MSN Virus - Bot meldet sich automatisch an - Spamlinks

Pedapano

Hallo,
Ich hatte folgendes Problem: Meine Facebook Kontakte wurden von einem bot zugespammt
Ich habe folgendes Problem:
Bei meinem Windows Live Messenger 2011 logt sich alle paar Minuten ein Bot ein (Das erkenne ich an dem zweiten eingeloggten Eckpunkt "Home-Pc") und verändert das Titelbild, sowie die Statusmeldung. Außerdem schreibt er meine Kontakte an und sendet ihnen Spamlinks. (Die übliche Msn-Virenleier eben)
Nun habe ich mal Kaspersky durchlaufen lassen: Kein Ergebniss
Danach habe ich das so oft empfohlene "Malwarebytes AntiMalware" laufen lassen, und er fand zwei Dateien, die ich direkt entfernt habe.(Was mein "Facebookproblem" löste)
Passwortänderung, Neuinstallation von MSN haben nicht geholfen.
Ich weiß nicht genau weshalb, allerdings meldet sich der Bot seit einer guten Stunde nicht mehr - Die symptome sind zwar weg, doch ich möchte lieber sichergehen

Also wie im Forum gewünscht der DDS-log: (Ein anderer wurde mir nicht angezeigt)

.
DDS (Ver_2011-08-26.01) - NTFSAMD64
Internet Explorer: 9.0.8112.16421
Run by *** at 17:57:10 on 2012-03-09
Microsoft Windows 7 Ultimate 6.1.7601.1.1252.49.1031.18.8105.4254 [GMT 1:00]
.
AV: Kaspersky Internet Security *Enabled/Updated* {2EAA32A5-1EE1-1B22-95DA-337730C6E984}
SP: Kaspersky Internet Security *Enabled/Updated* {95CBD341-38DB-14AC-AF6A-08054B41A339}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: Kaspersky Internet Security *Enabled* {1691B380-548E-1A7A-BE85-9A42CE15AEFF}
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\nvvsvc.exe
C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\ASRock\XFast LAN\spd.exe
C:\Windows\SysWOW64\PnkBstrA.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Program Files\Saitek\SD6\Software\ProfilerU.exe
C:\Program Files\Saitek\SD6\Software\SaiMfd.exe
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\hkcmd.exe
C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe
C:\Program Files (x86)\BumpTop\BumpTop.exe
C:\Program Files\Rainmeter\Rainmeter.exe
C:\Program Files (x86)\Stardock\ObjectDockFree\ObjectDock.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
C:\Program Files (x86)\InstallShield Installation Information\{F3D9AC82-30F4-4BB9-B9AB-8697637568C1}\AMBSPISyncService.exe
C:\Program Files (x86)\Creative\SB X-Fi MB\Volume Panel\VolPanlu.exe
C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe
C:\Program Files (x86)\Stardock\ObjectDockFree\Dock64.exe
C:\Program Files (x86)\iTunes\iTunesHelper.exe
C:\Users\***~1\AppData\Local\Temp\Sound_Blaster_X-Fi_MB_Cleanup.0001
C:\Program Files (x86)\Sound Volume Hotkeys\SoundVolumeHotkeys.exe
C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\XMBLicensing.exe
C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
C:\Program Files (x86)\BumpTop\TexHelper.exe
C:\Program Files (x86)\BumpTop\TexHelper.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\system32\SearchIndexer.exe
C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe
C:\Program Files (x86)\Safari\Safari.exe
C:\Program Files (x86)\Common Files\Apple\Apple Application Support\WebKit2WebProcess.exe
C:\Program Files\TeamSpeak 3 Client\ts3client_win64.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
C:\Windows\System32\svchost.exe -k secsvcs
C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
C:\Program Files (x86)\Origin\Origin.exe
C:\Windows\SysWOW64\PnkBstrB.exe
C:\Windows\explorer.exe
C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe
C:\Windows\explorer.exe
C:\Windows\explorer.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\conhost.exe
C:\Windows\SysWOW64\cscript.exe
C:\Windows\system32\wbem\wmiprvse.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://search.searchonme.com/
mStart Page = hxxp://search.searchonme.com/
uInternet Settings,ProxyOverride = *.local
mWinlogon: Userinit=userinit.exe,
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
BHO: Messenger Plus! Community SmartbarEngine: {31ad400d-1b06-4e33-a59a-90c2c140cba0} - mscoree.dll
BHO: IEVkbdBHO Class: {59273ab4-e7d3-40f9-a1a8-6fa9cca1862c} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\ievkbd.dll
BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - C:\PROGRA~2\MICROS~4\Office14\GROOVEEX.DLL
BHO: Windows Live ID-Anmelde-Hilfsprogramm: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
BHO: Windows Live Messenger Companion Helper: {9fdde16b-836f-4806-ab1f-1455cbeff289} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll
BHO: Office Document Cache Handler: {b4f3a835-0e21-4959-ba22-42b3008e02ff} - C:\PROGRA~2\MICROS~4\Office14\URLREDIR.DLL
BHO: FilterBHO Class: {e33cf602-d945-461a-83f0-819f76a199f8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\klwtbbho.dll
TB: Messenger Plus! Community Smartbar: {ae07101b-46d4-4a98-af68-0333ea26e113} - mscoree.dll
uRun: [ASRockXTU]
uRun: [zASRockInstantBoot]
uRun: [msnmsgr] "C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe" /background
mRun: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
mRun: [CTSyncService] C:\Program Files (x86)\InstallShield Installation Information\{F3D9AC82-30F4-4BB9-B9AB-8697637568C1}\AMBSPISyncService.exe /StartRunKey
mRun: [VolPanel] "C:\Program Files (x86)\Creative\SB X-Fi MB\Volume Panel\VolPanlu.exe" /r
mRun: [AVP] "C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe"
mRun: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
mRun: [UpdReg] C:\Windows\UpdReg.EXE
mRun: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
mRun: [SoundVolumeHotkeys.{9547D1C7-4F18-4104-8674-046DCD12BDF9}] C:\Program Files (x86)\Sound Volume Hotkeys\SoundVolumeHotkeys.exe -a
mRunOnce: [ Malwarebytes Anti-Malware ] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
StartupFolder: C:\Users\***~1\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\STARDO~1.LNK - C:\Program Files (x86)\Stardock\ObjectDockFree\ObjectDock.exe
StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\BumpTop.lnk - C:\Program Files (x86)\BumpTop\BumpTop.exe
StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\RAINME~1.LNK - C:\Program Files\Rainmeter\Rainmeter.exe
mPolicies-explorer: NoActiveDesktop = 1 (0x1)
mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)
mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: An OneNote s&enden - C:\PROGRA~2\MICROS~4\Office14\ONBttnIE.dll/105
IE: Hinzufügen zu Anti-Banner - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\ie_banner_deny.htm
IE: Nach Microsoft E&xcel exportieren - C:\PROGRA~2\MICROS~4\Office14\EXCEL.EXE/3000
IE: {0000036B-C524-4050-81A0-243669A86B9F} - {B63DBA5F-523F-4B9C-A43D-65DF1977EAD3} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll
IE: {4248FE82-7FCB-46AC-B270-339F08212110} - {4248FE82-7FCB-46AC-B270-339F08212110} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\ievkbd.dll
IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
IE: {CCF151D8-D089-449F-A5A4-D9909053F20F} - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\klwtbbho.dll
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab
TCP: DhcpNameServer = 192.168.178.1
TCP: Interfaces\{FEC4D322-584A-48B4-8101-C8607474E9B4} : DhcpNameServer = 192.168.178.1
Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL
AppInit_DLLs: C:\PROGRA~1\LUCIDL~1\VIRTU\x86\APPINI~1.DLL, C:\Windows\SysWOW64\nvinit.dll
SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - C:\PROGRA~2\MICROS~4\Office14\GROOVEEX.DLL
{18DF081C-E8AD-4283-A596-FA578C2EBDC3}
{31ad400d-1b06-4e33-a59a-90c2c140cba0}
{59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C}
{72853161-30C5-4D22-B7F9-0BBC1D38A37E}
{9030D464-4C02-4ABF-8ECC-5164760863C6}
{9FDDE16B-836F-4806-AB1F-1455CBEFF289}
{B4F3A835-0E21-4959-BA22-42B3008E02FF}
{E33CF602-D945-461A-83F0-819F76A199F8}
{ae07101b-46d4-4a98-af68-0333ea26e113}
mRun-x64: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
mRun-x64: [CTSyncService] C:\Program Files (x86)\InstallShield Installation Information\{F3D9AC82-30F4-4BB9-B9AB-8697637568C1}\AMBSPISyncService.exe /StartRunKey
mRun-x64: [VolPanel] "C:\Program Files (x86)\Creative\SB X-Fi MB\Volume Panel\VolPanlu.exe" /r
mRun-x64: [AVP] "C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe"
mRun-x64: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
mRun-x64: [UpdReg] C:\Windows\UpdReg.EXE
mRun-x64: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
mRun-x64: [SoundVolumeHotkeys.{9547D1C7-4F18-4104-8674-046DCD12BDF9}] C:\Program Files (x86)\Sound Volume Hotkeys\SoundVolumeHotkeys.exe -a
mRunOnce-x64: [ Malwarebytes Anti-Malware ] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
AppInit_DLLs-X64: C:\PROGRA~1\LUCIDL~1\VIRTU\x86\APPINI~1.DLL, C:\Windows\SysWOW64\nvinit.dll
SEH-X64: {B5A7F190-DDA6-4420-B3BA-52453494E6CD}: Groove GFS Stub Execution Hook
.
============= SERVICES / DRIVERS ===============
.
R1 AsrAppCharger;AsrAppCharger;C:\Windows\system32\DRIVERS\AsrAppCharger.sys --> C:\Windows\system32\DRIVERS\AsrAppCharger.sys [?]
R1 FNETURPX;FNETURPX;C:\Windows\system32\drivers\FNETURPX.SYS --> C:\Windows\system32\drivers\FNETURPX.SYS [?]
R1 kl2;kl2;C:\Windows\system32\DRIVERS\kl2.sys --> C:\Windows\system32\DRIVERS\kl2.sys [?]
R1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter;C:\Windows\system32\DRIVERS\klim6.sys --> C:\Windows\system32\DRIVERS\klim6.sys [?]
R2 AVP;Kaspersky Anti-Virus Service;C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe [2011-4-24 202296]
R2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [2012-2-28 13592]
R2 nvUpdatusService;NVIDIA Update Service Daemon;C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe [2012-2-28 2348352]
R2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2012-2-9 382272]
R2 UNS;Intel(R) Management and Security Application User Notification Service;C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2012-2-28 2656280]
R3 EtronHub3;Etron USB 3.0 Extensible Hub Driver;C:\Windows\system32\Drivers\EtronHub3.sys --> C:\Windows\system32\Drivers\EtronHub3.sys [?]
R3 EtronXHCI;Etron USB 3.0 Extensible Host Controller Driver;C:\Windows\system32\Drivers\EtronXHCI.sys --> C:\Windows\system32\Drivers\EtronXHCI.sys [?]
R3 klmouflt;Kaspersky Lab KLMOUFLT;C:\Windows\system32\DRIVERS\klmouflt.sys --> C:\Windows\system32\DRIVERS\klmouflt.sys [?]
R3 MEIx64;Intel(R) Management Engine Interface;C:\Windows\system32\DRIVERS\HECIx64.sys --> C:\Windows\system32\DRIVERS\HECIx64.sys [?]
R3 NVHDA;Service for NVIDIA High Definition Audio Driver;C:\Windows\system32\drivers\nvhda64v.sys --> C:\Windows\system32\drivers\nvhda64v.sys [?]
R3 RTL8167;Realtek 8167 NT Driver;C:\Windows\system32\DRIVERS\Rt64win7.sys --> C:\Windows\system32\DRIVERS\Rt64win7.sys [?]
R3 SaiK0CFA;SaiK0CFA;C:\Windows\system32\DRIVERS\SaiK0CFA.sys --> C:\Windows\system32\DRIVERS\SaiK0CFA.sys [?]
R3 SaiU0CFA;SaiU0CFA;C:\Windows\system32\DRIVERS\SaiU0CFA.sys --> C:\Windows\system32\DRIVERS\SaiU0CFA.sys [?]
R3 Sound Blaster X-Fi MB Licensing Service;Sound Blaster X-Fi MB Licensing Service;C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\XMBLicensing.exe [2012-2-28 79360]
R3 VirtuWDDM;VirtuWDDM;C:\Windows\system32\DRIVERS\VirtuWDDM.sys --> C:\Windows\system32\DRIVERS\VirtuWDDM.sys [?]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]
S3 Creative ALchemy AL6 Licensing Service;Creative ALchemy AL6 Licensing Service;C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\AL6Licensing.exe [2012-2-28 79360]
S3 Creative Audio Engine Licensing Service;Creative Audio Engine Licensing Service;C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [2012-2-28 79360]
S3 FNETTBOH_305;FNETTBOH_305;C:\Windows\system32\drivers\FNETTBOH_305.SYS --> C:\Windows\system32\drivers\FNETTBOH_305.SYS [?]
S3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE [2011-6-12 31125880]
S3 osppsvc;Office Software Protection Platform;C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-1-9 4925184]
S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;C:\Windows\system32\drivers\rdpvideominiport.sys --> C:\Windows\system32\drivers\rdpvideominiport.sys [?]
S3 TsUsbFlt;TsUsbFlt;C:\Windows\system32\drivers\tsusbflt.sys --> C:\Windows\system32\drivers\tsusbflt.sys [?]
S3 TTHID;Cinergy Hybrid-Stick HID service;C:\Windows\system32\DRIVERS\Cinergy_Hybrid-Stick_HID.sys --> C:\Windows\system32\DRIVERS\Cinergy_Hybrid-Stick_HID.sys [?]
S3 UDXTTM6010;Cinergy Hybrid-Stick BDA service;C:\Windows\system32\DRIVERS\UDXTTM6010.sys --> C:\Windows\system32\DRIVERS\UDXTTM6010.sys [?]
S3 USBAAPL64;Apple Mobile USB Driver;C:\Windows\system32\Drivers\usbaapl64.sys --> C:\Windows\system32\Drivers\usbaapl64.sys [?]
.
=============== Created Last 30 ================
.
2012-03-09 16:41:29 23152 ----a-w- C:\Windows\System32\drivers\mbam.sys
2012-03-09 16:41:29 -------- d-----w- C:\Program Files (x86)\Malwarebytes' Anti-Malware
2012-03-09 15:44:59 -------- d-----w- C:\Users\***\AppData\Local\{64FE8D22-FCD4-4749-8B53-5BE0D219D4A0}
2012-03-09 15:44:49 -------- d-----w- C:\Users\***\AppData\Local\{9C11270B-42C9-4FC4-B3FB-533CD6F4FCFB}
2012-03-09 15:44:13 -------- d-----w- C:\Windows\PCHEALTH
2012-03-09 15:33:40 -------- d-----w- C:\Users\***\AppData\Local\{C31004C7-8D9F-4D1F-BFB3-9F4AC1D5973C}
2012-03-09 14:11:49 -------- d-----w- C:\Users\***\AppData\Local\CrashDumps
2012-03-09 14:11:42 -------- d-----w- C:\Program Files (x86)\AxBx
2012-03-09 14:11:06 69000 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{7D8D4175-A155-40EF-9790-FBFECB1B4CC6}\offreg.dll
2012-03-09 11:58:52 -------- d-----w- C:\Users\***\AppData\Local\{000EB461-F0A9-4623-B4C3-9CA0428B79DB}
2012-03-09 11:58:42 -------- d-----w- C:\Users\***\AppData\Local\{43032F83-D3EB-466D-B0CB-20F63776DDA3}
2012-03-09 09:28:47 -------- d-----w- C:\Users\***\AppData\Roaming\Malwarebytes
2012-03-09 09:28:43 -------- d-----w- C:\ProgramData\Malwarebytes
2012-03-09 09:24:02 8643640 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{7D8D4175-A155-40EF-9790-FBFECB1B4CC6}\mpengine.dll
2012-03-08 12:40:20 -------- d-----w- C:\Users\***\AppData\Local\{9D9EEDD6-1939-4FB7-B6BC-0FCE81485183}
2012-03-08 12:40:09 -------- d-----w- C:\Users\***\AppData\Local\{65ED0D2E-1B47-467E-A6E9-B84822E85B68}
2012-03-07 19:56:58 -------- d-----w- C:\Users\***\AppData\Local\{76F0023D-4B6A-41D8-AE77-2EF88C90A6CE}
2012-03-07 19:56:40 -------- d-----w- C:\Users\***\AppData\Local\{97B2FB85-10EB-4586-9B98-1439B6574F08}
2012-03-07 07:56:17 -------- d-----w- C:\Users\***\AppData\Local\{4F1C7E6F-E901-44C6-8DC7-22731ACA8585}
2012-03-07 07:56:07 -------- d-----w- C:\Users\***\AppData\Local\{A97C6581-1413-41DF-8DBA-9E317CD17AE5}
2012-03-06 19:57:22 34152 ----a-w- C:\Windows\System32\drivers\GEARAspiWDM.sys
2012-03-06 19:57:22 126312 ----a-w- C:\Windows\System32\GEARAspi64.dll
2012-03-06 19:57:22 107368 ----a-w- C:\Windows\SysWow64\GEARAspi.dll
2012-03-06 19:57:14 -------- d-----w- C:\ProgramData\{93E26451-CD9A-43A5-A2FA-C42392EA4001}
2012-03-06 19:57:14 -------- d-----w- C:\Program Files\iTunes
2012-03-06 19:57:14 -------- d-----w- C:\Program Files\iPod
2012-03-06 19:57:14 -------- d-----w- C:\Program Files (x86)\iTunes
2012-03-06 18:43:13 -------- d-----w- C:\Windows\System32\appmgmt
2012-03-06 18:32:00 -------- d-----w- C:\ProgramData\Premium
2012-03-06 18:31:19 -------- d-----w- C:\ProgramData\InstallMate
2012-03-06 18:14:27 -------- d-----w- C:\Program Files (x86)\JDownloader
2012-03-06 15:40:46 -------- d-----w- C:\Users\***\AppData\Local\{5B9E7938-8A53-49ED-A761-8638579A09A3}
2012-03-06 15:40:36 -------- d-----w- C:\Users\Daniel Gamer\AppData\Local\{60167603-A015-450E-895E-705954935D51}
2012-03-05 14:44:07 -------- d-----w- C:\ProgramData\Nexon
2012-03-05 13:38:08 -------- d-----w- C:\Program Files (x86)\HD Tune
2012-03-05 13:18:14 -------- d-----w- C:\Users\***\AppData\Local\{6F44AA7D-9C22-45C0-8EBB-0C0CDA0F149E}
2012-03-05 13:18:04 -------- d-----w- C:\Users\***\AppData\Local\{53AC5D96-CF2C-4B52-8CB3-35F2BA151726}
2012-03-04 10:48:49 -------- d-----w- C:\Users\***\AppData\Local\ODUI
2012-03-04 10:48:46 -------- d-----w- C:\Users\***\AppData\Local\Stardock
2012-03-04 10:48:42 -------- d-----w- C:\Users\***\AppData\Roaming\Stardock
2012-03-04 10:48:41 -------- dc-h--w- C:\ProgramData\{5486EA6B-AF91-4B4B-868E-F80AB4BCD83A}
2012-03-04 10:48:40 -------- d-----w- C:\Program Files (x86)\Stardock
2012-03-04 10:48:20 -------- d-----w- C:\Users\***\AppData\Local\PackageAware
2012-03-04 10:25:07 -------- d-----w- C:\Users\***\AppData\Local\{AE57031E-DC42-4BE1-812A-E1490CBEAF33}
2012-03-04 10:24:57 -------- d-----w- C:\Users\***\AppData\Local\{FE97A54E-8D3B-4F02-BE7B-73F6CC0342A1}
2012-03-03 23:21:20 -------- d-----w- C:\Users\***\AppData\Roaming\Rainmeter
2012-03-03 23:21:16 -------- d-----w- C:\Program Files\Rainmeter
2012-03-03 23:02:28 -------- d-----w- C:\Users\***\AppData\Local\Bump Technologies, Inc
2012-03-03 23:02:20 -------- d-----w- C:\Users\***\AppData\Roaming\Bump Technologies, Inc
2012-03-03 23:02:16 -------- d-----w- C:\Windows\SysWow64\directx
2012-03-03 23:02:12 -------- d-----w- C:\Program Files (x86)\BumpTop
2012-03-03 22:41:58 -------- d-----w- C:\ProgramData\Saitek
2012-03-03 22:41:38 -------- d-----w- C:\Program Files\Saitek
2012-03-03 22:38:56 -------- d-----w- C:\Program Files (x86)\Sound Volume Hotkeys
2012-03-03 22:34:31 -------- d-----w- C:\ProgramData\NexonEU
2012-03-03 21:23:08 -------- d-----w- C:\Download
2012-03-03 21:22:52 446464 ----a-w- C:\Windows\NEXON_EU_DownloaderUpdater.exe
2012-03-03 21:22:52 235 ----a-w- C:\Windows\SysWow64\nxEuUninstall.bat
2012-03-03 21:22:52 -------- d-----w- C:\Nexon
2012-03-03 15:29:07 -------- d-----w- C:\Users\***\AppData\Local\{BD3E1674-B3CE-43EF-9FCC-7CFDA33BC31C}
2012-03-03 15:28:57 -------- d-----w- C:\Users\***\AppData\Local\{C3DA9AEA-FDAF-4373-B824-8C1B77DB3956}
2012-03-03 15:28:57 -------- d-----w- C:\Users\***\AppData\Local\{15DA8732-2605-4DE3-8D2B-32C3DDA712F8}
2012-03-02 13:34:59 8643640 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\Backup\mpengine.dll
2012-03-01 17:08:00 -------- d-----w- C:\Windows\System32\SPReview
2012-03-01 17:07:28 -------- d-----w- C:\Windows\System32\EventProviders
2012-03-01 17:05:57 529408 ----a-w- C:\Windows\System32\wbemcomn.dll
2012-03-01 17:05:57 244736 ----a-w- C:\Program Files\Windows Portable Devices\sqmapi.dll
2012-03-01 17:05:56 244736 ----a-w- C:\Windows\System32\sqmapi.dll
2012-03-01 16:58:24 1544192 ----a-w- C:\Windows\System32\DWrite.dll
2012-03-01 16:58:24 1139200 ----a-w- C:\Windows\System32\FntCache.dll
2012-03-01 16:58:24 1076736 ----a-w- C:\Windows\SysWow64\DWrite.dll
2012-03-01 16:58:23 902656 ----a-w- C:\Windows\System32\d2d1.dll
2012-03-01 16:58:23 739840 ----a-w- C:\Windows\SysWow64\d2d1.dll
2012-03-01 16:54:28 -------- d-----w- C:\Users\***\AppData\Local\{A82689CE-D79E-461C-9A01-2F1C003BF4E3}
2012-03-01 16:54:08 -------- d-----w- C:\Users\***\AppData\Local\{3AF2D60B-C152-48FE-B797-8448FB565E4A}
2012-02-29 20:07:53 2300696 ----a-w- C:\ProgramData\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup\markup.dll
2012-02-29 20:07:43 42776 ----a-w- C:\ProgramData\Microsoft\eHome\Packages\MCEClientUX\dSM\StartResources.dll
2012-02-29 20:07:35 1236816 ----a-w- C:\ProgramData\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll
2012-02-29 20:07:03 -------- d-----w- C:\Program Files\PlayReady
2012-02-29 19:47:43 840128 ----a-w- C:\Windows\System32\drivers\UDXTTM6010.sys
2012-02-29 19:47:43 26688 ----a-w- C:\Windows\System32\drivers\Cinergy_Hybrid-Stick_HID.sys
2012-02-29 19:47:43 -------- d-----w- C:\Program Files (x86)\Common Files\TerraTec
2012-02-29 16:19:51 282864 ----a-w- C:\Windows\SysWow64\PnkBstrB.xtr
2012-02-29 16:19:48 -------- d-----w- C:\Users\***\AppData\Local\PunkBuster
2012-02-29 16:19:15 -------- d-----w- C:\Program Files (x86)\Battlelog Web Plugins
2012-02-29 16:05:04 -------- d-----w- C:\Program Files (x86)\Microsoft Synchronization Services
2012-02-29 16:03:51 -------- d-----w- C:\Program Files (x86)\Microsoft Visual Studio 8
2012-02-29 16:03:26 -------- d-----w- C:\Program Files (x86)\Microsoft Analysis Services
2012-02-29 16:03:12 -------- d-----w- C:\Users\***\AppData\Local\Microsoft Help
2012-02-29 15:35:03 -------- d-----w- C:\Users\***\AppData\Local\{39904240-7197-442F-AFF9-A9651488BB18}
2012-02-29 15:34:54 -------- d-----w- C:\Users\***\AppData\Local\{F1F2907F-5D17-45C1-834D-C5DBE0DC61A5}
2012-02-29 15:34:41 -------- d-----w- C:\Users\***\Tracing
2012-02-29 15:30:20 -------- d-----w- C:\Program Files (x86)\Microsoft SQL Server Compact Edition
2012-02-29 14:29:34 -------- d-----w- C:\ProgramData\Soluto
2012-02-29 14:22:44 -------- d-----w- C:\ProgramData\EA Core
2012-02-29 14:22:43 -------- d-----w- C:\ProgramData\EA Logs
2012-02-29 10:59:59 68104 ----a-w- C:\Windows\System32\XAPOFX1_0.dll
2012-02-29 10:32:00 -------- d-----w- C:\Users\***\AppData\Roaming\Origin
2012-02-29 10:31:59 -------- d-----w- C:\Users\***\AppData\Local\Origin
2012-02-29 10:31:51 -------- d-----w- C:\ProgramData\Origin
2012-02-29 10:31:51 -------- d-----w- C:\ProgramData\Electronic Arts
2012-02-29 10:31:51 -------- d-----w- C:\Program Files (x86)\Origin Games
2012-02-29 10:31:35 -------- d-----w- C:\Program Files (x86)\Origin
2012-02-28 21:57:21 -------- d-----w- C:\Windows\SysWow64\wbem\en-US
2012-02-28 21:57:20 -------- d-----w- C:\Windows\System32\wbem\en-US
2012-02-28 21:36:35 98816 ----a-w- C:\Windows\System32\drivers\usbccgp.sys
2012-02-28 21:26:51 31808 ----a-w- C:\Windows\System32\drivers\FNETTBOH_305.SYS
2012-02-28 21:12:02 -------- d-----w- C:\Program Files (x86)\Microsoft
2012-02-28 21:09:31 -------- d-----w- C:\Users\***\AppData\Local\Windows Live
2012-02-28 21:09:31 -------- d-----w- C:\Program Files (x86)\Common Files\Windows Live
2012-02-28 21:09:10 -------- d-----w- C:\Users\***\AppData\Local\{2C7BDF2A-685D-467D-9AF3-187CD8418015}
2012-02-28 21:08:19 -------- d-----w- C:\Users\***\AppData\Local\Linkury
2012-02-28 21:02:55 -------- d-----w- C:\Users\***\AppData\Local\ElevatedDiagnostics
2012-02-28 20:29:46 -------- d-----w- C:\Users\***\AppData\Roaming\TS3Client
2012-02-28 19:16:07 50056 ----a-w- C:\Windows\System32\drivers\SaiBus.sys
2012-02-28 19:16:07 22792 ----a-w- C:\Windows\System32\drivers\SaiMini.sys
2012-02-28 19:16:01 41352 ----a-w- C:\Windows\System32\drivers\SaiU0CFA.sys
2012-02-28 19:16:00 174600 ----a-w- C:\Windows\System32\drivers\SaiK0CFA.sys
2012-02-28 19:16:00 1721576 ----a-w- C:\Windows\System32\WdfCoInstaller01009.dll
2012-02-28 19:15:41 -------- d-----w- C:\Program Files\Bonjour
2012-02-28 19:15:41 -------- d-----w- C:\Program Files (x86)\Bonjour
2012-02-28 19:09:58 -------- d-----w- C:\Program Files\TeamSpeak 3 Client
2012-02-28 19:09:06 -------- d-----w- C:\Program Files\CCleaner
2012-02-28 19:08:39 294912 ----a-w- C:\Windows\System32\browserchoice.exe
2012-02-28 18:59:59 94208 ----a-w- C:\Program Files (x86)\Common Files\System\Ole DB\msdaosp.dll
2012-02-28 18:58:26 2048 ----a-w- C:\Windows\SysWow64\tzres.dll
2012-02-28 18:58:26 2048 ----a-w- C:\Windows\System32\tzres.dll
2012-02-28 18:58:24 976896 ----a-w- C:\Windows\System32\inetcomm.dll
2012-02-28 18:58:24 741376 ----a-w- C:\Windows\SysWow64\inetcomm.dll
2012-02-28 18:58:17 5561216 ----a-w- C:\Windows\System32\ntoskrnl.exe
2012-02-28 18:58:16 3967872 ----a-w- C:\Windows\SysWow64\ntkrnlpa.exe
2012-02-28 18:58:16 3912576 ----a-w- C:\Windows\SysWow64\ntoskrnl.exe
2012-02-28 18:44:58 -------- d-----w- C:\Users\***\AppData\Local\Adobe
2012-02-28 18:44:24 -------- d-----w- C:\Users\***\AppData\Local\Apple Computer
2012-02-28 18:44:07 159744 ----a-w- C:\Program Files (x86)\Internet Explorer\Plugins\npqtplugin7.dll
2012-02-28 18:44:07 159744 ----a-w- C:\Program Files (x86)\Internet Explorer\Plugins\npqtplugin6.dll
2012-02-28 18:44:07 159744 ----a-w- C:\Program Files (x86)\Internet Explorer\Plugins\npqtplugin5.dll
2012-02-28 18:44:07 159744 ----a-w- C:\Program Files (x86)\Internet Explorer\Plugins\npqtplugin4.dll
2012-02-28 18:44:07 159744 ----a-w- C:\Program Files (x86)\Internet Explorer\Plugins\npqtplugin3.dll
2012-02-28 18:44:07 159744 ----a-w- C:\Program Files (x86)\Internet Explorer\Plugins\npqtplugin2.dll
2012-02-28 18:44:07 159744 ----a-w- C:\Program Files (x86)\Internet Explorer\Plugins\npqtplugin.dll
2012-02-28 18:43:53 -------- d-----w- C:\Users\***\AppData\Local\Apple
2012-02-28 18:40:16 -------- d-----w- C:\Windows\SysWow64\NV
2012-02-28 18:40:16 -------- d-----w- C:\Windows\System32\NV
2012-02-28 18:39:30 -------- d-----w- C:\ProgramData\Kaspersky Lab
2012-02-28 18:39:30 -------- d-----w- C:\Program Files (x86)\Kaspersky Lab
2012-02-28 18:37:09 2497985 ----a-w- C:\Windows\System32\nvcoproc.bin
2012-02-28 18:35:19 -------- d-----w- C:\Program Files (x86)\NVIDIA Corporation
2012-02-28 18:35:17 889664 ----a-w- C:\Windows\System32\nvvsvc.exe
2012-02-28 18:35:17 63296 ----a-w- C:\Windows\System32\nvshext.dll
2012-02-28 18:35:17 6074176 ----a-w- C:\Windows\System32\nvcpl.dll
2012-02-28 18:35:17 3089728 ----a-w- C:\Windows\System32\nvsvc64.dll
2012-02-28 18:35:17 2561856 ----a-w- C:\Windows\System32\nvsvcr.dll
2012-02-28 18:35:17 118080 ----a-w- C:\Windows\System32\nvmctray.dll
2012-02-28 18:35:15 -------- d-----w- C:\ProgramData\NVIDIA Corporation
2012-02-28 18:35:14 -------- d-----w- C:\Program Files\NVIDIA Corporation
2012-02-28 18:26:48 414368 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
2012-02-28 18:17:03 1632128 ----a-w- C:\Windows\System32\drivers\cfosspeed6.sys
2012-02-28 18:17:03 -------- d-----w- C:\Users\***\AppData\Local\cFos
2012-02-28 18:17:03 -------- d-----w- C:\Program Files\ASRock
2012-02-28 18:17:02 -------- d-----w- C:\ProgramData\cFos
2012-02-28 18:16:56 15936 ----a-w- C:\Windows\System32\drivers\FNETURPX.SYS
2012-02-28 18:16:56 -------- d-----w- C:\ProgramData\FNET
2012-02-28 18:16:55 -------- d-----w- C:\Program Files (x86)\XFastUsb
2012-02-28 18:16:50 -------- d-----w- C:\Program Files (x86)\ASRock Utility
2012-02-28 18:16:49 15368 ----a-w- C:\Windows\System32\drivers\AsrAppCharger.sys
2012-02-28 18:16:49 -------- d-----w- C:\Program Files\ASRock Utility
2012-02-28 18:15:54 66144 ----a-w- C:\Windows\System32\drivers\VirtuWDDM.sys
2012-02-28 18:15:53 -------- d-----w- C:\Users\***\Lucidlogix
2012-02-28 18:15:53 -------- d-----w- C:\Program Files\Lucidlogix Technologies
2012-02-28 18:15:49 -------- d-----w- C:\Program Files (x86)\Etron Technology
2012-02-28 18:15:45 -------- d-sh--w- C:\Windows\Installer
2012-02-28 18:14:05 -------- d-----w- C:\Users\***\AppData\Roaming\Intel Corporation
2012-02-28 18:13:01 8192 ----a-w- C:\Windows\System32\drivers\IntelMEFWVer.dll
2012-02-28 18:12:59 -------- d-----w- C:\Program Files (x86)\Common Files\postureAgent
2012-02-28 18:12:58 56344 ----a-w- C:\Windows\System32\drivers\HECIx64.sys
2012-02-28 18:12:29 557848 ----a-w- C:\Windows\System32\drivers\iaStor.sys
2012-02-28 18:10:38 -------- d-----w- C:\Program Files\Common Files\Intel
2012-02-28 18:04:03 53248 ----a-r- C:\Windows\SysWow64\CSVer.dll
2012-02-28 18:03:58 -------- d-----w- C:\Intel
2012-02-28 17:59:46 -------- d-----w- C:\Users\***
\AppData\Local\Diagnostics
2012-02-28 17:49:48 -------- d-----w- C:\Windows\Panther
2012-02-09 19:05:44 416064 ----a-w- C:\Windows\SysWow64\nvStreaming.exe
.
==================== Find3M ====================
.
2012-03-09 15:58:13 282864 ----a-w- C:\Windows\SysWow64\PnkBstrB.exe
2012-03-09 15:58:05 280904 ----a-w- C:\Windows\SysWow64\PnkBstrB.ex0
2012-03-01 17:10:24 175616 ----a-w- C:\Windows\System32\msclmd.dll
2012-03-01 17:10:24 152576 ----a-w- C:\Windows\SysWow64\msclmd.dll
2012-02-29 16:36:24 76888 ----a-w- C:\Windows\SysWow64\PnkBstrA.exe
2012-02-28 18:18:36 466456 ----a-w- C:\Windows\System32\wrap_oal.dll
2012-02-28 18:18:35 444952 ----a-w- C:\Windows\SysWow64\wrap_oal.dll
2012-02-28 18:18:35 122904 ----a-w- C:\Windows\System32\OpenAL32.dll
2012-02-28 18:18:35 109080 ----a-w- C:\Windows\SysWow64\OpenAL32.dll
2012-02-23 08:18:36 279656 ------w- C:\Windows\System32\MpSigStub.exe
2012-01-17 12:46:01 31040 ----a-w- C:\Windows\System32\nvhdap64.dll
2012-01-17 12:45:56 188224 ----a-w- C:\Windows\System32\drivers\nvhda64v.sys
2012-01-17 12:45:55 1451840 ----a-w- C:\Windows\System32\nvhdagenco6420103.dll
2012-01-14 04:06:27 3145728 ----a-w- C:\Windows\System32\win32k.sys
2012-01-04 10:44:20 509952 ----a-w- C:\Windows\System32\ntshrui.dll
2012-01-04 08:58:41 442880 ----a-w- C:\Windows\SysWow64\ntshrui.dll
2011-12-30 06:26:08 515584 ----a-w- C:\Windows\System32\timedate.cpl
2011-12-30 05:27:56 478720 ----a-w- C:\Windows\SysWow64\timedate.cpl
2011-12-28 03:59:24 498688 ----a-w- C:\Windows\System32\drivers\afd.sys
2011-12-16 08:46:06 634880 ----a-w- C:\Windows\System32\msvcrt.dll
2011-12-16 07:52:58 690688 ----a-w- C:\Windows\SysWow64\msvcrt.dll
.
============= FINISH: 17:57:45,13 ===============