Zurück   Trojaner-Board > Malware entfernen > Plagegeister aller Art und deren Bekämpfung

Plagegeister aller Art und deren Bekämpfung: Nach Malwarebites durchlauf Malware.N.Spack gefunden

Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen.

Antwort
Alt 20.11.2012, 18:15   #1
Veantur
 
Nach Malwarebites durchlauf Malware.N.Spack gefunden - Standard

Nach Malwarebites durchlauf Malware.N.Spack gefunden



Hallo
wie im Titel erwähnt habe ich nach routine Malwarebytes durchlauf zwei infizierte Datien entdeckt

hier im anhang der log

Malwarebytes Anti-Malware 1.65.1.1000
www.malwarebytes.org

Datenbank Version: v2012.11.20.03

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
S-System :: S-SYSTEM-PC [Administrator]

20.11.2012 18:39:02
mbam-log-2012-11-20 (18-42-46).txt

Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 244580
Laufzeit: 3 Minute(n), 31 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 2
C:\Users\S-System\AppData\Local\Temp\wtf31F5.tmp (Malware.NSPack) -> Keine Aktion durchgeführt.
C:\Users\S-System\AppData\Local\Temp\wtf9684.tmp (Malware.NSPack) -> Keine Aktion durchgeführt.

(Ende)



Für die Hilfe möchte ich im vorraus danken


habe nun auch einen OTL Scan durchgeführtOTL Logfile:
Code:
ATTFilter
OTL logfile created on: 20.11.2012 18:55:25 - Run 2
OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\S-System\Desktop
64bit- Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
4,00 Gb Total Physical Memory | 2,27 Gb Available Physical Memory | 56,65% Memory free
10,00 Gb Paging File | 7,82 Gb Available in Paging File | 78,23% Paging File free
Paging file location(s): c:\pagefile.sys 6142 12284 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 149,52 Gb Total Space | 68,20 Gb Free Space | 45,61% Space Free | Partition Type: NTFS
Drive D: | 24,41 Gb Total Space | 0,78 Gb Free Space | 3,20% Space Free | Partition Type: NTFS
Drive E: | 465,76 Gb Total Space | 59,94 Gb Free Space | 12,87% Space Free | Partition Type: NTFS
Drive F: | 14,65 Gb Total Space | 9,52 Gb Free Space | 65,00% Space Free | Partition Type: NTFS
Drive G: | 90,98 Gb Total Space | 82,98 Gb Free Space | 91,21% Space Free | Partition Type: NTFS
Drive H: | 414,09 Gb Total Space | 63,52 Gb Free Space | 15,34% Space Free | Partition Type: NTFS
Drive I: | 367,91 Gb Total Space | 236,40 Gb Free Space | 64,25% Space Free | Partition Type: NTFS
 
Computer Name: S-SYSTEM-PC | User Name: S-System | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 60 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\S-System\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe (Kaspersky Lab ZAO)
PRC - C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Program Files (x86)\Mozilla Thunderbird\thunderbird.exe (Mozilla Corporation)
PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe (Malwarebytes Corporation)
PRC - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
PRC - C:\Windows\SysWOW64\PnkBstrA.exe ()
PRC - C:\Programme\Autodesk\3ds Max 2012\mentalimages\satellite\raysat_3dsmax2012_64server.exe ()
PRC - C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe (Creative Technology Ltd)
 
 
========== Modules (No Company Name) ==========
 
MOD - C:\Program Files (x86)\Mozilla Firefox\mozjs.dll ()
MOD - C:\Program Files (x86)\Mozilla Thunderbird\mozjs.dll ()
MOD - C:\Program Files (x86)\Mozilla Thunderbird\NSLDAP32V60.dll ()
MOD - C:\Program Files (x86)\Mozilla Thunderbird\NSLDAPPR32V60.dll ()
MOD - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\QtGui4.dll ()
MOD - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\QtSql4.dll ()
MOD - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\QtScript4.dll ()
MOD - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\QtNetwork4.dll ()
MOD - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\QtCore4.dll ()
MOD - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\QtDeclarative4.dll ()
MOD - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\imageformats\qgif4.dll ()
MOD - C:\Windows\SysWOW64\APOMngr.DLL ()
MOD - C:\Windows\SysWOW64\CmdRtr.DLL ()
 
 
========== Services (SafeList) ==========
 
SRV:64bit: - (AMD External Events Utility) -- C:\Windows\SysNative\atiesrxx.exe (AMD)
SRV:64bit: - (AMD FUEL Service) -- C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe (Advanced Micro Devices, Inc.)
SRV:64bit: - (AppMgmt) -- C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)
SRV - (AdobeFlashPlayerUpdateSvc) -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (AVP) -- C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe (Kaspersky Lab ZAO)
SRV - (MozillaMaintenance) -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (Steam Client Service) -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe (Valve Corporation)
SRV - (MBAMService) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
SRV - (MBAMScheduler) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe (Malwarebytes Corporation)
SRV - (AdobeARMservice) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
SRV - (FLEXnet Licensing Service 64) -- C:\Programme\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe (Flexera Software, Inc.)
SRV - (PnkBstrA) -- C:\Windows\SysWOW64\PnkBstrA.exe ()
SRV - (Creative ALchemy AL6 Licensing Service) -- C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\AL6Licensing.exe (Creative Labs)
SRV - (Creative Audio Engine Licensing Service) -- C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe (Creative Labs)
SRV - (mi-raysat_3dsmax2012_64) -- C:\Programme\Autodesk\3ds Max 2012\mentalimages\satellite\raysat_3dsmax2012_64server.exe ()
SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (HPSLPSVC) -- C:\Program Files (x86)\HP\Digital Imaging\bin\HPSLPSVC64.DLL (Hewlett-Packard Co.)
SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
SRV - (CTAudSvcService) -- C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe (Creative Technology Ltd)
SRV - (SandraAgentSrv) -- C:\Programme\SiSoftware\SiSoftware Sandra Lite 2012.SP5c\RpcAgentSrv.exe (SiSoftware)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - (KLIF) -- C:\Windows\SysNative\drivers\klif.sys (Kaspersky Lab)
DRV:64bit: - (MBAMProtector) -- C:\Windows\SysNative\drivers\mbam.sys (Malwarebytes Corporation)
DRV:64bit: - (ssudmdm) -- C:\Windows\SysNative\drivers\ssudmdm.sys (DEVGURU Co., LTD.(www.devguru.co.kr))
DRV:64bit: - (dg_ssudbus) -- C:\Windows\SysNative\drivers\ssudbus.sys (DEVGURU Co., LTD.(www.devguru.co.kr))
DRV:64bit: - (amdkmdag) -- C:\Windows\SysNative\drivers\atikmdag.sys (Advanced Micro Devices, Inc.)
DRV:64bit: - (amdkmdap) -- C:\Windows\SysNative\drivers\atikmpag.sys (Advanced Micro Devices, Inc.)
DRV:64bit: - (Fs_Rec) -- C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation)
DRV:64bit: - (AtiHDAudioService) -- C:\Windows\SysNative\drivers\AtihdW76.sys (Advanced Micro Devices)
DRV:64bit: - (epmntdrv) -- C:\Windows\SysNative\epmntdrv.sys ()
DRV:64bit: - (EuGdiDrv) -- C:\Windows\SysNative\EuGdiDrv.sys ()
DRV:64bit: - (RTL8167) -- C:\Windows\SysNative\drivers\Rt64win7.sys (Realtek                                            )
DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (KLIM6) -- C:\Windows\SysNative\drivers\klim6.sys (Kaspersky Lab ZAO)
DRV:64bit: - (kl2) -- C:\Windows\SysNative\drivers\kl2.sys (Kaspersky Lab ZAO)
DRV:64bit: - (KL1) -- C:\Windows\SysNative\drivers\kl1.sys (Kaspersky Lab ZAO)
DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (TsUsbFlt) -- C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV:64bit: - (amdiox64) -- C:\Windows\SysNative\drivers\amdiox64.sys (Advanced Micro Devices)
DRV:64bit: - (klmouflt) -- C:\Windows\SysNative\drivers\klmouflt.sys (Kaspersky Lab)
DRV:64bit: - (P17) -- C:\Windows\SysNative\drivers\P17.sys (Creative Technology Ltd.)
DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV - (WinRing0_1_2_0) -- C:\Program Files (x86)\Razer\Razer Game Booster\Driver\WinRing0x64.sys (OpenLibSys.org)
DRV - (AODDriver4.1) -- C:\Programme\ATI Technologies\ATI.ACE\Fuel\amd64\aoddriver2.sys (Advanced Micro Devices)
DRV - (epmntdrv) -- C:\Windows\SysWOW64\epmntdrv.sys ()
DRV - (EuGdiDrv) -- C:\Windows\SysWOW64\EuGdiDrv.sys ()
DRV - (SANDRA) -- C:\Programme\SiSoftware\SiSoftware Sandra Lite 2012.SP5c\WNt500x64\sandra.sys (SiSoftware)
DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 1B B8 83 9B 6B C3 CD 01  [binary data]
IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = 188.95.51.206:80
 
========== FireFox ==========
 
FF - user.js - File not found
 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_5_502_110.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\adobe.com/AdobeAAMDetect: C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll File not found
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_5_502_110.dll ()
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.0: C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\ubisoft.com/uplaypc: C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll (Ubisoft)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\virtualKeyboard@kaspersky.ru: C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\FFExt\virtualKeyboard@kaspersky.ru [2012.11.01 19:43:42 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\linkfilter@kaspersky.ru: C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\FFExt\linkfilter@kaspersky.ru [2012.11.01 19:43:42 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\KavAntiBanner@Kaspersky.ru: C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\FFExt\KavAntiBanner@Kaspersky.ru [2012.11.01 19:43:42 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\smartwebprinting@hp.com: C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2012.06.02 11:27:41 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 16.0.2\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.10.31 20:45:42 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 16.0.2\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012.10.31 20:45:40 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 16.0.2\extensions\\Components: C:\Program Files (x86)\Mozilla Thunderbird\components [2012.10.30 18:55:32 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 16.0.2\extensions\\Plugins: C:\Program Files (x86)\Mozilla Thunderbird\plugins
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\smartwebprinting@hp.com: C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2012.06.02 11:27:41 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 16.0.2\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.10.31 20:45:42 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 16.0.2\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012.10.31 20:45:40 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Thunderbird 16.0.2\extensions\\Components: C:\Program Files (x86)\Mozilla Thunderbird\components [2012.10.30 18:55:32 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Thunderbird 16.0.2\extensions\\Plugins: C:\Program Files (x86)\Mozilla Thunderbird\plugins
 
[2012.03.17 00:42:20 | 000,000,000 | ---D | M] (No name found) -- C:\Users\S-System\AppData\Roaming\mozilla\Extensions
[2012.10.23 15:34:30 | 000,000,000 | ---D | M] (No name found) -- C:\Users\S-System\AppData\Roaming\mozilla\Firefox\Profiles\2om32i1e.default\extensions
[2012.10.31 20:45:39 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions
[2012.10.31 20:45:42 | 000,261,600 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2011.12.09 18:23:32 | 000,012,800 | ---- | M] (Nullsoft, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npwachk.dll
[2012.06.17 11:48:54 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.08.30 05:52:40 | 000,002,465 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2012.06.17 11:48:54 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2012.06.17 11:48:54 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.06.17 11:48:54 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.06.17 11:48:54 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2009.06.10 22:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2:64bit: - BHO: (IEVkbdBHO Class) - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\x64\ievkbd.dll (Kaspersky Lab ZAO)
O2:64bit: - BHO: (FilterBHO Class) - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\x64\klwtbbho.dll (Kaspersky Lab ZAO)
O2 - BHO: (IEVkbdBHO Class) - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\ievkbd.dll (Kaspersky Lab ZAO)
O2 - BHO: (FilterBHO Class) - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\klwtbbho.dll (Kaspersky Lab ZAO)
O4 - HKLM..\Run: [AMD AVT] C:\Windows\SysWow64\cmd.exe (Microsoft Corporation)
O4 - HKLM..\Run: [AVP] C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe (Kaspersky Lab ZAO)
O4 - HKLM..\Run: [P17RunE] C:\Windows\SysWow64\P17RunE.dll (Creative Technology Ltd.)
O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O8:64bit: - Extra context menu item: Hinzufügen zu Anti-Banner - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\ie_banner_deny.htm ()
O8 - Extra context menu item: Hinzufügen zu Anti-Banner - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\ie_banner_deny.htm ()
O9:64bit: - Extra Button: &Virtuelle Tastatur - {4248FE82-7FCB-46AC-B270-339F08212110} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\x64\ievkbd.dll (Kaspersky Lab ZAO)
O9:64bit: - Extra Button: Li&nks untersuchen - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\x64\klwtbbho.dll (Kaspersky Lab ZAO)
O9 - Extra Button: &Virtuelle Tastatur - {4248FE82-7FCB-46AC-B270-339F08212110} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\ievkbd.dll (Kaspersky Lab ZAO)
O9 - Extra Button: ICQ7M - {781B39EC-2E18-41FC-9B00-B84E4FFCA85F} - h:\Program Files (x86)\ICQ7M\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ7M - {781B39EC-2E18-41FC-9B00-B84E4FFCA85F} - h:\Program Files (x86)\ICQ7M\ICQ.exe (ICQ, LLC.)
O9 - Extra Button: Li&nks untersuchen - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\klwtbbho.dll (Kaspersky Lab ZAO)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {D4B68B83-8710-488B-A692-D74B50BA558E} hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/15113/CTPIDPDE.cab (Creative Software AutoUpdate Support Package 2)
O16 - DPF: {E705A591-DA3C-4228-B0D5-A356DBA42FBF} hxxp://ccfiles.creative.com/Web/softwareupdate/su2/ocx/20015/CTSUEng.cab (Creative Software AutoUpdate 2)
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/110926/CTPID.cab (Creative Software AutoUpdate Support Package)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{8CBA1030-D865-4F27-947F-C398CACD21D7}: DhcpNameServer = 192.168.0.1
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20:64bit: - Winlogon\Notify\klogon: DllName - (%SystemRoot%\System32\klogon.dll) - C:\Windows\SysNative\klogon.dll (Kaspersky Lab ZAO)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2012.03.23 10:30:41 | 000,000,000 | ---D | M] - F:\Autodesk -- [ NTFS ]
O32 - AutoRun File - [2011.10.26 22:38:38 | 000,000,000 | ---D | M] - H:\Autodesk -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 60 Days ==========
 
[2012.11.20 18:53:42 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\S-System\Desktop\OTL.exe
[2012.11.15 22:32:09 | 000,054,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\WdfLdr.sys
[2012.11.15 22:32:09 | 000,009,728 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\Wdfres.dll
[2012.11.15 22:27:15 | 000,096,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmled.dll
[2012.11.15 22:27:15 | 000,073,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmled.dll
[2012.11.15 22:27:14 | 001,427,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\inetcpl.cpl
[2012.11.15 22:27:14 | 000,248,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll
[2012.11.15 22:27:14 | 000,237,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\url.dll
[2012.11.15 22:27:14 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\url.dll
[2012.11.15 22:27:14 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll
[2012.11.15 22:27:14 | 000,173,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieUnatt.exe
[2012.11.15 22:27:14 | 000,142,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieUnatt.exe
[2012.11.15 22:27:13 | 002,312,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9.dll
[2012.11.15 22:27:13 | 001,494,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\inetcpl.cpl
[2012.11.15 22:27:13 | 000,729,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msfeeds.dll
[2012.11.15 22:27:12 | 000,816,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript.dll
[2012.11.15 22:27:12 | 000,717,824 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript.dll
[2012.11.15 22:27:12 | 000,599,040 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\vbscript.dll
[2012.11.15 22:25:21 | 000,194,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\WUDFPlatform.dll
[2012.11.15 22:25:20 | 000,744,448 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\WUDFx.dll
[2012.11.15 22:25:20 | 000,229,888 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\WUDFHost.exe
[2012.11.15 22:25:20 | 000,045,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\WUDFCoinstaller.dll
[2012.11.15 21:31:03 | 000,226,816 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\dhcpcore6.dll
[2012.11.15 21:31:03 | 000,193,536 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\dhcpcore6.dll
[2012.11.15 21:31:03 | 000,055,296 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\dhcpcsvc6.dll
[2012.11.15 21:31:00 | 000,246,272 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\netcorehc.dll
[2012.11.15 21:31:00 | 000,216,576 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ncsi.dll
[2012.11.15 21:31:00 | 000,175,104 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\netcorehc.dll
[2012.11.15 21:31:00 | 000,156,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ncsi.dll
[2012.11.15 21:30:59 | 000,018,944 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\netevent.dll
[2012.11.15 21:30:59 | 000,018,944 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\netevent.dll
[2012.11.15 21:30:43 | 000,095,744 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\synceng.dll
[2012.11.15 21:30:43 | 000,078,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\synceng.dll
[2012.11.13 21:02:30 | 000,000,000 | ---D | C] -- C:\Users\S-System\AppData\Local\Apps
[2012.11.11 17:48:00 | 000,000,000 | ---D | C] -- C:\Users\S-System\Documents\BioWare
[2012.11.10 16:50:00 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\MonitorDriver
[2012.11.10 16:42:22 | 000,000,000 | ---D | C] -- C:\Samsung
[2012.11.10 13:36:32 | 000,000,000 | ---D | C] -- C:\ProgramData\FLEXnet
[2012.11.10 13:36:27 | 000,000,000 | ---D | C] -- C:\Users\S-System\AppData\Local\Autodesk
[2012.11.04 15:34:29 | 000,000,000 | ---D | C] -- C:\Users\Public\Documents\CrashDump
[2012.11.04 13:09:16 | 000,000,000 | ---D | C] -- C:\Users\S-System\Documents\SelfMV
[2012.11.04 13:01:14 | 000,000,000 | ---D | C] -- C:\Temp
[2012.11.04 12:59:23 | 000,203,104 | ---- | C] (DEVGURU Co., LTD.(www.devguru.co.kr)) -- C:\Windows\SysNative\drivers\ssudmdm.sys
[2012.11.04 12:59:23 | 000,102,368 | ---- | C] (DEVGURU Co., LTD.(www.devguru.co.kr)) -- C:\Windows\SysNative\drivers\ssudbus.sys
[2012.11.04 12:57:21 | 000,000,000 | ---D | C] -- C:\Users\Public\Documents\NativeFus_Log
[2012.11.04 12:57:15 | 000,000,000 | ---D | C] -- C:\Users\S-System\AppData\Local\Samsung
[2012.11.04 12:57:14 | 000,000,000 | ---D | C] -- C:\Users\S-System\AppData\Roaming\Samsung
[2012.11.04 12:57:12 | 000,000,000 | ---D | C] -- C:\Users\S-System\Documents\samsung
[2012.11.04 12:55:58 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Samsung
[2012.11.04 12:55:50 | 004,659,712 | ---- | C] (Dmitry Streblechenko) -- C:\Windows\SysWow64\Redemption.dll
[2012.11.04 12:55:34 | 000,821,824 | ---- | C] (Devguru Co., Ltd.) -- C:\Windows\SysWow64\dgderapi.dll
[2012.11.04 12:55:34 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\MarkAny
[2012.11.04 12:55:17 | 000,000,000 | ---D | C] -- C:\ProgramData\Samsung
[2012.11.04 12:55:17 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Samsung
[2012.11.04 12:48:12 | 000,000,000 | ---D | C] -- C:\Users\S-System\AppData\Local\Downloaded Installations
[2012.11.03 18:45:53 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GOG.com
[2012.11.02 23:13:51 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SiSoftware
[2012.11.02 23:13:44 | 000,000,000 | ---D | C] -- C:\Program Files\SiSoftware
[2012.11.01 20:11:05 | 000,778,088 | ---- | C] (Hewlett-Packard Co.) -- C:\Windows\SysNative\HPDiscoPM5E12.dll
[2012.11.01 20:10:14 | 000,000,000 | ---D | C] -- C:\Program Files\HP
[2012.11.01 20:09:27 | 000,000,000 | ---D | C] -- C:\Users\S-System\AppData\Local\HP
[2012.10.31 20:45:38 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Firefox
[2012.10.30 18:55:32 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Thunderbird
[2012.10.27 11:20:32 | 000,000,000 | ---D | C] -- C:\Users\S-System\AppData\Local\Focus Home Interactive
[2012.10.27 07:36:12 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
[2012.10.27 07:36:12 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner
[2012.10.19 17:19:39 | 000,000,000 | ---D | C] -- C:\Users\S-System\AppData\Local\Programs
[2012.10.11 19:39:56 | 000,000,000 | ---D | C] -- C:\Users\S-System\AppData\Local\Razer
[2012.10.11 19:39:14 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Razer
[2012.10.11 19:39:13 | 000,000,000 | ---D | C] -- C:\ProgramData\Razer
[2012.10.11 19:39:13 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Razer
[2012.10.10 18:38:17 | 005,559,664 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ntoskrnl.exe
[2012.10.10 18:38:17 | 003,968,880 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntkrnlpa.exe
[2012.10.10 18:38:17 | 003,914,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntoskrnl.exe
[2012.10.10 18:38:08 | 001,162,240 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\kernel32.dll
[2012.10.10 18:38:08 | 000,424,448 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\KernelBase.dll
[2012.10.10 18:38:08 | 000,338,432 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\conhost.exe
[2012.10.10 18:38:08 | 000,215,040 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\winsrv.dll
[2012.10.10 18:38:06 | 000,243,200 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wow64.dll
[2012.10.10 18:38:06 | 000,025,600 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\setup16.exe
[2012.10.10 18:38:05 | 000,362,496 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wow64win.dll
[2012.10.10 18:38:05 | 000,016,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ntvdm64.dll
[2012.10.10 18:38:05 | 000,014,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ntvdm64.dll
[2012.10.10 18:38:05 | 000,013,312 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wow64cpu.dll
[2012.10.10 18:38:05 | 000,007,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\instnm.exe
[2012.10.10 18:38:05 | 000,005,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\wow32.dll
[2012.10.10 18:38:05 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-threadpool-l1-1-0.dll
[2012.10.10 18:38:05 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-processthreads-l1-1-0.dll
[2012.10.10 18:38:05 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-processthreads-l1-1-0.dll
[2012.10.10 18:38:05 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-sysinfo-l1-1-0.dll
[2012.10.10 18:38:05 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-sysinfo-l1-1-0.dll
[2012.10.10 18:38:05 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-synch-l1-1-0.dll
[2012.10.10 18:38:05 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-synch-l1-1-0.dll
[2012.10.10 18:38:05 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-misc-l1-1-0.dll
[2012.10.10 18:38:05 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-localregistry-l1-1-0.dll
[2012.10.10 18:38:05 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-localregistry-l1-1-0.dll
[2012.10.10 18:38:05 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-rtlsupport-l1-1-0.dll
[2012.10.10 18:38:05 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-processenvironment-l1-1-0.dll
[2012.10.10 18:38:05 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-namedpipe-l1-1-0.dll
[2012.10.10 18:38:05 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-misc-l1-1-0.dll
[2012.10.10 18:38:05 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-memory-l1-1-0.dll
[2012.10.10 18:38:05 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-heap-l1-1-0.dll
[2012.10.10 18:38:05 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-xstate-l1-1-0.dll
[2012.10.10 18:38:05 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-util-l1-1-0.dll
[2012.10.10 18:38:05 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-string-l1-1-0.dll
[2012.10.10 18:38:05 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-string-l1-1-0.dll
[2012.10.10 18:38:05 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-rtlsupport-l1-1-0.dll
[2012.10.10 18:38:05 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-profile-l1-1-0.dll
[2012.10.10 18:38:05 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-profile-l1-1-0.dll
[2012.10.10 18:38:04 | 000,006,144 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-security-base-l1-1-0.dll
[2012.10.10 18:38:04 | 000,005,120 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-file-l1-1-0.dll
[2012.10.10 18:38:04 | 000,005,120 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-file-l1-1-0.dll
[2012.10.10 18:38:04 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-processenvironment-l1-1-0.dll
[2012.10.10 18:38:04 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-namedpipe-l1-1-0.dll
[2012.10.10 18:38:04 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-memory-l1-1-0.dll
[2012.10.10 18:38:04 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-libraryloader-l1-1-0.dll
[2012.10.10 18:38:04 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-libraryloader-l1-1-0.dll
[2012.10.10 18:38:04 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-interlocked-l1-1-0.dll
[2012.10.10 18:38:04 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-heap-l1-1-0.dll
[2012.10.10 18:38:04 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-io-l1-1-0.dll
[2012.10.10 18:38:04 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-io-l1-1-0.dll
[2012.10.10 18:38:04 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-interlocked-l1-1-0.dll
[2012.10.10 18:38:04 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-handle-l1-1-0.dll
[2012.10.10 18:38:04 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-handle-l1-1-0.dll
[2012.10.10 18:38:04 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-fibers-l1-1-0.dll
[2012.10.10 18:38:04 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-fibers-l1-1-0.dll
[2012.10.10 18:38:04 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-errorhandling-l1-1-0.dll
[2012.10.10 18:38:04 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-errorhandling-l1-1-0.dll
[2012.10.10 18:38:04 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-delayload-l1-1-0.dll
[2012.10.10 18:38:04 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-delayload-l1-1-0.dll
[2012.10.10 18:38:04 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-debug-l1-1-0.dll
[2012.10.10 18:38:04 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-debug-l1-1-0.dll
[2012.10.10 18:38:04 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-datetime-l1-1-0.dll
[2012.10.10 18:38:04 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-datetime-l1-1-0.dll
[2012.10.10 18:38:03 | 000,006,144 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-security-base-l1-1-0.dll
[2012.10.10 18:38:03 | 000,004,608 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-threadpool-l1-1-0.dll
[2012.10.10 18:38:03 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-localization-l1-1-0.dll
[2012.10.10 18:38:03 | 000,004,096 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-localization-l1-1-0.dll
[2012.10.10 18:38:03 | 000,003,584 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-xstate-l1-1-0.dll
[2012.10.10 18:38:03 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-util-l1-1-0.dll
[2012.10.10 18:38:03 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\api-ms-win-core-console-l1-1-0.dll
[2012.10.10 18:38:02 | 000,003,072 | -H-- | C] (Microsoft Corporation) -- C:\Windows\SysNative\api-ms-win-core-console-l1-1-0.dll
[2012.10.10 18:38:02 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\user.exe
[2012.10.10 18:37:54 | 000,220,160 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wintrust.dll
[2012.10.10 18:37:39 | 001,464,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\crypt32.dll
[2012.10.10 18:37:39 | 000,140,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\cryptnet.dll
[2012.10.09 19:17:03 | 010,220,472 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerInstaller.exe
[2012.09.26 20:57:16 | 000,330,240 | ---- | C] ((주)마크애니) -- C:\Windows\MASetupCaller.dll
[2012.09.26 20:57:16 | 000,090,112 | ---- | C] ((주)마크애니) -- C:\Windows\MAMCityDownload.ocx
[2012.09.26 20:57:14 | 000,569,344 | ---- | C] ((c) MusicCity) -- C:\Windows\SysWow64\muzdecode.ax
[2012.09.26 20:57:14 | 000,491,520 | ---- | C] (Musiccity Co.Ltd.) -- C:\Windows\SysWow64\muzapp.dll
[2012.09.26 20:57:14 | 000,352,256 | ---- | C] (Sample Corporation) -- C:\Windows\SysWow64\MSLUR71.dll
[2012.09.26 20:57:14 | 000,258,048 | ---- | C] ((c) PeeringPortal) -- C:\Windows\SysWow64\muzoggsp.ax
[2012.09.26 20:57:14 | 000,245,760 | ---- | C] (Teruten Inc.) -- C:\Windows\SysWow64\MSCLib.dll
[2012.09.26 20:57:14 | 000,200,704 | ---- | C] ( (c) MusicCity) -- C:\Windows\SysWow64\muzwmts.dll
[2012.09.26 20:57:14 | 000,172,032 | ---- | C] (Musiccity Co.Ltd.) -- C:\Windows\SysWow64\muzapp.exe
[2012.09.26 20:57:14 | 000,155,648 | ---- | C] (Teruten Inc.) -- C:\Windows\SysWow64\MSFLib.dll
[2012.09.26 20:57:14 | 000,135,168 | ---- | C] (Musiccity Co.Ltd.) -- C:\Windows\SysWow64\muzaf1.dll
[2012.09.26 20:57:14 | 000,131,072 | ---- | C] ((c) MusicCity) -- C:\Windows\SysWow64\muzmpgsp.ax
[2012.09.26 20:57:14 | 000,122,880 | ---- | C] ((c) MUSICCITY) -- C:\Windows\SysWow64\muzeffect.ax
[2012.09.26 20:57:14 | 000,118,784 | ---- | C] ((주)마크애니) -- C:\Windows\SysWow64\MaDRM.dll
[2012.09.26 20:57:14 | 000,110,592 | ---- | C] ((c) MusicCity) -- C:\Windows\SysWow64\muzmp4sp.ax
[2012.09.26 20:57:14 | 000,057,344 | ---- | C] (Marktek) -- C:\Windows\SysWow64\MK_Lyric.dll
[2012.09.26 20:57:14 | 000,057,344 | ---- | C] (Marktek Inc.) -- C:\Windows\SysWow64\MTXSYNCICON.dll
[2012.09.26 20:57:14 | 000,049,152 | ---- | C] ((주) 마크애니) -- C:\Windows\SysWow64\MaJGUILib.dll
[2012.09.26 20:57:14 | 000,045,320 | ---- | C] (MARKANY) -- C:\Windows\SysWow64\MAMACExtract.dll
[2012.09.26 20:57:14 | 000,045,056 | ---- | C] ((주) 마크애니) -- C:\Windows\SysWow64\MaXMLProto.dll
[2012.09.26 20:57:14 | 000,045,056 | ---- | C] ((주) 마크애니) -- C:\Windows\SysWow64\MACXMLProto.dll
[2012.09.26 20:57:14 | 000,040,960 | ---- | C] (Telechips Inc.,) -- C:\Windows\SysWow64\MTTELECHIP.dll
[2012.09.26 20:57:14 | 000,024,576 | ---- | C] ((주)마크애니) -- C:\Windows\SysWow64\MASetupCleaner.exe
[2012.09.25 19:20:13 | 000,245,760 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\OxpsConverter.exe
[2012.09.22 20:25:21 | 000,000,000 | ---D | C] -- C:\Users\S-System\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VL Sound 5.1
[2012.09.22 20:25:21 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VL Sound 5.1
[2012.09.21 21:27:42 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ICQ7M
[2012.09.21 21:27:28 | 000,000,000 | ---D | C] -- C:\Users\S-System\AppData\Roaming\ICQ
[1 C:\*.tmp files -> C:\*.tmp -> ]
 
========== Files - Modified Within 60 Days ==========
 
[2012.11.20 18:53:30 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\S-System\Desktop\OTL.exe
[2012.11.20 18:46:17 | 000,014,752 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.11.20 18:46:17 | 000,014,752 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.11.20 18:43:40 | 001,612,484 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2012.11.20 18:43:40 | 000,696,620 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2012.11.20 18:43:40 | 000,651,938 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2012.11.20 18:43:40 | 000,147,916 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2012.11.20 18:43:40 | 000,120,870 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2012.11.20 18:37:33 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.11.20 18:37:28 | 3220,578,304 | -HS- | M] () -- C:\hiberfil.sys
[2012.11.19 23:17:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012.11.16 17:09:42 | 004,892,752 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2012.11.10 16:45:14 | 000,697,272 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerApp.exe
[2012.11.10 16:45:14 | 000,073,656 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
[2012.11.04 12:57:10 | 000,001,992 | ---- | M] () -- C:\Users\Public\Desktop\Samsung Kies.lnk
[2012.11.04 12:53:45 | 001,589,442 | ---- | M] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2012.11.03 18:45:57 | 000,001,013 | ---- | M] () -- C:\Users\Public\Desktop\Icewind Dale Complete.lnk
[2012.11.02 23:13:51 | 000,001,183 | ---- | M] () -- C:\Users\Public\Desktop\SiSoftware Sandra Lite 2012.SP5c.lnk
[2012.11.02 23:11:44 | 000,001,231 | ---- | M] () -- C:\Users\S-System\Desktop\AIDA64 Extreme Edition.lnk
[2012.11.01 20:11:04 | 000,002,116 | ---- | M] () -- C:\Users\Public\Desktop\HP Officejet 6100.lnk
[2012.11.01 20:11:04 | 000,001,832 | ---- | M] () -- C:\Users\Public\Desktop\HP ePrintCenter - HP Officejet 6100.lnk
[2012.11.01 20:10:08 | 000,000,057 | ---- | M] () -- C:\ProgramData\Ament.ini
[2012.11.01 19:43:41 | 000,637,272 | ---- | M] (Kaspersky Lab) -- C:\Windows\SysNative\drivers\klif.sys
[2012.10.27 07:53:08 | 000,001,109 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.10.27 07:36:12 | 000,000,822 | ---- | M] () -- C:\Users\Public\Desktop\CCleaner.lnk
[2012.10.11 19:39:14 | 000,002,144 | ---- | M] () -- C:\Users\Public\Desktop\Razer Game Booster.lnk
[2012.10.09 19:17:13 | 000,226,816 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\dhcpcore6.dll
[2012.10.09 19:17:13 | 000,055,296 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\dhcpcsvc6.dll
[2012.10.09 19:17:03 | 010,220,472 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerInstaller.exe
[2012.10.09 18:40:31 | 000,193,536 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\dhcpcore6.dll
[2012.10.08 12:31:03 | 002,312,704 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9.dll
[2012.10.08 12:22:55 | 001,494,528 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\inetcpl.cpl
[2012.10.08 12:22:17 | 000,237,056 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\url.dll
[2012.10.08 12:18:22 | 000,173,056 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\ieUnatt.exe
[2012.10.08 12:17:35 | 000,599,040 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\vbscript.dll
[2012.10.08 12:17:26 | 000,816,640 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\jscript.dll
[2012.10.08 12:15:59 | 000,729,088 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\msfeeds.dll
[2012.10.08 12:13:54 | 000,096,768 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmled.dll
[2012.10.08 12:09:39 | 000,248,320 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll
[2012.10.08 08:47:44 | 001,427,968 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\inetcpl.cpl
[2012.10.08 08:46:32 | 000,231,936 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\url.dll
[2012.10.08 08:44:05 | 000,142,848 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\ieUnatt.exe
[2012.10.08 08:43:05 | 000,717,824 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript.dll
[2012.10.08 08:41:19 | 000,073,216 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmled.dll
[2012.10.08 08:37:23 | 000,176,640 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll
[2012.10.03 18:44:17 | 000,246,272 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\netcorehc.dll
[2012.10.03 18:44:17 | 000,018,944 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\netevent.dll
[2012.10.03 18:44:16 | 000,216,576 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\ncsi.dll
[2012.10.03 17:42:24 | 000,175,104 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\netcorehc.dll
[2012.10.03 17:42:24 | 000,018,944 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\netevent.dll
[2012.10.03 17:42:23 | 000,156,672 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\ncsi.dll
[2012.09.29 18:54:26 | 000,025,928 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2012.09.26 20:57:22 | 004,659,712 | ---- | M] (Dmitry Streblechenko) -- C:\Windows\SysWow64\Redemption.dll
[2012.09.26 20:57:16 | 000,330,240 | ---- | M] ((주)마크애니) -- C:\Windows\MASetupCaller.dll
[2012.09.26 20:57:16 | 000,090,112 | ---- | M] ((주)마크애니) -- C:\Windows\MAMCityDownload.ocx
[2012.09.26 20:57:16 | 000,030,568 | ---- | M] () -- C:\Windows\MusiccityDownload.exe
[2012.09.26 20:57:14 | 000,974,848 | ---- | M] () -- C:\Windows\SysWow64\cis-2.4.dll
[2012.09.26 20:57:14 | 000,569,344 | ---- | M] ((c) MusicCity) -- C:\Windows\SysWow64\muzdecode.ax
[2012.09.26 20:57:14 | 000,491,520 | ---- | M] (Musiccity Co.Ltd.) -- C:\Windows\SysWow64\muzapp.dll
[2012.09.26 20:57:14 | 000,352,256 | ---- | M] (Sample Corporation) -- C:\Windows\SysWow64\MSLUR71.dll
[2012.09.26 20:57:14 | 000,258,048 | ---- | M] ((c) PeeringPortal) -- C:\Windows\SysWow64\muzoggsp.ax
[2012.09.26 20:57:14 | 000,245,760 | ---- | M] (Teruten Inc.) -- C:\Windows\SysWow64\MSCLib.dll
[2012.09.26 20:57:14 | 000,200,704 | ---- | M] ( (c) MusicCity) -- C:\Windows\SysWow64\muzwmts.dll
[2012.09.26 20:57:14 | 000,172,032 | ---- | M] (Musiccity Co.Ltd.) -- C:\Windows\SysWow64\muzapp.exe
[2012.09.26 20:57:14 | 000,155,648 | ---- | M] (Teruten Inc.) -- C:\Windows\SysWow64\MSFLib.dll
[2012.09.26 20:57:14 | 000,143,360 | ---- | M] () -- C:\Windows\SysWow64\3DAudio.ax
[2012.09.26 20:57:14 | 000,135,168 | ---- | M] (Musiccity Co.Ltd.) -- C:\Windows\SysWow64\muzaf1.dll
[2012.09.26 20:57:14 | 000,131,072 | ---- | M] ((c) MusicCity) -- C:\Windows\SysWow64\muzmpgsp.ax
[2012.09.26 20:57:14 | 000,122,880 | ---- | M] ((c) MUSICCITY) -- C:\Windows\SysWow64\muzeffect.ax
[2012.09.26 20:57:14 | 000,118,784 | ---- | M] ((주)마크애니) -- C:\Windows\SysWow64\MaDRM.dll
[2012.09.26 20:57:14 | 000,110,592 | ---- | M] ((c) MusicCity) -- C:\Windows\SysWow64\muzmp4sp.ax
[2012.09.26 20:57:14 | 000,081,920 | ---- | M] () -- C:\Windows\SysWow64\issacapi_bs-2.3.dll
[2012.09.26 20:57:14 | 000,065,536 | ---- | M] () -- C:\Windows\SysWow64\issacapi_pe-2.3.dll
[2012.09.26 20:57:14 | 000,057,344 | ---- | M] (Marktek) -- C:\Windows\SysWow64\MK_Lyric.dll
[2012.09.26 20:57:14 | 000,057,344 | ---- | M] (Marktek Inc.) -- C:\Windows\SysWow64\MTXSYNCICON.dll
[2012.09.26 20:57:14 | 000,057,344 | ---- | M] () -- C:\Windows\SysWow64\issacapi_se-2.3.dll
[2012.09.26 20:57:14 | 000,049,152 | ---- | M] ((주) 마크애니) -- C:\Windows\SysWow64\MaJGUILib.dll
[2012.09.26 20:57:14 | 000,045,320 | ---- | M] (MARKANY) -- C:\Windows\SysWow64\MAMACExtract.dll
[2012.09.26 20:57:14 | 000,045,056 | ---- | M] ((주) 마크애니) -- C:\Windows\SysWow64\MaXMLProto.dll
[2012.09.26 20:57:14 | 000,045,056 | ---- | M] ((주) 마크애니) -- C:\Windows\SysWow64\MACXMLProto.dll
[2012.09.26 20:57:14 | 000,040,960 | ---- | M] (Telechips Inc.,) -- C:\Windows\SysWow64\MTTELECHIP.dll
[2012.09.26 20:57:14 | 000,024,576 | ---- | M] ((주)마크애니) -- C:\Windows\SysWow64\MASetupCleaner.exe
[2012.09.26 20:57:12 | 000,821,824 | ---- | M] (Devguru Co., Ltd.) -- C:\Windows\SysWow64\dgderapi.dll
[2012.09.25 23:47:43 | 000,078,336 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\synceng.dll
[2012.09.25 23:46:17 | 000,095,744 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\synceng.dll
[1 C:\*.tmp files -> C:\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012.11.15 22:32:11 | 000,000,003 | ---- | C] () -- C:\Windows\SysNative\drivers\MsftWdf_Kernel_01011_Inbox_Critical.Wdf
[2012.11.15 22:25:20 | 000,000,003 | ---- | C] () -- C:\Windows\SysNative\drivers\MsftWdf_User_01_11_00_Inbox_Critical.Wdf
[2012.11.04 12:57:10 | 000,001,992 | ---- | C] () -- C:\Users\Public\Desktop\Samsung Kies.lnk
[2012.11.03 18:45:57 | 000,001,013 | ---- | C] () -- C:\Users\Public\Desktop\Icewind Dale Complete.lnk
[2012.11.02 23:14:11 | 011,624,448 | ---- | C] () -- C:\Users\S-System\AppData\Roaming\Sandra.mdb
[2012.11.02 23:13:51 | 000,001,183 | ---- | C] () -- C:\Users\Public\Desktop\SiSoftware Sandra Lite 2012.SP5c.lnk
[2012.11.01 20:11:04 | 000,002,116 | ---- | C] () -- C:\Users\Public\Desktop\HP Officejet 6100.lnk
[2012.11.01 20:11:04 | 000,001,832 | ---- | C] () -- C:\Users\Public\Desktop\HP ePrintCenter - HP Officejet 6100.lnk
[2012.11.01 20:10:08 | 000,000,057 | ---- | C] () -- C:\ProgramData\Ament.ini
[2012.10.27 07:36:12 | 000,000,822 | ---- | C] () -- C:\Users\Public\Desktop\CCleaner.lnk
[2012.10.11 19:39:14 | 000,002,144 | ---- | C] () -- C:\Users\Public\Desktop\Razer Game Booster.lnk
[2012.09.26 20:57:16 | 000,030,568 | ---- | C] () -- C:\Windows\MusiccityDownload.exe
[2012.09.26 20:57:14 | 000,974,848 | ---- | C] () -- C:\Windows\SysWow64\cis-2.4.dll
[2012.09.26 20:57:14 | 000,143,360 | ---- | C] () -- C:\Windows\SysWow64\3DAudio.ax
[2012.09.26 20:57:14 | 000,081,920 | ---- | C] () -- C:\Windows\SysWow64\issacapi_bs-2.3.dll
[2012.09.26 20:57:14 | 000,065,536 | ---- | C] () -- C:\Windows\SysWow64\issacapi_pe-2.3.dll
[2012.09.26 20:57:14 | 000,057,344 | ---- | C] () -- C:\Windows\SysWow64\issacapi_se-2.3.dll
[2012.06.13 09:00:01 | 002,469,760 | ---- | C] () -- C:\Windows\SysWow64\BootMan.exe
[2012.06.13 09:00:01 | 000,019,840 | ---- | C] () -- C:\Windows\SysWow64\EuEpmGdi.dll
[2012.06.13 09:00:00 | 000,086,408 | ---- | C] () -- C:\Windows\SysWow64\setupempdrv03.exe
[2012.06.13 09:00:00 | 000,014,216 | ---- | C] () -- C:\Windows\SysWow64\epmntdrv.sys
[2012.06.13 09:00:00 | 000,008,456 | ---- | C] () -- C:\Windows\SysWow64\EuGdiDrv.sys
[2012.06.06 20:02:47 | 000,000,782 | ---- | C] () -- C:\Windows\wiso.ini
[2012.06.02 11:23:22 | 000,245,227 | ---- | C] () -- C:\Windows\hpoins19.dat
[2012.06.02 11:23:22 | 000,013,898 | ---- | C] () -- C:\Windows\hpomdl19.dat
[2012.05.10 15:35:16 | 000,029,184 | ---- | C] () -- C:\Windows\SysWow64\kdbsdk32.dll
[2012.04.17 18:47:24 | 000,007,597 | ---- | C] () -- C:\Users\S-System\AppData\Local\Resmon.ResmonCfg
[2012.03.23 10:41:03 | 001,589,442 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2012.03.19 10:11:06 | 000,280,856 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrB.exe
[2012.03.19 10:11:04 | 000,076,888 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrA.exe
[2012.03.17 01:26:47 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin
[2012.03.17 00:59:17 | 000,017,408 | ---- | C] () -- C:\Users\S-System\AppData\Local\WebpageIcons.db
[2012.03.16 23:34:39 | 000,148,480 | ---- | C] () -- C:\Windows\SysWow64\APOMngr.DLL
[2012.03.16 23:34:39 | 000,073,728 | ---- | C] () -- C:\Windows\SysWow64\CmdRtr.DLL
[2012.02.15 03:36:36 | 000,204,952 | ---- | C] () -- C:\Windows\SysWow64\ativvsvl.dat
[2012.02.15 03:36:36 | 000,157,144 | ---- | C] () -- C:\Windows\SysWow64\ativvsva.dat
[2011.09.12 23:06:16 | 000,003,917 | ---- | C] () -- C:\Windows\SysWow64\atipblag.dat
 
========== ZeroAccess Check ==========
 
[2009.07.14 05:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll -- [2012.06.09 06:43:10 | 014,172,672 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2012.06.09 05:41:00 | 012,873,728 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.07.14 02:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.20 13:19:02 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 02:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

< End of report >
         
--- --- ---
OTL Logfile:
Code:
ATTFilter
OTL Extras logfile created on: 20.11.2012 18:55:25 - Run 2
OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\S-System\Desktop
64bit- Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
4,00 Gb Total Physical Memory | 2,27 Gb Available Physical Memory | 56,65% Memory free
10,00 Gb Paging File | 7,82 Gb Available in Paging File | 78,23% Paging File free
Paging file location(s): c:\pagefile.sys 6142 12284 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 149,52 Gb Total Space | 68,20 Gb Free Space | 45,61% Space Free | Partition Type: NTFS
Drive D: | 24,41 Gb Total Space | 0,78 Gb Free Space | 3,20% Space Free | Partition Type: NTFS
Drive E: | 465,76 Gb Total Space | 59,94 Gb Free Space | 12,87% Space Free | Partition Type: NTFS
Drive F: | 14,65 Gb Total Space | 9,52 Gb Free Space | 65,00% Space Free | Partition Type: NTFS
Drive G: | 90,98 Gb Total Space | 82,98 Gb Free Space | 91,21% Space Free | Partition Type: NTFS
Drive H: | 414,09 Gb Total Space | 63,52 Gb Free Space | 15,34% Space Free | Partition Type: NTFS
Drive I: | 367,91 Gb Total Space | 236,40 Gb Free Space | 64,25% Space Free | Partition Type: NTFS
 
Computer Name: S-SYSTEM-PC | User Name: S-System | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 60 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Directory [Winamp.Bookmark] -- "C:\Program Files (x86)\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft, Inc.)
Directory [Winamp.Enqueue] -- "C:\Program Files (x86)\Winamp\winamp.exe" /ADD "%1" (Nullsoft, Inc.)
Directory [Winamp.Play] -- "C:\Program Files (x86)\Winamp\winamp.exe" "%1" (Nullsoft, Inc.)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Directory [Winamp.Bookmark] -- "C:\Program Files (x86)\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft, Inc.)
Directory [Winamp.Enqueue] -- "C:\Program Files (x86)\Winamp\winamp.exe" /ADD "%1" (Nullsoft, Inc.)
Directory [Winamp.Play] -- "C:\Program Files (x86)\Winamp\winamp.exe" "%1" (Nullsoft, Inc.)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01  [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0
 
========== Authorized Applications List ==========
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{034C2F04-86F2-4FCF-8292-E6FC6614B993}" = lport=137 | protocol=17 | dir=in | app=system | 
"{11D859D1-5586-49AF-835D-8D8D3129BF40}" = lport=10243 | protocol=6 | dir=in | app=system | 
"{155CB6D4-D973-49DA-ABB9-92F82D0138B9}" = rport=138 | protocol=17 | dir=out | app=system | 
"{1636722E-508B-485B-80CD-68F3A337A37E}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{17FF79BC-1FD8-4491-A43F-8322E37707A6}" = lport=rpc | protocol=6 | dir=in | app=c:\program files\sisoftware\sisoftware sandra lite 2012.sp5c\rpcagentsrv.exe | 
"{24FFF4AE-D2BC-4522-9CB2-25DF360C6BDA}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 | 
"{302D78DA-35D1-4433-A88A-CE181FC0D462}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{3E0E34D8-BCC6-45C1-A1E0-B3A16959CCDB}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{3F70A495-25EE-454C-82B2-F16875560A19}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{493662E2-812B-4421-9B3E-81A3614372B4}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{54B05118-49FE-4B17-8C44-4178856E1EC3}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{5ED48A2D-6BC8-429A-9710-7524E47F559B}" = rport=137 | protocol=17 | dir=out | app=system | 
"{621B09F9-051E-41E2-81D5-4784F42005E2}" = lport=138 | protocol=17 | dir=in | app=system | 
"{6ACBF02E-F4DD-4EC1-B05C-7CEBC1A315E6}" = lport=139 | protocol=6 | dir=in | app=system | 
"{6F89E7E1-D3B4-42BA-B780-1BFB0C4615AE}" = lport=445 | protocol=6 | dir=in | app=system | 
"{8BFA0138-69CF-44E2-83FF-66B8D1A249AE}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{B6D8D3B0-1326-4AB9-8910-6FAEFF26F7DB}" = lport=rpc | protocol=6 | dir=in | app=c:\program files\sisoftware\sisoftware sandra lite 2012.sp5c\wnt500x64\rpcsandrasrv.exe | 
"{BDDDF2CF-4848-489A-900A-85F68702FDAB}" = rport=10243 | protocol=6 | dir=out | app=system | 
"{C10D7C4D-CB7B-4D2D-8287-852DC20A205B}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{C5AC6D91-C542-4655-AAC3-937856D32611}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{D19633C7-4482-41D6-A468-05F57DCD630F}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{D363F5F7-B6F7-441B-AF7C-A4849C28B0E4}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{D5C2C494-C8DD-432E-A811-96BD61BD1850}" = rport=445 | protocol=6 | dir=out | app=system | 
"{FD3534C5-1461-47DE-898C-221FD6E1E291}" = rport=139 | protocol=6 | dir=out | app=system | 
"{FE4C6F93-6767-4041-B9F4-9993270A7D9C}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | 
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0239C405-83D1-470F-9F55-2B12A410548C}" = protocol=6 | dir=in | app=h:\program files (x86)\steam\steamapps\common\xcom-enemy-unknown\binaries\win32\xcomgame.exe | 
"{0772C4EF-08FE-40E8-BE4E-65354565C0DB}" = protocol=17 | dir=in | app=h:\program files (x86)\steam\steamapps\common\command and conquer 4 tiberian twilight\support\ea help\electronic_arts_technical_support.htm | 
"{0AA89188-5D55-42C9-B5F9-09B9B06E9269}" = protocol=6 | dir=in | app=h:\program files (x86)\steam\steamapps\common\skyrim\skyrimlauncher.exe | 
"{0CCDF762-582D-475C-AEAC-2DE7C613BF18}" = protocol=6 | dir=in | app=h:\program files (x86)\steam\steamapps\common\red orchestra 2\binaries\win32\rogame.exe | 
"{0CD6AD9D-258E-4348-A061-72BDEC58BB1F}" = protocol=6 | dir=in | app=h:\program files (x86)\steam\steamapps\common\cities xl 2012\citiesxl_2012.exe | 
"{0DBC5C16-4F95-49EE-8244-4CF715625FA3}" = protocol=17 | dir=in | app=h:\program files (x86)\steam\steamapps\common\alien breed 2 assault\binaries\alienbreed2assault.exe | 
"{128B5A73-7D16-4F52-AD15-F1EC8CD169B2}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{15AD9656-EDEA-4DBB-B67B-20DA73543AC1}" = protocol=17 | dir=in | app=h:\program files (x86)\steam\steamapps\common\dota 2 beta\dota.exe | 
"{168F1C2F-36EE-4C1E-95DB-D3B2FE4A6020}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hpqkygrp.exe | 
"{189ECC3E-6B3F-4738-A9D3-18907908EC87}" = protocol=17 | dir=in | app=h:\program files (x86)\steam\steamapps\common\x3 terran conflict\x3tc.exe | 
"{18A499C7-6D72-43AA-973A-43E8D52BDF8A}" = protocol=17 | dir=in | app=h:\program files (x86)\steam\steamapps\common\alien swarm\srcds.exe | 
"{190AA9A7-95B0-4897-9AF2-615C0B2091CE}" = protocol=17 | dir=in | app=h:\program files (x86)\steam\steamapps\common\mass effect\binaries\masseffect.exe | 
"{1B9D6AC9-FC69-4490-B378-AF62F9571A13}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 | 
"{1D85C25C-087E-4D47-A308-7411B63622C1}" = protocol=17 | dir=in | app=h:\program files (x86)\steam\steamapps\common\endless space\endlessspace.exe | 
"{1E1A2D8A-AC5D-4BB5-B4FB-F63C84F35B15}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hpqpse.exe | 
"{1F762FA5-DBA9-4EE2-9522-23FE86150026}" = protocol=6 | dir=in | app=h:\program files (x86)\steam\steamapps\common\sid meier's civilization v\launcher.exe | 
"{20BBB6F4-988C-4D6B-B072-BA23D699DD80}" = protocol=17 | dir=in | app=h:\program files (x86)\steam\steamapps\common\dawn of war 2\dow2.exe | 
"{228A9560-934A-4853-9205-3F72CF3AE06E}" = protocol=6 | dir=in | app=h:\program files (x86)\steam\steamapps\common\il-2 sturmovik cliffs of dover\launcher.exe | 
"{22A20DD2-5E72-4535-87A5-D63C7046E196}" = protocol=17 | dir=in | app=h:\program files (x86)\steam\steamapps\common\il-2 sturmovik cliffs of dover\launcher.exe | 
"{22C82CD0-621B-4A45-86BC-9E3840A9FF82}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 | 
"{22CC0A9C-B8C1-4F0A-9028-AE7481C7E1A2}" = protocol=6 | dir=in | app=h:\program files (x86)\steam\steamapps\common\stronghold3\bin\win32_release\mapeditor.exe | 
"{255B16B7-9E4B-4E67-B78D-6A91BC7B09BD}" = protocol=6 | dir=in | app=h:\program files (x86)\steam\steamapps\common\magicka\magicka.exe | 
"{26AEAA5C-3B88-40C9-9B68-D12E5D4D8F78}" = protocol=6 | dir=in | app=h:\program files (x86)\steam\steamapps\common\endless space\endlessspace.exe | 
"{29B5D7D0-3283-47EB-9492-5B12ECE7E355}" = protocol=6 | dir=in | app=h:\program files (x86)\steam\steamapps\common\mass effect\docs\ea help\electronic_arts_technical_support.htm | 
"{29DCF9FD-BCC0-4EAA-A8CA-098A577D04B2}" = protocol=17 | dir=in | app=h:\program files (x86)\steam\steam.exe | 
"{2BCD7443-AAD3-41A7-A92D-8A60B2B9D8B2}" = protocol=6 | dir=in | app=c:\windows\syswow64\pnkbstrb.exe | 
"{2BD69A9A-003E-4033-85CF-BD3C73E5E512}" = protocol=6 | dir=in | app=h:\program files (x86)\steam\steamapps\common\x3 terran conflict\x3tc.exe | 
"{2CF354BD-7526-4337-86DE-27F4FDF33E22}" = protocol=17 | dir=in | app=h:\program files (x86)\steam\steamapps\common\alien breed 3 descent\binaries\alienbreed3descent.exe | 
"{2E438164-0B21-49EA-A9A5-CDC493C097C2}" = dir=in | app=c:\program files\hp\hp officejet 6100\bin\devicesetup.exe | 
"{2EB25A22-27DB-4CA5-A56C-7384ED7FF46C}" = protocol=6 | dir=in | app=h:\program files (x86)\steam\steamapps\common\dawn of war ii - retribution\dow2.exe | 
"{3249885F-C38D-4032-9AB3-00EFC32053C7}" = protocol=6 | dir=in | app=h:\program files (x86)\steam\steamapps\common\alien swarm\srcds.exe | 
"{3338F499-823D-4394-A6AD-01505BDED11F}" = protocol=17 | dir=in | app=h:\program files (x86)\steam\steamapps\common\from dust\from_dust.exe | 
"{35DF79A1-B2CD-4C0D-AF03-703526F78A0D}" = protocol=17 | dir=in | app=h:\games\star wars-the old republic\launcher.exe | 
"{360887F1-BBEA-4E23-A27E-490D2A47D09F}" = protocol=17 | dir=in | app=c:\program files (x86)\autodesk\backburner\manager.exe | 
"{3B1C2D1F-DCB3-4C94-873F-3F6EDA636BA5}" = protocol=17 | dir=in | app=h:\program files (x86)\steam\steamapps\common\napoleon total war\napoleon.exe | 
"{3D01C839-C469-4B4F-9B3F-5A649E8CFCB5}" = dir=in | app=c:\program files (x86)\common files\hp\digital imaging\bin\hpqphotocrm.exe | 
"{3F5B9BEA-7366-4535-9EE1-A800E054295E}" = protocol=6 | dir=in | app=c:\program files (x86)\autodesk\backburner\server.exe | 
"{3FADC0E7-F1A8-4A57-9D25-B69E62E2BC4E}" = protocol=6 | dir=in | app=c:\users\s-system\appdata\local\temp\7zs3956\hpdiagnosticcoreui.exe | 
"{4078289B-A90E-48E8-BF21-5D64580BA178}" = protocol=6 | dir=in | app=h:\program files (x86)\steam\steamapps\common\command and conquer 4 tiberian twilight\support\ea help\electronic_arts_technical_support.htm | 
"{4342DD29-B7F5-4141-9FD1-A9B0D00F6530}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe | 
"{46B84E4B-16E8-4FD6-A865-C24BBD551CD3}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe | 
"{47EDFD72-EF6F-4AC4-9D54-9DB72C3C5801}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{49B10D0B-345B-4BDF-9DC6-FA473F46FB6A}" = protocol=6 | dir=in | app=h:\program files (x86)\steam\steamapps\common\mountblade warband\mb_warband.exe | 
"{4A30763F-3A29-4FDC-A2BF-BA23F33C4E54}" = protocol=17 | dir=in | app=h:\program files (x86)\icq7m\icq.exe | 
"{4AC7C645-02A7-481E-8C98-F5100D8442AA}" = protocol=17 | dir=in | app=c:\program files\autodesk\3ds max 2012\mentalimages\satellite\raysat_3dsmax2012_64server.exe | 
"{4B8BF1F4-EF56-4BB7-B3FC-8DBB91ABF8D6}" = protocol=6 | dir=in | app=c:\windows\syswow64\muzapp.exe | 
"{4BC6782E-D438-40EB-B435-26ED2356DB1A}" = protocol=17 | dir=in | app=c:\program files (x86)\autodesk\backburner\server.exe | 
"{4C65D34B-2599-461F-B386-FA40D0012CC6}" = protocol=17 | dir=in | app=h:\program files (x86)\steam\steamapps\common\mass effect\docs\ea help\electronic_arts_technical_support.htm | 
"{4D0D9076-0B78-417D-B632-A288B4B206FC}" = protocol=6 | dir=in | app=h:\program files (x86)\icq7m\icq.exe | 
"{4D782717-7EF2-4E46-846F-ACA739FFCD6F}" = protocol=6 | dir=in | app=h:\program files (x86)\steam\steamapps\common\from dust\from_dust.exe | 
"{5035BAC8-2BFD-4A75-B2C2-9CFC1EF073D4}" = protocol=1 | dir=in | name=sisoftware sandra agent service (icmp-in) | 
"{54466E6E-A0EE-403C-9C19-15B696C67805}" = protocol=6 | dir=in | app=h:\games\star wars-the old republic\launcher.exe | 
"{5519F756-14C2-4BA0-988A-1BFCDFB7DB11}" = protocol=17 | dir=in | app=h:\program files (x86)\steam\steamapps\common\portal 2\portal2.exe | 
"{561356BB-8D8D-44AB-AA0C-31FFCD3F5123}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{56137BAB-CBA0-4CF9-B373-CC3C88D84969}" = protocol=17 | dir=in | app=h:\program files (x86)\steam\steamapps\common\sid meier's civilization v sdk\sid meier's civilization v sdk.exe | 
"{58AC2894-DAE7-489E-A05D-3F951997343D}" = protocol=17 | dir=in | app=c:\users\s-system\appdata\local\temp\7zs3ad1\hpdiagnosticcoreui.exe | 
"{5BA9219B-A3E2-40E4-9998-887E61330311}" = protocol=17 | dir=in | app=h:\program files (x86)\steam\steamapps\common\sid meier's pirates!\pirates!.exe | 
"{5C004F81-7761-4059-9741-84EE8897A975}" = protocol=17 | dir=in | app=c:\windows\syswow64\pnkbstrb.exe | 
"{5DC8DAF7-715F-4584-847A-D290689F2302}" = protocol=6 | dir=in | app=h:\program files (x86)\steam\steamapps\common\x3 terran conflict\x3ap.exe | 
"{5FD2968D-12DC-4613-A2E1-6CA2A4734077}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hpqgpc01.exe | 
"{620F8496-27BD-4783-985A-847651319B03}" = protocol=17 | dir=in | app=h:\program files (x86)\steam\steamapps\common\red orchestra 2\binaries\win32\rogame.exe | 
"{62CAA28E-4FFA-47B8-9FCC-0C04E6738CD6}" = protocol=17 | dir=in | app=h:\program files (x86)\steam\steamapps\common\dota 2 test\dota.exe | 
"{65585809-0630-4EA3-843B-D7BB2CBDAEBB}" = protocol=17 | dir=in | app=h:\program files (x86)\steam\steamapps\common\nuclear dawn\ndsrv.exe | 
"{672825F8-1FC1-4C5F-8FB4-3354DAB9F145}" = protocol=6 | dir=in | app=c:\program files (x86)\ubisoft\ubisoft game launcher\ubisoftgamelauncher.exe | 
"{683AF175-5764-472D-BF85-D9E4E8EA6C58}" = protocol=6 | dir=in | app=c:\windows\syswow64\pnkbstra.exe | 
"{6B1E661D-3402-42D6-B657-3C9CE6F20FC8}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hposid01.exe | 
"{6B9B2F0C-E01B-446E-9505-D15E9624696F}" = protocol=17 | dir=in | app=h:\program files (x86)\steam\steamapps\common\sword of the stars ii\bin\x86\sots2.exe | 
"{6D7FEAEC-EAF9-4806-B67D-37AC2896BE8A}" = protocol=6 | dir=in | app=c:\program files\autodesk\3ds max 2012\mentalimages\satellite\raysat_3dsmax2012_64server.exe | 
"{6FD835C0-5DFA-4144-8399-EA804823E5C3}" = protocol=6 | dir=in | app=h:\program files (x86)\stardock games\fallenenchantress\fallenenchantress.exe | 
"{72558B36-7463-4578-AEB3-1B41D008BF34}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hpoews01.exe | 
"{75D46335-DFCF-472B-85A8-4AD24CAFB4FF}" = protocol=17 | dir=in | app=c:\program files (x86)\ubisoft\ubisoft game launcher\ubisoftgamelauncher.exe | 
"{77234755-172C-42CF-A12F-02166B7DAA86}" = protocol=6 | dir=in | app=h:\program files (x86)\steam\steamapps\common\dawn of war 2\dow2.exe | 
"{77BAD646-14CB-4EE6-B9EE-7EB4FD1E7490}" = protocol=6 | dir=in | app=h:\program files (x86)\steam\steamapps\common\sword of the stars ii\bin\x86\sots2.exe | 
"{7936043B-A226-4740-9319-1A860E98F798}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 | 
"{7F7D67A4-220F-4C84-8EAC-D98106A1D206}" = protocol=1 | dir=in | name=sisoftware deployment agent service (icmp-in) | 
"{80B5E7CD-8A1C-411F-B12C-5030AADBD61A}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hpofxs08.exe | 
"{824FAC24-F1C1-4EED-9B05-05EED22D2677}" = protocol=6 | dir=in | app=h:\program files (x86)\2k games\firaxis games\sid meier's civilization iv colonization\colonization.exe | 
"{828F2E82-4AA9-4E1E-9B57-DE2078D0A5EB}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hpzwiz01.exe | 
"{8548C8FC-DEED-4959-8ECE-E646B37BED8D}" = protocol=6 | dir=in | app=h:\program files (x86)\steam\steamapps\common\stronghold3\bin\win32_release\stronghold3.exe | 
"{86022E2F-D105-43D0-97C5-011F28AA1B93}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 | 
"{86ADD4F2-3FB1-4B4E-8026-31787C3E272C}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hpofxm08.exe | 
"{884F1CA2-B71E-4D8D-82B5-35032F6337EF}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hpqfxt08.exe | 
"{88FDC3DA-C2B4-4FCC-9185-AC17F57547B3}" = protocol=17 | dir=in | app=h:\program files (x86)\steam\steamapps\common\skyrim\skyrimlauncher.exe | 
"{8BD5A0C7-3748-4B27-9942-7747C67E43CD}" = protocol=6 | dir=out | app=system | 
"{8D4F94F1-10B2-4012-84AC-DCBCA7C9061B}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hpqnrs08.exe | 
"{8D6ACE0E-847D-4CAD-B14F-44F0A56D56A8}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hpqste08.exe | 
"{90F46F38-F082-4EA4-B8B9-ABB7383B5A3C}" = protocol=17 | dir=in | app=h:\program files (x86)\icq7m\icq.exe | 
"{93D0F1DB-2198-4B0F-884F-B6AFA19A4D33}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hpfccopy.exe | 
"{99C1862E-8EAF-467F-89CA-2484F59DA096}" = protocol=17 | dir=in | app=h:\program files (x86)\steam\steamapps\common\legend of grimrock\grimrock.exe | 
"{9B59BB5E-6CA6-4F94-B5DC-A881E3C1A663}" = protocol=17 | dir=in | app=h:\program files (x86)\steam\steamapps\common\stronghold3\bin\win32_release\mapeditor.exe | 
"{9DDD2D39-6991-414F-8BD4-BAC668FEA05F}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{9F835657-7F78-43A6-A058-123A2E6EB866}" = protocol=17 | dir=in | app=h:\program files (x86)\steam\steamapps\common\dawn of war ii - retribution\dow2.exe | 
"{9F85DB73-960F-4F45-A548-089D421FC8AA}" = protocol=17 | dir=in | app=h:\program files (x86)\steam\steamapps\common\cities xl 2012\citiesxl_2012.exe | 
"{A13ED1ED-4AB5-4315-82ED-8E7F9AE513EE}" = protocol=6 | dir=in | app=h:\games\star wars-the old republic\launcher.exe | 
"{A2B1D416-B5DF-4F66-9DD9-C10AE1E22460}" = protocol=17 | dir=in | app=h:\program files (x86)\steam\steamapps\common\mountblade warband\mb_warband.exe | 
"{A4866F75-C576-4971-9387-E34CDC3A3845}" = protocol=17 | dir=in | app=h:\program files (x86)\2k games\firaxis games\sid meier's civilization iv colonization\colonization.exe | 
"{A5287859-2D85-4AD0-AA4F-91DCE822014B}" = protocol=6 | dir=in | app=h:\program files (x86)\steam\steamapps\common\napoleon total war\napoleon.exe | 
"{A6737C24-0995-4A84-9B8A-E3A2850721FB}" = protocol=17 | dir=in | app=h:\program files (x86)\steam\steamapps\common\company of heroes\reliccoh.exe | 
"{A7E4BC29-55A5-464A-94D9-6ACD40C074CB}" = protocol=6 | dir=in | app=h:\program files (x86)\steam\steamapps\common\nuclear dawn\nucleardawn.exe | 
"{AA54E0F9-0E6D-441F-879C-1F7A68605093}" = protocol=17 | dir=in | app=c:\program files\autodesk\3ds max 2012\mentalimages\satellite\raysat_3dsmax2012_64.exe | 
"{AD78974C-2A5D-4DD4-9705-C531BD1BD1CB}" = protocol=17 | dir=in | app=h:\program files (x86)\steam\steamapps\common\sid meier's civilization v\launcher.exe | 
"{AE7ED559-5102-48F4-B8FA-1782F7B5CF7C}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{B0EC9CC4-804E-4B8C-9D52-9016E451E337}" = protocol=6 | dir=in | app=h:\program files (x86)\steam\steamapps\common\portal 2\portal2.exe | 
"{B361D81B-303D-4939-B61D-B6B32AC9E8EE}" = protocol=6 | dir=in | app=c:\program files (x86)\autodesk\backburner\manager.exe | 
"{B38301EB-E6AB-4305-9807-4C877EB839D0}" = protocol=17 | dir=in | app=c:\program files (x86)\autodesk\backburner\monitor.exe | 
"{B523A6A4-DF20-434C-AF3D-D479360D4077}" = protocol=17 | dir=in | app=c:\users\s-system\appdata\local\temp\7zs3a5e\hpdiagnosticcoreui.exe | 
"{B627D9C8-875D-4572-AC2B-211718005DCD}" = protocol=6 | dir=in | app=h:\program files (x86)\steam\steamapps\common\alien breed 2 assault\binaries\alienbreed2assault.exe | 
"{B65F233A-059C-4E42-9B3F-3BBF7474A504}" = protocol=17 | dir=in | app=h:\program files (x86)\steam\steamapps\common\stronghold3\bin\win32_release\stronghold3.exe | 
"{B78973AD-53F2-49DF-ADF5-5C5F4C826941}" = protocol=6 | dir=in | app=h:\program files (x86)\steam\steam.exe | 
"{B7E7972B-B507-49A9-B04D-489A9A6CFEBB}" = dir=in | app=c:\program files (x86)\hp\digital imaging\smart web printing\smartwebprintexe.exe | 
"{B8033E1B-C158-40B3-B395-887271B0EA36}" = protocol=6 | dir=in | app=h:\program files (x86)\steam\steamapps\common\nuclear dawn\ndsrv.exe | 
"{B8768082-DFC9-4625-97D4-0D8F30297089}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hpqsudi.exe | 
"{BA534E6F-C836-4BFC-A20F-806DEC284AF3}" = protocol=17 | dir=in | app=h:\program files (x86)\steam\steamapps\common\command and conquer 4 tiberian twilight\cnc4.exe | 
"{BB683D34-294D-4EFA-BDB2-6F02A1A8E927}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 
"{BCBC29FD-ECBD-4CF0-8104-1A5321C84DBC}" = protocol=17 | dir=in | app=c:\windows\syswow64\pnkbstra.exe | 
"{BD214E28-8425-429A-8FD8-6D911BD197FD}" = protocol=6 | dir=in | app=h:\program files (x86)\steam\steamapps\common\company of heroes\reliccoh.exe | 
"{BE2C8D6A-5888-44F7-A750-5B04B082888E}" = protocol=6 | dir=in | app=h:\program files (x86)\steam\steamapps\common\legend of grimrock\grimrock.exe | 
"{BE372EC4-A8C7-416A-A1BE-C32FF01DD2EB}" = protocol=6 | dir=in | app=c:\users\s-system\appdata\local\temp\7zs3a5e\hpdiagnosticcoreui.exe | 
"{C05FE92B-C14B-4998-B6F9-02560ABE916A}" = protocol=6 | dir=in | app=h:\program files (x86)\steam\steamapps\common\alien breed 3 descent\binaries\alienbreed3descent.exe | 
"{C31AAABA-FFF0-4B41-A096-5C8122704C45}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{C6473E35-BA8A-48A4-A5BD-548ECEA45B26}" = protocol=17 | dir=in | app=h:\program files (x86)\steam\steamapps\common\xcom-enemy-unknown\binaries\win32\xcomgame.exe | 
"{C6E506CF-3548-4328-98E8-BD61E3AE0A83}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hpqcopy2.exe | 
"{C8A708BE-D0C3-4FDD-AEDE-835DF6E1F85C}" = dir=in | app=c:\program files\hp\hp officejet 6100\bin\hpnetworkcommunicator.exe | 
"{CA182C26-5ACA-4FD1-9CDE-AEB1AF563059}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hpqusgm.exe | 
"{CBC296EC-4DFA-4010-8A3E-FEF5163A603F}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hpqtra08.exe | 
"{CE02CB46-7D3E-46EA-9BE7-A28D3D9A8348}" = protocol=6 | dir=in | app=c:\users\s-system\appdata\local\temp\7zs3ad1\hpdiagnosticcoreui.exe | 
"{CE698BC6-DC49-4C60-8350-34D8142C50CE}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{CFD4755C-CDE3-4FAE-9B2C-36146F41F41F}" = protocol=17 | dir=in | app=c:\windows\syswow64\muzapp.exe | 
"{D17BAC18-E20C-4972-86DE-90196E33F5D6}" = protocol=6 | dir=in | app=h:\program files (x86)\steam\steamapps\common\command and conquer 4 tiberian twilight\cnc4.exe | 
"{D456302C-6C9B-48C0-BED4-CED94668A1DF}" = protocol=17 | dir=in | app=c:\program files\autodesk\3ds max 2012\3dsmax.exe | 
"{D676F901-11FB-4895-8249-120182B20052}" = protocol=17 | dir=in | app=h:\program files (x86)\steam\steamapps\common\magicka\magicka.exe | 
"{D719ECD5-A7E8-4680-BBB9-E6A4CA11696D}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hposfx08.exe | 
"{D9FCF23C-0852-4735-93A0-49B5B94CB3D8}" = protocol=17 | dir=in | app=h:\program files (x86)\steam\steamapps\common\x3 terran conflict\x3ap.exe | 
"{DA598122-4C12-49D4-8BCF-14AD0AF0428F}" = protocol=17 | dir=in | app=h:\games\star wars-the old republic\launcher.exe | 
"{DC6693A7-B1E8-4646-B832-2AF0DF7287C0}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hpqgplgtupl.exe | 
"{DD93B9E5-7F1F-4EB2-BCE6-9107B8B7B5B1}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hpqpsapp.exe | 
"{DD9E6374-48C1-45B1-8BD1-4EB18CB31863}" = protocol=17 | dir=in | app=h:\program files (x86)\stardock games\fallenenchantress\fallenenchantress.exe | 
"{DE49438B-B853-4276-8DC1-E5E542771EEA}" = protocol=6 | dir=in | app=c:\program files\autodesk\3ds max 2012\3dsmax.exe | 
"{DF8AC190-1B86-4580-A186-6D7D4E9CA863}" = protocol=6 | dir=in | app=h:\program files (x86)\steam\steamapps\common\mass effect\binaries\masseffect.exe | 
"{E0092BA6-84E0-47B3-B46A-898EEFB3F49D}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe | 
"{E0BCA89D-F821-40D0-826F-613B7D6A075E}" = protocol=6 | dir=in | app=h:\program files (x86)\steam\steamapps\common\dota 2 test\dota.exe | 
"{E4A04840-69C0-451C-8221-DF8A8EA82A00}" = protocol=17 | dir=in | app=h:\program files (x86)\steam\steamapps\common\nuclear dawn\nucleardawn.exe | 
"{E54A6116-190F-4CFB-AA93-BEE8B36A2F84}" = protocol=17 | dir=in | app=c:\users\s-system\appdata\local\temp\7zs3956\hpdiagnosticcoreui.exe | 
"{E832D4A1-833D-4B2E-97DA-D2709F6BA0EF}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 
"{E891EB4E-9BC4-44DB-84EE-30DA773E560D}" = protocol=6 | dir=in | app=h:\program files (x86)\steam\steamapps\common\sid meier's pirates!\pirates!.exe | 
"{EAFEE016-9767-4775-A5AC-8BCFBDA120B9}" = protocol=6 | dir=in | app=h:\program files (x86)\icq7m\icq.exe | 
"{EE5BDF8E-AAAD-46D2-89BC-C4E6CA6AFC5A}" = protocol=6 | dir=in | app=h:\program files (x86)\steam\steamapps\common\sid meier's civilization v sdk\sid meier's civilization v sdk.exe | 
"{EEB859C9-2EBA-45EA-AC96-95D409D593F7}" = protocol=6 | dir=in | app=c:\program files\autodesk\3ds max 2012\mentalimages\satellite\raysat_3dsmax2012_64.exe | 
"{F29A97A4-8ED7-4EBA-8F25-FD8B7252422E}" = protocol=6 | dir=in | app=h:\program files (x86)\steam\steamapps\common\dota 2 beta\dota.exe | 
"{F35B854A-4AEE-4BF7-A9B9-5D9C8A75A99B}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{F42D42DF-97EE-4483-B533-9B3E58E8FAFF}" = dir=in | app=c:\program files (x86)\hp\hp software update\hpwucli.exe | 
"{F4B4EAE1-E6F5-4E8D-BB6F-5355E244E9B5}" = protocol=6 | dir=in | app=c:\program files (x86)\autodesk\backburner\monitor.exe | 
"{FCD33357-9EB1-45C2-85FC-DC97CE69A3D4}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hpqusgh.exe | 
"{FD463330-E450-4444-9DBB-733FA6D07434}" = dir=in | app=c:\program files (x86)\hp\digital imaging\bin\hpiscnapp.exe | 
"{FF813FA1-05D4-4C96-8DC4-C3A931D8E7AF}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{05EFBF37-0E52-4579-875C-7EEF0DFB4FCB}" = Network64
"{0E3DAF3D-FF69-345A-A99E-1FED304CA083}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{12D93D02-3C15-DF08-581F-52E4A1EB0A3D}" = AMD Drag and Drop Transcoding
"{1D8E6291-B0D5-35EC-8441-6616F567A0F7}" = Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219
"{44B4F244-5B4D-856E-B3A6-E8DDBDC7F127}" = AMD Fuel
"{47F9B7C3-F172-940F-D0C4-203C7914E5D2}" = AMD Catalyst Install Manager
"{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148
"{503F672D-6C84-448A-8F8F-4BC35AC83441}" = AMD APP SDK Runtime
"{55D55008-E5F6-47D6-B16F-B2A40D4D145F}" = 64 Bit HP CIO Components Installer
"{59B69525-1383-C84A-38EF-F442B63E69BC}" = AMD Media Foundation Decoders
"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
"{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{723C8298-C7B0-0407-A1B6-C3BA6F3FFAB1}" = Autodesk 3ds Max 2012 64-bit - German
"{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
"{838AF9AD-DE38-17FB-57F6-ADDF929F191E}" = AMD Accelerated Video Transcoding
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8E34682C-8118-31F1-BC4C-98CD9675E1C2}" = Microsoft .NET Framework 4 Extended
"{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{B61ED343-0B14-4241-999C-490CB1A20DA4}" = HP Photosmart Officejet and Deskjet All-In-One Driver Software 13.0 Rel. B
"{C3113E55-7BCB-4de3-8EBF-60E6CE6B2396}_is1" = SiSoftware Sandra Lite 2012.SP5c
"{C8388DCB-6F85-C11F-C9F4-D636960E60F5}" = ccc-utility64
"{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}" = SAMSUNG USB Driver for Mobile Phones
"{E30BC112-507C-4980-A00B-13C5CC9EDB03}" = HP Officejet 6100 - Grundlegende Software für das Gerät
"{EA234BC3-39FE-4734-B72F-076086889F6D}" = Composite 2012 64-bit
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"6af12c54-643b-4752-87d0-8335503010de_is1" = Nexus Mod Manager
"Autodesk 3ds Max 2012 64-bit - German" = Autodesk 3ds Max 2012 64-bit - German
"Autodesk FBX Plug-in 2012.0 - 3ds Max 2012 64-bit" = Autodesk FBX Plug-in 2012.0 - 3ds Max 2012 64-bit
"CCleaner" = CCleaner
"HP Imaging Device Functions" = HP Imaging Device Functions 13.0
"HP Photosmart Essential" = HP Photosmart Essential 3.5
"HP Smart Web Printing" = HP Smart Web Printing 4.51
"HP Solution Center & Imaging Support Tools" = HP Solution Center 13.0
"HPExtendedCapabilities" = HP Customer Participation Program 13.0
"HPOCR" = OCR Software by I.R.I.S. 13.0
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"Shop for HP Supplies" = Shop for HP Supplies
"TeamSpeak 3 Client" = TeamSpeak 3 Client
"WinRAR archiver" = WinRAR 4.11 (64-Bit)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}" = PDFCreator
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{079A4EB2-9A74-7B86-12C2-00B52E395801}" = CCC Help Danish
"{08D2E121-7F6A-43EB-97FD-629B44903403}" = Microsoft_VC90_CRT_x86
"{0CC1DAFB-40C8-4903-953D-471E541477C7}" = WISO Steuer-Sparbuch 2012
"{0EF5BEA9-B9D3-46d7-8958-FB69A0BAEACC}" = Status
"{0F367CA3-3B2F-43F9-A44A-25A8EE69E45D}" = Scan
"{104066F4-5897-4067-85D3-4C88B67CCF75}" = AIO_Scan
"{112DDD07-E419-2498-1E9E-2157F82AF5AA}" = CCC Help Turkish
"{12A00DC2-1226-D9F2-13DA-F974111D439E}" = AMD VISION Engine Control Center
"{175F0111-2968-4935-8F70-33108C6A4DE3}" = MarketResearch
"{1EC71BFB-01A3-4239-B6AF-B1AE656B15C0}" = TrayApp
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{224828D6-DCA7-FDF3-3B85-085298AEC919}" = Catalyst Control Center InstallProxy
"{2993B157-97AE-7981-F29A-E6575F991CDB}" = CCC Help Swedish
"{2EEA7AA4-C203-4b90-A34F-19FB7EF1C81C}" = BufferChm
"{2FF8C687-DB7D-4adc-A5DC-57983EC25046}" = DeviceDiscovery
"{347966F8-E71A-E1A5-95E4-3A1C215383F6}" = CCC Help Chinese Traditional
"{3B11D799-48E0-48ED-BFD7-EA655676D8BB}" = Star Wars: The Old Republic
"{3B3D81AB-51E2-695F-7E57-1CC30049F2A3}" = CCC Help French
"{3C92B2E6-380D-4fef-B4DF-4A3B4B669771}" = Copy
"{3D347E6D-5A03-4342-B5BA-6A771885F379}" = Autodesk Backburner 2012.0.0
"{43CDF946-F5D9-4292-B006-BA0D92013021}" = WebReg
"{440B915A-0C85-45DB-92AE-75AE14704A64}" = Fax
"{45E557D6-2271-4F13-8101-C620B4285AB0}" = Kaspersky Internet Security 2012
"{462C2036-3055-4369-D30B-8DA032331EAB}" = CCC Help Greek
"{4A70EF07-7F88-4434-BB61-D1DE8AE93DD4}" = SolutionCenter
"{4B407A54-6CF2-42B5-B419-E900B2E36972}" = 1500
"{4E7C28C7-D5DA-4E9F-A1CA-60490B54AE35}" = UnloadSupport
"{4F5B0DA7-1696-472A-BC59-305A81C23AE5}" = WebTV
"{51054867-140B-8FBF-73A8-75386276BD98}" = CCC Help Spanish
"{586A5957-F21B-C8AD-F5C2-11D4D7DA5340}" = CCC Help German
"{633414E3-AA2A-CD04-5976-E91F5F871396}" = CCC Help Japanese
"{63FF21C9-A810-464F-B60A-3111747B1A6D}" = GPBaseService2
"{65420DC9-306E-4371-905F-F4DC3B418E52}" = Autodesk Material Library Base Resolution Image Library 2012
"{681B698F-C997-42C3-B184-B489C6CA24C9}" = HPPhotoSmartDiscLabelContent1
"{6B2FFB21-AC88-45C3-9A7D-4BB3E744EC91}" = HPSSupply
"{6BBA26E9-AB03-4FE7-831A-3535584CA002}" = Toolbox
"{7059BDA7-E1DB-442C-B7A1-6144596720A4}" = HP Update
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{73750E8F-0277-4EF7-AD90-7723B5C0A8B8}" = Elemental: Fallen Enchantress
"{758C8301-2696-4855-AF45-534B1200980A}" = Samsung Kies
"{781B39EC-2E18-41FC-9B00-B84E4FFCA85F}" = ICQ7M
"{812FF572-F216-EBA0-123E-636C1B6EBC5B}" = CCC Help Korean
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{85BB7CA7-6B0D-0B27-F4FF-B3D04282B3D1}" = CCC Help Russian
"{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek Ethernet Controller Driver
"{883CCFC7-CA6B-5531-704B-F9A64546B309}" = CCC Help Thai
"{888F1505-C2B3-4FDE-835D-36353EBD4754}" = Ubisoft Game Launcher
"{88F0F4FF-B514-4E32-9C17-CAF96D60EAFC}" = Razer Game Booster
"{8BDD3EC9-27E9-E490-7607-AF97FA678046}" = CCC Help Italian
"{8EA79DBF-D637-448A-89D6-410A087A4493}" = Samsung_MonSetup
"{8F0837C2-EE09-4903-88F3-1976FE7FFF4E}" = Autodesk Material Library 2012
"{92D58719-BBC1-4CC3-A08B-56C9E884CC2C}" = Microsoft_VC80_CRT_x86
"{94240445-6D61-4985-B240-9027DCA7193E}_is1" = Men of War: Red Tide (Remove Only)
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9B362566-EC1B-4700-BB9C-EC661BDE2175}" = DocProc
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9DA5221E-15DE-5B0F-D7BE-CCC7305575DD}" = CCC Help Dutch
"{9F6B13E2-B93F-4203-9BD4-5DC18C9F9DEB}" = AIO_CDB_Software
"{A1400F57-65CC-0C22-6461-948EA2837670}" = CCC Help Hungarian
"{A2101ACC-DC36-42AA-A576-6FD6A8D466DA}" = 1500_Help
"{A30269D0-4F0B-44BB-A169-C665CA856EEC}}_is1" = Crusader Kings II version 1.07b
"{A4C6B32D-5088-40AF-B74D-CDABEF144F04}" = 1500Trb
"{A561BB5F-5A85-5D88-E520-0A4512D5E6C0}" = CCC Help Norwegian
"{A8B72907-B3F5-4C18-2D2B-F5E786A520DF}" = CCC Help Polish
"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.4) - Deutsch
"{AD219F94-16F2-937F-076A-F22DAA8D0A0B}" = CCC Help Finnish
"{B2B5B39B-4E8C-AC78-7FF1-7055C338D243}" = Catalyst Control Center Graphics Previews Common
"{B5751715-EC10-43D9-8C95-62E1368433EF}" = Autodesk Material Library Medium Resolution Image Library 2012
"{B9135AC5-0FA4-4565-9768-61BF6C79CD29}" = WebTV
"{BD7204BA-DD64-499E-9B55-6A282CDF4FA4}" = Destinations
"{BEEFC4F8-2909-48B3-AFAA-55D3533FDEDD}" = Creative MediaSource 5
"{C43326F5-F135-4551-8270-7F7ABA0462E1}" = HPProductAssistant
"{CA328CDF-A284-445E-AAE7-B24A11E97201}" = MechWarrior Online
"{CAE4213F-F797-439D-BD9E-79B71D115BE3}" = HPPhotoGadget
"{D79113E7-274C-470B-BD46-01B10219DF6A}" = HPPhotosmartEssential
"{DC635845-46D3-404B-BCB1-FC4A91091AFA}" = SmartWebPrinting
"{DD8ACFF8-098E-130C-2799-BCA4D41EBAB2}" = CCC Help Chinese Standard
"{DE123FE9-B7F6-A75A-920D-3937FB9F06E4}" = CCC Help Portuguese
"{E2F0AF23-FE2F-4222-9A43-55E63CC41EF1}" = Catalyst Control Center - Branding
"{E7112940-5F8E-4918-B9FE-251F2F8DC81F}" = AIO_CDB_ProductContext
"{EE253E80-C298-4A31-BB22-7280DC8C7177}" = CCC Help Czech
"{EF36A836-BF89-4A4F-B079-057B0C68C1E0}" = Sid Meier's Civilization IV Colonization
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
"{F648F088-B270-CF18-6486-AF8B1FE6BC09}" = CCC Help English
"{FD85D9C0-783A-77B7-8EF8-326EC6C154D1}" = Catalyst Control Center Localization All
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"AIDA64 Extreme Edition_is1" = AIDA64 Extreme Edition v2.70
"ALchemy" = Creative ALchemy
"AudioCS" = Creative Audio-Systemsteuerung
"Autodesk 3ds Max 2012 64-bit - German SP2" = Autodesk 3ds Max 2012 64-bit - German SP2
"Creative Software AutoUpdate" = Creative Software AutoUpdate
"Diablo III" = Diablo III
"Distant Worlds1.0.6.0" = Distant Worlds
"EASEUS Partition Master Home Edition_is1" = EASEUS Partition Master 9.1.1 Home Edition
"EasyBCD" = EasyBCD 2.1.2
"Elemental: Fallen Enchantress" = Elemental: Fallen Enchantress
"Entropia Universe" = Entropia Universe
"ESET Online Scanner" = ESET Online Scanner v3
"EVE" = EVE Online (remove only)
"EVEMon" = EVEMon
"Fraps" = Fraps
"hon" = Heroes of Newerth
"Icewind Dale Complete_is1" = Icewind Dale Complete
"InstallShield_{758C8301-2696-4855-AF45-534B1200980A}" = Samsung Kies
"InstallWIX_{45E557D6-2271-4F13-8101-C620B4285AB0}" = Kaspersky Internet Security 2012
"Legend of Grimrock" = Legend of Grimrock
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.65.1.1000
"Men of War - Red Tide_is1" = Men of War - Red Tide 1.00.1
"Mozilla Firefox 16.0.2 (x86 de)" = Mozilla Firefox 16.0.2 (x86 de)
"Mozilla Thunderbird 16.0.2 (x86 de)" = Mozilla Thunderbird 16.0.2 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"PunkBusterSvc" = PunkBuster Services
"Starfarer" = Starfarer by Fractal Softworks LLC
"Steam App 16830" = Sid Meier's Civilization V SDK
"Steam App 200510" = XCOM: Enemy Unknown
"Steam App 205790" = Dota 2 Test
"Steam App 207170" = Legend of Grimrock
"Steam App 208140" = Endless Space
"Steam App 33460" = From Dust
"Steam App 34030" = Napoleon: Total War
"Steam App 3920" = Sid Meier's Pirates!
"Steam App 42990" = Sword of the Stars II
"Steam App 47400" = Stronghold 3
"Steam App 570" = Dota 2
"Steam App 620" = Portal 2
"Steam App 72850" = The Elder Scrolls V: Skyrim
"VL Sound 5.1" = VL Sound 5.1
"VLC media player" = VLC media player 2.0.0
"WaveStudio 7" = Creative WaveStudio 7
"Winamp" = Winamp
 
========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{4f004f4a-1930-4b55-83e6-61660211787f}" = MechWarrior Online
"Winamp Detect" = Winamp Erkennungs-Plug-in
 
========== Last 20 Event Log Errors ==========
 
[ Application Events ]
Error - 11.11.2012 14:55:58 | Computer Name = S-System-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: GameOverlayUI.exe, Version: 1.32.20.50,
 Zeitstempel: 0x4f46a9bf  Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0,
 Zeitstempel: 0x00000000  Ausnahmecode: 0xc0000005  Fehleroffset: 0x74a3e2d4  ID des fehlerhaften
 Prozesses: 0x1e08  Startzeit der fehlerhaften Anwendung: 0x01cdc03e2d3693c5  Pfad der
 fehlerhaften Anwendung: H:\Program Files (x86)\Steam\GameOverlayUI.exe  Pfad des 
fehlerhaften Moduls: unknown  Berichtskennung: 6da15496-2c31-11e2-b2d2-40618663e49f
 
Error - 13.11.2012 14:50:58 | Computer Name = S-System-PC | Source = SideBySide | ID = 16842785
Description = Fehler beim Generieren des Aktivierungskontextes für "C:\Program Files\Autodesk\Composite
 2012\python\lib\distutils\command\wininst-8_d.exe".  Die abhängige Assemblierung 
"Microsoft.VC80.DebugCRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0""
 konnte nicht gefunden werden.  Verwenden Sie für eine detaillierte Diagnose das Programm
 "sxstrace.exe".
 
Error - 13.11.2012 14:52:12 | Computer Name = S-System-PC | Source = SideBySide | ID = 16842832
Description = Fehler beim Generieren des Aktivierungskontexts für "c:\program files
 (x86)\ESET\eset online scanner\ESETSmartInstaller.exe". Fehler in  Manifest- oder
 Richtliniendatei "" in Zeile .  Eine für die Anwendung erforderliche Komponentenversion
 steht in Konflikt mit  einer anderen, bereits aktiven Komponentenversion.  In Konflikt
 stehende Komponenten:.  Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente
 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
 
Error - 14.11.2012 16:09:03 | Computer Name = S-System-PC | Source = SideBySide | ID = 16842785
Description = Fehler beim Generieren des Aktivierungskontextes für "C:\Program Files\Autodesk\Composite
 2012\python\lib\distutils\command\wininst-8_d.exe".  Die abhängige Assemblierung 
"Microsoft.VC80.DebugCRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0""
 konnte nicht gefunden werden.  Verwenden Sie für eine detaillierte Diagnose das Programm
 "sxstrace.exe".
 
Error - 14.11.2012 16:11:34 | Computer Name = S-System-PC | Source = SideBySide | ID = 16842832
Description = Fehler beim Generieren des Aktivierungskontexts für "c:\program files
 (x86)\ESET\eset online scanner\ESETSmartInstaller.exe". Fehler in  Manifest- oder
 Richtliniendatei "" in Zeile .  Eine für die Anwendung erforderliche Komponentenversion
 steht in Konflikt mit  einer anderen, bereits aktiven Komponentenversion.  In Konflikt
 stehende Komponenten:.  Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente
 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
 
Error - 17.11.2012 05:27:20 | Computer Name = S-System-PC | Source = SideBySide | ID = 16842785
Description = Fehler beim Generieren des Aktivierungskontextes für "C:\Program Files\Autodesk\Composite
 2012\python\lib\distutils\command\wininst-8_d.exe".  Die abhängige Assemblierung 
"Microsoft.VC80.DebugCRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0""
 konnte nicht gefunden werden.  Verwenden Sie für eine detaillierte Diagnose das Programm
 "sxstrace.exe".
 
Error - 17.11.2012 05:29:38 | Computer Name = S-System-PC | Source = SideBySide | ID = 16842832
Description = Fehler beim Generieren des Aktivierungskontexts für "c:\program files
 (x86)\ESET\eset online scanner\ESETSmartInstaller.exe". Fehler in  Manifest- oder
 Richtliniendatei "" in Zeile .  Eine für die Anwendung erforderliche Komponentenversion
 steht in Konflikt mit  einer anderen, bereits aktiven Komponentenversion.  In Konflikt
 stehende Komponenten:.  Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente
 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
 
Error - 18.11.2012 05:56:11 | Computer Name = S-System-PC | Source = SideBySide | ID = 16842785
Description = Fehler beim Generieren des Aktivierungskontextes für "C:\Program Files\Autodesk\Composite
 2012\python\lib\distutils\command\wininst-8_d.exe".  Die abhängige Assemblierung 
"Microsoft.VC80.DebugCRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0""
 konnte nicht gefunden werden.  Verwenden Sie für eine detaillierte Diagnose das Programm
 "sxstrace.exe".
 
Error - 18.11.2012 05:57:41 | Computer Name = S-System-PC | Source = SideBySide | ID = 16842832
Description = Fehler beim Generieren des Aktivierungskontexts für "c:\program files
 (x86)\ESET\eset online scanner\ESETSmartInstaller.exe". Fehler in  Manifest- oder
 Richtliniendatei "" in Zeile .  Eine für die Anwendung erforderliche Komponentenversion
 steht in Konflikt mit  einer anderen, bereits aktiven Komponentenversion.  In Konflikt
 stehende Komponenten:.  Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente
 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
 
Error - 18.11.2012 06:20:34 | Computer Name = S-System-PC | Source = SideBySide | ID = 16842785
Description = Fehler beim Generieren des Aktivierungskontextes für "C:\Program Files\Autodesk\Composite
 2012\python\lib\distutils\command\wininst-8_d.exe".  Die abhängige Assemblierung 
"Microsoft.VC80.DebugCRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0""
 konnte nicht gefunden werden.  Verwenden Sie für eine detaillierte Diagnose das Programm
 "sxstrace.exe".
 
[ System Events ]
Error - 18.11.2012 06:31:07 | Computer Name = S-System-PC | Source = cdrom | ID = 262151
Description = Fehlerhafter Block bei Gerät \Device\CdRom0.
 
Error - 18.11.2012 06:31:13 | Computer Name = S-System-PC | Source = cdrom | ID = 262151
Description = Fehlerhafter Block bei Gerät \Device\CdRom0.
 
Error - 18.11.2012 06:31:20 | Computer Name = S-System-PC | Source = cdrom | ID = 262151
Description = Fehlerhafter Block bei Gerät \Device\CdRom0.
 
Error - 18.11.2012 06:31:26 | Computer Name = S-System-PC | Source = cdrom | ID = 262151
Description = Fehlerhafter Block bei Gerät \Device\CdRom0.
 
Error - 18.11.2012 06:31:33 | Computer Name = S-System-PC | Source = cdrom | ID = 262151
Description = Fehlerhafter Block bei Gerät \Device\CdRom0.
 
Error - 18.11.2012 06:31:39 | Computer Name = S-System-PC | Source = cdrom | ID = 262151
Description = Fehlerhafter Block bei Gerät \Device\CdRom0.
 
Error - 18.11.2012 06:31:46 | Computer Name = S-System-PC | Source = cdrom | ID = 262151
Description = Fehlerhafter Block bei Gerät \Device\CdRom0.
 
Error - 18.11.2012 06:31:52 | Computer Name = S-System-PC | Source = cdrom | ID = 262151
Description = Fehlerhafter Block bei Gerät \Device\CdRom0.
 
Error - 18.11.2012 06:31:59 | Computer Name = S-System-PC | Source = cdrom | ID = 262151
Description = Fehlerhafter Block bei Gerät \Device\CdRom0.
 
Error - 20.11.2012 13:37:34 | Computer Name = S-System-PC | Source = EventLog | ID = 6008
Description = Das System wurde zuvor am ?19.?11.?2012 um 23:44:50 unerwartet heruntergefahren.
 
 
< End of report >
         
--- --- ---


ich habe dass selbe theme im Log analyse Forum reingestellt, da ich denke dies ist das richtigere, würde ich einen admin bitten das andere thema zu löschen / sperren

Bzw welches ist das richtige Forum?

Geändert von Veantur (20.11.2012 um 18:39 Uhr)

Alt 21.11.2012, 04:03   #2
t'john
/// Helfer-Team
 
Nach Malwarebites durchlauf Malware.N.Spack gefunden - Standard

Nach Malwarebites durchlauf Malware.N.Spack gefunden





Warum erstellst du Themen doppelt?

Downloade Dir bitte AdwCleaner Logo Icon AdwCleaner auf deinen Desktop.
  • Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
  • Starte die AdwCleaner.exe mit einem Doppelklick.
  • Stimme den Nutzungsbedingungen zu.
  • Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
    • "Tracing" Schlüssel löschen
    • Winsock Einstellungen zurücksetzen
    • Proxy Einstellungen zurücksetzen
    • Internet Explorer Richtlinien zurücksetzen
    • Chrome Richtlinien zurücksetzen
    • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
  • Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
  • Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
  • Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).



dann


ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

__________________

__________________

Alt 21.11.2012, 18:00   #3
Veantur
 
Nach Malwarebites durchlauf Malware.N.Spack gefunden - Standard

Nach Malwarebites durchlauf Malware.N.Spack gefunden



hi t john,

danke für deine hilfe.
Bissi blöd gewesen mitm doppel post


hier der log von
adwcleaner

# AdwCleaner v2.008 - Datei am 21/11/2012 um 18:55:55 erstellt
# Aktualisiert am 17/11/2012 von Xplode
# Betriebssystem : Windows 7 Professional Service Pack 1 (64 bits)
# Benutzer : S-System - S-SYSTEM-PC
# Bootmodus : Normal
# Ausgeführt unter : C:\Users\S-System\Desktop\adwcleaner.exe
# Option [Löschen]


**** [Dienste] ****


***** [Dateien / Ordner] *****

Ordner Gelöscht : C:\ProgramData\boost_interprocess
Ordner Gelöscht : C:\Users\S-System\AppData\Roaming\pdfforge

***** [Registrierungsdatenbank] *****

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{11549FE4-7C5A-4C17-9FC3-56FC5162A994}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{826D7151-8D99-434B-8540-082B8C2AE556}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}

***** [Internet Browser] *****

-\\ Internet Explorer v9.0.8112.16421

[OK] Die Registrierungsdatenbank ist sauber.

-\\ Mozilla Firefox v16.0.2 (de)

Profilname : default
Datei : C:\Users\S-System\AppData\Roaming\Mozilla\Firefox\Profiles\2om32i1e.default\prefs.js

[OK] Die Datei ist sauber.

Profilname : default
Datei : C:\Users\Surfer\AppData\Roaming\Mozilla\Firefox\Profiles\5lwozvxd.default\prefs.js

[OK] Die Datei ist sauber.

Profilname : default
Datei : C:\Users\Gast\AppData\Roaming\Mozilla\Firefox\Profiles\udigbhyo.default\prefs.js

[OK] Die Datei ist sauber.

*************************

AdwCleaner[S1].txt - [1660 octets] - [21/11/2012 18:55:55]

########## EOF - C:\AdwCleaner[S1].txt - [1720 octets] ##########


eset werde ich jetzt laufen lassen
__________________

Alt 22.11.2012, 05:17   #4
t'john
/// Helfer-Team
 
Nach Malwarebites durchlauf Malware.N.Spack gefunden - Standard

Nach Malwarebites durchlauf Malware.N.Spack gefunden



ESET Log?
__________________
Mfg, t'john
Das TB unterstützen

Alt 22.11.2012, 06:41   #5
Veantur
 
Nach Malwarebites durchlauf Malware.N.Spack gefunden - Standard

Nach Malwarebites durchlauf Malware.N.Spack gefunden



moin,

der scan hat über nacht gedauert

ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=6a20a71ec8f1d0459c80f035baefe119
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2012-11-22 05:27:56
# local_time=2012-11-22 06:27:56 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=1280 16777215 100 0 21591697 21591697 0 0
# compatibility_mode=5893 16776574 100 94 12390099 105160235 0 0
# compatibility_mode=8192 67108863 100 0 12392772 12392772 0 0
# scanned=1109171
# found=0
# cleaned=0
# scan_time=31691


Geändert von Veantur (22.11.2012 um 06:49 Uhr)

Alt 22.11.2012, 12:03   #6
t'john
/// Helfer-Team
 
Nach Malwarebites durchlauf Malware.N.Spack gefunden - Standard

Nach Malwarebites durchlauf Malware.N.Spack gefunden



Java aktualisieren

Dein Java ist nicht mehr aktuell. Älter Versionen enthalten Sicherheitslücken, die von Malware missbraucht werden können.
  • Downloade dir bitte die neueste Java-Version von hier
  • Speichere die jxpiinstall.exe
  • Schließe alle laufenden Programme. Speziell deinen Browser.
  • Starte die jxpiinstall.exe. Diese wird den Installer für die neueste Java Version ( Java 7 Update 9 ) herunter laden.
  • Wenn die Installation beendet wurde
    Start --> Systemsteuerung --> Programme und deinstalliere alle älteren Java Versionen.
  • Starte deinen Rechner neu sobald alle älteren Versionen deinstalliert wurden.
Nach dem Neustart
  • Öffne erneut die Systemsteuerung --> Programme und klicke auf das Java Symbol.
  • Im Reiter Allgemein, klicke unter Temporäre Internetdateien auf Einstellungen.
  • Klicke auf Dateien löschen....
  • Gehe sicher das überall ein Hacken gesetzt ist und klicke OK.
  • Klicke erneut OK.


Dann so einstellen: http://www.trojaner-board.de/105213-...tellungen.html

Danach poste (kopieren und einfuegen) mir, was du hier angezeigt bekommst: PluginCheck



Java deaktivieren

Aufgrund derezeitigen Sicherheitsluecke:

http://www.trojaner-board.de/122961-...ktivieren.html

Danach poste mir (kopieren und einfuegen), was du hier angezeigt bekommst: PluginCheck
__________________
--> Nach Malwarebites durchlauf Malware.N.Spack gefunden

Alt 22.11.2012, 18:00   #7
Veantur
 
Nach Malwarebites durchlauf Malware.N.Spack gefunden - Standard

Nach Malwarebites durchlauf Malware.N.Spack gefunden



hi t john

PluginCheck

Der PluginCheck hilft die größten Sicherheitslücken beim Surfen im Internet zu schliessen.
Überprüft wird: Browser, Flash, Java und Adobe Reader Version.

Firefox 16.0 ist aktuell

Flash (11,5,502,110) ist aktuell.

Java (1,7,0,9) ist aktuell.

Adobe Reader 10,1,4,38 ist veraltet!
Aktualisieren Sie bitte auf die neueste Version: 11.0

macht es sin Malwarebytes laufen zu lassen und die schädlinge zu löschen
die Malwarebytes erkennt?

PluginCheck

Der PluginCheck hilft die größten Sicherheitslücken beim Surfen im Internet zu schliessen.
Überprüft wird: Browser, Flash, Java und Adobe Reader Version.

Firefox 16.0 ist aktuell

Flash (11,5,502,110) ist aktuell.

Java ist Installiert aber nicht aktiviert.

Adobe Reader 10,1,4,38 ist veraltet!
Aktualisieren Sie bitte auf die neueste Version: 11.0

Alt 23.11.2012, 03:45   #8
t'john
/// Helfer-Team
 
Nach Malwarebites durchlauf Malware.N.Spack gefunden - Standard

Nach Malwarebites durchlauf Malware.N.Spack gefunden



Edit: Falsches Thema
__________________
Mfg, t'john
Das TB unterstützen

Alt 23.11.2012, 22:07   #9
Veantur
 
Nach Malwarebites durchlauf Malware.N.Spack gefunden - Standard

Nach Malwarebites durchlauf Malware.N.Spack gefunden



hi t john

ich denke nicht dass das system schon sauber sein kann
da ich ja vorgestern nur einen schnellscan mit malwarebites gemacht habe und die infizierten objekte nicht gelöscht habe

hab jetzt mal nen neuen vollscan durchgführt


hier die neue log

Malwarebytes Anti-Malware 1.65.1.1000
www.malwarebytes.org

Datenbank Version: v2012.11.20.03

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
S-System :: S-SYSTEM-PC [Administrator]

23.11.2012 07:17:19
mbam-log-2012-11-23 (07-17-19).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|F:\|G:\|H:\|I:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 1324696
Laufzeit: 3 Stunde(n), 26 Minute(n), 13 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 2
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Distant Worlds1.0.6.0 (Adware.Agent) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Entropia Universe (Adware.Agent) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(hier stellt sich mir die frage ob dies überhaupt schädlinge sein können, das ist legale software von zuverlässigen anbietern, kurzes feedback wäre sehr nett (Adware.Agent) )

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 4
C:\Users\S-System\AppData\Local\Temp\wtf31F5.tmp (Malware.NSPack) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\S-System\AppData\Local\Temp\wtf9684.tmp (Malware.NSPack) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Windows\Distant Worlds\uninstall.exe (Adware.Agent) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Windows\Entropia Universe\uninstall.exe (Adware.Agent) -> Erfolgreich gelöscht und in Quarantäne gestellt.

((Adware.Agent) siehe anmerkung oben)

(Ende)


die infizierten objekte sind nuch auch gelöscht worden (hoffe das ist ok, bitte um eine kurzes feedback)

zweiter scan


Malwarebytes Anti-Malware 1.65.1.1000
www.malwarebytes.org

Datenbank Version: v2012.11.20.03

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
S-System :: S-SYSTEM-PC [Administrator]

23.11.2012 18:45:56
mbam-log-2012-11-23 (18-45-56).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|F:\|G:\|H:\|I:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 1324371
Laufzeit: 3 Stunde(n), 17 Minute(n), 49 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)


otl scan
(der log extras wurde diesmal nicht angezeigt)OTL Logfile:
Code:
ATTFilter
OTL logfile created on: 23.11.2012 23:16:05 - Run 3
OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\S-System\Desktop
64bit- Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
4,00 Gb Total Physical Memory | 2,18 Gb Available Physical Memory | 54,45% Memory free
10,00 Gb Paging File | 7,09 Gb Available in Paging File | 70,97% Paging File free
Paging file location(s): c:\pagefile.sys 6142 12284 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 149,52 Gb Total Space | 66,43 Gb Free Space | 44,43% Space Free | Partition Type: NTFS
Drive D: | 24,41 Gb Total Space | 0,78 Gb Free Space | 3,20% Space Free | Partition Type: NTFS
Drive E: | 465,76 Gb Total Space | 59,94 Gb Free Space | 12,87% Space Free | Partition Type: NTFS
Drive F: | 14,65 Gb Total Space | 9,51 Gb Free Space | 64,90% Space Free | Partition Type: NTFS
Drive G: | 90,98 Gb Total Space | 82,98 Gb Free Space | 91,21% Space Free | Partition Type: NTFS
Drive H: | 414,09 Gb Total Space | 63,52 Gb Free Space | 15,34% Space Free | Partition Type: NTFS
Drive I: | 367,91 Gb Total Space | 236,40 Gb Free Space | 64,25% Space Free | Partition Type: NTFS
 
Computer Name: S-SYSTEM-PC | User Name: S-System | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\S-System\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe (Kaspersky Lab ZAO)
PRC - C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe (Malwarebytes Corporation)
PRC - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
PRC - C:\Windows\SysWOW64\PnkBstrA.exe ()
PRC - C:\Program Files (x86)\Winamp\winamp.exe (Nullsoft, Inc.)
PRC - C:\Programme\Autodesk\3ds Max 2012\mentalimages\satellite\raysat_3dsmax2012_64server.exe ()
PRC - C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe (Creative Technology Ltd)
 
 
========== Modules (No Company Name) ==========
 
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\winampa.lng ()
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\winamp.lng ()
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\vis_milk2.lng ()
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\vis_avs.lng ()
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\ml_local.lng ()
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\ml_disc.lng ()
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\ml_pmp.lng ()
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\pmp_wifi.lng ()
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\pmp_ipod.lng ()
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\ombrowser.lng ()
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\ml_plg.lng ()
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\pmp_android.lng ()
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\out_ds.lng ()
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\ml_wire.lng ()
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\ml_online.lng ()
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\ml_playlists.lng ()
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\pmp_usb.lng ()
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\ml_downloads.lng ()
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\ml_history.lng ()
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\ml_devices.lng ()
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\ml_transcode.lng ()
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\vis_nsfs.lng ()
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\out_wave.lng ()
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\ml_autotag.lng ()
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\tagz.lng ()
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\out_disk.lng ()
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\ml_rg.lng ()
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\ml_impex.lng ()
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\ml_bookmarks.lng ()
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\pmp_activesync.lng ()
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\ml_enqplay.lng ()
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\in_wv.lng ()
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\pmp_p4s.lng ()
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\ml_orb.lng ()
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\pmp_njb.lng ()
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\ml_nowplaying.lng ()
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\ml_addons.lng ()
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\playlist.lng ()
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\gen_jumpex.lng ()
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\gen_classicart.lng ()
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\in_mp3.lng ()
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\gen_ff.lng ()
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\gen_ml.lng ()
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\in_midi.lng ()
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\in_mod.lng ()
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\in_wm.lng ()
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\in_cdda.lng ()
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\in_nsv.lng ()
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\gen_skinmanager.lng ()
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\in_vorbis.lng ()
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\gen_hotkeys.lng ()
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\gen_undo.lng ()
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\gen_timerestore.lng ()
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\gen_nopro.lng ()
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\gen_tray.lng ()
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\gen_orgler.lng ()
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\gen_crasher.lng ()
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\in_wav.lng ()
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\in_dshow.lng ()
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\enc_wma.lng ()
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\in_wave.lng ()
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\in_flac.lng ()
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\in_mp4.lng ()
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\in_avi.lng ()
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\in_mkv.lng ()
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\gen_find_on_disk.lng ()
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\in_swf.lng ()
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\in_linein.lng ()
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\in_flv.lng ()
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\burnlib.lng ()
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\dsp_sps.lng ()
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\auth.lng ()
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\enc_fhgaac.lng ()
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\enc_lame.lng ()
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\enc_wav.lng ()
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\enc_vorbis.lng ()
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\enc_flac.lng ()
MOD - C:\Program Files (x86)\Mozilla Firefox\mozjs.dll ()
MOD - C:\Program Files (x86)\Winamp\System\jnetlib.w5s ()
MOD - C:\Program Files (x86)\Winamp\System\jpeg.w5s ()
MOD - C:\Program Files (x86)\Winamp\System\png.w5s ()
MOD - C:\Program Files (x86)\Winamp\System\xml.w5s ()
MOD - C:\Program Files (x86)\Winamp\System\playlist.w5s ()
MOD - C:\Program Files (x86)\Winamp\tataki.dll ()
MOD - C:\Program Files (x86)\Winamp\zlib.dll ()
MOD - C:\Program Files (x86)\Winamp\System\timer.w5s ()
MOD - C:\Program Files (x86)\Winamp\System\tagz.w5s ()
MOD - C:\Program Files (x86)\Winamp\System\gif.w5s ()
MOD - C:\Program Files (x86)\Winamp\System\dlmgr.w5s ()
MOD - C:\Program Files (x86)\Winamp\System\gracenote.w5s ()
MOD - C:\Program Files (x86)\Winamp\System\filereader.w5s ()
MOD - C:\Program Files (x86)\Winamp\System\primo.w5s ()
MOD - C:\Program Files (x86)\Winamp\System\auth.w5s ()
MOD - C:\Program Files (x86)\Winamp\Plugins\pmp_ipod.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\pmp_p4s.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\pmp_wifi.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\pmp_android.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\pmp_usb.dll ()
MOD - C:\Program Files (x86)\Winamp\System\devices.w5s ()
MOD - C:\Program Files (x86)\Winamp\System\albumart.w5s ()
MOD - C:\Program Files (x86)\Winamp\Plugins\pmp_njb.dll ()
MOD - C:\Program Files (x86)\Winamp\System\bmp.w5s ()
MOD - C:\Program Files (x86)\Winamp\Plugins\gen_ff.dll ()
MOD - C:\Program Files (x86)\Winamp\nsutil.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\freeform\wacs\freetype\freetype.wac ()
MOD - C:\Program Files (x86)\Winamp\Plugins\gen_ml.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\in_wm.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\ml_local.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\in_mp3.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\in_vorbis.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\ml_devices.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\ml_pmp.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\ml_disc.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\gen_jumpex.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\in_mod.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\ml_online.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\in_midi.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\in_cdda.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\ml_plg.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\ml_playlists.dll ()
MOD - C:\Program Files (x86)\Winamp\nde.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\in_nsv.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\in_dshow.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\in_avi.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\in_flac.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\ml_impex.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\gen_orgler.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\in_mp4.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\out_ds.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\ml_history.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\in_mkv.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\in_flv.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\ml_rg.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\ml_transcode.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\ml_autotag.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\ml_bookmarks.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\gen_hotkeys.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\gen_tray.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\in_swf.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\out_disk.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\out_wave.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\in_wave.dll ()
MOD - C:\Program Files (x86)\Winamp\Plugins\in_linein.dll ()
MOD - C:\Program Files (x86)\Winamp\libsndfile.dll ()
MOD - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\QtGui4.dll ()
MOD - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\QtSql4.dll ()
MOD - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\QtScript4.dll ()
MOD - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\QtNetwork4.dll ()
MOD - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\QtCore4.dll ()
MOD - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\QtDeclarative4.dll ()
MOD - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\imageformats\qgif4.dll ()
MOD - C:\Windows\SysWOW64\APOMngr.DLL ()
MOD - C:\Windows\SysWOW64\CmdRtr.DLL ()
 
 
========== Services (SafeList) ==========
 
SRV:64bit: - (AMD External Events Utility) -- C:\Windows\SysNative\atiesrxx.exe (AMD)
SRV:64bit: - (AMD FUEL Service) -- C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe (Advanced Micro Devices, Inc.)
SRV:64bit: - (AppMgmt) -- C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)
SRV - (MozillaMaintenance) -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (AdobeFlashPlayerUpdateSvc) -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (AVP) -- C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe (Kaspersky Lab ZAO)
SRV - (Steam Client Service) -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe (Valve Corporation)
SRV - (MBAMService) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
SRV - (MBAMScheduler) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe (Malwarebytes Corporation)
SRV - (AdobeARMservice) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
SRV - (FLEXnet Licensing Service 64) -- C:\Programme\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe (Flexera Software, Inc.)
SRV - (PnkBstrA) -- C:\Windows\SysWOW64\PnkBstrA.exe ()
SRV - (Creative ALchemy AL6 Licensing Service) -- C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\AL6Licensing.exe (Creative Labs)
SRV - (Creative Audio Engine Licensing Service) -- C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe (Creative Labs)
SRV - (mi-raysat_3dsmax2012_64) -- C:\Programme\Autodesk\3ds Max 2012\mentalimages\satellite\raysat_3dsmax2012_64server.exe ()
SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (HPSLPSVC) -- C:\Program Files (x86)\HP\Digital Imaging\bin\HPSLPSVC64.DLL (Hewlett-Packard Co.)
SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
SRV - (CTAudSvcService) -- C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe (Creative Technology Ltd)
SRV - (SandraAgentSrv) -- C:\Programme\SiSoftware\SiSoftware Sandra Lite 2012.SP5c\RpcAgentSrv.exe (SiSoftware)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - (KLIF) -- C:\Windows\SysNative\drivers\klif.sys (Kaspersky Lab)
DRV:64bit: - (MBAMProtector) -- C:\Windows\SysNative\drivers\mbam.sys (Malwarebytes Corporation)
DRV:64bit: - (ssudmdm) -- C:\Windows\SysNative\drivers\ssudmdm.sys (DEVGURU Co., LTD.(www.devguru.co.kr))
DRV:64bit: - (dg_ssudbus) -- C:\Windows\SysNative\drivers\ssudbus.sys (DEVGURU Co., LTD.(www.devguru.co.kr))
DRV:64bit: - (amdkmdag) -- C:\Windows\SysNative\drivers\atikmdag.sys (Advanced Micro Devices, Inc.)
DRV:64bit: - (amdkmdap) -- C:\Windows\SysNative\drivers\atikmpag.sys (Advanced Micro Devices, Inc.)
DRV:64bit: - (Fs_Rec) -- C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation)
DRV:64bit: - (AtiHDAudioService) -- C:\Windows\SysNative\drivers\AtihdW76.sys (Advanced Micro Devices)
DRV:64bit: - (epmntdrv) -- C:\Windows\SysNative\epmntdrv.sys ()
DRV:64bit: - (EuGdiDrv) -- C:\Windows\SysNative\EuGdiDrv.sys ()
DRV:64bit: - (RTL8167) -- C:\Windows\SysNative\drivers\Rt64win7.sys (Realtek                                            )
DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (KLIM6) -- C:\Windows\SysNative\drivers\klim6.sys (Kaspersky Lab ZAO)
DRV:64bit: - (kl2) -- C:\Windows\SysNative\drivers\kl2.sys (Kaspersky Lab ZAO)
DRV:64bit: - (KL1) -- C:\Windows\SysNative\drivers\kl1.sys (Kaspersky Lab ZAO)
DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (TsUsbFlt) -- C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV:64bit: - (amdiox64) -- C:\Windows\SysNative\drivers\amdiox64.sys (Advanced Micro Devices)
DRV:64bit: - (klmouflt) -- C:\Windows\SysNative\drivers\klmouflt.sys (Kaspersky Lab)
DRV:64bit: - (P17) -- C:\Windows\SysNative\drivers\P17.sys (Creative Technology Ltd.)
DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV - (WinRing0_1_2_0) -- C:\Program Files (x86)\Razer\Razer Game Booster\Driver\WinRing0x64.sys (OpenLibSys.org)
DRV - (AODDriver4.1) -- C:\Programme\ATI Technologies\ATI.ACE\Fuel\amd64\aoddriver2.sys (Advanced Micro Devices)
DRV - (epmntdrv) -- C:\Windows\SysWOW64\epmntdrv.sys ()
DRV - (EuGdiDrv) -- C:\Windows\SysWOW64\EuGdiDrv.sys ()
DRV - (SANDRA) -- C:\Programme\SiSoftware\SiSoftware Sandra Lite 2012.SP5c\WNt500x64\sandra.sys (SiSoftware)
DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = 
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = 
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
 
 
IE - HKU\.DEFAULT\..\SearchScopes,DefaultScope = 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\..\SearchScopes,DefaultScope = 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-19\..\SearchScopes,DefaultScope = 
 
IE - HKU\S-1-5-20\..\SearchScopes,DefaultScope = 
 
IE - HKU\S-1-5-21-2320744662-329307789-2970131851-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKU\S-1-5-21-2320744662-329307789-2970131851-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
IE - HKU\S-1-5-21-2320744662-329307789-2970131851-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 1B B8 83 9B 6B C3 CD 01  [binary data]
IE - HKU\S-1-5-21-2320744662-329307789-2970131851-1001\..\SearchScopes,DefaultScope = 
IE - HKU\S-1-5-21-2320744662-329307789-2970131851-1001\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKU\S-1-5-21-2320744662-329307789-2970131851-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-2320744662-329307789-2970131851-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = 188.95.51.206:80
 
========== FireFox ==========
 
FF - user.js - File not found
 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_5_502_110.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\adobe.com/AdobeAAMDetect: C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll File not found
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_5_502_110.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.9.2: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.9.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.0: C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\ubisoft.com/uplaypc: C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll (Ubisoft)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\virtualKeyboard@kaspersky.ru: C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\FFExt\virtualKeyboard@kaspersky.ru [2012.11.01 19:43:42 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\linkfilter@kaspersky.ru: C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\FFExt\linkfilter@kaspersky.ru [2012.11.01 19:43:42 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\KavAntiBanner@Kaspersky.ru: C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\FFExt\KavAntiBanner@Kaspersky.ru [2012.11.01 19:43:42 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\smartwebprinting@hp.com: C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2012.06.02 11:27:41 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 16.0.2\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.10.31 20:45:42 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 16.0.2\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012.10.31 20:45:40 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 17.0\extensions\\Components: C:\Program Files (x86)\Mozilla Thunderbird\components [2012.11.20 21:05:13 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 17.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Thunderbird\plugins
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\smartwebprinting@hp.com: C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2012.06.02 11:27:41 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 16.0.2\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.10.31 20:45:42 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 16.0.2\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012.10.31 20:45:40 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Thunderbird 17.0\extensions\\Components: C:\Program Files (x86)\Mozilla Thunderbird\components [2012.11.20 21:05:13 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Thunderbird 17.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Thunderbird\plugins
 
[2012.03.17 00:42:20 | 000,000,000 | ---D | M] (No name found) -- C:\Users\S-System\AppData\Roaming\mozilla\Extensions
[2012.11.23 21:27:04 | 000,000,000 | ---D | M] (No name found) -- C:\Users\S-System\AppData\Roaming\mozilla\Firefox\Profiles\2om32i1e.default\extensions
[2012.11.23 21:27:04 | 000,804,627 | ---- | M] () (No name found) -- C:\Users\S-System\AppData\Roaming\mozilla\firefox\profiles\2om32i1e.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
[2012.10.31 20:45:39 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions
[2012.10.31 20:45:42 | 000,261,600 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2011.12.09 18:23:32 | 000,012,800 | ---- | M] (Nullsoft, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npwachk.dll
[2012.06.17 11:48:54 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.08.30 05:52:40 | 000,002,465 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2012.06.17 11:48:54 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2012.06.17 11:48:54 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.06.17 11:48:54 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.06.17 11:48:54 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2009.06.10 22:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2:64bit: - BHO: (IEVkbdBHO Class) - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\x64\ievkbd.dll (Kaspersky Lab ZAO)
O2:64bit: - BHO: (FilterBHO Class) - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\x64\klwtbbho.dll (Kaspersky Lab ZAO)
O2 - BHO: (IEVkbdBHO Class) - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\ievkbd.dll (Kaspersky Lab ZAO)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (FilterBHO Class) - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\klwtbbho.dll (Kaspersky Lab ZAO)
O4 - HKLM..\Run: [AMD AVT] C:\Windows\SysWow64\cmd.exe (Microsoft Corporation)
O4 - HKLM..\Run: [AVP] C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe (Kaspersky Lab ZAO)
O4 - HKLM..\Run: [P17RunE] C:\Windows\SysWow64\P17RunE.dll (Creative Technology Ltd.)
O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O8:64bit: - Extra context menu item: Hinzufügen zu Anti-Banner - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\ie_banner_deny.htm ()
O8 - Extra context menu item: Hinzufügen zu Anti-Banner - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\ie_banner_deny.htm ()
O9:64bit: - Extra Button: &Virtuelle Tastatur - {4248FE82-7FCB-46AC-B270-339F08212110} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\x64\ievkbd.dll (Kaspersky Lab ZAO)
O9:64bit: - Extra Button: Li&nks untersuchen - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\x64\klwtbbho.dll (Kaspersky Lab ZAO)
O9 - Extra Button: &Virtuelle Tastatur - {4248FE82-7FCB-46AC-B270-339F08212110} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\ievkbd.dll (Kaspersky Lab ZAO)
O9 - Extra Button: ICQ7M - {781B39EC-2E18-41FC-9B00-B84E4FFCA85F} - h:\Program Files (x86)\ICQ7M\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ7M - {781B39EC-2E18-41FC-9B00-B84E4FFCA85F} - h:\Program Files (x86)\ICQ7M\ICQ.exe (ICQ, LLC.)
O9 - Extra Button: Li&nks untersuchen - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\klwtbbho.dll (Kaspersky Lab ZAO)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {D4B68B83-8710-488B-A692-D74B50BA558E} hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/15113/CTPIDPDE.cab (Creative Software AutoUpdate Support Package 2)
O16 - DPF: {E705A591-DA3C-4228-B0D5-A356DBA42FBF} hxxp://ccfiles.creative.com/Web/softwareupdate/su2/ocx/20015/CTSUEng.cab (Creative Software AutoUpdate 2)
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/110926/CTPID.cab (Creative Software AutoUpdate Support Package)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{8CBA1030-D865-4F27-947F-C398CACD21D7}: DhcpNameServer = 192.168.0.1
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20:64bit: - Winlogon\Notify\klogon: DllName - (%SystemRoot%\System32\klogon.dll) - C:\Windows\SysNative\klogon.dll (Kaspersky Lab ZAO)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2012.03.23 10:30:41 | 000,000,000 | ---D | M] - F:\Autodesk -- [ NTFS ]
O32 - AutoRun File - [2011.10.26 22:38:38 | 000,000,000 | ---D | M] - H:\Autodesk -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.11.22 18:50:35 | 000,000,000 | ---D | C] -- C:\ProgramData\Sun
[2012.11.22 18:50:33 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Java
[2012.11.22 18:50:24 | 000,821,736 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\npDeployJava1.dll
[2012.11.22 18:50:24 | 000,746,984 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\deployJava1.dll
[2012.11.22 18:50:24 | 000,246,760 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\javaws.exe
[2012.11.22 18:50:16 | 000,174,056 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\javaw.exe
[2012.11.22 18:50:16 | 000,174,056 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\java.exe
[2012.11.22 18:50:16 | 000,095,208 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\WindowsAccessBridge-32.dll
[2012.11.22 18:49:54 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Java
[2012.11.21 20:23:17 | 000,000,000 | ---D | C] -- C:\ProgramData\boost_interprocess
[2012.11.20 21:05:13 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Thunderbird
[2012.11.20 18:53:42 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\S-System\Desktop\OTL.exe
[2012.11.15 22:32:09 | 000,054,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\WdfLdr.sys
[2012.11.15 22:32:09 | 000,009,728 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\Wdfres.dll
[2012.11.15 22:27:15 | 000,096,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmled.dll
[2012.11.15 22:27:15 | 000,073,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmled.dll
[2012.11.15 22:27:14 | 001,427,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\inetcpl.cpl
[2012.11.15 22:27:14 | 000,248,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll
[2012.11.15 22:27:14 | 000,237,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\url.dll
[2012.11.15 22:27:14 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\url.dll
[2012.11.15 22:27:14 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll
[2012.11.15 22:27:14 | 000,173,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieUnatt.exe
[2012.11.15 22:27:14 | 000,142,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieUnatt.exe
[2012.11.15 22:27:13 | 002,312,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9.dll
[2012.11.15 22:27:13 | 001,494,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\inetcpl.cpl
[2012.11.15 22:27:13 | 000,729,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msfeeds.dll
[2012.11.15 22:27:12 | 000,816,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript.dll
[2012.11.15 22:27:12 | 000,717,824 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript.dll
[2012.11.15 22:27:12 | 000,599,040 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\vbscript.dll
[2012.11.15 22:25:21 | 000,194,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\WUDFPlatform.dll
[2012.11.15 22:25:20 | 000,744,448 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\WUDFx.dll
[2012.11.15 22:25:20 | 000,229,888 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\WUDFHost.exe
[2012.11.15 22:25:20 | 000,045,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\WUDFCoinstaller.dll
[2012.11.15 21:31:03 | 000,226,816 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\dhcpcore6.dll
[2012.11.15 21:31:03 | 000,193,536 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\dhcpcore6.dll
[2012.11.15 21:31:03 | 000,055,296 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\dhcpcsvc6.dll
[2012.11.15 21:31:00 | 000,246,272 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\netcorehc.dll
[2012.11.15 21:31:00 | 000,216,576 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ncsi.dll
[2012.11.15 21:31:00 | 000,175,104 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\netcorehc.dll
[2012.11.15 21:31:00 | 000,156,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ncsi.dll
[2012.11.15 21:30:59 | 000,018,944 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\netevent.dll
[2012.11.15 21:30:59 | 000,018,944 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\netevent.dll
[2012.11.15 21:30:43 | 000,095,744 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\synceng.dll
[2012.11.15 21:30:43 | 000,078,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\synceng.dll
[2012.11.13 21:02:30 | 000,000,000 | ---D | C] -- C:\Users\S-System\AppData\Local\Apps
[2012.11.11 17:48:00 | 000,000,000 | ---D | C] -- C:\Users\S-System\Documents\BioWare
[2012.11.10 16:50:00 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\MonitorDriver
[2012.11.10 16:42:22 | 000,000,000 | ---D | C] -- C:\Samsung
[2012.11.10 13:36:32 | 000,000,000 | ---D | C] -- C:\ProgramData\FLEXnet
[2012.11.10 13:36:27 | 000,000,000 | ---D | C] -- C:\Users\S-System\AppData\Local\Autodesk
[2012.11.04 15:34:29 | 000,000,000 | ---D | C] -- C:\Users\Public\Documents\CrashDump
[2012.11.04 13:09:16 | 000,000,000 | ---D | C] -- C:\Users\S-System\Documents\SelfMV
[2012.11.04 13:01:14 | 000,000,000 | ---D | C] -- C:\Temp
[2012.11.04 12:59:23 | 000,203,104 | ---- | C] (DEVGURU Co., LTD.(www.devguru.co.kr)) -- C:\Windows\SysNative\drivers\ssudmdm.sys
[2012.11.04 12:59:23 | 000,102,368 | ---- | C] (DEVGURU Co., LTD.(www.devguru.co.kr)) -- C:\Windows\SysNative\drivers\ssudbus.sys
[2012.11.04 12:57:21 | 000,000,000 | ---D | C] -- C:\Users\Public\Documents\NativeFus_Log
[2012.11.04 12:57:15 | 000,000,000 | ---D | C] -- C:\Users\S-System\AppData\Local\Samsung
[2012.11.04 12:57:14 | 000,000,000 | ---D | C] -- C:\Users\S-System\AppData\Roaming\Samsung
[2012.11.04 12:57:12 | 000,000,000 | ---D | C] -- C:\Users\S-System\Documents\samsung
[2012.11.04 12:55:58 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Samsung
[2012.11.04 12:55:50 | 004,659,712 | ---- | C] (Dmitry Streblechenko) -- C:\Windows\SysWow64\Redemption.dll
[2012.11.04 12:55:34 | 000,821,824 | ---- | C] (Devguru Co., Ltd.) -- C:\Windows\SysWow64\dgderapi.dll
[2012.11.04 12:55:34 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\MarkAny
[2012.11.04 12:55:17 | 000,000,000 | ---D | C] -- C:\ProgramData\Samsung
[2012.11.04 12:55:17 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Samsung
[2012.11.04 12:48:12 | 000,000,000 | ---D | C] -- C:\Users\S-System\AppData\Local\Downloaded Installations
[2012.11.03 18:45:53 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GOG.com
[2012.11.02 23:13:51 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SiSoftware
[2012.11.02 23:13:44 | 000,000,000 | ---D | C] -- C:\Program Files\SiSoftware
[2012.11.01 20:11:05 | 000,778,088 | ---- | C] (Hewlett-Packard Co.) -- C:\Windows\SysNative\HPDiscoPM5E12.dll
[2012.11.01 20:10:14 | 000,000,000 | ---D | C] -- C:\Program Files\HP
[2012.11.01 20:09:27 | 000,000,000 | ---D | C] -- C:\Users\S-System\AppData\Local\HP
[2012.10.31 20:45:38 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Firefox
[2012.10.27 11:20:32 | 000,000,000 | ---D | C] -- C:\Users\S-System\AppData\Local\Focus Home Interactive
[2012.10.27 07:36:12 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
[2012.10.27 07:36:12 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner
[1 C:\*.tmp files -> C:\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012.11.23 23:17:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012.11.23 18:52:54 | 000,014,752 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.11.23 18:52:54 | 000,014,752 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.11.23 18:44:24 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.11.23 18:44:20 | 3220,578,304 | -HS- | M] () -- C:\hiberfil.sys
[2012.11.22 18:49:58 | 000,095,208 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\WindowsAccessBridge-32.dll
[2012.11.22 18:49:57 | 000,821,736 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\npDeployJava1.dll
[2012.11.22 18:49:57 | 000,746,984 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\deployJava1.dll
[2012.11.22 18:49:57 | 000,246,760 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\javaws.exe
[2012.11.22 18:49:57 | 000,174,056 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\javaw.exe
[2012.11.22 18:49:57 | 000,174,056 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\java.exe
[2012.11.22 18:45:42 | 001,612,484 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2012.11.22 18:45:42 | 000,696,620 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2012.11.22 18:45:42 | 000,651,938 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2012.11.22 18:45:42 | 000,147,916 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2012.11.22 18:45:42 | 000,120,870 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2012.11.21 18:55:00 | 000,543,531 | ---- | M] () -- C:\Users\S-System\Desktop\adwcleaner.exe
[2012.11.20 18:53:30 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\S-System\Desktop\OTL.exe
[2012.11.16 17:09:42 | 004,892,752 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2012.11.10 16:45:14 | 000,697,272 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerApp.exe
[2012.11.10 16:45:14 | 000,073,656 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
[2012.11.04 12:57:10 | 000,001,992 | ---- | M] () -- C:\Users\Public\Desktop\Samsung Kies.lnk
[2012.11.04 12:53:45 | 001,589,442 | ---- | M] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2012.11.03 18:45:57 | 000,001,013 | ---- | M] () -- C:\Users\Public\Desktop\Icewind Dale Complete.lnk
[2012.11.02 23:13:51 | 000,001,183 | ---- | M] () -- C:\Users\Public\Desktop\SiSoftware Sandra Lite 2012.SP5c.lnk
[2012.11.02 23:11:44 | 000,001,231 | ---- | M] () -- C:\Users\S-System\Desktop\AIDA64 Extreme Edition.lnk
[2012.11.01 20:11:04 | 000,002,116 | ---- | M] () -- C:\Users\Public\Desktop\HP Officejet 6100.lnk
[2012.11.01 20:11:04 | 000,001,832 | ---- | M] () -- C:\Users\Public\Desktop\HP ePrintCenter - HP Officejet 6100.lnk
[2012.11.01 20:10:08 | 000,000,057 | ---- | M] () -- C:\ProgramData\Ament.ini
[2012.11.01 19:43:41 | 000,637,272 | ---- | M] (Kaspersky Lab) -- C:\Windows\SysNative\drivers\klif.sys
[2012.10.27 07:53:08 | 000,001,109 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.10.27 07:36:12 | 000,000,822 | ---- | M] () -- C:\Users\Public\Desktop\CCleaner.lnk
[1 C:\*.tmp files -> C:\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012.11.21 18:55:14 | 000,543,531 | ---- | C] () -- C:\Users\S-System\Desktop\adwcleaner.exe
[2012.11.15 22:32:11 | 000,000,003 | ---- | C] () -- C:\Windows\SysNative\drivers\MsftWdf_Kernel_01011_Inbox_Critical.Wdf
[2012.11.15 22:25:20 | 000,000,003 | ---- | C] () -- C:\Windows\SysNative\drivers\MsftWdf_User_01_11_00_Inbox_Critical.Wdf
[2012.11.04 12:57:10 | 000,001,992 | ---- | C] () -- C:\Users\Public\Desktop\Samsung Kies.lnk
[2012.11.03 18:45:57 | 000,001,013 | ---- | C] () -- C:\Users\Public\Desktop\Icewind Dale Complete.lnk
[2012.11.02 23:14:11 | 011,624,448 | ---- | C] () -- C:\Users\S-System\AppData\Roaming\Sandra.mdb
[2012.11.02 23:13:51 | 000,001,183 | ---- | C] () -- C:\Users\Public\Desktop\SiSoftware Sandra Lite 2012.SP5c.lnk
[2012.11.01 20:11:04 | 000,002,116 | ---- | C] () -- C:\Users\Public\Desktop\HP Officejet 6100.lnk
[2012.11.01 20:11:04 | 000,001,832 | ---- | C] () -- C:\Users\Public\Desktop\HP ePrintCenter - HP Officejet 6100.lnk
[2012.11.01 20:10:08 | 000,000,057 | ---- | C] () -- C:\ProgramData\Ament.ini
[2012.10.27 07:36:12 | 000,000,822 | ---- | C] () -- C:\Users\Public\Desktop\CCleaner.lnk
[2012.09.26 20:57:16 | 000,030,568 | ---- | C] () -- C:\Windows\MusiccityDownload.exe
[2012.09.26 20:57:14 | 000,974,848 | ---- | C] () -- C:\Windows\SysWow64\cis-2.4.dll
[2012.09.26 20:57:14 | 000,081,920 | ---- | C] () -- C:\Windows\SysWow64\issacapi_bs-2.3.dll
[2012.09.26 20:57:14 | 000,065,536 | ---- | C] () -- C:\Windows\SysWow64\issacapi_pe-2.3.dll
[2012.09.26 20:57:14 | 000,057,344 | ---- | C] () -- C:\Windows\SysWow64\issacapi_se-2.3.dll
[2012.06.13 09:00:01 | 002,469,760 | ---- | C] () -- C:\Windows\SysWow64\BootMan.exe
[2012.06.13 09:00:01 | 000,019,840 | ---- | C] () -- C:\Windows\SysWow64\EuEpmGdi.dll
[2012.06.13 09:00:00 | 000,086,408 | ---- | C] () -- C:\Windows\SysWow64\setupempdrv03.exe
[2012.06.13 09:00:00 | 000,014,216 | ---- | C] () -- C:\Windows\SysWow64\epmntdrv.sys
[2012.06.13 09:00:00 | 000,008,456 | ---- | C] () -- C:\Windows\SysWow64\EuGdiDrv.sys
[2012.06.06 20:02:47 | 000,000,782 | ---- | C] () -- C:\Windows\wiso.ini
[2012.06.02 11:23:22 | 000,245,227 | ---- | C] () -- C:\Windows\hpoins19.dat
[2012.06.02 11:23:22 | 000,013,898 | ---- | C] () -- C:\Windows\hpomdl19.dat
[2012.05.10 15:35:16 | 000,029,184 | ---- | C] () -- C:\Windows\SysWow64\kdbsdk32.dll
[2012.04.17 18:47:24 | 000,007,597 | ---- | C] () -- C:\Users\S-System\AppData\Local\Resmon.ResmonCfg
[2012.03.23 10:41:03 | 001,589,442 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2012.03.19 10:11:06 | 000,280,856 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrB.exe
[2012.03.19 10:11:04 | 000,076,888 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrA.exe
[2012.03.17 01:26:47 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin
[2012.03.17 00:59:17 | 000,017,408 | ---- | C] () -- C:\Users\S-System\AppData\Local\WebpageIcons.db
[2012.03.16 23:34:39 | 000,148,480 | ---- | C] () -- C:\Windows\SysWow64\APOMngr.DLL
[2012.03.16 23:34:39 | 000,073,728 | ---- | C] () -- C:\Windows\SysWow64\CmdRtr.DLL
[2012.02.15 03:36:36 | 000,204,952 | ---- | C] () -- C:\Windows\SysWow64\ativvsvl.dat
[2012.02.15 03:36:36 | 000,157,144 | ---- | C] () -- C:\Windows\SysWow64\ativvsva.dat
[2011.09.12 23:06:16 | 000,003,917 | ---- | C] () -- C:\Windows\SysWow64\atipblag.dat
 
========== ZeroAccess Check ==========
 
[2009.07.14 05:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll -- [2012.06.09 06:43:10 | 014,172,672 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2012.06.09 05:41:00 | 012,873,728 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.07.14 02:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.20 13:19:02 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 02:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
 
========== LOP Check ==========
 
[2012.11.10 13:45:01 | 000,000,000 | ---D | M] -- C:\Users\S-System\AppData\Roaming\Autodesk
[2012.08.17 11:44:12 | 000,000,000 | ---D | M] -- C:\Users\S-System\AppData\Roaming\Awesomium
[2012.06.06 20:05:18 | 000,000,000 | ---D | M] -- C:\Users\S-System\AppData\Roaming\Buhl Data Service
[2012.03.22 23:03:00 | 000,000,000 | ---D | M] -- C:\Users\S-System\AppData\Roaming\Code Force Limited
[2012.09.17 19:51:54 | 000,000,000 | ---D | M] -- C:\Users\S-System\AppData\Roaming\EVEMon
[2012.09.28 19:22:24 | 000,000,000 | ---D | M] -- C:\Users\S-System\AppData\Roaming\ICQ
[2012.03.19 11:46:28 | 000,000,000 | ---D | M] -- C:\Users\S-System\AppData\Roaming\Mount&Blade With Fire and Sword
[2012.08.15 07:03:56 | 000,000,000 | ---D | M] -- C:\Users\S-System\AppData\Roaming\PDAppFlex
[2012.11.04 12:57:14 | 000,000,000 | ---D | M] -- C:\Users\S-System\AppData\Roaming\Samsung
[2012.06.24 12:50:57 | 000,000,000 | ---D | M] -- C:\Users\S-System\AppData\Roaming\The Creative Assembly
[2012.03.21 18:19:58 | 000,000,000 | ---D | M] -- C:\Users\S-System\AppData\Roaming\Thunderbird
[2012.10.27 08:06:38 | 000,000,000 | ---D | M] -- C:\Users\S-System\AppData\Roaming\TS3Client
[2012.04.12 20:15:14 | 000,000,000 | ---D | M] -- C:\Users\S-System\AppData\Roaming\ts3overlay
[2012.06.07 15:53:33 | 000,000,000 | ---D | M] -- C:\Users\S-System\AppData\Roaming\UDP Software
[2012.06.14 10:44:01 | 000,000,000 | ---D | M] -- C:\Users\S-System\AppData\Roaming\wargaming.net
 
========== Purity Check ==========
 
 

< End of report >
         
--- --- ---

um die prozedur von gestern zu wiederholen habe ich noch mal adwcleaner laufen lassen

# AdwCleaner v2.008 - Datei am 23/11/2012 um 23:27:32 erstellt
# Aktualisiert am 17/11/2012 von Xplode
# Betriebssystem : Windows 7 Professional Service Pack 1 (64 bits)
# Benutzer : S-System - S-SYSTEM-PC
# Bootmodus : Normal
# Ausgeführt unter : C:\Users\S-System\Desktop\adwcleaner.exe
# Option [Löschen]


**** [Dienste] ****


***** [Dateien / Ordner] *****

Ordner Gelöscht : C:\ProgramData\boost_interprocess

***** [Registrierungsdatenbank] *****


***** [Internet Browser] *****

-\\ Internet Explorer v9.0.8112.16421

[OK] Die Registrierungsdatenbank ist sauber.

-\\ Mozilla Firefox v16.0.2 (de)

Profilname : default
Datei : C:\Users\S-System\AppData\Roaming\Mozilla\Firefox\Profiles\2om32i1e.default\prefs.js

[OK] Die Datei ist sauber.

Profilname : default
Datei : C:\Users\Surfer\AppData\Roaming\Mozilla\Firefox\Profiles\5lwozvxd.default\prefs.js

[OK] Die Datei ist sauber.

Profilname : default
Datei : C:\Users\Gast\AppData\Roaming\Mozilla\Firefox\Profiles\udigbhyo.default\prefs.js

[OK] Die Datei ist sauber.

*************************

AdwCleaner[S1].txt - [1787 octets] - [21/11/2012 18:55:55]
AdwCleaner[S2].txt - [1165 octets] - [23/11/2012 23:27:32]

########## EOF - C:\AdwCleaner[S2].txt - [1225 octets] ##########

ich hoffe ich überlade dich jetzt nich mit inforamtionen

will einfach nur sicher sein das mein system sauber ist

Geändert von Veantur (23.11.2012 um 22:57 Uhr)

Alt 24.11.2012, 05:00   #10
t'john
/// Helfer-Team
 
Nach Malwarebites durchlauf Malware.N.Spack gefunden - Standard

Nach Malwarebites durchlauf Malware.N.Spack gefunden



Sorry, ich habe irgedwie dein Thema verwechselt.



Die Bereinigung besteht aus mehreren Schritten, die ausgefuehrt werden muessen.
Diese Nacheinander abarbeiten und die 3 Logs, die dabei erstellt werden bitte in deine naechste Antwort einfuegen.

Sollte der OTL-FIX nicht richig durchgelaufen sein. Fahre nicht fort, sondern melde dies bitte.

1. Schritt

Fixen mit OTL

Lade (falls noch nicht vorhanden) OTL von Oldtimer herunter und speichere es auf Deinem Desktop (nicht woanders hin).

  • Deaktiviere etwaige Virenscanner wie Avira, Kaspersky etc.
  • Starte die OTL.exe.
    Vista- und Windows 7-User starten mit Rechtsklick auf das Programm-Icon und wählen "Als Administrator ausführen".
  • Kopiere folgendes Skript in das Textfeld unterhalb von Benuterdefinierte Scans/Fixes:
  • Der Fix fängt mit :OTL an. Vergewissere dich, dass du ihn richtig kopiert hast.


Code:
ATTFilter
:OTL
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\winampa.lng () 
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\winamp.lng () 
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\vis_milk2.lng () 
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\vis_avs.lng () 
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\ml_local.lng () 
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\ml_disc.lng () 
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\ml_pmp.lng () 
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\pmp_wifi.lng () 
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\pmp_ipod.lng () 
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\ombrowser.lng () 
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\ml_plg.lng () 
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\pmp_android.lng () 
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\out_ds.lng () 
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\ml_wire.lng () 
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\ml_online.lng () 
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\ml_playlists.lng () 
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\pmp_usb.lng () 
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\ml_downloads.lng () 
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\ml_history.lng () 
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\ml_devices.lng () 
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\ml_transcode.lng () 
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\vis_nsfs.lng () 
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\out_wave.lng () 
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\ml_autotag.lng () 
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\tagz.lng () 
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\out_disk.lng () 
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\ml_rg.lng () 
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\ml_impex.lng () 
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\ml_bookmarks.lng () 
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\pmp_activesync.lng () 
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\ml_enqplay.lng () 
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\in_wv.lng () 
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\pmp_p4s.lng () 
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\ml_orb.lng () 
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\pmp_njb.lng () 
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\ml_nowplaying.lng () 
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\ml_addons.lng () 
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\playlist.lng () 
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\gen_jumpex.lng () 
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\gen_classicart.lng () 
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\in_mp3.lng () 
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\gen_ff.lng () 
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\gen_ml.lng () 
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\in_midi.lng () 
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\in_mod.lng () 
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\in_wm.lng () 
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\in_cdda.lng () 
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\in_nsv.lng () 
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\gen_skinmanager.lng () 
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\in_vorbis.lng () 
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\gen_hotkeys.lng () 
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\gen_undo.lng () 
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\gen_timerestore.lng () 
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\gen_nopro.lng () 
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\gen_tray.lng () 
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\gen_orgler.lng () 
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\gen_crasher.lng () 
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\in_wav.lng () 
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\in_dshow.lng () 
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\enc_wma.lng () 
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\in_wave.lng () 
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\in_flac.lng () 
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\in_mp4.lng () 
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\in_avi.lng () 
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\in_mkv.lng () 
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\gen_find_on_disk.lng () 
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\in_swf.lng () 
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\in_linein.lng () 
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\in_flv.lng () 
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\burnlib.lng () 
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\dsp_sps.lng () 
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\auth.lng () 
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\enc_fhgaac.lng () 
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\enc_lame.lng () 
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\enc_wav.lng () 
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\enc_vorbis.lng () 
MOD - C:\Users\S-System\AppData\Local\Temp\WLZ898C.tmp\enc_flac.lng () 
IE - HKU\S-1-5-21-2320744662-329307789-2970131851-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = 188.95.51.206:80 
[2012.09.26 20:57:16 | 000,030,568 | ---- | C] () -- C:\Windows\MusiccityDownload.exe 
[2012.11.21 20:23:17 | 000,000,000 | ---D | C] -- C:\ProgramData\boost_interprocess 

:Files
C:\ProgramData\*.exe
C:\ProgramData\*.dll
C:\ProgramData\*.tmp
C:\ProgramData\TEMP
C:\Users\S-System\*.tmp
C:\Users\S-System\AppData\Local\Temp\*.exe
C:\Users\S-System\AppData\LocalLow\Sun\Java\Deployment\cache
%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk
ipconfig /flushdns /c
:Commands
[emptytemp]
         
  • Schließe alle Programme.
  • Klicke auf den Fix Button.
  • Wenn OTL einen Neustart verlangt, bitte zulassen.
  • Kopiere den Inhalt des Logfiles hier in Code-Tags in Deinen Thread.
    Nachträglich kannst Du das Logfile hier einsehen => C:\_OTL\MovedFiles\<datum_nummer.log>

Hinweis für Mitleser: Obiges OTL-Script ist ausschließlich für diesen User in dieser Situtation erstellt worden.
Auf keinen Fall auf anderen Rechnern anwenden, das kann andere Systeme nachhaltig schädigen!



2. Schritt
Downloade dir bitte Malwarebytes Anti-Rootkit und speichere es auf deinem Desktop.
  • Entpacke das Archiv auf deinem Desktop.
  • Im neu erstellten Ordner starte bitte die mbar.exe.
  • Folge den Anweisungen auf deinem Bildschirm und erlaube dem Tool, dein System zu scannen.
  • Klicke auf den CleanUp Button und erlaube den Neustart.
  • Während dem Neustart wird MBAR die gefundenen Objekte entfernen, also bleib geduldig.
  • Nach dem Neustart starte die mbar.exe erneut.
  • Sollte nochmal was gefunden werden, wiederhole den CleanUp Prozess.
Das Tool wird im erstellten Ordner eine Logfile ( mbar-log-<Jahr-Monat-Tag>.txt ) erzeugen. Bitte poste diese hier.

Starte keine andere Datei in diesem Ordner ohne Anweisung eines Helfers


danach:

3. Schritt
Downloade Dir bitte AdwCleaner Logo Icon AdwCleaner auf deinen Desktop.
  • Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
  • Starte die AdwCleaner.exe mit einem Doppelklick.
  • Stimme den Nutzungsbedingungen zu.
  • Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
    • "Tracing" Schlüssel löschen
    • Winsock Einstellungen zurücksetzen
    • Proxy Einstellungen zurücksetzen
    • Internet Explorer Richtlinien zurücksetzen
    • Chrome Richtlinien zurücksetzen
    • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
  • Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
  • Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
  • Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).
__________________
Mfg, t'john
Das TB unterstützen

Alt 24.11.2012, 11:36   #11
Veantur
 
Nach Malwarebites durchlauf Malware.N.Spack gefunden - Standard

Nach Malwarebites durchlauf Malware.N.Spack gefunden



moin t john
hier otl log

All processes killed
========== OTL ==========
HKU\S-1-5-21-2320744662-329307789-2970131851-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer| /E : value set successfully!
C:\Windows\MusiccityDownload.exe moved successfully.
Folder C:\ProgramData\boost_interprocess\ not found.
========== FILES ==========
File\Folder C:\ProgramData\*.exe not found.
File\Folder C:\ProgramData\*.dll not found.
File\Folder C:\ProgramData\*.tmp not found.
File\Folder C:\ProgramData\TEMP not found.
File\Folder C:\Users\S-System\*.tmp not found.
File\Folder C:\Users\S-System\AppData\Local\Temp\*.exe not found.
C:\Users\S-System\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\muffin folder moved successfully.
C:\Users\S-System\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\host folder moved successfully.
C:\Users\S-System\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\9 folder moved successfully.
C:\Users\S-System\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\8 folder moved successfully.
C:\Users\S-System\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\7 folder moved successfully.
C:\Users\S-System\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\63 folder moved successfully.
C:\Users\S-System\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\62 folder moved successfully.
C:\Users\S-System\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\61 folder moved successfully.
C:\Users\S-System\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\60 folder moved successfully.
C:\Users\S-System\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\6 folder moved successfully.
C:\Users\S-System\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\59 folder moved successfully.
C:\Users\S-System\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\58 folder moved successfully.
C:\Users\S-System\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\57 folder moved successfully.
C:\Users\S-System\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\56 folder moved successfully.
C:\Users\S-System\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\55 folder moved successfully.
C:\Users\S-System\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\54 folder moved successfully.
C:\Users\S-System\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\53 folder moved successfully.
C:\Users\S-System\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\52 folder moved successfully.
C:\Users\S-System\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\51 folder moved successfully.
C:\Users\S-System\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\50 folder moved successfully.
C:\Users\S-System\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\5 folder moved successfully.
C:\Users\S-System\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\49 folder moved successfully.
C:\Users\S-System\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\48 folder moved successfully.
C:\Users\S-System\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\47 folder moved successfully.
C:\Users\S-System\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\46 folder moved successfully.
C:\Users\S-System\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\45 folder moved successfully.
C:\Users\S-System\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\44 folder moved successfully.
C:\Users\S-System\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\43 folder moved successfully.
C:\Users\S-System\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\42 folder moved successfully.
C:\Users\S-System\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\41 folder moved successfully.
C:\Users\S-System\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\40 folder moved successfully.
C:\Users\S-System\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\4 folder moved successfully.
C:\Users\S-System\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\39 folder moved successfully.
C:\Users\S-System\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\38 folder moved successfully.
C:\Users\S-System\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\37 folder moved successfully.
C:\Users\S-System\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\36 folder moved successfully.
C:\Users\S-System\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\35 folder moved successfully.
C:\Users\S-System\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\34 folder moved successfully.
C:\Users\S-System\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\33 folder moved successfully.
C:\Users\S-System\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\32 folder moved successfully.
C:\Users\S-System\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\31 folder moved successfully.
C:\Users\S-System\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\30 folder moved successfully.
C:\Users\S-System\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\3 folder moved successfully.
C:\Users\S-System\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\29 folder moved successfully.
C:\Users\S-System\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\28 folder moved successfully.
C:\Users\S-System\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\27 folder moved successfully.
C:\Users\S-System\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\26 folder moved successfully.
C:\Users\S-System\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\25 folder moved successfully.
C:\Users\S-System\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\24 folder moved successfully.
C:\Users\S-System\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\23 folder moved successfully.
C:\Users\S-System\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\22 folder moved successfully.
C:\Users\S-System\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\21 folder moved successfully.
C:\Users\S-System\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\20 folder moved successfully.
C:\Users\S-System\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\2 folder moved successfully.
C:\Users\S-System\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\19 folder moved successfully.
C:\Users\S-System\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\18 folder moved successfully.
C:\Users\S-System\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\17 folder moved successfully.
C:\Users\S-System\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\16 folder moved successfully.
C:\Users\S-System\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\15 folder moved successfully.
C:\Users\S-System\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\14 folder moved successfully.
C:\Users\S-System\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\13 folder moved successfully.
C:\Users\S-System\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\12 folder moved successfully.
C:\Users\S-System\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\11 folder moved successfully.
C:\Users\S-System\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\10 folder moved successfully.
C:\Users\S-System\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\1 folder moved successfully.
C:\Users\S-System\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\0 folder moved successfully.
C:\Users\S-System\AppData\LocalLow\Sun\Java\Deployment\cache\6.0 folder moved successfully.
C:\Users\S-System\AppData\LocalLow\Sun\Java\Deployment\cache folder moved successfully.
File/Folder C:\Users\S-System\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk not found.
< ipconfig /flushdns /c >
Windows-IP-Konfiguration
Der DNS-Aufl”sungscache wurde geleert.
C:\Users\S-System\Desktop\cmd.bat deleted successfully.
C:\Users\S-System\Desktop\cmd.txt deleted successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Gast
->Temp folder emptied: 101913 bytes
->Temporary Internet Files folder emptied: 15088185 bytes
->FireFox cache emptied: 53186191 bytes
->Flash cache emptied: 848 bytes

User: Public

User: S-System
->Temp folder emptied: 189204334 bytes
->Temporary Internet Files folder emptied: 35325506 bytes
->FireFox cache emptied: 1031332286 bytes
->Flash cache emptied: 18906 bytes

User: Surfer
->Temp folder emptied: 143051 bytes
->Temporary Internet Files folder emptied: 65210 bytes
->FireFox cache emptied: 523561673 bytes
->Flash cache emptied: 9212 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 57506750 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 67832 bytes
RecycleBin emptied: 757163200 bytes

Total Files Cleaned = 2.539,00 mb


OTL by OldTimer - Version 3.2.69.0 log created on 11242012_122807

Files\Folders moved on Reboot...
C:\Users\S-System\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.

PendingFileRenameOperations files...

Registry entries deleted on Reboot...


malwarebites rootik scan

---------------------------------------
Malwarebytes Anti-Rootkit BETA 1.01.0.1009

(c) Malwarebytes Corporation 2011-2012

OS version: 6.1.7601 Windows 7 Service Pack 1 x64

Account is Administrative

Internet Explorer version: 9.0.8112.16421

File system is: NTFS
Disk drives: C:\ DRIVE_FIXED, D:\ DRIVE_FIXED, E:\ DRIVE_FIXED, F:\ DRIVE_FIXED, G:\ DRIVE_FIXED, H:\ DRIVE_FIXED, I:\ DRIVE_FIXED
CPU speed: 2.907000 GHz
Memory total: 4294107136, free: 2405404672

------------ Kernel report ------------
11/24/2012 12:38:12
------------ Loaded modules -----------
\SystemRoot\system32\ntoskrnl.exe
\SystemRoot\system32\hal.dll
\SystemRoot\system32\kdcom.dll
\SystemRoot\system32\mcupdate_AuthenticAMD.dll
\SystemRoot\system32\PSHED.dll
\SystemRoot\system32\CLFS.SYS
\SystemRoot\system32\CI.dll
\SystemRoot\system32\drivers\Wdf01000.sys
\SystemRoot\system32\drivers\WDFLDR.SYS
\SystemRoot\system32\drivers\ACPI.sys
\SystemRoot\system32\drivers\WMILIB.SYS
\SystemRoot\system32\drivers\msisadrv.sys
\SystemRoot\system32\drivers\pci.sys
\SystemRoot\system32\drivers\vdrvroot.sys
\SystemRoot\system32\DRIVERS\kl1.sys
\SystemRoot\System32\drivers\partmgr.sys
\SystemRoot\system32\drivers\volmgr.sys
\SystemRoot\System32\drivers\volmgrx.sys
\SystemRoot\system32\drivers\pciide.sys
\SystemRoot\system32\drivers\PCIIDEX.SYS
\SystemRoot\System32\drivers\mountmgr.sys
\SystemRoot\system32\drivers\vmbus.sys
\SystemRoot\system32\drivers\winhv.sys
\SystemRoot\system32\drivers\atapi.sys
\SystemRoot\system32\drivers\ataport.SYS
\SystemRoot\system32\drivers\amdxata.sys
\SystemRoot\system32\drivers\fltmgr.sys
\SystemRoot\system32\drivers\fileinfo.sys
\SystemRoot\System32\Drivers\Ntfs.sys
\SystemRoot\System32\Drivers\msrpc.sys
\SystemRoot\System32\Drivers\ksecdd.sys
\SystemRoot\System32\Drivers\cng.sys
\SystemRoot\System32\drivers\pcw.sys
\SystemRoot\System32\Drivers\Fs_Rec.sys
\SystemRoot\system32\drivers\ndis.sys
\SystemRoot\system32\drivers\NETIO.SYS
\SystemRoot\System32\Drivers\ksecpkg.sys
\SystemRoot\System32\drivers\tcpip.sys
\SystemRoot\System32\drivers\fwpkclnt.sys
\SystemRoot\system32\drivers\vmstorfl.sys
\SystemRoot\system32\drivers\volsnap.sys
\SystemRoot\System32\Drivers\spldr.sys
\SystemRoot\System32\drivers\rdyboost.sys
\SystemRoot\System32\Drivers\mup.sys
\SystemRoot\System32\drivers\hwpolicy.sys
\SystemRoot\System32\DRIVERS\fvevol.sys
\SystemRoot\system32\DRIVERS\disk.sys
\SystemRoot\system32\DRIVERS\CLASSPNP.SYS
\SystemRoot\system32\drivers\cdrom.sys
\SystemRoot\system32\DRIVERS\klif.sys
\SystemRoot\System32\Drivers\Null.SYS
\SystemRoot\System32\Drivers\Beep.SYS
\SystemRoot\System32\drivers\vga.sys
\SystemRoot\System32\drivers\VIDEOPRT.SYS
\SystemRoot\System32\drivers\watchdog.sys
\SystemRoot\System32\DRIVERS\RDPCDD.sys
\SystemRoot\system32\drivers\rdpencdd.sys
\SystemRoot\system32\drivers\rdprefmp.sys
\SystemRoot\System32\Drivers\Msfs.SYS
\SystemRoot\System32\Drivers\Npfs.SYS
\SystemRoot\system32\DRIVERS\tdx.sys
\SystemRoot\system32\DRIVERS\TDI.SYS
\SystemRoot\system32\DRIVERS\kl2.sys
\SystemRoot\system32\drivers\afd.sys
\SystemRoot\System32\DRIVERS\netbt.sys
\SystemRoot\system32\DRIVERS\wfplwf.sys
\SystemRoot\system32\DRIVERS\pacer.sys
\SystemRoot\system32\DRIVERS\klim6.sys
\SystemRoot\system32\DRIVERS\netbios.sys
\SystemRoot\system32\DRIVERS\serial.sys
\SystemRoot\system32\DRIVERS\wanarp.sys
\SystemRoot\system32\drivers\termdd.sys
\SystemRoot\system32\DRIVERS\rdbss.sys
\SystemRoot\system32\drivers\nsiproxy.sys
\SystemRoot\system32\drivers\mssmbios.sys
\SystemRoot\System32\drivers\discache.sys
\SystemRoot\system32\drivers\csc.sys
\SystemRoot\System32\Drivers\dfsc.sys
\SystemRoot\system32\DRIVERS\blbdrive.sys
\SystemRoot\system32\DRIVERS\tunnel.sys
\SystemRoot\system32\DRIVERS\amdppm.sys
\SystemRoot\system32\DRIVERS\atikmpag.sys
\SystemRoot\system32\DRIVERS\atikmdag.sys
\SystemRoot\System32\drivers\dxgkrnl.sys
\SystemRoot\System32\drivers\dxgmms1.sys
\SystemRoot\system32\drivers\HDAudBus.sys
\SystemRoot\system32\DRIVERS\Rt64win7.sys
\SystemRoot\system32\DRIVERS\usbohci.sys
\SystemRoot\system32\DRIVERS\USBPORT.SYS
\SystemRoot\system32\DRIVERS\usbehci.sys
\SystemRoot\system32\DRIVERS\serenum.sys
\SystemRoot\system32\drivers\i8042prt.sys
\SystemRoot\system32\DRIVERS\kbdclass.sys
\SystemRoot\system32\drivers\P17.sys
\SystemRoot\system32\drivers\portcls.sys
\SystemRoot\system32\drivers\drmk.sys
\SystemRoot\system32\drivers\ks.sys
\SystemRoot\system32\drivers\ksthunk.sys
\SystemRoot\system32\drivers\wmiacpi.sys
\SystemRoot\system32\drivers\CompositeBus.sys
\SystemRoot\system32\DRIVERS\AgileVpn.sys
\SystemRoot\system32\DRIVERS\rasl2tp.sys
\SystemRoot\system32\DRIVERS\ndistapi.sys
\SystemRoot\system32\DRIVERS\ndiswan.sys
\SystemRoot\system32\DRIVERS\raspppoe.sys
\SystemRoot\system32\DRIVERS\raspptp.sys
\SystemRoot\system32\DRIVERS\rassstp.sys
\SystemRoot\system32\DRIVERS\rdpbus.sys
\SystemRoot\system32\DRIVERS\mouclass.sys
\SystemRoot\system32\drivers\swenum.sys
\SystemRoot\system32\DRIVERS\amdiox64.sys
\SystemRoot\system32\DRIVERS\umbus.sys
\SystemRoot\system32\DRIVERS\usbhub.sys
\SystemRoot\System32\Drivers\NDProxy.SYS
\SystemRoot\system32\drivers\AtihdW76.sys
\SystemRoot\system32\drivers\HdAudio.sys
\SystemRoot\System32\Drivers\crashdmp.sys
\SystemRoot\System32\Drivers\dump_dumpata.sys
\SystemRoot\System32\Drivers\dump_atapi.sys
\SystemRoot\System32\Drivers\dump_dumpfve.sys
\SystemRoot\system32\DRIVERS\usbccgp.sys
\SystemRoot\system32\DRIVERS\USBD.SYS
\SystemRoot\system32\DRIVERS\hidusb.sys
\SystemRoot\system32\DRIVERS\HIDCLASS.SYS
\SystemRoot\system32\DRIVERS\HIDPARSE.SYS
\SystemRoot\system32\DRIVERS\kbdhid.sys
\SystemRoot\system32\DRIVERS\mouhid.sys
\SystemRoot\System32\win32k.sys
\SystemRoot\System32\drivers\Dxapi.sys
\SystemRoot\system32\DRIVERS\klmouflt.sys
\SystemRoot\system32\DRIVERS\monitor.sys
\SystemRoot\System32\TSDDD.dll
\SystemRoot\System32\cdd.dll
\SystemRoot\System32\ATMFD.DLL
\SystemRoot\system32\drivers\luafv.sys
\??\C:\Windows\system32\drivers\mbam.sys
\SystemRoot\system32\drivers\WudfPf.sys
\SystemRoot\system32\DRIVERS\lltdio.sys
\SystemRoot\system32\DRIVERS\rspndr.sys
\SystemRoot\system32\drivers\HTTP.sys
\SystemRoot\system32\DRIVERS\bowser.sys
\SystemRoot\System32\drivers\mpsdrv.sys
\SystemRoot\system32\DRIVERS\mrxsmb.sys
\SystemRoot\system32\DRIVERS\mrxsmb10.sys
\SystemRoot\system32\DRIVERS\mrxsmb20.sys
\??\C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys
\SystemRoot\system32\drivers\peauth.sys
\SystemRoot\System32\Drivers\secdrv.SYS
\SystemRoot\System32\DRIVERS\srvnet.sys
\SystemRoot\System32\drivers\tcpipreg.sys
\SystemRoot\System32\DRIVERS\srv2.sys
\SystemRoot\System32\DRIVERS\srv.sys
\SystemRoot\system32\drivers\spsys.sys
\SystemRoot\system32\DRIVERS\asyncmac.sys
\??\C:\Windows\system32\drivers\mbamchameleon.sys
\??\C:\Windows\system32\drivers\mbamswissarmy.sys
\Windows\System32\ntdll.dll
\Windows\System32\smss.exe
\Windows\System32\apisetschema.dll
\Windows\System32\autochk.exe
\Windows\System32\comdlg32.dll
\Windows\System32\msvcrt.dll
\Windows\System32\clbcatq.dll
\Windows\System32\user32.dll
\Windows\System32\usp10.dll
\Windows\System32\advapi32.dll
\Windows\System32\kernel32.dll
\Windows\System32\urlmon.dll
\Windows\System32\normaliz.dll
\Windows\System32\setupapi.dll
\Windows\System32\Wldap32.dll
\Windows\System32\iertutil.dll
\Windows\System32\sechost.dll
\Windows\System32\imm32.dll
\Windows\System32\psapi.dll
\Windows\System32\oleaut32.dll
\Windows\System32\difxapi.dll
\Windows\System32\lpk.dll
\Windows\System32\ole32.dll
\Windows\System32\nsi.dll
\Windows\System32\rpcrt4.dll
\Windows\System32\wininet.dll
\Windows\System32\gdi32.dll
\Windows\System32\imagehlp.dll
\Windows\System32\shell32.dll
\Windows\System32\ws2_32.dll
\Windows\System32\msctf.dll
\Windows\System32\shlwapi.dll
\Windows\System32\KernelBase.dll
\Windows\System32\wintrust.dll
\Windows\System32\crypt32.dll
\Windows\System32\cfgmgr32.dll
\Windows\System32\devobj.dll
\Windows\System32\comctl32.dll
\Windows\System32\msasn1.dll
----------- End -----------
<<<1>>>
Upper Device Name: \Device\Harddisk2\DR2
Upper Device Object: 0xfffffa8004a92060
Upper Device Driver Name: \Driver\Disk\
Lower Device Name: \Device\Ide\IdeDeviceP3T0L0-5\
Lower Device Object: 0xfffffa8004831060
Lower Device Driver Name: \Driver\atapi\
Driver name found: atapi
DriverEntry returned 0x0
Function returned 0x0
<<<1>>>
Upper Device Name: \Device\Harddisk1\DR1
Upper Device Object: 0xfffffa8004a91060
Upper Device Driver Name: \Driver\Disk\
Lower Device Name: \Device\Ide\IdeDeviceP1T1L0-7\
Lower Device Object: 0xfffffa8004825060
Lower Device Driver Name: \Driver\atapi\
Driver name found: atapi
<<<1>>>
Upper Device Name: \Device\Harddisk0\DR0
Upper Device Object: 0xfffffa8004a90060
Upper Device Driver Name: \Driver\Disk\
Lower Device Name: \Device\Ide\IdeDeviceP0T0L0-0\
Lower Device Object: 0xfffffa800474f060
Lower Device Driver Name: \Driver\atapi\
Driver name found: atapi
Downloaded database version: v2012.11.24.03
Downloaded database version: v2012.11.19.01
Initializing...
Done!
Scanning directory: C:\Windows\system32\drivers...
<<<2>>>
Device number: 0, partition: 3
Physical Sector Size: 512
Drive: 0, DevicePointer: 0xfffffa8004a90060, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
--------- Disk Stack ------
DevicePointer: 0xfffffa8004a90b90, DeviceName: Unknown, DriverName: \Driver\partmgr\
DevicePointer: 0xfffffa8004a90060, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
DevicePointer: 0xfffffa800474e580, DeviceName: Unknown, DriverName: \Driver\ACPI\
DevicePointer: 0xfffffa800474f060, DeviceName: \Device\Ide\IdeDeviceP0T0L0-0\, DriverName: \Driver\atapi\
------------ End ----------
Upper DeviceData: 0xfffff8a00c2fc1e0, 0xfffffa8004a90060, 0xfffffa800422b090
Lower DeviceData: 0xfffff8a001b3b130, 0xfffffa800474f060, 0xfffffa8004216e40
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
Done!
Drive 0
Scanning MBR on drive 0...
Inspecting partition table:
MBR Signature: 55AA
Disk Signature: B07EE9C5

Partition information:

Partition 0 type is Primary (0x7)
Partition is NOT ACTIVE.
Partition starts at LBA: 63 Numsec = 868409577

Partition 1 type is Primary (0x7)
Partition is NOT ACTIVE.
Partition starts at LBA: 868409640 Numsec = 771553755

Partition 2 type is Primary (0x7)
Partition is ACTIVE.
Partition starts at LBA: 1639963395 Numsec = 313556670
Partition file system is NTFS
Partition is bootable

Partition 3 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0

Disk Size: 1000204886016 bytes
Sector size: 512 bytes

Scanning physical sectors of unpartitioned space on drive 0 (1-62-1953505168-1953525168)...
Physical Sector Size: 512
Drive: 1, DevicePointer: 0xfffffa8004a91060, DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\Disk\
--------- Disk Stack ------
DevicePointer: 0xfffffa8004a91b90, DeviceName: Unknown, DriverName: \Driver\partmgr\
DevicePointer: 0xfffffa8004a91060, DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\Disk\
DevicePointer: 0xfffffa8004825c90, DeviceName: Unknown, DriverName: \Driver\ACPI\
DevicePointer: 0xfffffa8004825060, DeviceName: \Device\Ide\IdeDeviceP1T1L0-7\, DriverName: \Driver\atapi\
------------ End ----------
Upper DeviceData: 0xfffff8a003c5c100, 0xfffffa8004a91060, 0xfffffa800422d790
Lower DeviceData: 0xfffff8a00caafce0, 0xfffffa8004825060, 0xfffffa800422c540
Drive 1
Scanning MBR on drive 1...
Inspecting partition table:
MBR Signature: 55AA
Disk Signature: B944727

Partition information:

Partition 0 type is Primary (0x7)
Partition is NOT ACTIVE.
Partition starts at LBA: 2048 Numsec = 976769024

Partition 1 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0

Partition 2 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0

Partition 3 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0

Disk Size: 500107862016 bytes
Sector size: 512 bytes

Physical Sector Size: 512
Drive: 2, DevicePointer: 0xfffffa8004a92060, DeviceName: \Device\Harddisk2\DR2\, DriverName: \Driver\Disk\
--------- Disk Stack ------
DevicePointer: 0xfffffa8004a92b90, DeviceName: Unknown, DriverName: \Driver\partmgr\
DevicePointer: 0xfffffa8004a92060, DeviceName: \Device\Harddisk2\DR2\, DriverName: \Driver\Disk\
DevicePointer: 0xfffffa8004891bc0, DeviceName: Unknown, DriverName: \Driver\ACPI\
DevicePointer: 0xfffffa8004831060, DeviceName: \Device\Ide\IdeDeviceP3T0L0-5\, DriverName: \Driver\atapi\
------------ End ----------
Upper DeviceData: 0xfffff8a00c9ac1c0, 0xfffffa8004a92060, 0xfffffa800421d090
Lower DeviceData: 0xfffff8a00ca9eb00, 0xfffffa8004831060, 0xfffffa8003ef3b40
Drive 2
Scanning MBR on drive 2...
Inspecting partition table:
MBR Signature: 55AA
Disk Signature: C9FFC9FF

Partition information:

Partition 0 type is Primary (0x7)
Partition is ACTIVE.
Partition starts at LBA: 63 Numsec = 51199092
Partition file system is NTFS
Partition is not bootable

Partition 1 type is Primary (0x7)
Partition is NOT ACTIVE.
Partition starts at LBA: 51199155 Numsec = 30716280

Partition 2 type is Primary (0x7)
Partition is NOT ACTIVE.
Partition starts at LBA: 81915435 Numsec = 190801958

Partition 3 type is Extended with CSH (0x5)
Partition is NOT ACTIVE.
Partition starts at LBA: 272717822 Numsec = 39862274

Disk Size: 160041885696 bytes
Sector size: 512 bytes

Done!
Performing system, memory and registry scan...
Read File: File "C:\ProgramData\{2B1A3ED6-C663-46A8-9249-D663F0C35EF2}\instance.dat" is compressed (flags = 1)
Read File: File "C:\ProgramData\{2B1A3ED6-C663-46A8-9249-D663F0C35EF2}\setup.dat" is compressed (flags = 1)
Done!
Scan finished
=======================================


hier heisst es clean up nicht notwendig


adw cleaner log

# AdwCleaner v2.008 - Datei am 24/11/2012 um 12:47:53 erstellt
# Aktualisiert am 17/11/2012 von Xplode
# Betriebssystem : Windows 7 Professional Service Pack 1 (64 bits)
# Benutzer : S-System - S-SYSTEM-PC
# Bootmodus : Normal
# Ausgeführt unter : C:\Users\S-System\Desktop\adwcleaner.exe
# Option [Löschen]


**** [Dienste] ****


***** [Dateien / Ordner] *****


***** [Registrierungsdatenbank] *****


***** [Internet Browser] *****

-\\ Internet Explorer v9.0.8112.16421

[OK] Die Registrierungsdatenbank ist sauber.

-\\ Mozilla Firefox v16.0.2 (de)

Profilname : default
Datei : C:\Users\S-System\AppData\Roaming\Mozilla\Firefox\Profiles\2om32i1e.default\prefs.js

[OK] Die Datei ist sauber.

Profilname : default
Datei : C:\Users\Surfer\AppData\Roaming\Mozilla\Firefox\Profiles\5lwozvxd.default\prefs.js

[OK] Die Datei ist sauber.

Profilname : default
Datei : C:\Users\Gast\AppData\Roaming\Mozilla\Firefox\Profiles\udigbhyo.default\prefs.js

[OK] Die Datei ist sauber.

*************************

AdwCleaner[S1].txt - [1787 octets] - [21/11/2012 18:55:55]
AdwCleaner[S2].txt - [1294 octets] - [23/11/2012 23:27:32]
AdwCleaner[S3].txt - [1172 octets] - [24/11/2012 12:47:53]

########## EOF - C:\AdwCleaner[S3].txt - [1232 octets] ##########

Geändert von Veantur (24.11.2012 um 11:51 Uhr)

Alt 24.11.2012, 20:43   #12
t'john
/// Helfer-Team
 
Nach Malwarebites durchlauf Malware.N.Spack gefunden - Standard

Nach Malwarebites durchlauf Malware.N.Spack gefunden



zu Malwarebytes' Anti-Rootkit, bitte das andere Log posten!
siehe Anleitung!
__________________
Mfg, t'john
Das TB unterstützen

Alt 24.11.2012, 21:02   #13
Veantur
 
Nach Malwarebites durchlauf Malware.N.Spack gefunden - Standard

Nach Malwarebites durchlauf Malware.N.Spack gefunden



hi t john tatsächlich das zweite vergessen

Malwarebytes Anti-Rootkit 1.1.0.1009
www.malwarebytes.org

Database version: v2012.11.24.03

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
S-System :: S-SYSTEM-PC [administrator]

24.11.2012 12:44:53
mbar-log-2012-11-24 (12-44-53).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken
Scan options disabled: PUP | PUM | P2P
Objects scanned: 25447
Time elapsed: 5 minute(s), 51 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)

Alt 25.11.2012, 06:00   #14
t'john
/// Helfer-Team
 
Nach Malwarebites durchlauf Malware.N.Spack gefunden - Standard

Nach Malwarebites durchlauf Malware.N.Spack gefunden



Sehr gut!

Wie laeuft der Rechner?


Malware-Scan mit Emsisoft Anti-Malware

Lade die Gratisversion von => Emsisoft Anti-Malware herunter und installiere das Programm.
Lade über Jetzt Updaten die aktuellen Signaturen herunter.
Wähle den Freeware-Modus aus.

Wähle Detail Scan und starte über den Button Scan die Überprüfung des Computers.
Am Ende des Scans nichts loeschen lassen!. Mit Klick auf Bericht speichern das Logfile auf dem Desktop speichern und hier in den Thread posten.

Anleitung: http://www.trojaner-board.de/103809-...i-malware.html
__________________
Mfg, t'john
Das TB unterstützen

Alt 25.11.2012, 10:32   #15
Veantur
 
Nach Malwarebites durchlauf Malware.N.Spack gefunden - Standard

Nach Malwarebites durchlauf Malware.N.Spack gefunden



hallo t john

der Malware-Scan mit Emsisoft Anti-Malware läuft , hat den anschein dass es etwas länger dauern wird.

es wurde ein schädling gefunden in der adwcleaner.exe (Trojan.Generic.8191512(B)) kann es falscher alarm sein ?

Emsisoft Anti-Malware - Version 7.0
Letztes Update: 25.11.2012 10:31:07

Scan Einstellungen:

Scan Methode: Detail Scan
Objekte: Rootkits, Speicher, Traces, C:\, D:\, E:\, F:\, G:\, H:\, I:\

Riskware-Erkennung: Aus
Archiv Scan: An
ADS Scan: An
Dateitypen-Filter: Aus
Erweitertes Caching: An
Direkter Festplattenzugriff: Aus

Scan Beginn: 25.11.2012 10:31:24

C:\Users\S-System\Desktop\adwcleaner.exe gefunden: Trojan.Generic.8191512 (B)
C:\Users\S-System\Downloads\adwcleaner.exe gefunden: Trojan.Generic.8191512 (B)
G:\System Volume Information\_restore{38E6B898-21CA-47D3-BAAD-D2510E6A19DA}\RP62\A0012948.exe gefunden: Trojan.Win32.Agent.bqpu (A)

Gescannt 1202310
Gefunden 3

Scan Ende: 25.11.2012 15:13:16
Scan Zeit: 4:41:52

Antwort

Themen zu Nach Malwarebites durchlauf Malware.N.Spack gefunden
administrator, adobe, adobe flash player, autorun, avp.exe, explorer, firefox, flash player, focus, format, forum?, infizierte, install.exe, kaspersky, logfile, malware.nspack, monitor.exe, mozilla, nexus, officejet, pirates, programme, realtek, registry, richtlinie, rundll, security, software, svchost.exe, tastatur, teamspeak, temp, version.



Ähnliche Themen: Nach Malwarebites durchlauf Malware.N.Spack gefunden


  1. Google/Firefox und weitere Programme funktionieren nach Durchlauf von Avira nicht
    Plagegeister aller Art und deren Bekämpfung - 30.03.2015 (17)
  2. adwcleaner jeweils nach dem Durchlauf einer Rubrik neu starten?
    Antiviren-, Firewall- und andere Schutzprogramme - 08.03.2015 (5)
  3. Nach ImgBurn Installation Malware gefunden
    Plagegeister aller Art und deren Bekämpfung - 24.09.2014 (15)
  4. Nach Durchlauf Malwarebytes einen Befall festgestellt
    Plagegeister aller Art und deren Bekämpfung - 11.08.2014 (15)
  5. Viele Fehler mit Malwarebites Anti-Malware gefunden
    Log-Analyse und Auswertung - 21.07.2014 (43)
  6. Malwarebites findet Befall mit PUP.Optional.WowSearch.A nach Lame-aktuallisierung (Windows 8.1)
    Log-Analyse und Auswertung - 05.06.2014 (40)
  7. Hilfe! Malware/Backdoor gefunden & Outlook stürzt nach Start ab
    Plagegeister aller Art und deren Bekämpfung - 13.02.2014 (10)
  8. Vista: nach Avira Systemcheck einige Malware und Trojaner gefunden
    Log-Analyse und Auswertung - 26.01.2014 (3)
  9. Weißer Bildschirm bei Windows XP nach start - zuvor Malware gefunden
    Log-Analyse und Auswertung - 23.05.2013 (19)
  10. Nach Malwarebites durchlauf Malware.N.Spack gefunden
    Log-Analyse und Auswertung - 21.11.2012 (1)
  11. Nach Malware- Scan 21 Infizierungen auf meinen Rechner gefunden. Was soll ich tun?
    Plagegeister aller Art und deren Bekämpfung - 17.06.2011 (7)
  12. Nach Malwarebites'Anti-Maleware Scannung alle Daten und Programme weg
    Log-Analyse und Auswertung - 16.06.2011 (3)
  13. nach malware scan 139 viren gefunden auf meinen rechner was soll ich tun
    Plagegeister aller Art und deren Bekämpfung - 11.06.2011 (1)
  14. Beim Virenprogramm durchlauf Maleware gefunden..
    Plagegeister aller Art und deren Bekämpfung - 04.05.2011 (7)
  15. Antimalware Doctor nach Malwarebytes Anti Malware Durchlauf noch da
    Log-Analyse und Auswertung - 03.10.2010 (1)
  16. Nach Durchlauf von S&D, immer noch Trojaner am PC
    Mülltonne - 11.11.2008 (0)
  17. Malwarebites Anti-Malware oder Superantispyware
    Antiviren-, Firewall- und andere Schutzprogramme - 29.04.2008 (2)

Zum Thema Nach Malwarebites durchlauf Malware.N.Spack gefunden - Hallo wie im Titel erwähnt habe ich nach routine Malwarebytes durchlauf zwei infizierte Datien entdeckt hier im anhang der log Malwarebytes Anti-Malware 1.65.1.1000 www.malwarebytes.org Datenbank Version: v2012.11.20.03 Windows 7 Service - Nach Malwarebites durchlauf Malware.N.Spack gefunden...
Archiv
Du betrachtest: Nach Malwarebites durchlauf Malware.N.Spack gefunden auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.