)
SRV - (PnkBstrA) -- C:\Windows\SysWOW64\PnkBstrA.exe ()
SRV - (Creative ALchemy AL6 Licensing Service) -- C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\AL6Licensing.exe (Creative Labs)
SRV - (Creative Audio Engine Licensing Service) -- C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe (Creative Labs)
SRV - (mi-raysat_3dsmax2012_64) -- C:\Programme\Autodesk\3ds Max 2012\mentalimages\satellite\raysat_3dsmax2012_64server.exe ()
SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (HPSLPSVC) -- C:\Program Files (x86)\HP\Digital Imaging\bin\HPSLPSVC64.DLL (Hewlett-Packard Co.)
SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
SRV - (CTAudSvcService) -- C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe (Creative Technology Ltd)
SRV - (SandraAgentSrv) -- C:\Programme\SiSoftware\SiSoftware Sandra Lite 2012.SP5c\RpcAgentSrv.exe (SiSoftware)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - (KLIF) -- C:\Windows\SysNative\drivers\klif.sys (Kaspersky Lab)
DRV:64bit: - (MBAMProtector) -- C:\Windows\SysNative\drivers\mbam.sys (Malwarebytes Corporation)
DRV:64bit: - (ssudmdm) -- C:\Windows\SysNative\drivers\ssudmdm.sys (DEVGURU Co., LTD.(www.devguru.co.kr))
DRV:64bit: - (dg_ssudbus) -- C:\Windows\SysNative\drivers\ssudbus.sys (DEVGURU Co., LTD.(www.devguru.co.kr))
DRV:64bit: - (amdkmdag) -- C:\Windows\SysNative\drivers\atikmdag.sys (Advanced Micro Devices, Inc.)
DRV:64bit: - (amdkmdap) -- C:\Windows\SysNative\drivers\atikmpag.sys (Advanced Micro Devices, Inc.)
DRV:64bit: - (Fs_Rec) -- C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation)
DRV:64bit: - (AtiHDAudioService) -- C:\Windows\SysNative\drivers\AtihdW76.sys (Advanced Micro Devices)
DRV:64bit: - (epmntdrv) -- C:\Windows\SysNative\epmntdrv.sys ()
DRV:64bit: - (EuGdiDrv) -- C:\Windows\SysNative\EuGdiDrv.sys ()
DRV:64bit: - (RTL8167) -- C:\Windows\SysNative\drivers\Rt64win7.sys (Realtek                                            )
DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (KLIM6) -- C:\Windows\SysNative\drivers\klim6.sys (Kaspersky Lab ZAO)
DRV:64bit: - (kl2) -- C:\Windows\SysNative\drivers\kl2.sys (Kaspersky Lab ZAO)
DRV:64bit: - (KL1) -- C:\Windows\SysNative\drivers\kl1.sys (Kaspersky Lab ZAO)
DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (TsUsbFlt) -- C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV:64bit: - (amdiox64) -- C:\Windows\SysNative\drivers\amdiox64.sys (Advanced Micro Devices)
DRV:64bit: - (klmouflt) -- C:\Windows\SysNative\drivers\klmouflt.sys (Kaspersky Lab)
DRV:64bit: - (P17) -- C:\Windows\SysNative\drivers\P17.sys (Creative Technology Ltd.)
DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV - (WinRing0_1_2_0) -- C:\Program Files (x86)\Razer\Razer Game Booster\Driver\WinRing0x64.sys (OpenLibSys.org)
DRV - (AODDriver4.1) -- C:\Programme\ATI Technologies\ATI.ACE\Fuel\amd64\aoddriver2.sys (Advanced Micro Devices)
DRV - (epmntdrv) -- C:\Windows\SysWOW64\epmntdrv.sys ()
DRV - (EuGdiDrv) -- C:\Windows\SysWOW64\EuGdiDrv.sys ()
DRV - (SANDRA) -- C:\Programme\SiSoftware\SiSoftware Sandra Lite 2012.SP5c\WNt500x64\sandra.sys (SiSoftware)
DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = 
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = 
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
 
 
IE - HKU\.DEFAULT\..\SearchScopes,DefaultScope = 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\..\SearchScopes,DefaultScope = 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-19\..\SearchScopes,DefaultScope = 
 
IE - HKU\S-1-5-20\..\SearchScopes,DefaultScope = 
 
IE - HKU\S-1-5-21-2320744662-329307789-2970131851-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKU\S-1-5-21-2320744662-329307789-2970131851-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
IE - HKU\S-1-5-21-2320744662-329307789-2970131851-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 1B B8 83 9B 6B C3 CD 01  [binary data]
IE - HKU\S-1-5-21-2320744662-329307789-2970131851-1001\..\SearchScopes,DefaultScope = 
IE - HKU\S-1-5-21-2320744662-329307789-2970131851-1001\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKU\S-1-5-21-2320744662-329307789-2970131851-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-2320744662-329307789-2970131851-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = 188.95.51.206:80
 
========== FireFox ==========
 
FF - user.js - File not found
 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_5_502_110.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\adobe.com/AdobeAAMDetect: C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll File not found
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_5_502_110.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.9.2: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.9.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.0: C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\ubisoft.com/uplaypc: C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll (Ubisoft)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\virtualKeyboard@kaspersky.ru: C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\FFExt\virtualKeyboard@kaspersky.ru [2012.11.01 19:43:42 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\linkfilter@kaspersky.ru: C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\FFExt\linkfilter@kaspersky.ru [2012.11.01 19:43:42 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\KavAntiBanner@Kaspersky.ru: C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\FFExt\KavAntiBanner@Kaspersky.ru [2012.11.01 19:43:42 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\smartwebprinting@hp.com: C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2012.06.02 11:27:41 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 16.0.2\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.10.31 20:45:42 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 16.0.2\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012.10.31 20:45:40 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 17.0\extensions\\Components: C:\Program Files (x86)\Mozilla Thunderbird\components [2012.11.20 21:05:13 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 17.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Thunderbird\plugins
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\smartwebprinting@hp.com: C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2012.06.02 11:27:41 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 16.0.2\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.10.31 20:45:42 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 16.0.2\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012.10.31 20:45:40 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Thunderbird 17.0\extensions\\Components: C:\Program Files (x86)\Mozilla Thunderbird\components [2012.11.20 21:05:13 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Thunderbird 17.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Thunderbird\plugins
 
[2012.03.17 00:42:20 | 000,000,000 | ---D | M] (No name found) -- C:\Users\S-System\AppData\Roaming\mozilla\Extensions
[2012.11.23 21:27:04 | 000,000,000 | ---D | M] (No name found) -- C:\Users\S-System\AppData\Roaming\mozilla\Firefox\Profiles\2om32i1e.default\extensions
[2012.11.23 21:27:04 | 000,804,627 | ---- | M] () (No name found) -- C:\Users\S-System\AppData\Roaming\mozilla\firefox\profiles\2om32i1e.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
[2012.10.31 20:45:39 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions
[2012.10.31 20:45:42 | 000,261,600 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2011.12.09 18:23:32 | 000,012,800 | ---- | M] (Nullsoft, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npwachk.dll
[2012.06.17 11:48:54 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.08.30 05:52:40 | 000,002,465 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2012.06.17 11:48:54 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2012.06.17 11:48:54 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.06.17 11:48:54 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.06.17 11:48:54 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2009.06.10 22:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2:64bit: - BHO: (IEVkbdBHO Class) - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\x64\ievkbd.dll (Kaspersky Lab ZAO)
O2:64bit: - BHO: (FilterBHO Class) - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\x64\klwtbbho.dll (Kaspersky Lab ZAO)
O2 - BHO: (IEVkbdBHO Class) - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\ievkbd.dll (Kaspersky Lab ZAO)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (FilterBHO Class) - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\klwtbbho.dll (Kaspersky Lab ZAO)
O4 - HKLM..\Run: [AMD AVT] C:\Windows\SysWow64\cmd.exe (Microsoft Corporation)
O4 - HKLM..\Run: [AVP] C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe (Kaspersky Lab ZAO)
O4 - HKLM..\Run: [P17RunE] C:\Windows\SysWow64\P17RunE.dll (Creative Technology Ltd.)
O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O8:64bit: - Extra context menu item: Hinzufügen zu Anti-Banner - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\ie_banner_deny.htm ()
O8 - Extra context menu item: Hinzufügen zu Anti-Banner - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\ie_banner_deny.htm ()
O9:64bit: - Extra Button: &Virtuelle Tastatur - {4248FE82-7FCB-46AC-B270-339F08212110} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\x64\ievkbd.dll (Kaspersky Lab ZAO)
O9:64bit: - Extra Button: Li&nks untersuchen - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\x64\klwtbbho.dll (Kaspersky Lab ZAO)
O9 - Extra Button: &Virtuelle Tastatur - {4248FE82-7FCB-46AC-B270-339F08212110} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\ievkbd.dll (Kaspersky Lab ZAO)
O9 - Extra Button: ICQ7M - {781B39EC-2E18-41FC-9B00-B84E4FFCA85F} - h:\Program Files (x86)\ICQ7M\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ7M - {781B39EC-2E18-41FC-9B00-B84E4FFCA85F} - h:\Program Files (x86)\ICQ7M\ICQ.exe (ICQ, LLC.)
O9 - Extra Button: Li&nks untersuchen - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\klwtbbho.dll (Kaspersky Lab ZAO)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {D4B68B83-8710-488B-A692-D74B50BA558E} hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/15113/CTPIDPDE.cab (Creative Software AutoUpdate Support Package 2)
O16 - DPF: {E705A591-DA3C-4228-B0D5-A356DBA42FBF} hxxp://ccfiles.creative.com/Web/softwareupdate/su2/ocx/20015/CTSUEng.cab (Creative Software AutoUpdate 2)
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/110926/CTPID.cab (Creative Software AutoUpdate Support Package)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{8CBA1030-D865-4F27-947F-C398CACD21D7}: DhcpNameServer = 192.168.0.1
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20:64bit: - Winlogon\Notify\klogon: DllName - (%SystemRoot%\System32\klogon.dll) - C:\Windows\SysNative\klogon.dll (Kaspersky Lab ZAO)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2012.03.23 10:30:41 | 000,000,000 | ---D | M] - F:\Autodesk -- [ NTFS ]
O32 - AutoRun File - [2011.10.26 22:38:38 | 000,000,000 | ---D | M] - H:\Autodesk -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.11.22 18:50:35 | 000,000,000 | ---D | C] -- C:\ProgramData\Sun
[2012.11.22 18:50:33 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Java
[2012.11.22 18:50:24 | 000,821,736 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\npDeployJava1.dll
[2012.11.22 18:50:24 | 000,746,984 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\deployJava1.dll
[2012.11.22 18:50:24 | 000,246,760 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\javaws.exe
[2012.11.22 18:50:16 | 000,174,056 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\javaw.exe
[2012.11.22 18:50:16 | 000,174,056 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\java.exe
[2012.11.22 18:50:16 | 000,095,208 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\WindowsAccessBridge-32.dll
[2012.11.22 18:49:54 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Java
[2012.11.21 20:23:17 | 000,000,000 | ---D | C] -- C:\ProgramData\boost_interprocess
[2012.11.20 21:05:13 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Thunderbird
[2012.11.20 18:53:42 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\S-System\Desktop\OTL.exe
[2012.11.15 22:32:09 | 000,054,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\WdfLdr.sys
[2012.11.15 22:32:09 | 000,009,728 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\Wdfres.dll
[2012.11.15 22:27:15 | 000,096,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmled.dll
[2012.11.15 22:27:15 | 000,073,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmled.dll
[2012.11.15 22:27:14 | 001,427,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\inetcpl.cpl
[2012.11.15 22:27:14 | 000,248,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll
[2012.11.15 22:27:14 | 000,237,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\url.dll
[2012.11.15 22:27:14 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\url.dll
[2012.11.15 22:27:14 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll
[2012.11.15 22:27:14 | 000,173,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieUnatt.exe
[2012.11.15 22:27:14 | 000,142,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieUnatt.exe
[2012.11.15 22:27:13 | 002,312,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9.dll
[2012.11.15 22:27:13 | 001,494,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\inetcpl.cpl
[2012.11.15 22:27:13 | 000,729,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msfeeds.dll
[2012.11.15 22:27:12 | 000,816,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript.dll
[2012.11.15 22:27:12 | 000,717,824 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript.dll
[2012.11.15 22:27:12 | 000,599,040 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\vbscript.dll
[2012.11.15 22:25:21 | 000,194,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\WUDFPlatform.dll
[2012.11.15 22:25:20 | 000,744,448 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\WUDFx.dll
[2012.11.15 22:25:20 | 000,229,888 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\WUDFHost.exe
[2012.11.15 22:25:20 | 000,045,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\WUDFCoinstaller.dll
[2012.11.15 21:31:03 | 000,226,816 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\dhcpcore6.dll
[2012.11.15 21:31:03 | 000,193,536 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\dhcpcore6.dll
[2012.11.15 21:31:03 | 000,055,296 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\dhcpcsvc6.dll
[2012.11.15 21:31:00 | 000,246,272 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\netcorehc.dll
[2012.11.15 21:31:00 | 000,216,576 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ncsi.dll
[2012.11.15 21:31:00 | 000,175,104 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\netcorehc.dll
[2012.11.15 21:31:00 | 000,156,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ncsi.dll
[2012.11.15 21:30:59 | 000,018,944 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\netevent.dll
[2012.11.15 21:30:59 | 000,018,944 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\netevent.dll
[2012.11.15 21:30:43 | 000,095,744 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\synceng.dll
[2012.11.15 21:30:43 | 000,078,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\synceng.dll
[2012.11.13 21:02:30 | 000,000,000 | ---D | C] -- C:\Users\S-System\AppData\Local\Apps
[2012.11.11 17:48:00 | 000,000,000 | ---D | C] -- C:\Users\S-System\Documents\BioWare
[2012.11.10 16:50:00 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\MonitorDriver
[2012.11.10 16:42:22 | 000,000,000 | ---D | C] -- C:\Samsung
[2012.11.10 13:36:32 | 000,000,000 | ---D | C] -- C:\ProgramData\FLEXnet
[2012.11.10 13:36:27 | 000,000,000 | ---D | C] -- C:\Users\S-System\AppData\Local\Autodesk
[2012.11.04 15:34:29 | 000,000,000 | ---D | C] -- C:\Users\Public\Documents\CrashDump
[2012.11.04 13:09:16 | 000,000,000 | ---D | C] -- C:\Users\S-System\Documents\SelfMV
[2012.11.04 13:01:14 | 000,000,000 | ---D | C] -- C:\Temp
[2012.11.04 12:59:23 | 000,203,104 | ---- | C] (DEVGURU Co., LTD.(www.devguru.co.kr)) -- C:\Windows\SysNative\drivers\ssudmdm.sys
[2012.11.04 12:59:23 | 000,102,368 | ---- | C] (DEVGURU Co., LTD.(www.devguru.co.kr)) -- C:\Windows\SysNative\drivers\ssudbus.sys
[2012.11.04 12:57:21 | 000,000,000 | ---D | C] -- C:\Users\Public\Documents\NativeFus_Log
[2012.11.04 12:57:15 | 000,000,000 | ---D | C] -- C:\Users\S-System\AppData\Local\Samsung
[2012.11.04 12:57:14 | 000,000,000 | ---D | C] -- C:\Users\S-System\AppData\Roaming\Samsung
[2012.11.04 12:57:12 | 000,000,000 | ---D | C] -- C:\Users\S-System\Documents\samsung
[2012.11.04 12:55:58 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Samsung
[2012.11.04 12:55:50 | 004,659,712 | ---- | C] (Dmitry Streblechenko) -- C:\Windows\SysWow64\Redemption.dll
[2012.11.04 12:55:34 | 000,821,824 | ---- | C] (Devguru Co., Ltd.) -- C:\Windows\SysWow64\dgderapi.dll
[2012.11.04 12:55:34 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\MarkAny
[2012.11.04 12:55:17 | 000,000,000 | ---D | C] -- C:\ProgramData\Samsung
[2012.11.04 12:55:17 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Samsung
[2012.11.04 12:48:12 | 000,000,000 | ---D | C] -- C:\Users\S-System\AppData\Local\Downloaded Installations
[2012.11.03 18:45:53 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GOG.com
[2012.11.02 23:13:51 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SiSoftware
[2012.11.02 23:13:44 | 000,000,000 | ---D | C] -- C:\Program Files\SiSoftware
[2012.11.01 20:11:05 | 000,778,088 | ---- | C] (Hewlett-Packard Co.) -- C:\Windows\SysNative\HPDiscoPM5E12.dll
[2012.11.01 20:10:14 | 000,000,000 | ---D | C] -- C:\Program Files\HP
[2012.11.01 20:09:27 | 000,000,000 | ---D | C] -- C:\Users\S-System\AppData\Local\HP
[2012.10.31 20:45:38 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Firefox
[2012.10.27 11:20:32 | 000,000,000 | ---D | C] -- C:\Users\S-System\AppData\Local\Focus Home Interactive
[2012.10.27 07:36:12 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
[2012.10.27 07:36:12 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner
[1 C:\*.tmp files -> C:\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012.11.23 23:17:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012.11.23 18:52:54 | 000,014,752 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.11.23 18:52:54 | 000,014,752 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.11.23 18:44:24 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.11.23 18:44:20 | 3220,578,304 | -HS- | M] () -- C:\hiberfil.sys
[2012.11.22 18:49:58 | 000,095,208 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\WindowsAccessBridge-32.dll
[2012.11.22 18:49:57 | 000,821,736 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\npDeployJava1.dll
[2012.11.22 18:49:57 | 000,746,984 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\deployJava1.dll
[2012.11.22 18:49:57 | 000,246,760 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\javaws.exe
[2012.11.22 18:49:57 | 000,174,056 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\javaw.exe
[2012.11.22 18:49:57 | 000,174,056 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\java.exe
[2012.11.22 18:45:42 | 001,612,484 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2012.11.22 18:45:42 | 000,696,620 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2012.11.22 18:45:42 | 000,651,938 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2012.11.22 18:45:42 | 000,147,916 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2012.11.22 18:45:42 | 000,120,870 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2012.11.21 18:55:00 | 000,543,531 | ---- | M] () -- C:\Users\S-System\Desktop\adwcleaner.exe
[2012.11.20 18:53:30 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\S-System\Desktop\OTL.exe
[2012.11.16 17:09:42 | 004,892,752 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2012.11.10 16:45:14 | 000,697,272 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerApp.exe
[2012.11.10 16:45:14 | 000,073,656 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
[2012.11.04 12:57:10 | 000,001,992 | ---- | M] () -- C:\Users\Public\Desktop\Samsung Kies.lnk
[2012.11.04 12:53:45 | 001,589,442 | ---- | M] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2012.11.03 18:45:57 | 000,001,013 | ---- | M] () -- C:\Users\Public\Desktop\Icewind Dale Complete.lnk
[2012.11.02 23:13:51 | 000,001,183 | ---- | M] () -- C:\Users\Public\Desktop\SiSoftware Sandra Lite 2012.SP5c.lnk
[2012.11.02 23:11:44 | 000,001,231 | ---- | M] () -- C:\Users\S-System\Desktop\AIDA64 Extreme Edition.lnk
[2012.11.01 20:11:04 | 000,002,116 | ---- | M] () -- C:\Users\Public\Desktop\HP Officejet 6100.lnk
[2012.11.01 20:11:04 | 000,001,832 | ---- | M] () -- C:\Users\Public\Desktop\HP ePrintCenter - HP Officejet 6100.lnk
[2012.11.01 20:10:08 | 000,000,057 | ---- | M] () -- C:\ProgramData\Ament.ini
[2012.11.01 19:43:41 | 000,637,272 | ---- | M] (Kaspersky Lab) -- C:\Windows\SysNative\drivers\klif.sys
[2012.10.27 07:53:08 | 000,001,109 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.10.27 07:36:12 | 000,000,822 | ---- | M] () -- C:\Users\Public\Desktop\CCleaner.lnk
[1 C:\*.tmp files -> C:\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012.11.21 18:55:14 | 000,543,531 | ---- | C] () -- C:\Users\S-System\Desktop\adwcleaner.exe
[2012.11.15 22:32:11 | 000,000,003 | ---- | C] () -- C:\Windows\SysNative\drivers\MsftWdf_Kernel_01011_Inbox_Critical.Wdf
[2012.11.15 22:25:20 | 000,000,003 | ---- | C] () -- C:\Windows\SysNative\drivers\MsftWdf_User_01_11_00_Inbox_Critical.Wdf
[2012.11.04 12:57:10 | 000,001,992 | ---- | C] () -- C:\Users\Public\Desktop\Samsung Kies.lnk
[2012.11.03 18:45:57 | 000,001,013 | ---- | C] () -- C:\Users\Public\Desktop\Icewind Dale Complete.lnk
[2012.11.02 23:14:11 | 011,624,448 | ---- | C] () -- C:\Users\S-System\AppData\Roaming\Sandra.mdb
[2012.11.02 23:13:51 | 000,001,183 | ---- | C] () -- C:\Users\Public\Desktop\SiSoftware Sandra Lite 2012.SP5c.lnk
[2012.11.01 20:11:04 | 000,002,116 | ---- | C] () -- C:\Users\Public\Desktop\HP Officejet 6100.lnk
[2012.11.01 20:11:04 | 000,001,832 | ---- | C] () -- C:\Users\Public\Desktop\HP ePrintCenter - HP Officejet 6100.lnk
[2012.11.01 20:10:08 | 000,000,057 | ---- | C] () -- C:\ProgramData\Ament.ini
[2012.10.27 07:36:12 | 000,000,822 | ---- | C] () -- C:\Users\Public\Desktop\CCleaner.lnk
[2012.09.26 20:57:16 | 000,030,568 | ---- | C] () -- C:\Windows\MusiccityDownload.exe
[2012.09.26 20:57:14 | 000,974,848 | ---- | C] () -- C:\Windows\SysWow64\cis-2.4.dll
[2012.09.26 20:57:14 | 000,081,920 | ---- | C] () -- C:\Windows\SysWow64\issacapi_bs-2.3.dll
[2012.09.26 20:57:14 | 000,065,536 | ---- | C] () -- C:\Windows\SysWow64\issacapi_pe-2.3.dll
[2012.09.26 20:57:14 | 000,057,344 | ---- | C] () -- C:\Windows\SysWow64\issacapi_se-2.3.dll
[2012.06.13 09:00:01 | 002,469,760 | ---- | C] () -- C:\Windows\SysWow64\BootMan.exe
[2012.06.13 09:00:01 | 000,019,840 | ---- | C] () -- C:\Windows\SysWow64\EuEpmGdi.dll
[2012.06.13 09:00:00 | 000,086,408 | ---- | C] () -- C:\Windows\SysWow64\setupempdrv03.exe
[2012.06.13 09:00:00 | 000,014,216 | ---- | C] () -- C:\Windows\SysWow64\epmntdrv.sys
[2012.06.13 09:00:00 | 000,008,456 | ---- | C] () -- C:\Windows\SysWow64\EuGdiDrv.sys
[2012.06.06 20:02:47 | 000,000,782 | ---- | C] () -- C:\Windows\wiso.ini
[2012.06.02 11:23:22 | 000,245,227 | ---- | C] () -- C:\Windows\hpoins19.dat
[2012.06.02 11:23:22 | 000,013,898 | ---- | C] () -- C:\Windows\hpomdl19.dat
[2012.05.10 15:35:16 | 000,029,184 | ---- | C] () -- C:\Windows\SysWow64\kdbsdk32.dll
[2012.04.17 18:47:24 | 000,007,597 | ---- | C] () -- C:\Users\S-System\AppData\Local\Resmon.ResmonCfg
[2012.03.23 10:41:03 | 001,589,442 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2012.03.19 10:11:06 | 000,280,856 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrB.exe
[2012.03.19 10:11:04 | 000,076,888 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrA.exe
[2012.03.17 01:26:47 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin
[2012.03.17 00:59:17 | 000,017,408 | ---- | C] () -- C:\Users\S-System\AppData\Local\WebpageIcons.db
[2012.03.16 23:34:39 | 000,148,480 | ---- | C] () -- C:\Windows\SysWow64\APOMngr.DLL
[2012.03.16 23:34:39 | 000,073,728 | ---- | C] () -- C:\Windows\SysWow64\CmdRtr.DLL
[2012.02.15 03:36:36 | 000,204,952 | ---- | C] () -- C:\Windows\SysWow64\ativvsvl.dat
[2012.02.15 03:36:36 | 000,157,144 | ---- | C] () -- C:\Windows\SysWow64\ativvsva.dat
[2011.09.12 23:06:16 | 000,003,917 | ---- | C] () -- C:\Windows\SysWow64\atipblag.dat
 
========== ZeroAccess Check ==========
 
[2009.07.14 05:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll -- [2012.06.09 06:43:10 | 014,172,672 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2012.06.09 05:41:00 | 012,873,728 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.07.14 02:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.20 13:19:02 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 02:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
 
========== LOP Check ==========
 
[2012.11.10 13:45:01 | 000,000,000 | ---D | M] -- C:\Users\S-System\AppData\Roaming\Autodesk
[2012.08.17 11:44:12 | 000,000,000 | ---D | M] -- C:\Users\S-System\AppData\Roaming\Awesomium
[2012.06.06 20:05:18 | 000,000,000 | ---D | M] -- C:\Users\S-System\AppData\Roaming\Buhl Data Service
[2012.03.22 23:03:00 | 000,000,000 | ---D | M] -- C:\Users\S-System\AppData\Roaming\Code Force Limited
[2012.09.17 19:51:54 | 000,000,000 | ---D | M] -- C:\Users\S-System\AppData\Roaming\EVEMon
[2012.09.28 19:22:24 | 000,000,000 | ---D | M] -- C:\Users\S-System\AppData\Roaming\ICQ
[2012.03.19 11:46:28 | 000,000,000 | ---D | M] -- C:\Users\S-System\AppData\Roaming\Mount&Blade With Fire and Sword
[2012.08.15 07:03:56 | 000,000,000 | ---D | M] -- C:\Users\S-System\AppData\Roaming\PDAppFlex
[2012.11.04 12:57:14 | 000,000,000 | ---D | M] -- C:\Users\S-System\AppData\Roaming\Samsung
[2012.06.24 12:50:57 | 000,000,000 | ---D | M] -- C:\Users\S-System\AppData\Roaming\The Creative Assembly
[2012.03.21 18:19:58 | 000,000,000 | ---D | M] -- C:\Users\S-System\AppData\Roaming\Thunderbird
[2012.10.27 08:06:38 | 000,000,000 | ---D | M] -- C:\Users\S-System\AppData\Roaming\TS3Client
[2012.04.12 20:15:14 | 000,000,000 | ---D | M] -- C:\Users\S-System\AppData\Roaming\ts3overlay
[2012.06.07 15:53:33 | 000,000,000 | ---D | M] -- C:\Users\S-System\AppData\Roaming\UDP Software
[2012.06.14 10:44:01 | 000,000,000 | ---D | M] -- C:\Users\S-System\AppData\Roaming\wargaming.net
 
========== Purity Check ==========
 
 

< End of report >
--- --- ---

um die prozedur von gestern zu wiederholen habe ich noch mal adwcleaner laufen lassen

# AdwCleaner v2.008 - Datei am 23/11/2012 um 23:27:32 erstellt
# Aktualisiert am 17/11/2012 von Xplode
# Betriebssystem : Windows 7 Professional Service Pack 1 (64 bits)
# Benutzer : S-System - S-SYSTEM-PC
# Bootmodus : Normal
# Ausgeführt unter : C:\Users\S-System\Desktop\adwcleaner.exe
# Option [Löschen]


**** [Dienste] ****


***** [Dateien / Ordner] *****

Ordner Gelöscht : C:\ProgramData\boost_interprocess

***** [Registrierungsdatenbank] *****


***** [Internet Browser] *****

-\\ Internet Explorer v9.0.8112.16421

[OK] Die Registrierungsdatenbank ist sauber.

-\\ Mozilla Firefox v16.0.2 (de)

Profilname : default
Datei : C:\Users\S-System\AppData\Roaming\Mozilla\Firefox\Profiles\2om32i1e.default\prefs.js

[OK] Die Datei ist sauber.

Profilname : default
Datei : C:\Users\Surfer\AppData\Roaming\Mozilla\Firefox\Profiles\5lwozvxd.default\prefs.js

[OK] Die Datei ist sauber.

Profilname : default
Datei : C:\Users\Gast\AppData\Roaming\Mozilla\Firefox\Profiles\udigbhyo.default\prefs.js

[OK] Die Datei ist sauber.

*************************

AdwCleaner[S1].txt - [1787 octets] - [21/11/2012 18:55:55]
AdwCleaner[S2].txt - [1165 octets] - [23/11/2012 23:27:32]

########## EOF - C:\AdwCleaner[S2].txt - [1225 octets] ##########

ich hoffe ich überlade dich jetzt nich mit inforamtionen

will einfach nur sicher sein das mein system sauber ist
__________________

Geändert von Veantur (23.11.2012 um 23:57 Uhr)

Antwort

Themen zu Nach Malwarebites durchlauf Malware.N.Spack gefunden
administrator, adobe, adobe flash player, autorun, avp.exe, explorer, firefox, flash player, focus, format, forum?, infizierte, install.exe, kaspersky, logfile, malware.nspack, monitor.exe, mozilla, nexus, officejet, pirates, plug-in, programme, realtek, registry, richtlinie, rundll, security, software, svchost.exe, tastatur, teamspeak, temp, version.


« gvu-trojaner auf dem laptop der tochter | Claro Search entfernen »


Ähnliche Themen: Nach Malwarebites durchlauf Malware.N.Spack gefunden


  1. Google/Firefox und weitere Programme funktionieren nach Durchlauf von Avira nicht
    Plagegeister aller Art und deren Bekämpfung - 30.03.2015 (17)
  2. adwcleaner jeweils nach dem Durchlauf einer Rubrik neu starten?
    Antiviren-, Firewall- und andere Schutzprogramme - 08.03.2015 (5)
  3. Nach ImgBurn Installation Malware gefunden
    Plagegeister aller Art und deren Bekämpfung - 24.09.2014 (15)
  4. Nach Durchlauf Malwarebytes einen Befall festgestellt
    Plagegeister aller Art und deren Bekämpfung - 11.08.2014 (15)
  5. Viele Fehler mit Malwarebites Anti-Malware gefunden
    Log-Analyse und Auswertung - 21.07.2014 (43)
  6. Malwarebites findet Befall mit PUP.Optional.WowSearch.A nach Lame-aktuallisierung (Windows 8.1)
    Log-Analyse und Auswertung - 05.06.2014 (40)
  7. Hilfe! Malware/Backdoor gefunden & Outlook stürzt nach Start ab
    Plagegeister aller Art und deren Bekämpfung - 13.02.2014 (10)
  8. Vista: nach Avira Systemcheck einige Malware und Trojaner gefunden
    Log-Analyse und Auswertung - 26.01.2014 (3)
  9. Weißer Bildschirm bei Windows XP nach start - zuvor Malware gefunden
    Log-Analyse und Auswertung - 23.05.2013 (19)
  10. Nach Malwarebites durchlauf Malware.N.Spack gefunden
    Log-Analyse und Auswertung - 21.11.2012 (1)
  11. Nach Malware- Scan 21 Infizierungen auf meinen Rechner gefunden. Was soll ich tun?
    Plagegeister aller Art und deren Bekämpfung - 17.06.2011 (7)
  12. Nach Malwarebites'Anti-Maleware Scannung alle Daten und Programme weg
    Log-Analyse und Auswertung - 16.06.2011 (3)
  13. nach malware scan 139 viren gefunden auf meinen rechner was soll ich tun
    Plagegeister aller Art und deren Bekämpfung - 11.06.2011 (1)
  14. Beim Virenprogramm durchlauf Maleware gefunden..
    Plagegeister aller Art und deren Bekämpfung - 04.05.2011 (7)
  15. Antimalware Doctor nach Malwarebytes Anti Malware Durchlauf noch da
    Log-Analyse und Auswertung - 03.10.2010 (1)
  16. Nach Durchlauf von S&D, immer noch Trojaner am PC
    Mülltonne - 11.11.2008 (0)
  17. Malwarebites Anti-Malware oder Superantispyware
    Antiviren-, Firewall- und andere Schutzprogramme - 29.04.2008 (2)
Anleitungen und Tipps

- Für alle Hilfesuchenden! Was beachten?

- Anleitung: MyStartSearch.com entfernen

- Anleitung: WebSearches löschen

- Hilfe: iStartSurf entfernen – so gehts!

- Anleitung: Omiga Plus richtig entfernen

- Browser Viren entfernen


Zum Thema Nach Malwarebites durchlauf Malware.N.Spack gefunden - Edit: Falsches Thema - Nach Malwarebites durchlauf Malware.N.Spack gefunden...
Archiv
Du betrachtest: Nach Malwarebites durchlauf Malware.N.Spack gefunden auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131