Zurück   Trojaner-Board > Malware entfernen > Plagegeister aller Art und deren Bekämpfung

Plagegeister aller Art und deren Bekämpfung: Malware loswerden, wie?

Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen.

Antwort
Alt 23.07.2013, 13:13   #1
Haterix
 
Malware loswerden, wie? - Standard

Malware loswerden, wie?



Hallo liebes Trojaner-Board,

Ich habe seit ein paar Minuten das Problem das sich manchmal Seiten wie "Blackmath.net", "Ads.glispa.com" oder "datasrvrs.com" öffnen ohne das ich es möchte.

Ich habe keine große Ahnung von solchen Dingen, aber ich möchte nicht dass das so weiter geht.

Mir wurde geraten hier nach Hilfe zu suchen und mein Problem zu beschreiben.

Ich hoffe es kann mir jemand helfen.

Alt 23.07.2013, 13:21   #2
schrauber
/// the machine
/// TB-Ausbilder
 

Malware loswerden, wie? - Standard

Malware loswerden, wie?



hi,

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST Download FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
  • Starte jetzt FRST.
  • Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
  • Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
  • Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

__________________

__________________

Alt 23.07.2013, 13:35   #3
Haterix
 
Malware loswerden, wie? - Standard

Malware loswerden, wie?



Vielen dank für diese erstmal schnelle und kompetente Antwort.


(Es tut mir leid falls ich etwas unbeholfen wirke, ich habe mich nie wirklich mit meinem PC befasst)

Ich habe nun wie mir jemand geraten hat OTL laufen lassen und die Logdateien sehen wie folgt aus:
OTL Logfile:
Code:
ATTFilter
OTL logfile created on: 23.07.2013 14:21:17 - Run 1
OTL by OldTimer - Version 3.2.69.0     Folder = D:\Downloads
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.10.9200.16635)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
5,98 Gb Total Physical Memory | 3,34 Gb Available Physical Memory | 55,87% Memory free
11,96 Gb Paging File | 9,10 Gb Available in Paging File | 76,08% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 457,89 Gb Total Space | 353,20 Gb Free Space | 77,14% Space Free | Partition Type: NTFS
Drive D: | 457,89 Gb Total Space | 181,39 Gb Free Space | 39,61% Space Free | Partition Type: NTFS
Drive E: | 3,15 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: CDFS
 
Computer Name: PETER-PC | User Name: peter | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - D:\Downloads\OTL.exe (OldTimer Tools)
PRC - C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Users\peter\AppData\Roaming\WebCake\WebCakeDesktop.exe (WebCake LLC)
PRC - C:\Program Files (x86)\WebCake\WebCakeDesktop.Updater.exe (WebCake LLC)
PRC - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_7_700_202.exe (Adobe Systems, Inc.)
PRC - C:\Users\peter\AppData\Local\Akamai\netsession_win.exe (Akamai Technologies, Inc.)
PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe (Malwarebytes Corporation)
PRC - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation)
PRC - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avscan.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avcenter.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Program Files (x86)\Acer\Hotkey Utility\HotkeyUtility.exe ()
PRC - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Intel Corporation)
PRC - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Intel Corporation)
PRC - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe (Intel Corporation)
PRC - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Intel Corporation)
PRC - C:\Program Files (x86)\EgisTec MyWinLocker\x86\mwlDaemon.exe (Egis Technology Inc.)
PRC - C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe (Egis Technology Inc.)
PRC - C:\Program Files\Acer\Acer Updater\UpdaterService.exe (Acer Group)
PRC - C:\Program Files (x86)\Acer\Registration\GREGsvc.exe (Acer Incorporated)
PRC - C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe (MAGIX AG)
PRC - C:\Program Files (x86)\TC UP\TOTALCMD.EXE (C. Ghisler & Co.)
 
 
========== Modules (No Company Name) ==========
 
MOD - C:\Users\peter\AppData\Roaming\WebCake\dat\sqlite3.DLL ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\IAStorUtil\e937e3331234e8da935e71172e46ba17\IAStorUtil.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\IAStorCommon\34002b75cd0faab68bf8079299c1aa46\IAStorCommon.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\c8ea295fd4dce110b32c3c4f0e3807b2\System.Runtime.Remoting.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\178644ab40108f3becd8b91049a254c3\System.Windows.Forms.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\bfa7a95284aec941f4b03bae0debe07c\System.Drawing.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\c25666b99761bc42322bae2e59968df8\WindowsBase.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\32066405eb9ab14056b2af3115d2a6de\System.Xml.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\9e24b9ffd816c0c90efc4d3fc9fd745f\System.Configuration.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System\187c13e8967097d2ed1e5f123e7d890a\System.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9a6c1b7af18b4d5a91dc7f8d6617522f\mscorlib.ni.dll ()
MOD - C:\Program Files (x86)\Mozilla Firefox\mozjs.dll ()
MOD - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_202.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\System.Xml\2.0.0.0__b77a5c561934e089\System.Xml.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\System.Configuration\2.0.0.0__b03f5f7f11d50a3a\System.Configuration.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.dll ()
MOD - C:\Windows\assembly\GAC_32\System.Web\2.0.0.0__b03f5f7f11d50a3a\System.Web.dll ()
MOD - C:\Program Files (x86)\Acer\Hotkey Utility\HotkeyUtility.exe ()
MOD - C:\Program Files (x86)\Acer\Hotkey Utility\HotkeyHook.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll ()
MOD - C:\Windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll ()
MOD - C:\Windows\assembly\GAC_MSIL\System.Runtime.Remoting.resources\2.0.0.0_de_b77a5c561934e089\System.Runtime.Remoting.resources.dll ()
 
 
========== Services (SafeList) ==========
 
SRV:64bit: - (WinDefend) -- C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV:64bit: - (wlcrasvc) -- C:\Program Files\Windows Live\Mesh\wlcrasvc.exe (Microsoft Corporation)
SRV:64bit: - (Updater Service) -- C:\Program Files\Acer\Acer Updater\UpdaterService.exe (Acer Group)
SRV:64bit: - (UxTuneUp) -- C:\Windows\SysNative\uxtuneup.dll (TuneUp Software)
SRV - (MozillaMaintenance) -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (Akamai) -- c:\program files (x86)\common files\akamai/netsession_win_8fa3539.dll ()
SRV - (MBAMService) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
SRV - (MBAMScheduler) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe (Malwarebytes Corporation)
SRV - (SkypeUpdate) -- C:\Program Files (x86)\Skype\Updater\Updater.exe (Skype Technologies)
SRV - (nvUpdatusService) -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe (NVIDIA Corporation)
SRV - (Stereo Service) -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation)
SRV - (AdobeARMservice) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
SRV - (AntiVirSchedulerService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)
SRV - (AntiVirService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)
SRV - (TuneUp.Defrag) -- C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpDefragService.exe (TuneUp Software)
SRV - (npggsvc) -- C:\Windows\SysWOW64\GameMon.des (INCA Internet Co., Ltd.)
SRV - (UNS) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Intel Corporation)
SRV - (LMS) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Intel Corporation)
SRV - (IAStorDataMgrSvc) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe (Intel Corporation)
SRV - (MWLService) -- C:\Program Files (x86)\EgisTec MyWinLocker\x86\MWLService.exe (Egis Technology Inc.)
SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (Nero BackItUp Scheduler 4.0) -- C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe (Nero AG)
SRV - (GREGService) -- C:\Program Files (x86)\Acer\Registration\GREGsvc.exe (Acer Incorporated)
SRV - (TuneUp.UtilitiesSvc) -- C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpUtilitiesService64.exe (TuneUp Software)
SRV - (UxTuneUp) -- C:\Windows\SysWOW64\uxtuneup.dll (TuneUp Software)
SRV - (Fabs) -- C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe (MAGIX AG)
SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
SRV - (FirebirdServerMAGIXInstance) -- C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\fbserver.exe (MAGIX®)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - (MBAMProtector) -- C:\Windows\SysNative\drivers\mbam.sys (Malwarebytes Corporation)
DRV:64bit: - (aswKbd) -- C:\Windows\SysNative\drivers\aswKbd.sys (AVAST Software)
DRV:64bit: - (avkmgr) -- C:\Windows\SysNative\drivers\avkmgr.sys (Avira GmbH)
DRV:64bit: - (avipbb) -- C:\Windows\SysNative\drivers\avipbb.sys (Avira GmbH)
DRV:64bit: - (avgntflt) -- C:\Windows\SysNative\drivers\avgntflt.sys (Avira GmbH)
DRV:64bit: - (Fs_Rec) -- C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation)
DRV:64bit: - (tap0901) -- C:\Windows\SysNative\drivers\tap0901.sys (The OpenVPN Project)
DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (TsUsbFlt) -- C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV:64bit: - (e1cexpress) -- C:\Windows\SysNative\drivers\e1c62x64.sys (Intel Corporation)
DRV:64bit: - (MEIx64) -- C:\Windows\SysNative\drivers\HECIx64.sys (Intel Corporation)
DRV:64bit: - (iaStor) -- C:\Windows\SysNative\drivers\iaStor.sys (Intel Corporation)
DRV:64bit: - (NVHDA) -- C:\Windows\SysNative\drivers\nvhda64v.sys (NVIDIA Corporation)
DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (1394hub) -- C:\Windows\SysNative\svchost.exe (Microsoft Corporation)
DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV:64bit: - (mwlPSDVDisk) -- C:\Windows\SysNative\drivers\mwlPSDVDisk.sys (Egis Technology Inc.)
DRV:64bit: - (mwlPSDFilter) -- C:\Windows\SysNative\drivers\mwlPSDFilter.sys (Egis Technology Inc.)
DRV:64bit: - (mwlPSDNServ) -- C:\Windows\SysNative\drivers\mwlPSDNserv.sys (Egis Technology Inc.)
DRV - (TuneUpUtilitiesDrv) -- C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpUtilitiesDriver64.sys (TuneUp Software)
DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)
DRV - (VD_FileDisk) -- C:\Windows\SysWow64\drivers\vd_filedisk.sys (Flint Incorporation)
DRV - (NPPTNT2) -- C:\Windows\SysWOW64\npptNT2.sys (INCA Internet Co., Ltd.)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=AARTDF&pc=MAAR&src=IE-SearchBox
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=AARTDF&pc=MAAR&src=IE-SearchBox
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>
 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>
 
 
 
IE - HKU\S-1-5-21-113889186-958389736-2327801283-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://acer.msn.com
IE - HKU\S-1-5-21-113889186-958389736-2327801283-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://start.nexon.com
IE - HKU\S-1-5-21-113889186-958389736-2327801283-1000\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\S-1-5-21-113889186-958389736-2327801283-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-113889186-958389736-2327801283-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>
 
========== FireFox ==========
 
FF - prefs.js..extensions.enabledAddons: %7B64161300-e22b-11db-8314-0800200c9a66%7D:0.9.6.15
FF - prefs.js..extensions.enabledAddons: plugin%40getwebcake.com:1.00.01
FF - prefs.js..extensions.enabledAddons: %7Bb9db16a4-6edc-47ec-a1f4-b86292ed211d%7D:4.9.17
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:22.0
 
 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_7_700_202.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_202.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.25.2: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.25.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3555.0308: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@nexon.com/NexonPlugWebExtension: C:\ProgramData\Nexon\NexonPlug\npPlugWire_1.0.0.0.dll (Nexon)
FF - HKLM\Software\MozillaPlugins\@nexon.com/NxGame: C:\ProgramData\Nexon\NGM\npnxgame.dll File not found
FF - HKLM\Software\MozillaPlugins\@nexon.net/NxGame: C:\ProgramData\NexonUS\NGM\npNxGameUS.dll File not found
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@ogplanet.com/npOGPPlugin: C:\Windows\system32\npOGPPlugin.dll (OGPlanet)
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{EB132DB0-A4CA-11DF-9732-0E29E0D72085}: C:\Program Files (x86)\Object\facetheme [2011.07.18 00:34:06 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\{EB132DB0-A4CA-11DF-9732-0E29E0D72085}: C:\Program Files (x86)\Object\facetheme [2011.07.18 00:34:06 | 000,000,000 | ---D | M]
 
[2013.07.14 19:52:26 | 000,000,000 | ---D | M] (No name found) -- C:\Users\peter\AppData\Roaming\mozilla\Extensions
[2013.07.22 15:56:00 | 000,000,000 | ---D | M] (No name found) -- C:\Users\peter\AppData\Roaming\mozilla\Firefox\Profiles\bjyo7zt0.default\extensions
[2011.12.27 15:46:19 | 000,000,000 | ---D | M] (Hyperionics DB Toolbar) -- C:\Users\peter\AppData\Roaming\mozilla\Firefox\Profiles\bjyo7zt0.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}
[2013.07.19 23:26:37 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Users\peter\AppData\Roaming\mozilla\Firefox\Profiles\bjyo7zt0.default\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2013.07.11 17:10:48 | 000,000,000 | ---D | M] (WebCake) -- C:\Users\peter\AppData\Roaming\mozilla\Firefox\Profiles\bjyo7zt0.default\extensions\plugin@getwebcake.com
[2013.06.05 18:20:49 | 000,281,668 | ---- | M] () (No name found) -- C:\Users\peter\AppData\Roaming\mozilla\firefox\profiles\bjyo7zt0.default\extensions\{64161300-e22b-11db-8314-0800200c9a66}.xpi
[2013.07.22 15:56:00 | 000,818,491 | ---- | M] () (No name found) -- C:\Users\peter\AppData\Roaming\mozilla\firefox\profiles\bjyo7zt0.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
[2013.07.03 06:16:26 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\browser\extensions
[2013.07.03 06:16:29 | 000,000,000 | ---D | M] (Default) -- C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
 
O1 HOSTS File: ([2009.06.10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2 - BHO: (WebCake) - {2A5A2A90-3B30-4E6E-A955-2F232C6EF517} - C:\Program Files (x86)\WebCake\WebCakeIEClient.dll (WebCake LLC)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (SMTTB2009 Class) - {FCBCCB87-9224-4B8D-B117-F56D924BEB18} - C:\Program Files (x86)\Hyperionics DB Toolbar\tbcore3.dll ()
O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKLM\..\Toolbar: (Hyperionics DB Toolbar) - {338B4DFE-2E2C-4338-9E41-E176D497299E} - C:\Program Files (x86)\Hyperionics DB Toolbar\tbcore3.dll ()
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKU\S-1-5-21-113889186-958389736-2327801283-1000\..\Toolbar\WebBrowser: (Hyperionics DB Toolbar) - {338B4DFE-2E2C-4338-9E41-E176D497299E} - C:\Program Files (x86)\Hyperionics DB Toolbar\tbcore3.dll ()
O4:64bit: - HKLM..\Run: [mwlDaemon] C:\Program Files (x86)\EgisTec MyWinLocker\x86\mwlDaemon.exe (Egis Technology Inc.)
O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [EgisTecPMMUpdate] C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe (Egis Technology Inc.)
O4 - HKLM..\Run: [Hotkey Utility] C:\Program Files (x86)\Acer\Hotkey Utility\HotkeyUtility.exe ()
O4 - HKLM..\Run: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Intel Corporation)
O4 - HKLM..\Run: [SuiteTray] C:\Program Files (x86)\EgisTec MyWinLockerSuite\x86\SuiteTray.exe (Egis Technology Inc.)
O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-21-113889186-958389736-2327801283-1000..\Run: [Akamai NetSession Interface] C:\Users\peter\AppData\Local\Akamai\netsession_win.exe (Akamai Technologies, Inc.)
O4 - HKU\S-1-5-21-113889186-958389736-2327801283-1000..\Run: [WebCake Desktop] C:\Users\peter\AppData\Roaming\WebCake\WebCakeDesktop.exe (WebCake LLC)
O4 - HKLM..\RunOnce: [ Malwarebytes Anti-Malware ] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutorun = 0
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutorun = 0
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{50013DB5-E9CF-4C4A-8250-CC107C688551}: DhcpNameServer = 192.168.2.1
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\msdaipp - No CLSID value found
O18:64bit: - Protocol\Handler\msdaipp\0x00000001 - No CLSID value found
O18:64bit: - Protocol\Handler\msdaipp\oledb - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\mso-offdap11 - No CLSID value found
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18:64bit: - Protocol\Handler\wlpg - No CLSID value found
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18:64bit: - Protocol\Filter\text/xml - No CLSID value found
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2013.07.23 14:20:01 | 000,000,000 | ---D | C] -- C:\Users\peter\AppData\Roaming\Malwarebytes
[2013.07.23 14:19:07 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2013.07.23 14:19:04 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2013.07.23 14:19:03 | 000,025,928 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2013.07.23 14:19:03 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2013.07.23 00:12:34 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\koramgame
[2013.07.23 00:10:34 | 000,000,000 | ---D | C] -- C:\koramgame
[2013.07.22 11:53:50 | 000,000,000 | ---D | C] -- C:\Users\peter\AppData\Local\{BD40AB1C-0A4E-4DDF-833E-E9EE7CB54B3B}
[2013.07.21 23:53:24 | 000,000,000 | ---D | C] -- C:\Users\peter\AppData\Local\{0AAB630D-473D-4CE5-9C06-9C4B49BCFB64}
[2013.07.20 09:09:16 | 000,000,000 | ---D | C] -- C:\Users\peter\AppData\Local\{F59909EA-0794-4496-A61C-F223F3430CEF}
[2013.07.17 04:30:57 | 000,000,000 | ---D | C] -- C:\Windows\Sun
[2013.07.16 11:54:38 | 000,000,000 | ---D | C] -- C:\Users\peter\AppData\Local\{94D7BEBB-D0CC-4B33-B342-35BB542AFBE1}
[2013.07.15 18:03:57 | 000,000,000 | ---D | C] -- C:\Users\peter\AppData\Local\{EBE713C7-C5F2-4E3F-A324-4013AE55F55C}
[2013.07.15 04:44:04 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Grand Chase
[2013.07.15 04:38:13 | 000,000,000 | ---D | C] -- C:\SG Interactive
[2013.07.15 04:38:07 | 000,000,000 | ---D | C] -- C:\Users\peter\AppData\Local\Programs
[2013.07.15 03:13:37 | 000,383,864 | ---- | C] (SG Interactive                                              ) -- C:\GrandChase_Install_070213.exe
[2013.07.14 21:26:28 | 000,000,000 | ---D | C] -- C:\Users\peter\Documents\The KMPlayer
[2013.07.14 19:57:17 | 000,000,000 | ---D | C] -- C:\Users\peter\AppData\Roaming\Avira
[2013.07.14 13:23:55 | 000,000,000 | ---D | C] -- C:\Users\peter\AppData\Local\Macromedia
[2013.07.12 21:02:28 | 000,000,000 | ---D | C] -- C:\Users\peter\AppData\Local\PMB Files
[2013.07.12 21:02:27 | 000,000,000 | ---D | C] -- C:\ProgramData\PMB Files
[2013.07.12 02:29:31 | 000,526,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll
[2013.07.12 02:29:31 | 000,391,168 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll
[2013.07.12 02:29:30 | 000,136,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iesysprep.dll
[2013.07.12 02:29:30 | 000,109,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iesysprep.dll
[2013.07.12 02:29:30 | 000,089,600 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\RegisterIEPKEYs.exe
[2013.07.12 02:29:30 | 000,071,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\RegisterIEPKEYs.exe
[2013.07.12 02:29:30 | 000,067,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iesetup.dll
[2013.07.12 02:29:30 | 000,061,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iesetup.dll
[2013.07.12 02:29:30 | 000,051,712 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ie4uinit.exe
[2013.07.12 02:29:30 | 000,039,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iernonce.dll
[2013.07.12 02:29:30 | 000,033,280 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iernonce.dll
[2013.07.12 02:29:29 | 000,855,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript.dll
[2013.07.12 02:29:29 | 000,690,688 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript.dll
[2013.07.12 02:29:29 | 000,603,136 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msfeeds.dll
[2013.07.12 02:29:28 | 003,958,784 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9.dll
[2013.07.11 20:26:05 | 001,887,744 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\WMVDECOD.DLL
[2013.07.11 20:26:05 | 001,620,480 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\WMVDECOD.DLL
[2013.07.11 20:26:05 | 000,624,128 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\qedit.dll
[2013.07.11 20:26:05 | 000,509,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\qedit.dll
[2013.07.11 20:25:02 | 001,643,520 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\DWrite.dll
[2013.07.11 17:10:47 | 000,000,000 | ---D | C] -- C:\Users\peter\AppData\Roaming\WebCake
[2013.07.11 17:10:47 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\WebCake
[2013.07.11 17:10:42 | 000,000,000 | ---D | C] -- C:\ProgramData\Tarma Installer
[2013.07.10 19:36:29 | 000,000,000 | ---D | C] -- C:\Users\peter\AppData\Roaming\FreeVideoConverter
[2013.07.10 18:06:23 | 000,000,000 | ---D | C] -- C:\Users\peter\AppData\Roaming\DVDVideoSoft
[2013.07.09 14:17:02 | 671,261,856 | ---- | C] (InstallShield Software Corporation) -- C:\S4_League.exe
[2013.07.05 22:02:21 | 000,000,000 | ---D | C] -- C:\lang
[2013.07.05 22:02:21 | 000,000,000 | ---D | C] -- C:\flash0
[2013.07.05 22:02:21 | 000,000,000 | ---D | C] -- C:\assets
[2013.07.05 06:06:59 | 000,000,000 | ---D | C] -- C:\Users\peter\AppData\Local\Keldon_Corps
[2013.07.04 19:19:43 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Elsword_DE
[2013.07.04 19:18:44 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Gameforge4D
[2013.07.03 15:38:09 | 000,000,000 | ---D | C] -- C:\dolphin-3.0-win32
[2013.07.03 06:16:26 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Firefox
[2013.07.03 05:53:17 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Java
[2013.07.03 05:53:07 | 000,263,592 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\javaws.exe
[2013.07.03 05:53:02 | 000,175,016 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\javaw.exe
[2013.07.03 05:53:02 | 000,175,016 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\java.exe
[2013.07.03 05:53:02 | 000,096,168 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\WindowsAccessBridge-32.dll
[2013.07.01 23:10:17 | 000,000,000 | ---D | C] -- C:\Users\peter\Documents\JoWooD
[2013.06.26 22:42:57 | 000,000,000 | ---D | C] -- C:\Users\peter\AppData\Roaming\SEGA
[2011.09.27 19:18:56 | 000,079,392 | ---- | C] (Martin Pesch) -- C:\Program Files\mp3DirectCut.exe
[2011.07.14 00:55:45 | 001,220,608 | ---- | C] (Perfect world) -- C:\Program Files (x86)\install.exe
[2011.07.14 00:55:45 | 000,372,736 | ---- | C] (Intel Corporation) -- C:\Program Files (x86)\ijl15.dll
[2011.07.14 00:55:45 | 000,258,352 | ---- | C] (Microsoft Corporation) -- C:\Program Files (x86)\unicows.dll
[2011.06.01 16:52:24 | 000,925,080 | ---- | C] (Hyperionics) -- C:\Program Files (x86)\HyCam2.exe
[2011.06.01 16:52:24 | 000,137,216 | ---- | C] (Hyperionics) -- C:\Program Files (x86)\CamRes2.dll
[2011.06.01 16:52:24 | 000,078,248 | ---- | C] (Hyperionics) -- C:\Program Files (x86)\UnHyCam2.exe
[2011.06.01 16:52:24 | 000,044,032 | ---- | C] (Hyperionics) -- C:\Program Files (x86)\MClick2.dll
[2011.06.01 16:39:27 | 711,189,938 | ---- | C] (InstallShield Software Corporation) -- C:\Program Files (x86)\S4League.exe
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2013.07.23 14:19:07 | 000,001,073 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2013.07.23 07:16:31 | 000,018,512 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013.07.23 07:16:31 | 000,018,512 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013.07.23 07:13:31 | 001,498,742 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2013.07.23 07:13:31 | 000,654,150 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2013.07.23 07:13:31 | 000,616,032 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2013.07.23 07:13:31 | 000,130,022 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2013.07.23 07:13:31 | 000,106,412 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2013.07.23 07:09:03 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2013.07.23 07:09:00 | 523,124,735 | -HS- | M] () -- C:\hiberfil.sys
[2013.07.23 00:12:34 | 000,001,606 | ---- | M] () -- C:\Users\Public\Desktop\Spirit Tales.lnk
[2013.07.15 04:44:04 | 000,001,692 | ---- | M] () -- C:\Users\Public\Desktop\Grand Chase.lnk
[2013.07.15 04:35:41 | 2099,622,144 | ---- | M] () -- C:\GrandChase_Install_070213-1.bin
[2013.07.15 04:35:37 | 1030,227,746 | ---- | M] () -- C:\GrandChase_Install_070213-2.bin
[2013.07.15 04:07:17 | 000,383,864 | ---- | M] (SG Interactive                                              ) -- C:\GrandChase_Install_070213.exe
[2013.07.12 05:48:38 | 000,437,512 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2013.07.09 14:34:39 | 671,261,856 | ---- | M] (InstallShield Software Corporation) -- C:\S4_League.exe
[2013.07.03 05:52:57 | 000,867,240 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\npDeployJava1.dll
[2013.07.03 05:52:57 | 000,789,416 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\deployJava1.dll
[2013.07.03 05:52:57 | 000,263,592 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\javaws.exe
[2013.07.03 05:52:57 | 000,175,016 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\javaw.exe
[2013.07.03 05:52:57 | 000,175,016 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\java.exe
[2013.07.03 05:52:57 | 000,096,168 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\WindowsAccessBridge-32.dll
[2013.06.26 22:08:55 | 929,925,841 | ---- | M] (www.gamerkraft.com                                          ) -- C:\FreeJack_v40142.exe
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2013.07.23 14:19:07 | 000,001,073 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2013.07.23 00:12:33 | 000,001,606 | ---- | C] () -- C:\Users\Public\Desktop\Spirit Tales.lnk
[2013.07.15 04:44:04 | 000,001,692 | ---- | C] () -- C:\Users\Public\Desktop\Grand Chase.lnk
[2013.07.15 03:13:37 | 2099,622,144 | ---- | C] () -- C:\GrandChase_Install_070213-1.bin
[2013.07.15 03:13:37 | 1030,227,746 | ---- | C] () -- C:\GrandChase_Install_070213-2.bin
[2013.07.03 05:59:55 | 000,000,032 | R--- | C] () -- C:\Windows\hash.dat
[2013.05.16 21:37:42 | 000,012,288 | -H-- | C] () -- C:\Users\peter\photothumb.db
[2013.04.27 13:53:18 | 003,217,371 | ---- | C] () -- C:\Users\peter\20130426_164633.jpg
[2013.04.27 13:53:18 | 001,997,978 | ---- | C] () -- C:\Users\peter\20130426_190151.jpg
[2013.02.08 16:37:59 | 000,000,012 | ---- | C] () -- C:\Windows\SysWow64\ssnac.dat
[2012.11.19 09:33:32 | 000,065,656 | ---- | C] () -- C:\Windows\SysWow64\bdmpegv.dll
[2012.11.19 09:33:30 | 000,022,640 | ---- | C] () -- C:\Windows\SysWow64\bdmjpeg.dll
[2012.11.18 22:58:43 | 000,230,752 | ---- | C] () -- C:\Windows\patchw32.dll
[2012.11.18 22:58:43 | 000,118,176 | ---- | C] () -- C:\Windows\patchw.dll
[2012.10.20 15:02:49 | 000,000,020 | ---- | C] () -- C:\Windows\GKLauncherInfo.ini
[2011.10.08 14:44:31 | 000,000,000 | ---- | C] () -- C:\Users\peter\AppData\Local\{DD5251E8-FB5D-42C1-81FB-50ADE6FBDD6F}
[2011.09.27 19:18:56 | 000,026,314 | ---- | C] () -- C:\Program Files\Manual.htm
[2011.09.27 19:18:56 | 000,014,512 | ---- | C] () -- C:\Program Files\FAQ.htm
[2011.07.29 13:21:24 | 000,000,242 | ---- | C] () -- C:\Windows\wininit.ini
[2011.07.14 00:55:45 | 2097,176,247 | ---- | C] () -- C:\Program Files (x86)\data1.pck
[2011.07.14 00:55:45 | 2038,771,408 | ---- | C] () -- C:\Program Files (x86)\data2.pck
[2011.07.14 00:55:45 | 001,723,866 | ---- | C] () -- C:\Program Files (x86)\setup2.jpg
[2011.07.14 00:55:45 | 001,676,376 | ---- | C] () -- C:\Program Files (x86)\check.md
[2011.07.14 00:55:45 | 001,478,399 | ---- | C] () -- C:\Program Files (x86)\setup1.jpg
[2011.07.14 00:55:45 | 001,387,571 | ---- | C] () -- C:\Program Files (x86)\setup4.jpg
[2011.07.14 00:55:45 | 001,279,527 | ---- | C] () -- C:\Program Files (x86)\setup3.jpg
[2011.07.14 00:55:45 | 001,178,830 | ---- | C] () -- C:\Program Files (x86)\setup0.jpg
[2011.07.14 00:55:45 | 000,086,350 | ---- | C] () -- C:\Program Files (x86)\Logo.jpg
[2011.07.14 00:55:45 | 000,028,672 | ---- | C] () -- C:\Program Files (x86)\JPGI.dll
[2011.07.14 00:55:45 | 000,005,650 | ---- | C] () -- C:\Program Files (x86)\install.ini
[2011.06.10 18:21:37 | 000,010,752 | ---- | C] () -- C:\Users\peter\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011.06.01 16:52:24 | 000,199,268 | ---- | C] () -- C:\Program Files (x86)\HyCam2.chm
[2011.06.01 16:52:24 | 000,005,784 | ---- | C] () -- C:\Program Files (x86)\HyCam2.tlb
[2011.06.01 16:52:24 | 000,001,186 | ---- | C] () -- C:\Program Files (x86)\16-44100d.wav
[2011.06.01 16:52:24 | 000,000,956 | ---- | C] () -- C:\Program Files (x86)\16-44100u.wav
[2011.06.01 16:52:24 | 000,000,652 | ---- | C] () -- C:\Program Files (x86)\16-22050d.wav
[2011.06.01 16:52:24 | 000,000,587 | ---- | C] () -- C:\Program Files (x86)\8-44100d.wav
[2011.06.01 16:52:24 | 000,000,442 | ---- | C] () -- C:\Program Files (x86)\16-22050u.wav
[2011.06.01 16:52:24 | 000,000,421 | ---- | C] () -- C:\Program Files (x86)\8-44100u.wav
[2011.06.01 16:52:24 | 000,000,340 | ---- | C] () -- C:\Program Files (x86)\16-11025d.wav
[2011.06.01 16:52:24 | 000,000,326 | ---- | C] () -- C:\Program Files (x86)\16-11025u.wav
[2011.06.01 16:52:24 | 000,000,317 | ---- | C] () -- C:\Program Files (x86)\8-22050d.wav
[2011.06.01 16:52:24 | 000,000,260 | ---- | C] () -- C:\Program Files (x86)\16-8000d.wav
[2011.06.01 16:52:24 | 000,000,225 | ---- | C] () -- C:\Program Files (x86)\8-22050u.wav
[2011.06.01 16:52:24 | 000,000,220 | ---- | C] () -- C:\Program Files (x86)\16-8000u.wav
[2011.06.01 16:52:24 | 000,000,183 | ---- | C] () -- C:\Program Files (x86)\8-11025d.wav
[2011.06.01 16:52:24 | 000,000,151 | ---- | C] () -- C:\Program Files (x86)\8-8000d.wav
[2011.06.01 16:52:24 | 000,000,135 | ---- | C] () -- C:\Program Files (x86)\8-11025u.wav
[2011.06.01 16:52:24 | 000,000,127 | ---- | C] () -- C:\Program Files (x86)\8-8000u.wav
[2011.06.01 16:52:24 | 000,000,055 | ---- | C] () -- C:\Program Files (x86)\HomePage.url
[2011.05.30 15:08:27 | 3580,254,830 | ---- | C] () -- C:\Program Files\argo20110511.zip
[2010.10.27 13:08:21 | 000,131,984 | ---- | C] () -- C:\ProgramData\FullRemove.exe
 
========== ZeroAccess Check ==========
 
[2009.07.14 06:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll -- [2013.02.27 07:52:56 | 014,172,672 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2013.02.27 06:55:05 | 012,872,704 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.07.14 03:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.20 14:19:02 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 03:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
 
========== LOP Check ==========
 
[2012.07.21 23:48:59 | 000,000,000 | ---D | M] -- C:\Users\peter\AppData\Roaming\Aeria Games & Entertainment
[2012.06.30 20:24:47 | 000,000,000 | ---D | M] -- C:\Users\peter\AppData\Roaming\BANDISOFT
[2012.06.21 16:18:53 | 000,000,000 | ---D | M] -- C:\Users\peter\AppData\Roaming\DragonicaECB
[2011.12.18 00:27:39 | 000,000,000 | ---D | M] -- C:\Users\peter\AppData\Roaming\DragonicaSCB
[2013.07.12 21:22:32 | 000,000,000 | ---D | M] -- C:\Users\peter\AppData\Roaming\DVDVideoSoft
[2013.07.12 21:22:32 | 000,000,000 | ---D | M] -- C:\Users\peter\AppData\Roaming\FreeVideoConverter
[2011.05.28 14:57:27 | 000,000,000 | ---D | M] -- C:\Users\peter\AppData\Roaming\HEXelon
[2012.09.25 17:49:43 | 000,000,000 | ---D | M] -- C:\Users\peter\AppData\Roaming\KlLauncherST
[2011.09.07 21:26:34 | 000,000,000 | ---D | M] -- C:\Users\peter\AppData\Roaming\MAGIX
[2012.06.30 20:24:47 | 000,000,000 | ---D | M] -- C:\Users\peter\AppData\Roaming\mp3DirectCut
[2011.05.28 14:24:00 | 000,000,000 | ---D | M] -- C:\Users\peter\AppData\Roaming\OEM
[2013.07.15 10:31:11 | 000,000,000 | ---D | M] -- C:\Users\peter\AppData\Roaming\PhotoScape
[2013.06.26 22:42:57 | 000,000,000 | ---D | M] -- C:\Users\peter\AppData\Roaming\SEGA
[2013.07.12 21:22:40 | 000,000,000 | ---D | M] -- C:\Users\peter\AppData\Roaming\Sony
[2013.04.13 20:51:54 | 000,000,000 | ---D | M] -- C:\Users\peter\AppData\Roaming\TechSmith
[2013.05.21 18:41:41 | 000,000,000 | ---D | M] -- C:\Users\peter\AppData\Roaming\TERA
[2012.01.07 00:14:18 | 000,000,000 | ---D | M] -- C:\Users\peter\AppData\Roaming\TS3Client
[2011.05.28 15:27:29 | 000,000,000 | ---D | M] -- C:\Users\peter\AppData\Roaming\TuneUp Software
[2013.07.23 13:39:40 | 000,000,000 | ---D | M] -- C:\Users\peter\AppData\Roaming\WebCake
[2012.02.04 17:07:08 | 000,000,000 | ---D | M] -- C:\Users\peter\AppData\Roaming\XnView
 
========== Purity Check ==========
 
 

< End of report >
         
--- --- ---

Hier nun auch der FRST Log:
FRST Logfile:
Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 22-07-2013 01
Ran by peter (administrator) on 23-07-2013 14:49:50
Running from D:\Downloads
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(MAGIX AG) C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe
(Acer Incorporated) C:\Program Files (x86)\Acer\Registration\GREGsvc.exe
(TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpUtilitiesService64.exe
(Acer Group) C:\Program Files\Acer\Acer Updater\UpdaterService.exe
(WebCake LLC) C:\Program Files (x86)\WebCake\WebCakeDesktop.Updater.exe
(TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpUtilitiesApp64.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Egis Technology Inc.) C:\Program Files (x86)\EgisTec MyWinLocker\x86\mwlDaemon.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Akamai Technologies, Inc.) C:\Users\peter\AppData\Local\Akamai\netsession_win.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(WebCake LLC) C:\Users\peter\AppData\Roaming\WebCake\WebCakeDesktop.exe
(Akamai Technologies, Inc.) C:\Users\peter\AppData\Local\Akamai\netsession_win.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Egis Technology Inc.) C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe
() C:\Program Files (x86)\Acer\Hotkey Utility\HotkeyUtility.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(C. Ghisler & Co.) C:\Program Files (x86)\TC UP\totalcmd.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_7_700_202.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_7_700_202.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avscan.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [mwlDaemon] - C:\Program Files (x86)\EgisTec MyWinLocker\x86\mwlDaemon.exe [349552 2010-05-27] (Egis Technology Inc.)
HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [11464296 2010-09-03] (Realtek Semiconductor)
HKLM-x32\...\RunOnce: [ Malwarebytes Anti-Malware ] - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent [532040 2013-04-04] (Malwarebytes Corporation)
HKCU\...\Run: [Sidebar] - C:\Program Files\Windows Sidebar\sidebar.exe [1475584 2010-11-20] (Microsoft Corporation)
HKCU\...\Run: [Akamai NetSession Interface] - C:\Users\peter\AppData\Local\Akamai\netsession_win.exe [4489472 2013-06-05] (Akamai Technologies, Inc.)
HKCU\...\Run: [Skype] - C:\Program Files (x86)\Skype\Phone\Skype.exe [18678376 2013-04-19] (Skype Technologies S.A.)
HKCU\...\Run: [WebCake Desktop] - C:\Users\peter\AppData\Roaming\WebCake\WebCakeDesktop.exe [47896 2013-06-21] (WebCake LLC)
HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [283160 2010-09-13] (Intel Corporation)
HKLM-x32\...\Run: [SuiteTray] - "C:\Program Files (x86)\EgisTec MyWinLockerSuite\x86\SuiteTray.exe" [337264 2010-05-27] (Egis Technology Inc.)
HKLM-x32\...\Run: [EgisTecPMMUpdate] - "C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe" [407920 2010-03-11] (Egis Technology Inc.)
HKLM-x32\...\Run: [Hotkey Utility] - C:\Program Files (x86)\Acer\Hotkey Utility\HotkeyUtility.exe [618600 2010-12-03] ()
HKLM-x32\...\Run: [avgnt] - "C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min [348664 2012-08-08] (Avira Operations GmbH & Co. KG)
HKU\Default\...\RunOnce: [ScrSav] - C:\Program Files (x86)\Acer\Screensaver\run_Acer.exe /default [154144 2010-07-29] ()
HKU\Default User\...\RunOnce: [ScrSav] - C:\Program Files (x86)\Acer\Screensaver\run_Acer.exe /default [154144 2010-07-29] ()
HKU\UpdatusUser\...\RunOnce: [ScrSav] - C:\Program Files (x86)\Acer\Screensaver\run_Acer.exe /default [154144 2010-07-29] ()

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://start.nexon.com
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://acer.msn.com
SearchScopes: HKLM - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=AARTDF&pc=MAAR&src=IE-SearchBox
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=AARTDF&pc=MAAR&src=IE-SearchBox
SearchScopes: HKLM-x32 - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=AARTDF&pc=MAAR&src=IE-SearchBox
SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=AARTDF&pc=MAAR&src=IE-SearchBox
SearchScopes: HKCU - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: WebCake - {2A5A2A90-3B30-4E6E-A955-2F232C6EF517} - C:\Program Files (x86)\WebCake\WebCakeIEClient.dll (WebCake LLC)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: SMTTB2009 Class - {FCBCCB87-9224-4B8D-B117-F56D924BEB18} - C:\Program Files (x86)\Hyperionics DB Toolbar\tbcore3.dll ()
Toolbar: HKLM-x32 - Hyperionics DB Toolbar - {338B4DFE-2E2C-4338-9E41-E176D497299E} - C:\Program Files (x86)\Hyperionics DB Toolbar\tbcore3.dll ()
Toolbar: HKCU - No Name - {338B4DFE-2E2C-4338-9E41-E176D497299E} -  No File
Handler: msdaipp - No CLSID Value - 
Handler-x32: msdaipp - No CLSID Value - 
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Filter: text/xml - {807553E5-5146-11D5-A672-00B0D022E945} -  No File
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\peter\AppData\Roaming\Mozilla\Firefox\Profiles\bjyo7zt0.default
FF user.js: detected! => C:\Users\peter\AppData\Roaming\Mozilla\Firefox\Profiles\bjyo7zt0.default\user.js
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_7_700_202.dll ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_202.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3555.0308 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @nexon.com/NexonPlugWebExtension - C:\ProgramData\Nexon\NexonPlug\npPlugWire_1.0.0.0.dll (Nexon)
FF Plugin-x32: @nexon.com/NxGame - C:\ProgramData\Nexon\NGM\npnxgame.dll No File
FF Plugin-x32: @nexon.net/NxGame - C:\ProgramData\NexonUS\NGM\npNxGameUS.dll No File
FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @ogplanet.com/npOGPPlugin - C:\Windows\system32\npOGPPlugin.dll No File
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Extension: WebCake - C:\Users\peter\AppData\Roaming\Mozilla\Firefox\Profiles\bjyo7zt0.default\Extensions\plugin@getwebcake.com
FF Extension: Hyperionics DB Toolbar - C:\Users\peter\AppData\Roaming\Mozilla\Firefox\Profiles\bjyo7zt0.default\Extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}
FF Extension: DownloadHelper - C:\Users\peter\AppData\Roaming\Mozilla\Firefox\Profiles\bjyo7zt0.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
FF Extension: No Name - C:\Users\peter\AppData\Roaming\Mozilla\Firefox\Profiles\bjyo7zt0.default\Extensions\{64161300-e22b-11db-8314-0800200c9a66}.xpi
FF Extension: No Name - C:\Users\peter\AppData\Roaming\Mozilla\Firefox\Profiles\bjyo7zt0.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
FF Extension: Default - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF HKLM-x32\...\Firefox\Extensions: [{EB132DB0-A4CA-11DF-9732-0E29E0D72085}] C:\Program Files (x86)\Object\facetheme
FF Extension: FaceTheme - Change your Facebook layout! - C:\Program Files (x86)\Object\facetheme
FF HKCU\...\Firefox\Extensions: [{EB132DB0-A4CA-11DF-9732-0E29E0D72085}] C:\Program Files (x86)\Object\facetheme
FF Extension: FaceTheme - Change your Facebook layout! - C:\Program Files (x86)\Object\facetheme

==================== Services (Whitelisted) =================

R2 Akamai; c:\program files (x86)\common files\akamai/netsession_win_8fa3539.dll [4569856 2013-07-01] (Akamai Technologies, Inc.)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [86224 2012-05-02] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [110032 2012-05-02] (Avira Operations GmbH & Co. KG)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
S3 MWLService; C:\Program Files (x86)\EgisTec MyWinLocker\x86\MWLService.exe [305520 2010-05-27] (Egis Technology Inc.)
S3 npggsvc; C:\Windows\SysWow64\GameMon.des [3963248 2011-01-12] (INCA Internet Co., Ltd.)
S3 TuneUp.Defrag; C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpDefragService.exe [607048 2011-05-28] (TuneUp Software)
R2 TuneUp.UtilitiesSvc; C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpUtilitiesService64.exe [1394504 2009-12-09] (TuneUp Software)
R2 WebCake Desktop Updater; C:\Program Files (x86)\WebCake\WebCakeDesktop.Updater.exe [23552 2013-06-21] (WebCake LLC)

==================== Drivers (Whitelisted) ====================

S3 1394hub; C:\Windows\System32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
S3 1394hub; C:\Windows\SysWow64\svchost.exe [20992 2009-07-14] (Microsoft Corporation)
R1 aswKbd; C:\Windows\System32\Drivers\aswKbd.sys [19600 2012-06-28] (AVAST Software)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [98848 2012-04-25] (Avira GmbH)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132832 2012-04-27] (Avira GmbH)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [27760 2012-05-02] (Avira GmbH)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
S3 NPPTNT2; C:\Windows\SysWow64\npptNT2.sys [4682 2005-01-02] (INCA Internet Co., Ltd.)
R3 TuneUpUtilitiesDrv; C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpUtilitiesDriver64.sys [11856 2009-10-14] (TuneUp Software)
S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [x]
S3 NPPTNT2; \??\C:\Windows\system32\npptNT2.sys [x]
S3 uqk; \??\C:\koramgame\STOnline\avital\wyqku64.sys [x]
S1 VD_FileDisk; No ImagePath
S3 X6va003; \??\C:\Users\peter\AppData\Local\Temp\003472D.tmp [x]
S3 X6va005; \??\C:\Users\peter\AppData\Local\Temp\0055E46.tmp [x]
S3 X6va006; \??\C:\Users\peter\AppData\Local\Temp\006F27A.tmp [x]
S3 X6va008; \??\C:\Users\peter\AppData\Local\Temp\0083CC3.tmp [x]
S3 X6va009; \??\C:\Windows\SysWOW64\Drivers\X6va009 [x]
S3 X6va010; \??\C:\Windows\SysWOW64\Drivers\X6va010 [x]
S3 X6va011; \??\C:\Windows\SysWOW64\Drivers\X6va011 [x]
S3 X6va012; \??\C:\Windows\SysWOW64\Drivers\X6va012 [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-07-23 14:49 - 2013-07-23 14:49 - 00000000 ____D C:\FRST
2013-07-23 14:20 - 2013-07-23 14:20 - 00000000 ____D C:\Users\peter\AppData\Roaming\Malwarebytes
2013-07-23 14:19 - 2013-07-23 14:19 - 00001073 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-07-23 14:19 - 2013-07-23 14:19 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-07-23 14:19 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-07-23 00:12 - 2013-07-23 00:12 - 00001606 _____ C:\Users\Public\Desktop\Spirit Tales.lnk
2013-07-23 00:10 - 2013-07-23 00:10 - 00000000 ____D C:\koramgame
2013-07-22 11:53 - 2013-07-22 11:54 - 00000000 ____D C:\Users\peter\AppData\Local\{BD40AB1C-0A4E-4DDF-833E-E9EE7CB54B3B}
2013-07-21 23:53 - 2013-07-21 23:53 - 00000000 ____D C:\Users\peter\AppData\Local\{0AAB630D-473D-4CE5-9C06-9C4B49BCFB64}
2013-07-20 09:09 - 2013-07-20 09:09 - 00000000 ____D C:\Users\peter\AppData\Local\{F59909EA-0794-4496-A61C-F223F3430CEF}
2013-07-17 04:30 - 2013-07-17 04:30 - 00000000 ____D C:\Windows\Sun
2013-07-16 11:54 - 2013-07-16 11:54 - 00000000 ____D C:\Users\peter\AppData\Local\{94D7BEBB-D0CC-4B33-B342-35BB542AFBE1}
2013-07-15 18:03 - 2013-07-15 18:04 - 00000000 ____D C:\Users\peter\AppData\Local\{EBE713C7-C5F2-4E3F-A324-4013AE55F55C}
2013-07-15 04:44 - 2013-07-15 04:44 - 00001692 _____ C:\Users\Public\Desktop\Grand Chase.lnk
2013-07-15 04:38 - 2013-07-15 04:38 - 00000000 ____D C:\SG Interactive
2013-07-15 03:13 - 2013-07-15 04:35 - 2099622144 _____ C:\GrandChase_Install_070213-1.bin
2013-07-15 03:13 - 2013-07-15 04:35 - 1030227746 _____ C:\GrandChase_Install_070213-2.bin
2013-07-15 03:13 - 2013-07-15 04:07 - 00383864 _____ (SG Interactive                                              ) C:\GrandChase_Install_070213.exe
2013-07-14 21:26 - 2013-07-14 21:26 - 00000000 ____D C:\Users\peter\Documents\The KMPlayer
2013-07-14 19:57 - 2013-07-14 19:57 - 00000000 ____D C:\Users\peter\AppData\Roaming\Avira
2013-07-14 13:23 - 2013-07-14 13:23 - 00000000 ____D C:\Users\peter\AppData\Local\Macromedia
2013-07-12 23:37 - 2013-07-12 23:37 - 00003798 _____ C:\Windows\System32\Tasks\Java Update Scheduler
2013-07-12 21:02 - 2013-07-16 03:24 - 00000000 ____D C:\Users\peter\AppData\Local\PMB Files
2013-07-12 02:29 - 2013-06-12 01:43 - 14329856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-07-12 02:29 - 2013-06-12 01:43 - 02877440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-07-12 02:29 - 2013-06-12 01:43 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-07-12 02:29 - 2013-06-12 01:43 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-07-12 02:29 - 2013-06-12 01:43 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-07-12 02:29 - 2013-06-12 01:43 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-07-12 02:29 - 2013-06-12 01:43 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-07-12 02:29 - 2013-06-12 01:42 - 13760512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-07-12 02:29 - 2013-06-12 01:42 - 02046976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-07-12 02:29 - 2013-06-12 01:42 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-07-12 02:29 - 2013-06-12 01:42 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-07-12 02:29 - 2013-06-12 01:42 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-07-12 02:29 - 2013-06-12 01:42 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-07-12 02:29 - 2013-06-12 01:26 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-07-12 02:29 - 2013-06-12 01:26 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-07-12 02:29 - 2013-06-12 01:26 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-07-12 02:29 - 2013-06-12 01:25 - 19238912 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-07-12 02:29 - 2013-06-12 01:25 - 15404032 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-07-12 02:29 - 2013-06-12 01:25 - 03958784 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-07-12 02:29 - 2013-06-12 01:25 - 02648576 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-07-12 02:29 - 2013-06-12 01:25 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-07-12 02:29 - 2013-06-12 01:25 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-07-12 02:29 - 2013-06-12 01:25 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-07-12 02:29 - 2013-06-12 01:25 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-07-12 02:29 - 2013-06-12 01:25 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-07-12 02:29 - 2013-06-12 01:25 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-07-12 02:29 - 2013-06-12 01:25 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-07-12 02:29 - 2013-06-12 00:51 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-07-12 02:29 - 2013-06-12 00:50 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-07-12 02:29 - 2013-06-07 05:22 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-07-12 02:29 - 2013-06-07 04:37 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-07-11 20:26 - 2013-06-04 08:00 - 00624128 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2013-07-11 20:26 - 2013-06-04 06:53 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll
2013-07-11 20:26 - 2013-05-06 08:03 - 01887744 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2013-07-11 20:26 - 2013-05-06 06:56 - 01620480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL
2013-07-11 20:25 - 2013-06-05 05:34 - 03153920 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-07-11 20:25 - 2013-04-10 01:34 - 01247744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll
2013-07-11 20:25 - 2013-04-03 00:51 - 01643520 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2013-07-11 17:10 - 2013-07-23 13:39 - 00000000 ____D C:\Users\peter\AppData\Roaming\WebCake
2013-07-11 17:10 - 2013-07-11 17:10 - 00000000 ____D C:\Program Files (x86)\WebCake
2013-07-10 19:36 - 2013-07-12 21:22 - 00000000 ____D C:\Users\peter\AppData\Roaming\FreeVideoConverter
2013-07-10 19:35 - 2013-07-10 19:35 - 01128472 _____ (Koyote-Lab Inc) C:\Users\peter\Downloads\FreeVideoConverterSetup-r135-n-bc.exe
2013-07-10 19:34 - 2013-07-10 19:34 - 01204496 _____ (DVDVideoSoft Ltd.                                           ) C:\Users\peter\Downloads\FreeAudioDub.exe
2013-07-10 18:06 - 2013-07-12 21:22 - 00000000 ____D C:\Users\peter\AppData\Roaming\DVDVideoSoft
2013-07-09 14:17 - 2013-07-09 14:34 - 671261856 _____ (InstallShield Software Corporation) C:\S4_League.exe
2013-07-05 22:02 - 2013-04-22 22:49 - 00000000 ____D C:\lang
2013-07-05 22:02 - 2013-04-22 22:49 - 00000000 ____D C:\assets
2013-07-05 22:02 - 2013-03-22 23:38 - 00000000 ____D C:\flash0
2013-07-05 06:06 - 2013-07-05 06:06 - 00000000 ____D C:\Users\peter\AppData\Local\Keldon_Corps
2013-07-04 19:18 - 2013-07-04 19:18 - 00000000 ____D C:\Program Files (x86)\Gameforge4D
2013-07-03 15:38 - 2013-07-15 17:09 - 00000000 ____D C:\dolphin-3.0-win32
2013-07-03 06:16 - 2013-07-03 06:16 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-07-03 05:59 - 2013-05-04 05:59 - 00000032 ____R C:\Windows\hash.dat
2013-07-03 05:53 - 2013-07-03 05:52 - 00263592 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2013-07-03 05:53 - 2013-07-03 05:52 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2013-07-03 05:53 - 2013-07-03 05:52 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2013-07-03 05:53 - 2013-07-03 05:52 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2013-07-01 23:10 - 2013-07-01 23:10 - 00000000 ____D C:\Users\peter\Documents\JoWooD
2013-06-26 22:42 - 2013-06-26 22:42 - 00000000 ____D C:\Users\peter\AppData\Roaming\SEGA

==================== One Month Modified Files and Folders =======

2013-07-23 14:49 - 2013-07-23 14:49 - 00000000 ____D C:\FRST
2013-07-23 14:38 - 2011-05-28 15:08 - 00000000 ____D C:\Users\peter\AppData\Roaming\Skype
2013-07-23 14:35 - 2010-10-10 08:16 - 01079437 _____ C:\Windows\WindowsUpdate.log
2013-07-23 14:20 - 2013-07-23 14:20 - 00000000 ____D C:\Users\peter\AppData\Roaming\Malwarebytes
2013-07-23 14:19 - 2013-07-23 14:19 - 00001073 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-07-23 14:19 - 2013-07-23 14:19 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-07-23 13:39 - 2013-07-11 17:10 - 00000000 ____D C:\Users\peter\AppData\Roaming\WebCake
2013-07-23 07:16 - 2009-07-14 06:45 - 00018512 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-07-23 07:16 - 2009-07-14 06:45 - 00018512 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-07-23 07:13 - 2010-10-10 18:07 - 00654150 _____ C:\Windows\system32\perfh007.dat
2013-07-23 07:13 - 2010-10-10 18:07 - 00130022 _____ C:\Windows\system32\perfc007.dat
2013-07-23 07:13 - 2009-07-14 07:13 - 01498742 _____ C:\Windows\system32\PerfStringBackup.INI
2013-07-23 07:09 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-07-23 07:09 - 2009-07-14 06:51 - 00207563 _____ C:\Windows\setupact.log
2013-07-23 07:08 - 2010-10-10 08:11 - 02126124 _____ C:\Windows\PFRO.log
2013-07-23 00:12 - 2013-07-23 00:12 - 00001606 _____ C:\Users\Public\Desktop\Spirit Tales.lnk
2013-07-23 00:10 - 2013-07-23 00:10 - 00000000 ____D C:\koramgame
2013-07-23 00:10 - 2010-10-27 13:00 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2013-07-22 11:54 - 2013-07-22 11:53 - 00000000 ____D C:\Users\peter\AppData\Local\{BD40AB1C-0A4E-4DDF-833E-E9EE7CB54B3B}
2013-07-21 23:53 - 2013-07-21 23:53 - 00000000 ____D C:\Users\peter\AppData\Local\{0AAB630D-473D-4CE5-9C06-9C4B49BCFB64}
2013-07-20 09:09 - 2013-07-20 09:09 - 00000000 ____D C:\Users\peter\AppData\Local\{F59909EA-0794-4496-A61C-F223F3430CEF}
2013-07-17 04:30 - 2013-07-17 04:30 - 00000000 ____D C:\Windows\Sun
2013-07-16 11:54 - 2013-07-16 11:54 - 00000000 ____D C:\Users\peter\AppData\Local\{94D7BEBB-D0CC-4B33-B342-35BB542AFBE1}
2013-07-16 03:24 - 2013-07-12 21:02 - 00000000 ____D C:\Users\peter\AppData\Local\PMB Files
2013-07-15 18:04 - 2013-07-15 18:03 - 00000000 ____D C:\Users\peter\AppData\Local\{EBE713C7-C5F2-4E3F-A324-4013AE55F55C}
2013-07-15 17:09 - 2013-07-03 15:38 - 00000000 ____D C:\dolphin-3.0-win32
2013-07-15 10:31 - 2011-05-28 19:23 - 00000000 ____D C:\Users\peter\AppData\Roaming\PhotoScape
2013-07-15 04:44 - 2013-07-15 04:44 - 00001692 _____ C:\Users\Public\Desktop\Grand Chase.lnk
2013-07-15 04:38 - 2013-07-15 04:38 - 00000000 ____D C:\SG Interactive
2013-07-15 04:35 - 2013-07-15 03:13 - 2099622144 _____ C:\GrandChase_Install_070213-1.bin
2013-07-15 04:35 - 2013-07-15 03:13 - 1030227746 _____ C:\GrandChase_Install_070213-2.bin
2013-07-15 04:07 - 2013-07-15 03:13 - 00383864 _____ (SG Interactive                                              ) C:\GrandChase_Install_070213.exe
2013-07-14 21:26 - 2013-07-14 21:26 - 00000000 ____D C:\Users\peter\Documents\The KMPlayer
2013-07-14 19:57 - 2013-07-14 19:57 - 00000000 ____D C:\Users\peter\AppData\Roaming\Avira
2013-07-14 19:52 - 2011-11-09 21:29 - 00000000 ____D C:\Users\peter\AppData\Local\Akamai
2013-07-14 19:52 - 2011-05-28 15:12 - 00000000 ____D C:\Users\peter\AppData\Roaming\Mozilla
2013-07-14 13:23 - 2013-07-14 13:23 - 00000000 ____D C:\Users\peter\AppData\Local\Macromedia
2013-07-12 23:37 - 2013-07-12 23:37 - 00003798 _____ C:\Windows\System32\Tasks\Java Update Scheduler
2013-07-12 23:35 - 2009-07-14 07:08 - 00032640 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-07-12 21:22 - 2013-07-10 19:36 - 00000000 ____D C:\Users\peter\AppData\Roaming\FreeVideoConverter
2013-07-12 21:22 - 2013-07-10 18:06 - 00000000 ____D C:\Users\peter\AppData\Roaming\DVDVideoSoft
2013-07-12 21:22 - 2011-11-14 21:54 - 00000000 ____D C:\Users\peter\AppData\Roaming\Sony
2013-07-12 21:21 - 2012-05-03 21:59 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-07-12 21:02 - 2011-05-28 15:43 - 00000000 ____D C:\Program Files (x86)\Pando Networks
2013-07-12 05:48 - 2009-07-14 06:45 - 00437512 _____ C:\Windows\system32\FNTCACHE.DAT
2013-07-12 05:47 - 2013-03-14 21:03 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2013-07-12 05:47 - 2013-03-14 21:03 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight
2013-07-12 05:47 - 2009-07-14 09:45 - 00000000 ____D C:\Program Files\Windows Journal
2013-07-12 05:47 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files\Windows Defender
2013-07-12 05:47 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files (x86)\Windows Defender
2013-07-12 02:30 - 2011-05-29 08:34 - 78185248 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-07-11 17:10 - 2013-07-11 17:10 - 00000000 ____D C:\Program Files (x86)\WebCake
2013-07-10 19:35 - 2013-07-10 19:35 - 01128472 _____ (Koyote-Lab Inc) C:\Users\peter\Downloads\FreeVideoConverterSetup-r135-n-bc.exe
2013-07-10 19:34 - 2013-07-10 19:34 - 01204496 _____ (DVDVideoSoft Ltd.                                           ) C:\Users\peter\Downloads\FreeAudioDub.exe
2013-07-09 14:34 - 2013-07-09 14:17 - 671261856 _____ (InstallShield Software Corporation) C:\S4_League.exe
2013-07-05 06:06 - 2013-07-05 06:06 - 00000000 ____D C:\Users\peter\AppData\Local\Keldon_Corps
2013-07-04 19:18 - 2013-07-04 19:18 - 00000000 ____D C:\Program Files (x86)\Gameforge4D
2013-07-03 06:16 - 2013-07-03 06:16 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-07-03 05:52 - 2013-07-03 05:53 - 00263592 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2013-07-03 05:52 - 2013-07-03 05:53 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2013-07-03 05:52 - 2013-07-03 05:53 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2013-07-03 05:52 - 2013-07-03 05:53 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2013-07-03 05:52 - 2012-12-26 16:51 - 00867240 _____ (Oracle Corporation) C:\Windows\SysWOW64\npDeployJava1.dll
2013-07-03 05:52 - 2012-12-26 16:51 - 00789416 _____ (Oracle Corporation) C:\Windows\SysWOW64\deployJava1.dll
2013-07-01 23:10 - 2013-07-01 23:10 - 00000000 ____D C:\Users\peter\Documents\JoWooD
2013-06-26 22:44 - 2011-05-28 14:22 - 00000000 ____D C:\Users\peter
2013-06-26 22:42 - 2013-06-26 22:42 - 00000000 ____D C:\Users\peter\AppData\Roaming\SEGA
2013-06-26 22:08 - 2013-06-09 19:26 - 929925841 _____ (www.gamerkraft.com                                          ) C:\FreeJack_v40142.exe

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-07-13 20:59

==================== End Of Log ============================
         
--- --- ---

und die Addition.txtFRST Additions Logfile:
Code:
ATTFilter
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 22-07-2013 01
Ran by peter at 2013-07-23 14:50:28
Running from D:\Downloads
Boot Mode: Normal
==========================================================


==================== Installed Programs =======================

   
Acer eRecovery Management (x32 Version: 4.05.3015)
Acer Registration (x32 Version: 1.03.3003)
Acer ScreenSaver (x32 Version: 1.1.0825.2010)
Acer Updater (x32 Version: 1.02.3001)
Acrobat.com (x32 Version: 1.6.65)
Adobe AIR (x32 Version: 1.5.0.7220)
Adobe Flash Player 10 ActiveX (x32 Version: 10.1.82.76)
Adobe Flash Player 11 Plugin (x32 Version: 11.7.700.202)
Adobe Reader XI (11.0.02) - Deutsch (x32 Version: 11.0.02)
Advertising Center (x32 Version: 0.0.0.2)
AIMP2 (x32)
Akamai NetSession Interface (HKCU)
Akamai NetSession Interface (x32)
Avira Free Antivirus (x32 Version: 12.1.9.2400)
Bandicam (x32 Version: 1.8.6.321)
Bandisoft MPEG-1 Decoder (x32)
D3DX10 (x32 Version: 15.4.2368.0902)
Elsword_DE (x32)
eSobi v2 (x32 Version: 2.0.4.000274)
Facetheme (x32 Version: 1.0)
Firebird SQL Server - MAGIX Edition (x32 Version: 2.1.27.0)
Grand Chase version 070213 (x32 Version: 070213)
Hotkey Utility (x32 Version: 2.05.3013)
Hyperionics DB Toolbar (x32)
Identity Card (x32 Version: 1.00.3003)
ImagXpress (x32 Version: 7.0.74.0)
Intel(R) Management Engine Components (x32 Version: 7.0.0.1118)
Intel(R) Rapid Storage Technology (x32 Version: 10.0.0.1046)
Java 7 Update 25 (x32 Version: 7.0.250)
Java Auto Updater (x32 Version: 2.1.9.5)
Junk Mail filter update (x32 Version: 15.4.3502.0922)
Malwarebytes Anti-Malware Version 1.75.0.1300 (x32 Version: 1.75.0.1300)
Mesh Runtime (x32 Version: 15.4.5722.2)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319)
Microsoft Application Error Reporting (Version: 12.0.6015.5000)
Microsoft Office Professional Edition 2003 (x32 Version: 11.0.8173.0)
Microsoft Silverlight (Version: 5.1.20513.0)
Microsoft SQL Server 2005 Compact Edition [ENU] (x32 Version: 3.1.0000)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (x32 Version: 8.0.50727.4053)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (x32 Version: 9.0.21022)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (x32 Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.30319 (Version: 10.0.30319)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219)
Mozilla Firefox 22.0 (x86 de) (x32 Version: 22.0)
Mozilla Maintenance Service (x32 Version: 22.0)
MSVCRT (x32 Version: 15.4.2862.0708)
MSVCRT Redists (Version: 1.0)
MSVCRT Redists (x32 Version: 1.0)
MSVCRT_amd64 (x32 Version: 15.4.2862.0708)
MSXML 4.0 SP2 (KB954430) (x32 Version: 4.20.9870.0)
MSXML 4.0 SP2 (KB973688) (x32 Version: 4.20.9876.0)
MyWinLocker (x32 Version: 3.1.212.0)
MyWinLocker Suite (x32 Version: 3.1.212.0)
NC Launcher (GameForge) (x32)
Nero 9 Essentials (x32)
Nero ControlCenter (x32 Version: 9.0.0.1)
Nero DiscSpeed (x32 Version: 5.4.13.100)
Nero DiscSpeed Help (x32 Version: 5.4.4.100)
Nero DriveSpeed (x32 Version: 4.4.12.100)
Nero DriveSpeed Help (x32 Version: 4.4.4.100)
Nero Express Help (x32 Version: 9.4.37.100)
Nero InfoTool (x32 Version: 6.4.12.100)
Nero InfoTool Help (x32 Version: 6.4.4.100)
Nero Installer (x32 Version: 4.4.9.0)
Nero Online Upgrade (x32 Version: 1.3.0.0)
Nero StartSmart (x32 Version: 9.4.37.100)
Nero StartSmart Help (x32 Version: 9.4.27.100)
Nero StartSmart OEM (x32 Version: 9.16.0.100)
NeroExpress (x32 Version: 9.4.37.100)
neroxml (x32 Version: 1.0.0)
NVIDIA 3D Vision Treiber 311.06 (Version: 311.06)
NVIDIA Display Control Panel (Version: 6.14.12.5933)
NVIDIA Drivers (Version: 1.10.62.40)
NVIDIA Grafiktreiber 311.06 (Version: 311.06)
NVIDIA Install Application (Version: 2.1002.108.688)
NVIDIA PhysX (x32 Version: 9.10.0224)
NVIDIA Stereoscopic 3D Driver (x32 Version: 7.17.13.1106)
NVIDIA Systemsteuerung 311.06 (Version: 311.06)
NVIDIA Update 1.11.3 (Version: 1.11.3)
NVIDIA Update Components (Version: 1.11.3)
Pando Media Booster (x32 Version: 2.6.0.9)
PhotoScape (x32)
Realtek High Definition Audio Driver (x32 Version: 6.0.1.6194)
rosoft .NET Framework 4 Client Profile (Version: 4.0.30319)
Shredder (Version: 2.0.8.3)
Shredder (x32 Version: 2.0.8.3)
Skype™ 6.3 (x32 Version: 6.3.107)
STOnline (x32 Version: 1.0000)
Text-To-Speech-Runtime (x32 Version: 1.0.0.0)
Total Commander Ultima Prime 4.6.0.0 (x32 Version: 4.6.0.0)
TuneUp Utilities (x32 Version: 9.0.3000.52)
TuneUp Utilities Language Pack (de-DE) (x32 Version: 9.0.3000.52)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (x32 Version: 1)
WebCake 3.00 (Version: 3.00)
Welcome Center (x32 Version: 1.02.3005)
Windows Live Communications Platform (x32 Version: 15.4.3502.0922)
Windows Live Essentials (x32 Version: 15.4.3502.0922)
Windows Live Essentials (x32 Version: 15.4.3555.0308)
Windows Live Fotogalerie (x32 Version: 15.4.3502.0922)
Windows Live ID Sign-in Assistant (Version: 7.250.4232.0)
Windows Live Installer (x32 Version: 15.4.3502.0922)
Windows Live Language Selector (Version: 15.4.3555.0308)
Windows Live Mail (x32 Version: 15.4.3502.0922)
Windows Live Mesh (x32 Version: 15.4.3502.0922)
Windows Live Mesh ActiveX control for remote connections (x32 Version: 15.4.5722.2)
Windows Live Messenger (x32 Version: 15.4.3538.0513)
Windows Live MIME IFilter (Version: 15.4.3502.0922)
Windows Live Movie Maker (x32 Version: 15.4.3502.0922)
Windows Live Photo Common (x32 Version: 15.4.3502.0922)
Windows Live Photo Gallery (x32 Version: 15.4.3502.0922)
Windows Live PIMT Platform (x32 Version: 15.4.3508.1109)
Windows Live Remote Client (Version: 15.4.5722.2)
Windows Live Remote Client Resources (Version: 15.4.5722.2)
Windows Live Remote Service (Version: 15.4.5722.2)
Windows Live Remote Service Resources (Version: 15.4.5722.2)
Windows Live SOXE (x32 Version: 15.4.3502.0922)
Windows Live SOXE Definitions (x32 Version: 15.4.3502.0922)
Windows Live UX Platform (x32 Version: 15.4.3502.0922)
Windows Live UX Platform Language Pack (x32 Version: 15.4.3508.1109)
Windows Live Writer (x32 Version: 15.4.3502.0922)
Windows Live Writer Resources (x32 Version: 15.4.3502.0922)
Windows Movie Maker 2.6 (x32 Version: 2.6.4037.0)
WinRAR 4.01 (32-Bit) (x32 Version: 4.01.0)

==================== Restore Points  =========================

19-07-2013 15:30:23 Geplanter Prüfpunkt
22-07-2013 22:10:18 Installed STOnline

==================== Hosts content: ==========================

2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

Task: {31AA3C03-74FF-46BE-BF91-64AC35BFB331} - System32\Tasks\Adobe Reader and Acrobat Manager => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2012-12-18] (Adobe Systems Incorporated)
Task: {7FEAD0FE-E8BC-4157-9EAC-C28F3F811018} - System32\Tasks\Microsoft\Windows Live\SOXE\Extractor Definitions Update Task
Task: {827879F4-4439-4E14-9490-CFF37F8D3F3B} - System32\Tasks\Java Update Scheduler => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [2013-03-12] (Oracle Corporation)
Task: {98F9C1C0-8825-4020-96C5-C54A4BE9D521} - System32\Tasks\Automatische Problemsuche => C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpSystemStatusCheck.exe [2009-12-09] (TuneUp Software)
Task: {A164B16A-75C9-439F-A1BF-91CCFDE82ACB} - System32\Tasks\TuneUpUtilities_Task_BkGndMaintenance => C:\Program Files (x86)\TuneUp Utilities 2010\OneClick.exe [2009-12-09] (TuneUp Software)

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (07/23/2013 08:50:48 AM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: _Launcher.exe, Version: 1.1.1.1, Zeitstempel: 0x51dd0542
Name des fehlerhaften Moduls: _Launcher.exe, Version: 1.1.1.1, Zeitstempel: 0x51dd0542
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00131ef9
ID des fehlerhaften Prozesses: 0x13c4
Startzeit der fehlerhaften Anwendung: 0x_Launcher.exe0
Pfad der fehlerhaften Anwendung: _Launcher.exe1
Pfad des fehlerhaften Moduls: _Launcher.exe2
Berichtskennung: _Launcher.exe3

Error: (07/22/2013 07:35:31 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "assemblyIdentity1". Fehler in Manifest- oder Richtliniendatei "assemblyIdentity2" in Zeile assemblyIdentity3.
Der Wert "*" des "language"-Attributs im assemblyIdentity-Element ist ungültig.

Error: (07/22/2013 07:35:14 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "assemblyIdentity1". Fehler in Manifest- oder Richtliniendatei "assemblyIdentity2" in Zeile assemblyIdentity3.
Der Wert "MAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINOR" des "version"-Attributs im assemblyIdentity-Element ist ungültig.

Error: (07/22/2013 01:00:14 PM) (Source: Application Hang) (User: )
Description: Programm Skype.exe, Version 6.3.0.107 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 1854

Startzeit: 01ce86c9ee587635

Endzeit: 10

Anwendungspfad: C:\Program Files (x86)\Skype\Phone\Skype.exe

Berichts-ID:

Error: (07/22/2013 00:48:55 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: Skype.exe, Version: 6.3.0.107, Zeitstempel: 0x51715160
Name des fehlerhaften Moduls: bdcam.dll_unloaded, Version: 0.0.0.0, Zeitstempel: 0x5119d76e
Ausnahmecode: 0xc0000005
Fehleroffset: 0x67d78570
ID des fehlerhaften Prozesses: 0xb6c
Startzeit der fehlerhaften Anwendung: 0xSkype.exe0
Pfad der fehlerhaften Anwendung: Skype.exe1
Pfad des fehlerhaften Moduls: Skype.exe2
Berichtskennung: Skype.exe3

Error: (07/19/2013 05:24:29 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "assemblyIdentity1". Fehler in Manifest- oder Richtliniendatei "assemblyIdentity2" in Zeile assemblyIdentity3.
Der Wert "*" des "language"-Attributs im assemblyIdentity-Element ist ungültig.

Error: (07/19/2013 05:24:14 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "assemblyIdentity1". Fehler in Manifest- oder Richtliniendatei "assemblyIdentity2" in Zeile assemblyIdentity3.
Der Wert "MAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINOR" des "version"-Attributs im assemblyIdentity-Element ist ungültig.

Error: (07/18/2013 04:12:29 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "assemblyIdentity1". Fehler in Manifest- oder Richtliniendatei "assemblyIdentity2" in Zeile assemblyIdentity3.
Der Wert "MAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINOR" des "version"-Attributs im assemblyIdentity-Element ist ungültig.

Error: (07/17/2013 04:43:41 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: MovieMaker.exe, Version: 15.4.3555.308, Zeitstempel: 0x4f596bb7
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0xc0000005
Fehleroffset: 0xe1c2f3b7
ID des fehlerhaften Prozesses: 0xcbc
Startzeit der fehlerhaften Anwendung: 0xMovieMaker.exe0
Pfad der fehlerhaften Anwendung: MovieMaker.exe1
Pfad des fehlerhaften Moduls: MovieMaker.exe2
Berichtskennung: MovieMaker.exe3

Error: (07/17/2013 02:00:18 AM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: firefox.exe, Version: 22.0.0.4917, Zeitstempel: 0x51c06b1b
Name des fehlerhaften Moduls: xul.dll, Version: 22.0.0.4917, Zeitstempel: 0x51c06a5b
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00173668
ID des fehlerhaften Prozesses: 0xb48
Startzeit der fehlerhaften Anwendung: 0xfirefox.exe0
Pfad der fehlerhaften Anwendung: firefox.exe1
Pfad des fehlerhaften Moduls: firefox.exe2
Berichtskennung: firefox.exe3


System errors:
=============
Error: (07/23/2013 07:11:27 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "NVIDIA Update Service Daemon" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1069

Error: (07/23/2013 07:11:27 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "nvUpdatusService" konnte sich nicht als ".\UpdatusUser" mit dem aktuellen Kennwort aufgrund des folgenden Fehlers anmelden: 
%%1330

Vergewissern Sie sich, dass der Dienst richtig konfiguriert ist im Dienste-Snap-In in der Microsoft Management Console (MMC).

Error: (07/23/2013 07:09:23 AM) (Source: Service Control Manager) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen: 
VD_FileDisk

Error: (07/23/2013 07:08:58 AM) (Source: Application Popup) (User: )
Description: Aufgrund der Inkompatibilität mit diesem System wurde \SystemRoot\SysWow64\Drivers\VD_FileDisk.SYS nicht geladen. Wenden Sie sich an den Softwarehersteller, um eine kompatible Version des Treibers zu erhalten.

Error: (07/22/2013 06:31:08 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "NVIDIA Update Service Daemon" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1069

Error: (07/22/2013 06:31:08 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "nvUpdatusService" konnte sich nicht als ".\UpdatusUser" mit dem aktuellen Kennwort aufgrund des folgenden Fehlers anmelden: 
%%1330

Vergewissern Sie sich, dass der Dienst richtig konfiguriert ist im Dienste-Snap-In in der Microsoft Management Console (MMC).

Error: (07/22/2013 06:29:05 AM) (Source: Service Control Manager) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen: 
VD_FileDisk

Error: (07/22/2013 06:28:38 AM) (Source: Application Popup) (User: )
Description: Aufgrund der Inkompatibilität mit diesem System wurde \SystemRoot\SysWow64\Drivers\VD_FileDisk.SYS nicht geladen. Wenden Sie sich an den Softwarehersteller, um eine kompatible Version des Treibers zu erhalten.

Error: (07/21/2013 03:02:51 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "NVIDIA Update Service Daemon" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1069

Error: (07/21/2013 03:02:51 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "nvUpdatusService" konnte sich nicht als ".\UpdatusUser" mit dem aktuellen Kennwort aufgrund des folgenden Fehlers anmelden: 
%%1330

Vergewissern Sie sich, dass der Dienst richtig konfiguriert ist im Dienste-Snap-In in der Microsoft Management Console (MMC).


Microsoft Office Sessions:
=========================
Error: (07/23/2013 08:50:48 AM) (Source: Application Error)(User: )
Description: _Launcher.exe1.1.1.151dd0542_Launcher.exe1.1.1.151dd0542c000000500131ef913c401ce8768d9bc264eC:\koramgame\STOnline\_Launcher.exeC:\koramgame\STOnline\_Launcher.exe3412f3c5-f364-11e2-bcf1-f80f4115d201

Error: (07/22/2013 07:35:31 PM) (Source: SideBySide)(User: )
Description: assemblyIdentitylanguage*c:\program files (x86)\TC UP\PLUGINS\Media\SiMail\DelphiZip.dllc:\program files (x86)\TC UP\PLUGINS\Media\SiMail\DelphiZip.dll8

Error: (07/22/2013 07:35:14 PM) (Source: SideBySide)(User: )
Description: assemblyIdentityversionMAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINORc:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dllc:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dll3

Error: (07/22/2013 01:00:14 PM) (Source: Application Hang)(User: )
Description: Skype.exe6.3.0.107185401ce86c9ee58763510C:\Program Files (x86)\Skype\Phone\Skype.exe

Error: (07/22/2013 00:48:55 PM) (Source: Application Error)(User: )
Description: Skype.exe6.3.0.10751715160bdcam.dll_unloaded0.0.0.05119d76ec000000567d78570b6c01ce8693f9dec749C:\Program Files (x86)\Skype\Phone\Skype.exebdcam.dll4da3471b-f2bc-11e2-bb55-f80f4115d201

Error: (07/19/2013 05:24:29 PM) (Source: SideBySide)(User: )
Description: assemblyIdentitylanguage*c:\program files (x86)\TC UP\PLUGINS\Media\SiMail\DelphiZip.dllc:\program files (x86)\TC UP\PLUGINS\Media\SiMail\DelphiZip.dll8

Error: (07/19/2013 05:24:14 PM) (Source: SideBySide)(User: )
Description: assemblyIdentityversionMAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINORc:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dllc:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dll3

Error: (07/18/2013 04:12:29 PM) (Source: SideBySide)(User: )
Description: assemblyIdentityversionMAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINORc:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dllc:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dll3

Error: (07/17/2013 04:43:41 PM) (Source: Application Error)(User: )
Description: MovieMaker.exe15.4.3555.3084f596bb7unknown0.0.0.000000000c0000005e1c2f3b7cbc01ce82fc05efc506C:\Program Files (x86)\Windows Live\Photo Gallery\MovieMaker.exeunknown45bc6156-eeef-11e2-b121-f80f4115d201

Error: (07/17/2013 02:00:18 AM) (Source: Application Error)(User: )
Description: firefox.exe22.0.0.491751c06b1bxul.dll22.0.0.491751c06a5bc000000500173668b4801ce827c9f967d74C:\Program Files (x86)\Mozilla Firefox\firefox.exeC:\Program Files (x86)\Mozilla Firefox\xul.dlldd2b093c-ee73-11e2-85bc-f80f4115d201


==================== Memory info =========================== 

Percentage of memory in use: 50%
Total physical RAM: 6126.52 MB
Available physical RAM: 3044.33 MB
Total Pagefile: 12251.23 MB
Available Pagefile: 8976.59 MB
Total Virtual: 8192 MB
Available Virtual: 8191.82 MB

==================== Drives ================================

Drive c: (Acer) (Fixed) (Total:457.89 GB) (Free:353.42 GB) NTFS (Disk=0 Partition=3)
Drive d: (Data) (Fixed) (Total:457.89 GB) (Free:181.39 GB) NTFS (Disk=0 Partition=4)
Drive e: (Vampire Knights) (CDROM) (Total:3.15 GB) (Free:0 GB) CDFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 932 GB) (Disk ID: 0DDF3744)
Partition 1: (Not Active) - (Size=16 GB) - (Type=27)
Partition 2: (Active) - (Size=102 MB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=458 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=458 GB) - (Type=07 NTFS)

==================== End Of Log ============================
         
--- --- ---
__________________

Geändert von Haterix (23.07.2013 um 13:52 Uhr)

Alt 23.07.2013, 14:26   #4
schrauber
/// the machine
/// TB-Ausbilder
 

Malware loswerden, wie? - Standard

Malware loswerden, wie?



Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!
Downloade dir bitte Combofix vom folgenden Downloadspiegel

Link 1


WICHTIG - Speichere Combofix auf deinem Desktop
  • Deaktiviere bitte all deine Anti Viren sowie Anti Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören.
Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Wenn Combofix fertig ist, wird es eine Logfile erstellen. Bitte poste die C:\Combofix.txt in deiner nächsten Antwort.


Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Zitat:
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.
__________________
gruß,
schrauber

Proud Member of UNITE and ASAP since 2009

Spenden
Anleitungen und Hilfestellungen
Trojaner-Board Facebook-Seite

Keine Hilfestellung via PM!

Alt 23.07.2013, 18:50   #5
Haterix
 
Malware loswerden, wie? - Standard

Malware loswerden, wie?



Hallo schrauber,

Ich habe ComboFix nun 2x laufen lassen und es scheint als wenn es nach der 49 Datei stehenbleibt.
(Ich habe es 2 Stunden nachdem es aufgehört hat offensichtlich zu arbeiten, offen gelassen, doch hat sich auch dann nichts geändert.)

Ich habe in einem anderen Thread gelesen das man, während es läuft, nichts anderes machen sollte.

Ist das korrekt?
Falls ja, werde ich es nochmals probieren.

Durch MalwareBytes, welches mir ein Bekannter empfohlen hat, konnte ich, sofern das Programm nicht lügt, bereits alles vom Programm erkannten schädlichen Dateien entfernen, jedoch bekomme ich in einem meiner Foren immernoch unten ein kleines Fenster von WebCake mit einer %-Zahl angezeigt.


Danke für deine bisherige Hilfe.


Alt 23.07.2013, 19:14   #6
schrauber
/// the machine
/// TB-Ausbilder
 

Malware loswerden, wie? - Standard

Malware loswerden, wie?



Ja, nichts machen wenn CF läuft.

Wenn es wieder slange stehen bleibt abbrechen und ein frisches FRST log posten.

Denk dran dein AV Programm abzustellen wenn CF läuft.
__________________
--> Malware loswerden, wie?

Alt 23.07.2013, 20:27   #7
Haterix
 
Malware loswerden, wie? - Standard

Malware loswerden, wie?



Es hing wieder bei der 49. Datei, wobei ich die Maus für 50 Minuten kein einziges Mal bewegt habe.

Hier ist der Log:
FRST Logfile:
Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 23-07-2013
Ran by peter (administrator) on 23-07-2013 21:25:33
Running from D:\Downloads
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(MAGIX AG) C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe
(Acer Incorporated) C:\Program Files (x86)\Acer\Registration\GREGsvc.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
(TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpUtilitiesService64.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
(Acer Group) C:\Program Files\Acer\Acer Updater\UpdaterService.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpUtilitiesApp64.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Egis Technology Inc.) C:\Program Files (x86)\EgisTec MyWinLocker\x86\mwlDaemon.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Akamai Technologies, Inc.) C:\Users\peter\AppData\Local\Akamai\netsession_win.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Egis Technology Inc.) C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe
() C:\Program Files (x86)\Acer\Hotkey Utility\HotkeyUtility.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Akamai Technologies, Inc.) C:\Users\peter\AppData\Local\Akamai\netsession_win.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Program Files (x86)\Internet Explorer\IELowutil.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_7_700_202.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_7_700_202.exe
(TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpSystemStatusCheck.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [mwlDaemon] - C:\Program Files (x86)\EgisTec MyWinLocker\x86\mwlDaemon.exe [349552 2010-05-27] (Egis Technology Inc.)
HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [11464296 2010-09-03] (Realtek Semiconductor)
HKCU\...\Run: [Sidebar] - C:\Program Files\Windows Sidebar\sidebar.exe [1475584 2010-11-20] (Microsoft Corporation)
HKCU\...\Run: [Akamai NetSession Interface] - C:\Users\peter\AppData\Local\Akamai\netsession_win.exe [4489472 2013-06-05] (Akamai Technologies, Inc.)
HKCU\...\Run: [Skype] - C:\Program Files (x86)\Skype\Phone\Skype.exe [18678376 2013-04-19] (Skype Technologies S.A.)
HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [283160 2010-09-13] (Intel Corporation)
HKLM-x32\...\Run: [SuiteTray] - "C:\Program Files (x86)\EgisTec MyWinLockerSuite\x86\SuiteTray.exe" [337264 2010-05-27] (Egis Technology Inc.)
HKLM-x32\...\Run: [EgisTecPMMUpdate] - "C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe" [407920 2010-03-11] (Egis Technology Inc.)
HKLM-x32\...\Run: [Hotkey Utility] - C:\Program Files (x86)\Acer\Hotkey Utility\HotkeyUtility.exe [618600 2010-12-03] ()
HKLM-x32\...\Run: [avgnt] - "C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min [348664 2012-08-08] (Avira Operations GmbH & Co. KG)
HKU\Default\...\RunOnce: [ScrSav] - C:\Program Files (x86)\Acer\Screensaver\run_Acer.exe /default [154144 2010-07-29] ()
HKU\Default User\...\RunOnce: [ScrSav] - C:\Program Files (x86)\Acer\Screensaver\run_Acer.exe /default [154144 2010-07-29] ()
HKU\UpdatusUser\...\RunOnce: [ScrSav] - C:\Program Files (x86)\Acer\Screensaver\run_Acer.exe /default [154144 2010-07-29] ()

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://start.nexon.com
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://acer.msn.com
SearchScopes: HKLM - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=AARTDF&pc=MAAR&src=IE-SearchBox
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=AARTDF&pc=MAAR&src=IE-SearchBox
SearchScopes: HKLM-x32 - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=AARTDF&pc=MAAR&src=IE-SearchBox
SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=AARTDF&pc=MAAR&src=IE-SearchBox
SearchScopes: HKCU - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Handler: msdaipp - No CLSID Value - 
Handler-x32: msdaipp - No CLSID Value - 
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Filter: text/xml - {807553E5-5146-11D5-A672-00B0D022E945} -  No File
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\peter\AppData\Roaming\Mozilla\Firefox\Profiles\bjyo7zt0.default
FF user.js: detected! => C:\Users\peter\AppData\Roaming\Mozilla\Firefox\Profiles\bjyo7zt0.default\user.js
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_7_700_202.dll ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_202.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3555.0308 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @nexon.com/NexonPlugWebExtension - C:\ProgramData\Nexon\NexonPlug\npPlugWire_1.0.0.0.dll (Nexon)
FF Plugin-x32: @nexon.com/NxGame - C:\ProgramData\Nexon\NGM\npnxgame.dll No File
FF Plugin-x32: @nexon.net/NxGame - C:\ProgramData\NexonUS\NGM\npNxGameUS.dll No File
FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @ogplanet.com/npOGPPlugin - C:\Windows\system32\npOGPPlugin.dll No File
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Extension: WebCake - C:\Users\peter\AppData\Roaming\Mozilla\Firefox\Profiles\bjyo7zt0.default\Extensions\plugin@getwebcake.com
FF Extension: DownloadHelper - C:\Users\peter\AppData\Roaming\Mozilla\Firefox\Profiles\bjyo7zt0.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
FF Extension: No Name - C:\Users\peter\AppData\Roaming\Mozilla\Firefox\Profiles\bjyo7zt0.default\Extensions\{64161300-e22b-11db-8314-0800200c9a66}.xpi
FF Extension: No Name - C:\Users\peter\AppData\Roaming\Mozilla\Firefox\Profiles\bjyo7zt0.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
FF Extension: Default - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF HKLM-x32\...\Firefox\Extensions: [{EB132DB0-A4CA-11DF-9732-0E29E0D72085}] C:\Program Files (x86)\Object\facetheme
FF HKCU\...\Firefox\Extensions: [{EB132DB0-A4CA-11DF-9732-0E29E0D72085}] C:\Program Files (x86)\Object\facetheme

==================== Services (Whitelisted) =================

R2 Akamai; c:\program files (x86)\common files\akamai/netsession_win_8fa3539.dll [4569856 2013-07-01] (Akamai Technologies, Inc.)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [86224 2012-05-02] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [110032 2012-05-02] (Avira Operations GmbH & Co. KG)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
S3 MWLService; C:\Program Files (x86)\EgisTec MyWinLocker\x86\MWLService.exe [305520 2010-05-27] (Egis Technology Inc.)
S3 npggsvc; C:\Windows\SysWow64\GameMon.des [3963248 2011-01-12] (INCA Internet Co., Ltd.)
S3 TuneUp.Defrag; C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpDefragService.exe [607048 2011-05-28] (TuneUp Software)
R2 TuneUp.UtilitiesSvc; C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpUtilitiesService64.exe [1394504 2009-12-09] (TuneUp Software)

==================== Drivers (Whitelisted) ====================

S3 1394hub; C:\Windows\System32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
S3 1394hub; C:\Windows\SysWow64\svchost.exe [20992 2009-07-14] (Microsoft Corporation)
R1 aswKbd; C:\Windows\System32\Drivers\aswKbd.sys [19600 2012-06-28] (AVAST Software)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [98848 2012-04-25] (Avira GmbH)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132832 2012-04-27] (Avira GmbH)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [27760 2012-05-02] (Avira GmbH)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
S3 NPPTNT2; C:\Windows\SysWow64\npptNT2.sys [4682 2005-01-02] (INCA Internet Co., Ltd.)
R3 TuneUpUtilitiesDrv; C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpUtilitiesDriver64.sys [11856 2009-10-14] (TuneUp Software)
S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [x]
S3 NPPTNT2; \??\C:\Windows\system32\npptNT2.sys [x]
S3 uqk; \??\C:\koramgame\STOnline\avital\wyqku64.sys [x]
S1 VD_FileDisk; No ImagePath
S3 X6va003; \??\C:\Users\peter\AppData\Local\Temp\003472D.tmp [x]
S3 X6va005; \??\C:\Users\peter\AppData\Local\Temp\0055E46.tmp [x]
S3 X6va006; \??\C:\Users\peter\AppData\Local\Temp\006F27A.tmp [x]
S3 X6va008; \??\C:\Users\peter\AppData\Local\Temp\0083CC3.tmp [x]
S3 X6va009; \??\C:\Windows\SysWOW64\Drivers\X6va009 [x]
S3 X6va010; \??\C:\Windows\SysWOW64\Drivers\X6va010 [x]
S3 X6va011; \??\C:\Windows\SysWOW64\Drivers\X6va011 [x]
S3 X6va012; \??\C:\Windows\SysWOW64\Drivers\X6va012 [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-07-23 20:55 - 2013-07-23 21:00 - 00000000 ___SD C:\ComboFix
2013-07-23 19:43 - 2013-07-23 19:43 - 00000872 _____ C:\Users\peter\Desktop\ComboFix.lnk
2013-07-23 15:46 - 2011-06-26 08:45 - 00256000 _____ C:\Windows\PEV.exe
2013-07-23 15:46 - 2010-11-07 19:20 - 00208896 _____ C:\Windows\MBR.exe
2013-07-23 15:46 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2013-07-23 15:46 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2013-07-23 15:46 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2013-07-23 15:46 - 2000-08-31 02:00 - 00098816 _____ C:\Windows\sed.exe
2013-07-23 15:46 - 2000-08-31 02:00 - 00080412 _____ C:\Windows\grep.exe
2013-07-23 15:46 - 2000-08-31 02:00 - 00068096 _____ C:\Windows\zip.exe
2013-07-23 15:44 - 2013-07-23 15:45 - 00000000 ____D C:\Qoobox
2013-07-23 15:44 - 2013-07-23 15:44 - 00000000 ____D C:\Windows\erdnt
2013-07-23 14:49 - 2013-07-23 14:49 - 00000000 ____D C:\FRST
2013-07-23 14:20 - 2013-07-23 14:20 - 00000000 ____D C:\Users\peter\AppData\Roaming\Malwarebytes
2013-07-23 14:19 - 2013-07-23 14:19 - 00001073 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-07-23 14:19 - 2013-07-23 14:19 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-07-23 14:19 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-07-23 00:12 - 2013-07-23 00:12 - 00001606 _____ C:\Users\Public\Desktop\Spirit Tales.lnk
2013-07-23 00:10 - 2013-07-23 00:10 - 00000000 ____D C:\koramgame
2013-07-22 11:53 - 2013-07-22 11:54 - 00000000 ____D C:\Users\peter\AppData\Local\{BD40AB1C-0A4E-4DDF-833E-E9EE7CB54B3B}
2013-07-21 23:53 - 2013-07-21 23:53 - 00000000 ____D C:\Users\peter\AppData\Local\{0AAB630D-473D-4CE5-9C06-9C4B49BCFB64}
2013-07-20 09:09 - 2013-07-20 09:09 - 00000000 ____D C:\Users\peter\AppData\Local\{F59909EA-0794-4496-A61C-F223F3430CEF}
2013-07-17 04:30 - 2013-07-17 04:30 - 00000000 ____D C:\Windows\Sun
2013-07-16 11:54 - 2013-07-16 11:54 - 00000000 ____D C:\Users\peter\AppData\Local\{94D7BEBB-D0CC-4B33-B342-35BB542AFBE1}
2013-07-15 18:03 - 2013-07-15 18:04 - 00000000 ____D C:\Users\peter\AppData\Local\{EBE713C7-C5F2-4E3F-A324-4013AE55F55C}
2013-07-15 04:44 - 2013-07-15 04:44 - 00001692 _____ C:\Users\Public\Desktop\Grand Chase.lnk
2013-07-15 04:38 - 2013-07-15 04:38 - 00000000 ____D C:\SG Interactive
2013-07-15 03:13 - 2013-07-15 04:35 - 2099622144 _____ C:\GrandChase_Install_070213-1.bin
2013-07-15 03:13 - 2013-07-15 04:35 - 1030227746 _____ C:\GrandChase_Install_070213-2.bin
2013-07-15 03:13 - 2013-07-15 04:07 - 00383864 _____ (SG Interactive                                              ) C:\GrandChase_Install_070213.exe
2013-07-14 21:26 - 2013-07-14 21:26 - 00000000 ____D C:\Users\peter\Documents\The KMPlayer
2013-07-14 19:57 - 2013-07-14 19:57 - 00000000 ____D C:\Users\peter\AppData\Roaming\Avira
2013-07-14 13:23 - 2013-07-14 13:23 - 00000000 ____D C:\Users\peter\AppData\Local\Macromedia
2013-07-12 23:37 - 2013-07-12 23:37 - 00003798 _____ C:\Windows\System32\Tasks\Java Update Scheduler
2013-07-12 21:02 - 2013-07-16 03:24 - 00000000 ____D C:\Users\peter\AppData\Local\PMB Files
2013-07-12 02:29 - 2013-06-12 01:43 - 14329856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-07-12 02:29 - 2013-06-12 01:43 - 02877440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-07-12 02:29 - 2013-06-12 01:43 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-07-12 02:29 - 2013-06-12 01:43 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-07-12 02:29 - 2013-06-12 01:43 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-07-12 02:29 - 2013-06-12 01:43 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-07-12 02:29 - 2013-06-12 01:43 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-07-12 02:29 - 2013-06-12 01:42 - 13760512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-07-12 02:29 - 2013-06-12 01:42 - 02046976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-07-12 02:29 - 2013-06-12 01:42 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-07-12 02:29 - 2013-06-12 01:42 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-07-12 02:29 - 2013-06-12 01:42 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-07-12 02:29 - 2013-06-12 01:42 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-07-12 02:29 - 2013-06-12 01:26 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-07-12 02:29 - 2013-06-12 01:26 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-07-12 02:29 - 2013-06-12 01:26 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-07-12 02:29 - 2013-06-12 01:25 - 19238912 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-07-12 02:29 - 2013-06-12 01:25 - 15404032 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-07-12 02:29 - 2013-06-12 01:25 - 03958784 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-07-12 02:29 - 2013-06-12 01:25 - 02648576 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-07-12 02:29 - 2013-06-12 01:25 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-07-12 02:29 - 2013-06-12 01:25 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-07-12 02:29 - 2013-06-12 01:25 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-07-12 02:29 - 2013-06-12 01:25 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-07-12 02:29 - 2013-06-12 01:25 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-07-12 02:29 - 2013-06-12 01:25 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-07-12 02:29 - 2013-06-12 01:25 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-07-12 02:29 - 2013-06-12 00:51 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-07-12 02:29 - 2013-06-12 00:50 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-07-12 02:29 - 2013-06-07 05:22 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-07-12 02:29 - 2013-06-07 04:37 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-07-11 20:26 - 2013-06-04 08:00 - 00624128 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2013-07-11 20:26 - 2013-06-04 06:53 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll
2013-07-11 20:26 - 2013-05-06 08:03 - 01887744 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2013-07-11 20:26 - 2013-05-06 06:56 - 01620480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL
2013-07-11 20:25 - 2013-06-05 05:34 - 03153920 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-07-11 20:25 - 2013-04-10 01:34 - 01247744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll
2013-07-11 20:25 - 2013-04-03 00:51 - 01643520 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2013-07-10 19:36 - 2013-07-12 21:22 - 00000000 ____D C:\Users\peter\AppData\Roaming\FreeVideoConverter
2013-07-10 19:35 - 2013-07-10 19:35 - 01128472 _____ (Koyote-Lab Inc) C:\Users\peter\Downloads\FreeVideoConverterSetup-r135-n-bc.exe
2013-07-10 19:34 - 2013-07-10 19:34 - 01204496 _____ (DVDVideoSoft Ltd.                                           ) C:\Users\peter\Downloads\FreeAudioDub.exe
2013-07-10 18:06 - 2013-07-12 21:22 - 00000000 ____D C:\Users\peter\AppData\Roaming\DVDVideoSoft
2013-07-09 14:17 - 2013-07-09 14:34 - 671261856 _____ (InstallShield Software Corporation) C:\S4_League.exe
2013-07-05 22:02 - 2013-04-22 22:49 - 00000000 ____D C:\lang
2013-07-05 22:02 - 2013-04-22 22:49 - 00000000 ____D C:\assets
2013-07-05 22:02 - 2013-03-22 23:38 - 00000000 ____D C:\flash0
2013-07-05 06:06 - 2013-07-05 06:06 - 00000000 ____D C:\Users\peter\AppData\Local\Keldon_Corps
2013-07-04 19:18 - 2013-07-04 19:18 - 00000000 ____D C:\Program Files (x86)\Gameforge4D
2013-07-03 15:38 - 2013-07-15 17:09 - 00000000 ____D C:\dolphin-3.0-win32
2013-07-03 06:16 - 2013-07-03 06:16 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-07-03 05:59 - 2013-05-04 05:59 - 00000032 ____R C:\Windows\hash.dat
2013-07-03 05:53 - 2013-07-03 05:52 - 00263592 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2013-07-03 05:53 - 2013-07-03 05:52 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2013-07-03 05:53 - 2013-07-03 05:52 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2013-07-03 05:53 - 2013-07-03 05:52 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2013-07-01 23:10 - 2013-07-01 23:10 - 00000000 ____D C:\Users\peter\Documents\JoWooD
2013-06-26 22:42 - 2013-06-26 22:42 - 00000000 ____D C:\Users\peter\AppData\Roaming\SEGA

==================== One Month Modified Files and Folders =======

2013-07-23 21:24 - 2011-05-28 15:08 - 00000000 ____D C:\Users\peter\AppData\Roaming\Skype
2013-07-23 21:23 - 2010-10-10 08:11 - 02154094 _____ C:\Windows\PFRO.log
2013-07-23 21:23 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-07-23 21:23 - 2009-07-14 06:51 - 00207787 _____ C:\Windows\setupact.log
2013-07-23 21:22 - 2010-10-10 08:16 - 01135239 _____ C:\Windows\WindowsUpdate.log
2013-07-23 21:00 - 2013-07-23 20:55 - 00000000 ___SD C:\ComboFix
2013-07-23 19:43 - 2013-07-23 19:43 - 00000872 _____ C:\Users\peter\Desktop\ComboFix.lnk
2013-07-23 18:14 - 2009-07-14 06:45 - 00018512 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-07-23 18:14 - 2009-07-14 06:45 - 00018512 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-07-23 18:11 - 2010-10-10 18:07 - 00654150 _____ C:\Windows\system32\perfh007.dat
2013-07-23 18:11 - 2010-10-10 18:07 - 00130022 _____ C:\Windows\system32\perfc007.dat
2013-07-23 18:11 - 2009-07-14 07:13 - 01498742 _____ C:\Windows\system32\PerfStringBackup.INI
2013-07-23 15:45 - 2013-07-23 15:44 - 00000000 ____D C:\Qoobox
2013-07-23 15:44 - 2013-07-23 15:44 - 00000000 ____D C:\Windows\erdnt
2013-07-23 14:49 - 2013-07-23 14:49 - 00000000 ____D C:\FRST
2013-07-23 14:20 - 2013-07-23 14:20 - 00000000 ____D C:\Users\peter\AppData\Roaming\Malwarebytes
2013-07-23 14:19 - 2013-07-23 14:19 - 00001073 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-07-23 14:19 - 2013-07-23 14:19 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-07-23 00:12 - 2013-07-23 00:12 - 00001606 _____ C:\Users\Public\Desktop\Spirit Tales.lnk
2013-07-23 00:10 - 2013-07-23 00:10 - 00000000 ____D C:\koramgame
2013-07-23 00:10 - 2010-10-27 13:00 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2013-07-22 11:54 - 2013-07-22 11:53 - 00000000 ____D C:\Users\peter\AppData\Local\{BD40AB1C-0A4E-4DDF-833E-E9EE7CB54B3B}
2013-07-21 23:53 - 2013-07-21 23:53 - 00000000 ____D C:\Users\peter\AppData\Local\{0AAB630D-473D-4CE5-9C06-9C4B49BCFB64}
2013-07-20 09:09 - 2013-07-20 09:09 - 00000000 ____D C:\Users\peter\AppData\Local\{F59909EA-0794-4496-A61C-F223F3430CEF}
2013-07-17 04:30 - 2013-07-17 04:30 - 00000000 ____D C:\Windows\Sun
2013-07-16 11:54 - 2013-07-16 11:54 - 00000000 ____D C:\Users\peter\AppData\Local\{94D7BEBB-D0CC-4B33-B342-35BB542AFBE1}
2013-07-16 03:24 - 2013-07-12 21:02 - 00000000 ____D C:\Users\peter\AppData\Local\PMB Files
2013-07-15 18:04 - 2013-07-15 18:03 - 00000000 ____D C:\Users\peter\AppData\Local\{EBE713C7-C5F2-4E3F-A324-4013AE55F55C}
2013-07-15 17:09 - 2013-07-03 15:38 - 00000000 ____D C:\dolphin-3.0-win32
2013-07-15 10:31 - 2011-05-28 19:23 - 00000000 ____D C:\Users\peter\AppData\Roaming\PhotoScape
2013-07-15 04:44 - 2013-07-15 04:44 - 00001692 _____ C:\Users\Public\Desktop\Grand Chase.lnk
2013-07-15 04:38 - 2013-07-15 04:38 - 00000000 ____D C:\SG Interactive
2013-07-15 04:35 - 2013-07-15 03:13 - 2099622144 _____ C:\GrandChase_Install_070213-1.bin
2013-07-15 04:35 - 2013-07-15 03:13 - 1030227746 _____ C:\GrandChase_Install_070213-2.bin
2013-07-15 04:07 - 2013-07-15 03:13 - 00383864 _____ (SG Interactive                                              ) C:\GrandChase_Install_070213.exe
2013-07-14 21:26 - 2013-07-14 21:26 - 00000000 ____D C:\Users\peter\Documents\The KMPlayer
2013-07-14 19:57 - 2013-07-14 19:57 - 00000000 ____D C:\Users\peter\AppData\Roaming\Avira
2013-07-14 19:52 - 2011-11-09 21:29 - 00000000 ____D C:\Users\peter\AppData\Local\Akamai
2013-07-14 19:52 - 2011-05-28 15:12 - 00000000 ____D C:\Users\peter\AppData\Roaming\Mozilla
2013-07-14 13:23 - 2013-07-14 13:23 - 00000000 ____D C:\Users\peter\AppData\Local\Macromedia
2013-07-12 23:37 - 2013-07-12 23:37 - 00003798 _____ C:\Windows\System32\Tasks\Java Update Scheduler
2013-07-12 23:35 - 2009-07-14 07:08 - 00032640 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-07-12 21:22 - 2013-07-10 19:36 - 00000000 ____D C:\Users\peter\AppData\Roaming\FreeVideoConverter
2013-07-12 21:22 - 2013-07-10 18:06 - 00000000 ____D C:\Users\peter\AppData\Roaming\DVDVideoSoft
2013-07-12 21:22 - 2011-11-14 21:54 - 00000000 ____D C:\Users\peter\AppData\Roaming\Sony
2013-07-12 21:21 - 2012-05-03 21:59 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-07-12 21:02 - 2011-05-28 15:43 - 00000000 ____D C:\Program Files (x86)\Pando Networks
2013-07-12 05:48 - 2009-07-14 06:45 - 00437512 _____ C:\Windows\system32\FNTCACHE.DAT
2013-07-12 05:47 - 2013-03-14 21:03 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2013-07-12 05:47 - 2013-03-14 21:03 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight
2013-07-12 05:47 - 2009-07-14 09:45 - 00000000 ____D C:\Program Files\Windows Journal
2013-07-12 05:47 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files\Windows Defender
2013-07-12 05:47 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files (x86)\Windows Defender
2013-07-12 02:30 - 2011-05-29 08:34 - 78185248 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-07-10 19:35 - 2013-07-10 19:35 - 01128472 _____ (Koyote-Lab Inc) C:\Users\peter\Downloads\FreeVideoConverterSetup-r135-n-bc.exe
2013-07-10 19:34 - 2013-07-10 19:34 - 01204496 _____ (DVDVideoSoft Ltd.                                           ) C:\Users\peter\Downloads\FreeAudioDub.exe
2013-07-09 14:34 - 2013-07-09 14:17 - 671261856 _____ (InstallShield Software Corporation) C:\S4_League.exe
2013-07-05 06:06 - 2013-07-05 06:06 - 00000000 ____D C:\Users\peter\AppData\Local\Keldon_Corps
2013-07-04 19:18 - 2013-07-04 19:18 - 00000000 ____D C:\Program Files (x86)\Gameforge4D
2013-07-03 06:16 - 2013-07-03 06:16 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-07-03 05:52 - 2013-07-03 05:53 - 00263592 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2013-07-03 05:52 - 2013-07-03 05:53 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2013-07-03 05:52 - 2013-07-03 05:53 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2013-07-03 05:52 - 2013-07-03 05:53 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2013-07-03 05:52 - 2012-12-26 16:51 - 00867240 _____ (Oracle Corporation) C:\Windows\SysWOW64\npDeployJava1.dll
2013-07-03 05:52 - 2012-12-26 16:51 - 00789416 _____ (Oracle Corporation) C:\Windows\SysWOW64\deployJava1.dll
2013-07-01 23:10 - 2013-07-01 23:10 - 00000000 ____D C:\Users\peter\Documents\JoWooD
2013-06-26 22:44 - 2011-05-28 14:22 - 00000000 ____D C:\Users\peter
2013-06-26 22:42 - 2013-06-26 22:42 - 00000000 ____D C:\Users\peter\AppData\Roaming\SEGA
2013-06-26 22:08 - 2013-06-09 19:26 - 929925841 _____ (www.gamerkraft.com                                          ) C:\FreeJack_v40142.exe

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-07-23 19:20

==================== End Of Log ============================
         
--- --- ---

Alt 23.07.2013, 21:09   #8
schrauber
/// the machine
/// TB-Ausbilder
 

Malware loswerden, wie? - Standard

Malware loswerden, wie?



Downloade Dir bitte Malwarebytes Anti-Malware
  • Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
  • Starte Malwarebytes' Anti-Malware (MBAM).
  • Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
  • Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
  • Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
  • Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
  • Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
  • Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.


Downloade Dir bitte AdwCleaner Logo Icon AdwCleaner auf deinen Desktop.
  • Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
  • Starte die AdwCleaner.exe mit einem Doppelklick.
  • Stimme den Nutzungsbedingungen zu.
  • Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
    • "Tracing" Schlüssel löschen
    • Winsock Einstellungen zurücksetzen
    • Proxy Einstellungen zurücksetzen
    • Internet Explorer Richtlinien zurücksetzen
    • Chrome Richtlinien zurücksetzen
    • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
  • Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
  • Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
  • Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

  • Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
  • Drücke eine beliebige Taste, um das Tool zu starten.
  • Je nach System kann der Scan eine Weile dauern.
  • Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
  • Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.


und ein frisches FRST log bitte.
__________________
gruß,
schrauber

Proud Member of UNITE and ASAP since 2009

Spenden
Anleitungen und Hilfestellungen
Trojaner-Board Facebook-Seite

Keine Hilfestellung via PM!

Alt 24.07.2013, 09:38   #9
Haterix
 
Malware loswerden, wie? - Standard

Malware loswerden, wie?



AdwCleaner Logfile:
Code:
ATTFilter
# AdwCleaner v2.306 - Datei am 24/07/2013 um 10:17:35 erstellt
# Aktualisiert am 19/07/2013 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzer : peter - PETER-PC
# Bootmodus : Normal
# Ausgeführt unter : D:\Downloads\adwcleaner.exe
# Option [Löschen]


**** [Dienste] ****


***** [Dateien / Ordner] *****

Ordner Gelöscht : C:\ProgramData\Tarma Installer
Ordner Gelöscht : C:\Users\peter\AppData\LocalLow\Toolbar4
Ordner Gelöscht : C:\Users\peter\AppData\Roaming\Mozilla\Firefox\Profiles\bjyo7zt0.default\extensions\plugin@getwebcake.com

***** [Registrierungsdatenbank] *****

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{338B4DFE-2E2C-4338-9E41-E176D497299E}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{FCBCCB87-9224-4B8D-B117-F56D924BEB18}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{338B4DFE-2E2C-4338-9E41-E176D497299E}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AF6B0594-6008-4327-93E5-608AD710A6FA}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{FCBCCB87-9224-4B8D-B117-F56D924BEB18}
Schlüssel Gelöscht : HKCU\Software\Softonic
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{7169BBB3-3289-4696-B35D-4A88BCF6FB12}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\WebCakeDesktop_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\WebCakeDesktop_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{AF6B0594-6008-4327-93E5-608AD710A6FA}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{AF6B0594-6008-4327-93E5-608AD710A6FA}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{DF84E609-C3A4-49CB-A160-61767DAF8899}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{DF84E609-C3A4-49CB-A160-61767DAF8899}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{628F3201-34D0-49C0-BB9A-82A26AEFB291}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{4897BBA6-48D9-468C-8EFA-846275D7701B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{DF84E609-C3A4-49CB-A160-61767DAF8899}
Schlüssel Gelöscht : HKLM\SOFTWARE\Tarma Installer
Wert Gelöscht : HKCU\Software\Mozilla\Firefox\Extensions [{EB132DB0-A4CA-11DF-9732-0E29E0D72085}]
Wert Gelöscht : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [{EB132DB0-A4CA-11DF-9732-0E29E0D72085}]

***** [Internet Browser] *****

-\\ Internet Explorer v10.0.9200.16635

[OK] Die Registrierungsdatenbank ist sauber.

-\\ Mozilla Firefox v22.0 (de)

Datei : C:\Users\peter\AppData\Roaming\Mozilla\Firefox\Profiles\bjyo7zt0.default\prefs.js

C:\Users\peter\AppData\Roaming\Mozilla\Firefox\Profiles\bjyo7zt0.default\user.js ... Gelöscht !

[OK] Die Datei ist sauber.

*************************

AdwCleaner[S1].txt - [2949 octets] - [24/07/2013 10:17:35]

########## EOF - C:\AdwCleaner[S1].txt - [3009 octets] ##########
         
--- --- ---





Code:
ATTFilter
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 5.2.2 (07.22.2013:2)
OS: Windows 7 Home Premium x64
Ran by peter on 24.07.2013 at 10:22:24,53
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\clsid\{a0b10ebe-4e51-4cae-949b-e6b9e7d68cea}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\clsid\{bb975e58-e769-4e5a-ba12-b765bc559ff3}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\clsid\{f511afdb-726e-4458-90e7-1ecb97406544}
Failed to delete: [Registry Key] HKEY_CLASSES_ROOT\clsid\{fb684d26-01f4-4d9d-87cb-f486beba56dc}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\Wow6432Node\clsid\{fb684d26-01f4-4d9d-87cb-f486beba56dc}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\tracing\apnstub_rasapi32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\tracing\apnstub_rasmancs



~~~ Files



~~~ Folders

Successfully deleted: [Empty Folder] C:\Users\peter\appdata\local\{0AAB630D-473D-4CE5-9C06-9C4B49BCFB64}
Successfully deleted: [Empty Folder] C:\Users\peter\appdata\local\{94D7BEBB-D0CC-4B33-B342-35BB542AFBE1}
Successfully deleted: [Empty Folder] C:\Users\peter\appdata\local\{BD40AB1C-0A4E-4DDF-833E-E9EE7CB54B3B}
Successfully deleted: [Empty Folder] C:\Users\peter\appdata\local\{EBE713C7-C5F2-4E3F-A324-4013AE55F55C}
Successfully deleted: [Empty Folder] C:\Users\peter\appdata\local\{F59909EA-0794-4496-A61C-F223F3430CEF}



~~~ FireFox

Emptied folder: C:\Users\peter\AppData\Roaming\mozilla\firefox\profiles\bjyo7zt0.default\minidumps [95 files]



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 24.07.2013 at 10:26:13,08
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
         
FRST Logfile:

FRST Logfile:
Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 23-07-2013
Ran by peter (administrator) on 24-07-2013 10:37:24
Running from D:\Downloads
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(MAGIX AG) C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe
(Acer Incorporated) C:\Program Files (x86)\Acer\Registration\GREGsvc.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
(TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpUtilitiesService64.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
(TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpUtilitiesApp64.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Egis Technology Inc.) C:\Program Files (x86)\EgisTec MyWinLocker\x86\mwlDaemon.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Akamai Technologies, Inc.) C:\Users\peter\AppData\Local\Akamai\netsession_win.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Egis Technology Inc.) C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe
(Akamai Technologies, Inc.) C:\Users\peter\AppData\Local\Akamai\netsession_win.exe
() C:\Program Files (x86)\Acer\Hotkey Utility\HotkeyUtility.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Microsoft Corporation) C:\Program Files (x86)\Windows Live\Photo Gallery\MovieMaker.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_7_700_202.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_7_700_202.exe
(C. Ghisler & Co.) C:\Program Files (x86)\TC UP\totalcmd.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [mwlDaemon] - C:\Program Files (x86)\EgisTec MyWinLocker\x86\mwlDaemon.exe [349552 2010-05-27] (Egis Technology Inc.)
HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [11464296 2010-09-03] (Realtek Semiconductor)
HKCU\...\Run: [Sidebar] - C:\Program Files\Windows Sidebar\sidebar.exe [1475584 2010-11-20] (Microsoft Corporation)
HKCU\...\Run: [Akamai NetSession Interface] - C:\Users\peter\AppData\Local\Akamai\netsession_win.exe [4489472 2013-06-05] (Akamai Technologies, Inc.)
HKCU\...\Run: [Skype] - C:\Program Files (x86)\Skype\Phone\Skype.exe [18678376 2013-04-19] (Skype Technologies S.A.)
HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [283160 2010-09-13] (Intel Corporation)
HKLM-x32\...\Run: [SuiteTray] - "C:\Program Files (x86)\EgisTec MyWinLockerSuite\x86\SuiteTray.exe" [337264 2010-05-27] (Egis Technology Inc.)
HKLM-x32\...\Run: [EgisTecPMMUpdate] - "C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe" [407920 2010-03-11] (Egis Technology Inc.)
HKLM-x32\...\Run: [Hotkey Utility] - C:\Program Files (x86)\Acer\Hotkey Utility\HotkeyUtility.exe [618600 2010-12-03] ()
HKLM-x32\...\Run: [avgnt] - "C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min [348664 2012-08-08] (Avira Operations GmbH & Co. KG)
HKU\Default\...\RunOnce: [ScrSav] - C:\Program Files (x86)\Acer\Screensaver\run_Acer.exe /default [154144 2010-07-29] ()
HKU\Default User\...\RunOnce: [ScrSav] - C:\Program Files (x86)\Acer\Screensaver\run_Acer.exe /default [154144 2010-07-29] ()
HKU\UpdatusUser\...\RunOnce: [ScrSav] - C:\Program Files (x86)\Acer\Screensaver\run_Acer.exe /default [154144 2010-07-29] ()

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://start.nexon.com
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://acer.msn.com
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=AARTDF&pc=MAAR&src=IE-SearchBox
SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=AARTDF&pc=MAAR&src=IE-SearchBox
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Handler: msdaipp - No CLSID Value - 
Handler-x32: msdaipp - No CLSID Value - 
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Filter: text/xml - {807553E5-5146-11D5-A672-00B0D022E945} -  No File
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\peter\AppData\Roaming\Mozilla\Firefox\Profiles\bjyo7zt0.default
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_7_700_202.dll ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_202.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3555.0308 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @nexon.com/NexonPlugWebExtension - C:\ProgramData\Nexon\NexonPlug\npPlugWire_1.0.0.0.dll (Nexon)
FF Plugin-x32: @nexon.com/NxGame - C:\ProgramData\Nexon\NGM\npnxgame.dll No File
FF Plugin-x32: @nexon.net/NxGame - C:\ProgramData\NexonUS\NGM\npNxGameUS.dll No File
FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @ogplanet.com/npOGPPlugin - C:\Windows\system32\npOGPPlugin.dll No File
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Extension: DownloadHelper - C:\Users\peter\AppData\Roaming\Mozilla\Firefox\Profiles\bjyo7zt0.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
FF Extension: No Name - C:\Users\peter\AppData\Roaming\Mozilla\Firefox\Profiles\bjyo7zt0.default\Extensions\{64161300-e22b-11db-8314-0800200c9a66}.xpi
FF Extension: No Name - C:\Users\peter\AppData\Roaming\Mozilla\Firefox\Profiles\bjyo7zt0.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
FF Extension: Default - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

==================== Services (Whitelisted) =================

R2 Akamai; c:\program files (x86)\common files\akamai/netsession_win_8fa3539.dll [4569856 2013-07-01] (Akamai Technologies, Inc.)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [86224 2012-05-02] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [110032 2012-05-02] (Avira Operations GmbH & Co. KG)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
S3 MWLService; C:\Program Files (x86)\EgisTec MyWinLocker\x86\MWLService.exe [305520 2010-05-27] (Egis Technology Inc.)
S3 npggsvc; C:\Windows\SysWow64\GameMon.des [3963248 2011-01-12] (INCA Internet Co., Ltd.)
S3 TuneUp.Defrag; C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpDefragService.exe [607048 2011-05-28] (TuneUp Software)
R2 TuneUp.UtilitiesSvc; C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpUtilitiesService64.exe [1394504 2009-12-09] (TuneUp Software)

==================== Drivers (Whitelisted) ====================

S3 1394hub; C:\Windows\System32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
S3 1394hub; C:\Windows\SysWow64\svchost.exe [20992 2009-07-14] (Microsoft Corporation)
R1 aswKbd; C:\Windows\System32\Drivers\aswKbd.sys [19600 2012-06-28] (AVAST Software)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [98848 2012-04-25] (Avira GmbH)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132832 2012-04-27] (Avira GmbH)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [27760 2012-05-02] (Avira GmbH)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
S3 NPPTNT2; C:\Windows\SysWow64\npptNT2.sys [4682 2005-01-02] (INCA Internet Co., Ltd.)
R3 TuneUpUtilitiesDrv; C:\Program Files (x86)\TuneUp Utilities 2010\TuneUpUtilitiesDriver64.sys [11856 2009-10-14] (TuneUp Software)
S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [x]
S3 NPPTNT2; \??\C:\Windows\system32\npptNT2.sys [x]
S3 uqk; \??\C:\koramgame\STOnline\avital\wyqku64.sys [x]
S1 VD_FileDisk; No ImagePath
S3 X6va003; \??\C:\Users\peter\AppData\Local\Temp\003472D.tmp [x]
S3 X6va005; \??\C:\Users\peter\AppData\Local\Temp\0055E46.tmp [x]
S3 X6va006; \??\C:\Users\peter\AppData\Local\Temp\006F27A.tmp [x]
S3 X6va008; \??\C:\Users\peter\AppData\Local\Temp\0083CC3.tmp [x]
S3 X6va009; \??\C:\Windows\SysWOW64\Drivers\X6va009 [x]
S3 X6va010; \??\C:\Windows\SysWOW64\Drivers\X6va010 [x]
S3 X6va011; \??\C:\Windows\SysWOW64\Drivers\X6va011 [x]
S3 X6va012; \??\C:\Windows\SysWOW64\Drivers\X6va012 [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-07-24 10:26 - 2013-07-24 10:26 - 00002006 _____ C:\Users\peter\Desktop\JRT.txt
2013-07-24 10:22 - 2013-07-24 10:22 - 00000000 ____D C:\Windows\ERUNT
2013-07-24 10:17 - 2013-07-24 10:17 - 00003072 _____ C:\AdwCleaner[S1].txt
2013-07-23 20:55 - 2013-07-23 21:00 - 00000000 ___SD C:\ComboFix
2013-07-23 15:46 - 2011-06-26 08:45 - 00256000 _____ C:\Windows\PEV.exe
2013-07-23 15:46 - 2010-11-07 19:20 - 00208896 _____ C:\Windows\MBR.exe
2013-07-23 15:46 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2013-07-23 15:46 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2013-07-23 15:46 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2013-07-23 15:46 - 2000-08-31 02:00 - 00098816 _____ C:\Windows\sed.exe
2013-07-23 15:46 - 2000-08-31 02:00 - 00080412 _____ C:\Windows\grep.exe
2013-07-23 15:46 - 2000-08-31 02:00 - 00068096 _____ C:\Windows\zip.exe
2013-07-23 15:44 - 2013-07-23 15:45 - 00000000 ____D C:\Qoobox
2013-07-23 15:44 - 2013-07-23 15:44 - 00000000 ____D C:\Windows\erdnt
2013-07-23 14:49 - 2013-07-23 14:49 - 00000000 ____D C:\FRST
2013-07-23 14:20 - 2013-07-23 14:20 - 00000000 ____D C:\Users\peter\AppData\Roaming\Malwarebytes
2013-07-23 14:19 - 2013-07-23 14:19 - 00001073 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-07-23 14:19 - 2013-07-23 14:19 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-07-23 14:19 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-07-23 00:12 - 2013-07-23 00:12 - 00001606 _____ C:\Users\Public\Desktop\Spirit Tales.lnk
2013-07-23 00:10 - 2013-07-23 00:10 - 00000000 ____D C:\koramgame
2013-07-17 04:30 - 2013-07-17 04:30 - 00000000 ____D C:\Windows\Sun
2013-07-15 04:44 - 2013-07-15 04:44 - 00001692 _____ C:\Users\Public\Desktop\Grand Chase.lnk
2013-07-15 04:38 - 2013-07-15 04:38 - 00000000 ____D C:\SG Interactive
2013-07-15 03:13 - 2013-07-15 04:35 - 2099622144 _____ C:\GrandChase_Install_070213-1.bin
2013-07-15 03:13 - 2013-07-15 04:35 - 1030227746 _____ C:\GrandChase_Install_070213-2.bin
2013-07-15 03:13 - 2013-07-15 04:07 - 00383864 _____ (SG Interactive                                              ) C:\GrandChase_Install_070213.exe
2013-07-14 21:26 - 2013-07-14 21:26 - 00000000 ____D C:\Users\peter\Documents\The KMPlayer
2013-07-14 19:57 - 2013-07-14 19:57 - 00000000 ____D C:\Users\peter\AppData\Roaming\Avira
2013-07-14 13:23 - 2013-07-14 13:23 - 00000000 ____D C:\Users\peter\AppData\Local\Macromedia
2013-07-12 23:37 - 2013-07-12 23:37 - 00003798 _____ C:\Windows\System32\Tasks\Java Update Scheduler
2013-07-12 21:02 - 2013-07-16 03:24 - 00000000 ____D C:\Users\peter\AppData\Local\PMB Files
2013-07-12 02:29 - 2013-06-12 01:43 - 14329856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-07-12 02:29 - 2013-06-12 01:43 - 02877440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-07-12 02:29 - 2013-06-12 01:43 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-07-12 02:29 - 2013-06-12 01:43 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-07-12 02:29 - 2013-06-12 01:43 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-07-12 02:29 - 2013-06-12 01:43 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-07-12 02:29 - 2013-06-12 01:43 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-07-12 02:29 - 2013-06-12 01:42 - 13760512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-07-12 02:29 - 2013-06-12 01:42 - 02046976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-07-12 02:29 - 2013-06-12 01:42 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-07-12 02:29 - 2013-06-12 01:42 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-07-12 02:29 - 2013-06-12 01:42 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-07-12 02:29 - 2013-06-12 01:42 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-07-12 02:29 - 2013-06-12 01:26 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-07-12 02:29 - 2013-06-12 01:26 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-07-12 02:29 - 2013-06-12 01:26 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-07-12 02:29 - 2013-06-12 01:25 - 19238912 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-07-12 02:29 - 2013-06-12 01:25 - 15404032 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-07-12 02:29 - 2013-06-12 01:25 - 03958784 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-07-12 02:29 - 2013-06-12 01:25 - 02648576 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-07-12 02:29 - 2013-06-12 01:25 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-07-12 02:29 - 2013-06-12 01:25 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-07-12 02:29 - 2013-06-12 01:25 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-07-12 02:29 - 2013-06-12 01:25 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-07-12 02:29 - 2013-06-12 01:25 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-07-12 02:29 - 2013-06-12 01:25 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-07-12 02:29 - 2013-06-12 01:25 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-07-12 02:29 - 2013-06-12 00:51 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-07-12 02:29 - 2013-06-12 00:50 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-07-12 02:29 - 2013-06-07 05:22 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-07-12 02:29 - 2013-06-07 04:37 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-07-11 20:26 - 2013-06-04 08:00 - 00624128 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2013-07-11 20:26 - 2013-06-04 06:53 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll
2013-07-11 20:26 - 2013-05-06 08:03 - 01887744 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2013-07-11 20:26 - 2013-05-06 06:56 - 01620480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL
2013-07-11 20:25 - 2013-06-05 05:34 - 03153920 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-07-11 20:25 - 2013-04-10 01:34 - 01247744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll
2013-07-11 20:25 - 2013-04-03 00:51 - 01643520 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2013-07-10 19:36 - 2013-07-12 21:22 - 00000000 ____D C:\Users\peter\AppData\Roaming\FreeVideoConverter
2013-07-10 19:35 - 2013-07-10 19:35 - 01128472 _____ (Koyote-Lab Inc) C:\Users\peter\Downloads\FreeVideoConverterSetup-r135-n-bc.exe
2013-07-10 19:34 - 2013-07-10 19:34 - 01204496 _____ (DVDVideoSoft Ltd.                                           ) C:\Users\peter\Downloads\FreeAudioDub.exe
2013-07-10 18:06 - 2013-07-12 21:22 - 00000000 ____D C:\Users\peter\AppData\Roaming\DVDVideoSoft
2013-07-09 14:17 - 2013-07-09 14:34 - 671261856 _____ (InstallShield Software Corporation) C:\S4_League.exe
2013-07-05 22:02 - 2013-04-22 22:49 - 00000000 ____D C:\lang
2013-07-05 22:02 - 2013-04-22 22:49 - 00000000 ____D C:\assets
2013-07-05 22:02 - 2013-03-22 23:38 - 00000000 ____D C:\flash0
2013-07-05 06:06 - 2013-07-05 06:06 - 00000000 ____D C:\Users\peter\AppData\Local\Keldon_Corps
2013-07-04 19:18 - 2013-07-04 19:18 - 00000000 ____D C:\Program Files (x86)\Gameforge4D
2013-07-03 15:38 - 2013-07-15 17:09 - 00000000 ____D C:\dolphin-3.0-win32
2013-07-03 06:16 - 2013-07-03 06:16 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-07-03 05:59 - 2013-05-04 05:59 - 00000032 ____R C:\Windows\hash.dat
2013-07-03 05:53 - 2013-07-03 05:52 - 00263592 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2013-07-03 05:53 - 2013-07-03 05:52 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2013-07-03 05:53 - 2013-07-03 05:52 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2013-07-03 05:53 - 2013-07-03 05:52 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2013-07-01 23:10 - 2013-07-01 23:10 - 00000000 ____D C:\Users\peter\Documents\JoWooD
2013-06-26 22:42 - 2013-06-26 22:42 - 00000000 ____D C:\Users\peter\AppData\Roaming\SEGA

==================== One Month Modified Files and Folders =======

2013-07-24 10:37 - 2011-05-28 15:08 - 00000000 ____D C:\Users\peter\AppData\Roaming\Skype
2013-07-24 10:26 - 2013-07-24 10:26 - 00002006 _____ C:\Users\peter\Desktop\JRT.txt
2013-07-24 10:26 - 2009-07-14 06:45 - 00018512 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-07-24 10:26 - 2009-07-14 06:45 - 00018512 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-07-24 10:25 - 2010-10-10 18:07 - 00654150 _____ C:\Windows\system32\perfh007.dat
2013-07-24 10:25 - 2010-10-10 18:07 - 00130022 _____ C:\Windows\system32\perfc007.dat
2013-07-24 10:25 - 2009-07-14 07:13 - 01498742 _____ C:\Windows\system32\PerfStringBackup.INI
2013-07-24 10:22 - 2013-07-24 10:22 - 00000000 ____D C:\Windows\ERUNT
2013-07-24 10:19 - 2010-10-10 08:11 - 02157678 _____ C:\Windows\PFRO.log
2013-07-24 10:19 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-07-24 10:19 - 2009-07-14 06:51 - 00208011 _____ C:\Windows\setupact.log
2013-07-24 10:18 - 2010-10-10 08:16 - 01214019 _____ C:\Windows\WindowsUpdate.log
2013-07-24 10:17 - 2013-07-24 10:17 - 00003072 _____ C:\AdwCleaner[S1].txt
2013-07-23 21:00 - 2013-07-23 20:55 - 00000000 ___SD C:\ComboFix
2013-07-23 15:45 - 2013-07-23 15:44 - 00000000 ____D C:\Qoobox
2013-07-23 15:44 - 2013-07-23 15:44 - 00000000 ____D C:\Windows\erdnt
2013-07-23 14:49 - 2013-07-23 14:49 - 00000000 ____D C:\FRST
2013-07-23 14:20 - 2013-07-23 14:20 - 00000000 ____D C:\Users\peter\AppData\Roaming\Malwarebytes
2013-07-23 14:19 - 2013-07-23 14:19 - 00001073 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-07-23 14:19 - 2013-07-23 14:19 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-07-23 00:12 - 2013-07-23 00:12 - 00001606 _____ C:\Users\Public\Desktop\Spirit Tales.lnk
2013-07-23 00:10 - 2013-07-23 00:10 - 00000000 ____D C:\koramgame
2013-07-23 00:10 - 2010-10-27 13:00 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2013-07-17 04:30 - 2013-07-17 04:30 - 00000000 ____D C:\Windows\Sun
2013-07-16 03:24 - 2013-07-12 21:02 - 00000000 ____D C:\Users\peter\AppData\Local\PMB Files
2013-07-15 17:09 - 2013-07-03 15:38 - 00000000 ____D C:\dolphin-3.0-win32
2013-07-15 10:31 - 2011-05-28 19:23 - 00000000 ____D C:\Users\peter\AppData\Roaming\PhotoScape
2013-07-15 04:44 - 2013-07-15 04:44 - 00001692 _____ C:\Users\Public\Desktop\Grand Chase.lnk
2013-07-15 04:38 - 2013-07-15 04:38 - 00000000 ____D C:\SG Interactive
2013-07-15 04:35 - 2013-07-15 03:13 - 2099622144 _____ C:\GrandChase_Install_070213-1.bin
2013-07-15 04:35 - 2013-07-15 03:13 - 1030227746 _____ C:\GrandChase_Install_070213-2.bin
2013-07-15 04:07 - 2013-07-15 03:13 - 00383864 _____ (SG Interactive                                              ) C:\GrandChase_Install_070213.exe
2013-07-14 21:26 - 2013-07-14 21:26 - 00000000 ____D C:\Users\peter\Documents\The KMPlayer
2013-07-14 19:57 - 2013-07-14 19:57 - 00000000 ____D C:\Users\peter\AppData\Roaming\Avira
2013-07-14 19:52 - 2011-11-09 21:29 - 00000000 ____D C:\Users\peter\AppData\Local\Akamai
2013-07-14 19:52 - 2011-05-28 15:12 - 00000000 ____D C:\Users\peter\AppData\Roaming\Mozilla
2013-07-14 13:23 - 2013-07-14 13:23 - 00000000 ____D C:\Users\peter\AppData\Local\Macromedia
2013-07-12 23:37 - 2013-07-12 23:37 - 00003798 _____ C:\Windows\System32\Tasks\Java Update Scheduler
2013-07-12 23:35 - 2009-07-14 07:08 - 00032640 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-07-12 21:22 - 2013-07-10 19:36 - 00000000 ____D C:\Users\peter\AppData\Roaming\FreeVideoConverter
2013-07-12 21:22 - 2013-07-10 18:06 - 00000000 ____D C:\Users\peter\AppData\Roaming\DVDVideoSoft
2013-07-12 21:22 - 2011-11-14 21:54 - 00000000 ____D C:\Users\peter\AppData\Roaming\Sony
2013-07-12 21:21 - 2012-05-03 21:59 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-07-12 21:02 - 2011-05-28 15:43 - 00000000 ____D C:\Program Files (x86)\Pando Networks
2013-07-12 05:48 - 2009-07-14 06:45 - 00437512 _____ C:\Windows\system32\FNTCACHE.DAT
2013-07-12 05:47 - 2013-03-14 21:03 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2013-07-12 05:47 - 2013-03-14 21:03 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight
2013-07-12 05:47 - 2009-07-14 09:45 - 00000000 ____D C:\Program Files\Windows Journal
2013-07-12 05:47 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files\Windows Defender
2013-07-12 05:47 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files (x86)\Windows Defender
2013-07-12 02:30 - 2011-05-29 08:34 - 78185248 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-07-10 19:35 - 2013-07-10 19:35 - 01128472 _____ (Koyote-Lab Inc) C:\Users\peter\Downloads\FreeVideoConverterSetup-r135-n-bc.exe
2013-07-10 19:34 - 2013-07-10 19:34 - 01204496 _____ (DVDVideoSoft Ltd.                                           ) C:\Users\peter\Downloads\FreeAudioDub.exe
2013-07-09 14:34 - 2013-07-09 14:17 - 671261856 _____ (InstallShield Software Corporation) C:\S4_League.exe
2013-07-05 06:06 - 2013-07-05 06:06 - 00000000 ____D C:\Users\peter\AppData\Local\Keldon_Corps
2013-07-04 19:18 - 2013-07-04 19:18 - 00000000 ____D C:\Program Files (x86)\Gameforge4D
2013-07-03 06:16 - 2013-07-03 06:16 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-07-03 05:52 - 2013-07-03 05:53 - 00263592 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2013-07-03 05:52 - 2013-07-03 05:53 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2013-07-03 05:52 - 2013-07-03 05:53 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2013-07-03 05:52 - 2013-07-03 05:53 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2013-07-03 05:52 - 2012-12-26 16:51 - 00867240 _____ (Oracle Corporation) C:\Windows\SysWOW64\npDeployJava1.dll
2013-07-03 05:52 - 2012-12-26 16:51 - 00789416 _____ (Oracle Corporation) C:\Windows\SysWOW64\deployJava1.dll
2013-07-01 23:10 - 2013-07-01 23:10 - 00000000 ____D C:\Users\peter\Documents\JoWooD
2013-06-26 22:44 - 2011-05-28 14:22 - 00000000 ____D C:\Users\peter
2013-06-26 22:42 - 2013-06-26 22:42 - 00000000 ____D C:\Users\peter\AppData\Roaming\SEGA
2013-06-26 22:08 - 2013-06-09 19:26 - 929925841 _____ (www.gamerkraft.com                                          ) C:\FreeJack_v40142.exe

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-07-23 19:20

==================== End Of Log ============================
         
--- --- ---

--- --- ---

Alt 24.07.2013, 11:43   #10
schrauber
/// the machine
/// TB-Ausbilder
 

Malware loswerden, wie? - Standard

Malware loswerden, wie?




ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset


Downloade Dir bitte SecurityCheck und:

  • Speichere es auf dem Desktop.
  • Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
  • Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.
Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme?
__________________
gruß,
schrauber

Proud Member of UNITE and ASAP since 2009

Spenden
Anleitungen und Hilfestellungen
Trojaner-Board Facebook-Seite

Keine Hilfestellung via PM!

Alt 24.07.2013, 14:14   #11
Haterix
 
Malware loswerden, wie? - Standard

Malware loswerden, wie?



Seit ich den vorletzten Schritt fertig hatte, hab ich bisher keine Probleme mehr, Ich werde aber schauen das ich die Dinge die du nun gepostet hast, abarbeiten werde um ganz sicher zu sein.

Danke.

Alt 24.07.2013, 14:52   #12
schrauber
/// the machine
/// TB-Ausbilder
 

Malware loswerden, wie? - Standard

Malware loswerden, wie?



alles klar
__________________
gruß,
schrauber

Proud Member of UNITE and ASAP since 2009

Spenden
Anleitungen und Hilfestellungen
Trojaner-Board Facebook-Seite

Keine Hilfestellung via PM!

Antwort

Themen zu Malware loswerden, wie?
ahnung, dinge, gen, große, hilfe, hoffe, loswerden, malware, minute, minuten, problem, seite, seiten, suche, troja, öffnen



Ähnliche Themen: Malware loswerden, wie?


  1. SafeSearch loswerden
    Plagegeister aller Art und deren Bekämpfung - 29.09.2015 (2)
  2. DNS Unlocker loswerden
    Log-Analyse und Auswertung - 23.09.2015 (22)
  3. websearches.com loswerden
    Log-Analyse und Auswertung - 04.09.2014 (1)
  4. Bundestrojaner loswerden
    Plagegeister aller Art und deren Bekämpfung - 08.09.2013 (1)
  5. chatzum loswerden wie?
    Plagegeister aller Art und deren Bekämpfung - 06.09.2013 (12)
  6. email link Malware Funde Heur.PE@4294967295, Malware@#nwdk01o66rpro, Malware@#2x6qrvr63cjrw
    Plagegeister aller Art und deren Bekämpfung - 29.10.2012 (10)
  7. 007Guard , wie Loswerden ?
    Plagegeister aller Art und deren Bekämpfung - 03.10.2010 (2)
  8. ICQsearch loswerden - wie?
    Plagegeister aller Art und deren Bekämpfung - 29.12.2009 (24)
  9. wuauclt.exe loswerden
    Plagegeister aller Art und deren Bekämpfung - 01.03.2009 (1)
  10. zlob loswerden?
    Log-Analyse und Auswertung - 03.04.2008 (3)
  11. TR/Inject.ZS - wie loswerden?
    Plagegeister aller Art und deren Bekämpfung - 20.03.2008 (7)
  12. CiD entlich loswerden!!
    Log-Analyse und Auswertung - 28.02.2008 (3)
  13. SysKontroller loswerden
    Mülltonne - 12.02.2008 (0)
  14. Trojaner wie loswerden?
    Mülltonne - 17.09.2006 (1)
  15. TR/Agent.QT - WIE LOSWERDEN?
    Log-Analyse und Auswertung - 22.06.2006 (9)
  16. TR/DNSChanger.CS.4 wie loswerden?
    Log-Analyse und Auswertung - 16.06.2006 (1)
  17. surfaccuracy loswerden
    Log-Analyse und Auswertung - 16.11.2005 (11)

Zum Thema Malware loswerden, wie? - Hallo liebes Trojaner-Board, Ich habe seit ein paar Minuten das Problem das sich manchmal Seiten wie "Blackmath.net", "Ads.glispa.com" oder "datasrvrs.com" öffnen ohne das ich es möchte. Ich habe keine große - Malware loswerden, wie?...
Archiv
Du betrachtest: Malware loswerden, wie? auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.